The Personnel File: What Goes In and Who Can See It

Why this matters

This is the least interesting article in the category and it prevents more expensive problems than most of the others. Two failures do all the damage. A shop keeps one folder per person with everything in it, including a doctor's note, which is a confidentiality violation independent of anything else that happens. And a shop discovers, on the day it has to hand the file over, that three of the documents it has been describing to an agency do not exist. The file is the shop's memory, and nobody audits it until the worst possible moment.

This is orientation on the structure and the clocks, not legal advice. The employee inspection rules in particular are state law and vary enough that your state's statute is the only one that answers your question.

It is not one file, it is four

Treating this as one folder is the root of most of what follows. Four separate stores, with different contents, different access rules and different clocks.

1. The general personnel file. Application and resume, offer letter, the written job description, signed acknowledgments (handbook, vehicle policy, tool policy), performance reviews, disciplinary write-ups, training and certification records, pay rate changes, and separation documents.

2. The confidential medical file. Anything carrying health information at all. This one is not a filing preference, it is a requirement, covered below.

3. The I-9 binder. Kept apart from both, for a practical reason: an immigration audit gets your I-9s, and if they live inside personnel files you have just handed a government inspector every performance review in the shop. Retention and the form's mechanics are owned by the I-9 card in the References.

4. Investigation material. The complaint, witness statements, the investigator's notes and the written finding. This does not belong in the complainant's file and does not belong in the accused's file either. What goes into the subject's personnel file is the outcome and any discipline that resulted, not the investigation that produced it.

Payroll records are often a fifth store in practice, sitting with the bookkeeper or the payroll provider, and they carry their own retention clock.

The medical file is a legal requirement, not a filing preference

The Americans with Disabilities Act requires that medical information obtained from post-offer examinations and inquiries be collected and maintained on separate forms and in separate medical files, and treated as a confidential medical record (42 U.S.C. 12112(d)(3)(B), implemented at 29 CFR 1630.14). GINA carries a parallel confidentiality requirement at 29 CFR 1635.9, and FMLA medical certifications must be kept as confidential medical records in separate files under 29 CFR 825.500(g).

What actually belongs in there is broader than owners expect: the return-to-work note, the accommodation request and everything exchanged about it, the workers comp claim file, drug and alcohol test results, the fitness-for-duty exam, FMLA certifications, and any benefits enrollment form carrying health information.

Access to it is narrow, and the exceptions are the useful part. Supervisors and managers may be told about necessary work restrictions and accommodations, first aid and safety personnel may be told where the condition might require emergency treatment, and government officials investigating compliance get access. Notice what that permits: the lead learns that this tech cannot lift over a stated weight, not why. That distinction is the whole point of the separate file, and it is the one a small shop breaks most often, usually with good intentions and in the truck.

How long each category has to be kept

These are federal floors. State retention statutes are frequently longer, and the longest applicable rule governs.

Read the middle column carefully, because the clocks do not all start in the same place. Most run from when the record was made. The personnel-records rule runs from the record or the personnel action, whichever is later, so a write-up about a termination is measured from the termination. The I-9 runs from hire or separation, whichever is later, which means the destruction date for a long-tenured employee is computable only after they leave. And the last row is the one that matters most in practice: once a charge is filed, everything relevant freezes, whatever the schedule says.

Who can see it, which is a state question with real deadlines

There is no federal right for a private-sector employee to inspect their own personnel file. Roughly half the states give one, and most owners do not know their state is among them until a request arrives with a deadline attached.

Three examples, chosen because the terms differ so much:

• California (Labor Code 1198.5) gives current and former employees, and their representatives, the right to inspect and receive a copy of personnel records relating to performance or to a grievance, within 30 calendar days of a written request, and separately requires payroll records within 21 calendar days (Labor Code 226(b)). The same section requires the employer to keep those records for at least three years after termination.
• Illinois (Personnel Record Review Act, 820 ILCS 40) requires production within 7 working days, with one extension of 7 more where the employer cannot reasonably comply, and limits the employee to two requests a year.
• Massachusetts (M.G.L. c. 149, s. 52C) requires production within 5 business days of a written request, and adds the duty nobody knows about: the employer must notify the employee within 10 days of placing in the file any information that is or may be used to negatively affect their employment, promotion, transfer, compensation or the possibility of discipline.

Most of these statutes let you withhold certain categories, commonly reference letters, records of an ongoing criminal investigation, and material that would identify other employees, and most let you require the request in writing. Read yours before you need it, because the deadline is short in several states and the penalty for missing it is its own separate problem sitting on top of whatever the request was really about.

Worked example: an access request arrives three weeks after a termination

A twelve-person shop in a state giving 30 calendar days receives a written request from a technician terminated three weeks earlier, asking for his personnel file and a copy of everything in it.

Day 0. The request is logged with its receipt date, because the clock runs from receipt and the only way to prove you were inside it is a dated log entry.

The four stores are pulled and sorted. Produced: 13 documents from the general file, being the application, the offer letter, the job description, two signed acknowledgments, three performance reviews, two disciplinary write-ups, two pay change notices and the separation letter. Withheld: the medical file, which is governed separately and under its own confidentiality duty rather than by the general inspection right; the I-9, which is produced to the government under its own process and is not a performance record; the investigation file about a complaint made by a different employee; and a reference letter the statute exempts.

What the shop learns while doing it. Of the 13 documents, two are the write-ups, and only one of those carries a date. Three documents the owner remembered as being in the file are not in it: a counseling note from March, a forwarded customer complaint, and a final written warning the owner is certain he wrote. Whether he wrote it or not is now unanswerable, because the file is the answer.

Day 12. The file is produced with a cover letter listing what is included and a note that certain categories are withheld under the statute, well inside the 30 days.

What this cost and what it bought. It cost about two hours. It bought a precise inventory of the shop's evidence, delivered at the one moment the shop can still do something about the gaps, which is before a charge rather than after. It also told the shop something it needed: a file with two write-ups, one undated, on a terminated tech is a thin file, and thin is what the performance-documentation card in the References exists to fix. The request is a free audit of the record, and the auditor is the person most likely to file.

The small-shop version that is actually achievable

You do not need an HR department, you need four places and one habit.

• One general folder per person, in your system or a locked drawer, with a consistent naming scheme so an absent bookkeeper is not a blocker.
• One folder per person marked medical, opened by one named person, physically or logically separate from the first.
• All I-9s in one binder or one folder, filed by hire date, with separated employees in a second section so the destruction pass is a single sweep once a year rather than a per-person calculation.
• Investigation files held by whoever conducted the investigation, separate from everyone's personnel folder.

The habit is that a document is filed the day it is created, by the person who created it. The time cost is genuinely a couple of minutes a week for a shop this size, and what it buys is that the write-up you remember and the write-up in the file are the same document.

How to verify you got this right

Pick one current employee at random and produce their file as though a request had arrived, with a timer running. Count how many documents you expected to find and how many you actually found; the gap is your real record, not the one in your head. Open the general folder and look for anything mentioning a health condition, an injury, a restriction or a medication, and move it. Check that your I-9s are in their own store and that you can compute a destruction date for someone who left last year. Then look up your state's inspection statute for two things specifically: the deadline, and whether it imposes a notification duty when you put negative information in a file, because that one changes what you do on an ordinary Tuesday rather than on the day a request lands.

References

• Americans with Disabilities Act, 42 U.S.C. 12112(d)(3)(B) and 29 CFR 1630.14, confidentiality and separate maintenance of medical information; GINA at 29 CFR 1635.9
• Retention: 29 CFR 516.5 and 516.6; 29 CFR 1602.14; 29 CFR 1627.3; 29 CFR 825.500(b); 8 CFR 274a.2(b)(2)(i)(A); 29 CFR 1904.33; 29 CFR 1910.1020(d)(1)(i); 29 U.S.C. 1027
• State personnel-records access statutes, for example Cal. Labor Code 1198.5 and 226(b), 820 ILCS 40, and M.G.L. c. 149, s. 52C
• See related: Form I-9 and E-Verify Compliance; Documenting Performance So a Termination Holds Up; the workplace-investigation and charge-process cards in this category