How Long Must a Business Keep HR Records

HR records retention is a critical compliance area for businesses in the United States. Properly storing payroll, hiring, benefits, and personnel documents helps meet legal obligations, supports audits, and protects against disputes. This guide outlines federal expectations, common state variations, and practical policies to help organizations establish a clear retention schedule that balances legal risk with data management efficiency.

Key HR Records And Their Retention Periods

Retention periods vary by document type and by jurisdiction. The table below provides typical guidance for commonly kept HR records. Always verify with current federal guidance and state law, and consult a legal adviser for specific circumstances.

Document Type Typical Retention Period Notes
Payroll Records (including timesheets, wage calculations) 3–7 years
Employee Tax Records (W-2s, tax withholdings) 4–7 years
I-9 Employment Eligibility Verification Current employee records kept for 3 years after hire or 1 year after termination, whichever is later
Benefit Plans, FMLA, ADA Records 3–7 years after active involvement or termination
Medical Records (COBRA, workers’ comp, leave documentation) 3–7 years, depending on statute
Health Insurance Portability And Accountability Act (HIPAA) related records As long as data is maintained, with appropriate safeguards
Performance Reviews and Disciplinary Files 3–7 years after separation (or longer if required by state law)
Recruitment Records (applications, interview notes) 1–2 years after decision; longer in some states
Safety and OSHA Records 5–5.5 years, with some items requiring longer retention

Legal Requirements By Federal And State

Federal requirements influence many HR records, but state and local laws often impose stricter retention rules or specific formats. Key federal reference points include the Fair Labor Standards Act, the Internal Revenue Service, the Equal Employment Opportunity Commission, and OSHA. States may mandate longer retention for personnel files, I-9s, or wage records, and some localities impose additional protections for sensitive information. Businesses should establish a baseline retention schedule aligned with federal guidance and then adjust for state-specific rules.

✓
Quick, confidential phone check
Tell us the basics and we’ll point you to the right next step. No long forms.
Confidential • Fast • Helpful guidance

Important considerations include:

  • I-9 Records: Must be retained for the current employees and for a period after termination based on the later of three years from hire or one year from termination.
  • Essential for tax and auditing purposes; many jurisdictions require several years of records for payroll and tax compliance.
  • OSHA 300 logs and related documentation typically require retention for five years from the date of the recordable incident.
  • Health and leave information may be subject to HIPAA and data privacy rules; keep securely and only with authorized access.

Practical Retention Policies For Small Businesses

Establishing a clear retention policy helps avoid accidental early destruction or over-retention of sensitive data. Consider these practical steps:

  • Document retention periods by document type and designate responsible personnel for audits and disposal.
  • Use secure deletion or shredding methods when records reach end of life; document the disposal process.
  • Periodically review files to remove records beyond their statutory retention periods while preserving those with ongoing relevance.
  • Store highly confidential documents (e.g., medical records, background checks) separately with restricted access and enhanced protections.
  • Ensure retention practices reflect privacy laws and employee consent where applicable.

What Happens If Records Are Retained Too Long Or Too Short

Both over-retention and premature destruction carry risks. Excessively long retention increases data breach exposure and storage costs, and may complicate privacy management. On the other hand, destroying records too soon can expose a business to legal penalties, failed audits, or defensive litigation challenges. A compliant schedule minimizes risk by balancing accessibility for legitimate needs with security and privacy controls.

Best practices to avoid issues include:

  • Keep clear records of retention decisions, including legal references and any state-specific requirements.
  • Use access controls, encryption for digital records, and locked storage for physical files.
  • Conduct annual reviews of retention schedules and disposal procedures to ensure ongoing compliance.

Industry And Role-Specific Considerations

Some industries face unique retention demands, such as healthcare, financial services, or construction, where regulatory bodies dictate longer retention or stricter documentation standards. Roles responsible for HR compliance should coordinate with legal, finance, and IT to tailor retention policies to industry needs and organizational risk tolerance. Including external HR vendors or payroll providers may also require contract-based compliance alignment to ensure proper data handling and retention across all systems.

Similar Posts