Personnel Files and Safeguarding Sensitive Data. Office of Human Resources August 2008

Transcription

1 Personnel Files and Safeguarding Sensitive Data Office of Human Resources August 2008

2 What Is a Personnel File? Lab "Personnel file" as used in RSA 275:56 means any personnel records created and maintained by an employer and pertaining to an employee including and not limited to employment applications, internal evaluations, disciplinary documentation, payroll records, injury reports and performance assessments, whether maintained in one or more locations, unless such records are exempt from disclosure under RSA 275:56, III or are otherwise privileged or confidential by law. The term does not include recommendations, peer evaluations or notes not generated or created by the employer.

3 What Is a Personnel File? All files kept on an employee, whether paper files in the department, electronic files in the department or central paper or electronic files are considered to be a part of the Personnel File and therefore subject to review by the employee and may be 'discoverable' in the event of litigation.

4 What to Keep in a Personnel File General Rules Keep only what you need. All important, job-related documents

5 List of Documents to Be Kept Centrally job description for the position job application and/or resume offer of employment IRS Form W-4 (the Employee's Withholding Allowance Certificate) performance evaluations forms providing next of kin and emergency contacts awards or citations for excellent performance records of attendance or completion of training programs warnings and/or other disciplinary actions notes on attendance or tardiness any contract, written agreement, receipt, or acknowledgment between the employee and the employer (such as a noncompete agreement, an employment contract, or an agreement relating to a company-provided car), and documents relating to the worker's departure from the company (such as reasons why the worker left or was fired, unemployment documents, insurance continuation forms, and so on).

6 List of Documents That May Be Kept Locally job description for the position job application and/or resume* offer of employment performance evaluations* awards or citations for excellent performance records of attendance or completion of training programs warnings and/or other disciplinary actions* notes on attendance or tardiness notes from meetings recording what is needed professionally *Note: Originals should be kept in HR

7 What Not to Keep in a Personnel File Don't create anything that you would not want a jury to see. like references to an employee's private life or political beliefs, or unsubstantiated criticisms or comments about an employee's race, sex, or religion Again, the regulation states, any personnel records created and maintained by an employer and pertaining to an employee The key word is created Don t create anything that is not professionally necessary Review files regularly

8 What Not to Keep in a Dept. Personnel File Medical records. Do not put medical records into a personnel file. If your worker has a disability, we are legally required to keep all of the worker's medical records in a separate central file -- and limit access to only a few people. (regulated by ADA and HIPAA) Form I-9s. Do not put Form I-9s into your employees' personnel files. (Form I-9 is a form from U.S.Citizenship and Immigration Services (USCIS)). We have all Form I-9s in a separate central filing system for access by USCIS.

9 Employee Access to Files If requested by a present or former employee, is the employer required to provide the employee with access to their personnel file? Yes, an employee, whether past or current, must be given access to review or be given a copy of, if requested, their own personnel file, whether maintained in one or more locations. 275:56 Employee Access to Personnel Files

10 Employee Access to Files If a current or former employee wishes to access their file they should contact Human Resources to set up an appointment to do so.

11 Terminated Employee Records Policy Departmental personnel files on terminated employees (except faculty) are to be disposed no more than one year after the employee's termination date. Materials such as original performance reviews, letters of warning, or other disciplinary documentation should be forwarded to the Human Resources office to be considered for inclusion in the employee's permanent file. The remainder should be sent for shredding as per established policies. Departmental files on terminated staff should not be sent to Records Management. Any terminated staff files received by Records Management will be returned to the originating department.

12 Safeguarding Sensitive Data Personally Identifiable Information (PII) In information security and privacy, PII is any piece of information which can potentially be used to uniquely identify, contact, or locate a single person. Pieces of information that are considered private include, but are not limited to: Name SSN Address Salary

13 Safeguarding Sensitive Data Anyone working with sensitive, private, or personally identifiable information of employees should sign a confidentiality agreement Ask your manager if a template exists for your organization Use HR s as a template if one does not exist (handout)

14 Safeguarding Sensitive Data An employee s employment data should always be safeguarded: 1. Password protect your computer. If you leave it unguarded even for a minute, close the file in which you were working. 2. Do not store reports on desktop or laptop hard drives use a secure central server 3. Do not store reports on an external drive unless the data is encrypted 4. Do not send reports through if possible minimallypassword protect the reports before sending 5. Do not include SSN in any reports or s

15 Protecting Personal Information Here are some common sense steps that you can take at work to lower risk and our exposure to identity theft: 1. Cross-shred all sensitive documents before throwing them away, especially those with personal identifying information. 2. Keep wallets and purses in locked cabinets while at work. 3. Make sure that conversations cannot be overheard when exchanging sensitive information. 4. Avoid providing sensitive information over the telephone or by Avoid placing personal mail with checks, SSN or account information in the unlocked outgoing mailbox (i.e. at the receptionist s desk).

16 Protecting Personal Information What should I do if I become an identity theft victim or believe I might be? 1. Assess the damage: Call the three credit reporting agencies. Place a fraud alert on your Social Security number and have them send you copies of your reports. Look them over carefully for any fraudulent activity or inaccuracies. This preliminary fraud alert only lasts 90 days so renew it before it lapses! Victims are permitted a 7-year alert with a police report. 2. Take action: Call the police where you live. They need to take a report and give you a copy. Send a copy of this report with any affidavits (letters stating the account is fraudulent) you send to creditors. Also contact the Federal Trade Commission to report the crime. 3. Contact the companies who have reported fraudulent accounts. Send correspondence certified, return receipt requested. Tell them this is a case of ID theft. Request copies of all application and transaction account information. Federal law requires them to comply. Ask for letters of clearance.

17 Resources Identity Theft Resource Center (ITRC) Americans with Disabilities Act HIPAA Dartmouth College Employment Policies and Procedures Manual