Q & A – Can we dispose of personnel file information after the retention period has expired?

Q: Can we dispose of personnel file information after the retention period has expired?

A: The public and private sector employers should establish a policy directing personnel records and any other documents with personally identifying information of employees to be disposed of in a manner designed to prevent someone from obtaining or stealing this information.  This could include shredding, incinerating, or redacting protected information from documents.

A destruction policy should be developed for documents specifically containing Social Security numbers, personal identification numbers, passwords, pass codes, state or government-issued driver’s license or identification card numbers, passport numbers, biometric dates, employer names, student or military identification numbers, or financial transaction devices.
If using a third party to assist in disposing of such documentation and such documentation includes Protected Health Information (PHI_, a business associate agreement should be created to comply with the Health Insurance Portability and Accountability Act (HIPAA).