Management of Human Resource Records: Personnel Records for Staff and Temporary Employees and Benefit Program Records for All Employees, Retirees, and COBRA Participants

Scope

1. Staff and Temporary employees for personnel records
2. Academic, Staff, and Temporary Employees for benefit program records
3. Retirees and COBRA participants for benefit program records

Back to top

Policy Statement

1. It is the policy of Indiana University to comply with applicable laws and best practices with regard to the management, retention, and disposal of its human resource records in order to document its management decisions; provide historical references of employee, participant, and university-initiated transactions and events; demonstrate regulatory compliance; and enhance its operational efficiencies.
2. Indiana University’s Human Resource Records
   1. Indiana University’s human resource records are the collection both paper and electronic communications and documents related to the employment of an employee stored under the person’s name or identification number, including but not limited to: forms, letters, memos, reports, lists, e-mails, etc. The records serve as the historical record of information pertaining to an employee from date of hire to separation, and contain some pre-employment and post-employment information.
   2. There are four categories of records that make up the human resource records:
      1. Personal records includes records related to personally-identifiable information, such as name, date of birth, home address, emergency contact, social security number, etc.
      2. Personnel records include records covering employment, position classification, wage or salary, employee relations, performance management, training, organizational development, attendance and paid time-off usage, etc.
      3. Benefits program records include records covering benefit plan enrollments in such plans as health care, retirement, investments, tuition benefit, and voluntary plans, as well as beneficiaries in these plans where applicable.
      4. Medical records include all medical certifications, physician statements, and related information that describe the health and medical history or condition of an employee or an employee’s family members.  These include ADA and FMLA forms and correspondence, disability documents, claims for medical services, doctors’ notes, workers’ compensation records, injury or illness reports, and drug screening results. (Not an inclusive list.) They do not include attendance reports from such systems as TIME or ePTO that simply record what category of paid time-off to which an absence from work is charged.
   3. University Human Resources, the campus Human Resources Office, and the employing school or department maintain the university’s human resource records in paper and/or electronic files.  Paper records containing confidential information are kept in locked offices or cabinets or drawers with access controlled by the keeper of the record.  Electronic records containing confidential information are maintained in a secure environment per University Information Technology Services policies.
   4. Under the Health and Insurance Portability and Accountability Act (HIPAA) and the Americans with Disabilities Act (ADA), employers are required to protect medical records as confidential information to be kept separate from other business records.  Medical records are not to be maintained with other human resource records, although they may be stored in the same locked cabinet.
   5. A supervisor may keep records related to an individual employee to track work in progress and performance related information, and typically includes documents of ongoing work such as notes of conversations, assignments, and status reports.  A supervisor’s records maintained by employee name or identification number are considered part of the official university human resource records.
   6. Grievances and complaints filed by or against an employee, and notes, statements, and other information gathered as part of an investigation of a workplace incident, grievance, or complaint are to be maintained separately and are not considered part of an employee’s personnel records.
   7. As a public institution, Indiana University’s human resource records are subject to the provisions of Indiana Code 5-14-3, Access to Public Records. Under this law, none of the University’s human resource records have to be produced except for:
      1. The name, compensation, job title, business address, business telephone number, job description, education and training background, previous work experience, or dates of first and last employment of present or former employees of the university;
      2. Information relating to the status of any formal charges against the employee; and
      3. The factual basis for a disciplinary action in which final action has been taken and that resulted in the employee being suspended, demoted, or discharged.
   8. Any request citing Indiana’s Access to Public Records law shall be sent to the University Counsel’s office for their attention, before any response is made. Any court subpoena for records referenced in this policy shall be sent to the University Counsel’s office for their attention before any response is made. (This section applies to any request citing Indiana’s Access to Public Records law and court subpoenas for records received by any unit at the University.)
   9. All records that are part of an employee’s human resource records shall be made available to the employee or their representative.
3. Safeguards Against Unauthorized or Accidental Disclosure
   1. Until the human resource records are properly disposed, each department of the university is accountable for securing and maintaining its human resource records regardless of format or location.
   2. Each department is accountable for ensuring that employees and others are granted access to confidential human resource records only if such access is essential to the performance of their duties.  Further, each department must ensure that those granted access are trained and employ reasonable safeguards to protect the confidential records.
4. Human Resource Records Retention Schedule
   1. The Human Resource Records Retention Schedule is a comprehensive list of human resource records covering areas such as benefits, classification and compensation, employee relations, employment, and organizational development.
   2. The Records Retention Schedule lists each record, provides a brief description of the record, the primary record value, the highest level of data classification, and identifies the retention period and the disposal method.  These terms are defined in the Definition section of this policy.
   3. Human resource records which have been retained beyond the stipulated retention period should be disposed of in accordance with the method in the schedule as early as practicable.
5. Suspension of the Human Resource Records Retention Schedule
   1. When litigation involving the university or its employees is filed or threatened, the university has a duty to preserve all records that pertain to the issues involved.  Once aware that litigation exists or is likely to be filed, University Counsel will inform the affected departments, who will disseminate this information to the appropriate employees and provide direction as to what records are to be preserved and by what method.  So-called “litigation holds” override the records retention schedule that may otherwise call for the disposal of relevant records.
   2. No university employee who has been notified by University Counsel may alter or destroy a record that falls within the scope of the litigation-hold notification.
   3. Any university employee who becomes aware of litigation or threatened litigation prior to receiving a litigation-hold notification from University Counsel shall inform University Counsel immediately and shall suspend the records retention schedule until specific instructions are received.

Back to top

Reason for Policy

1. Indiana University creates and maintains human resource records for its Academic, Staff and Temporary employees, Retirees, and COBRA participants to fulfill legal requirements, fiscal requirements, and administrative needs.  It is necessary to have a well defined management, retention, and disposal policy to ensure that these complex and sometimes competing requirements and needs are satisfied.
2. The purpose of this policy is to establish accountability for human resource records management and retention, to reinforce safeguards against unauthorized or accidental disclosure of confidential records, to establish the length of time certain categories of human resource records are to be maintained and stored, and to establish appropriate records disposal practices.

Back to top

Procedures

1. Access to human resource records
   1. Access to human resource records should be restricted to those whose job duties necessitate access and to those with designated authority to review the records, such as a supervisor, department manager, or a human resource representative.
   2. Upon request, a university employee or their designated representative will be provided with timely access to all of the employee’s human resource records, including personnel records, benefit program records, and medical records.  The determination of timeliness must reflect any policy or practical deadlines that the employee, representative, or university must meet. Units that need assistance regarding the content of records that can be disclosed should seek advice from a campus HR office.
   3. The designated representative must present a written authorization signed by the employee that clearly and specifically describes the records the representative may inspect or copy.
   4. If the designated representative is a union representative of the employee, the inspection will occur during times when the designated representative is authorized by university policies to conduct union business and in a manner that corresponds with departmental and university human resource record-keeping policies and practices.
   5. At no time during the examination of the employee’s records shall the records be out of the direct supervision of the university record keeper.
   6. Contact the campus Human Resources Office to obtain the guidelines for accessing Staff personnel records.
2. Access to confidential information
   1. Employees whose jobs provide access to human resource records shall follow the policies and procedures specific to their position for confidential information found in the human resource records and not release it to any person who does not have authorization to receive it.  Employees shall not use such confidential information of other employees for personal reasons.
   2. Members of the public, which includes persons employed by the university, have access only to the information contained within human resource records that is designated as public information under the Indiana Access to Public Records law.
   3. All human resource records shall be made available to the affected employee or their representative.
3. Retention of human resource records
   1. Each human resource record is to be retained for the retention period contained in the Records Retention Schedule for that record.
   2. Confidential medical records are to be maintained separately from other human resource records.
   3. In departments, when there is a change in supervisors, any personal records and personnel records as defined in the Policy Statement above, including paper, electronic, and email records, that the supervisor has maintained on their employees are to be retained for the duration of the retention period in the Records Retention Schedule and made available to the new supervisor.
   4. When a Staff employee transfers to another department within the University, the human resource records located in the original employing department are to be sent to the campus Human Resources Office to be combined with the human resource records maintained in that office.
   5. When a Staff employee terminates employment with Indiana University, the human resource records in the employing department are to be sent to the campus Human Resources Office to be combined with the human resource records maintained in that office and retained for the retention period contained in the Records Retention Schedule.
4. Disposal of human resource records
   1. When the required retention period for a record expires, the senior officer of the responsible office (UHR, the campus HR Office, or the employing department) shall initiate and authorize the process for the records disposal.
   2. In the event of any dispute regarding the authorization of disposal of the records, disposal will be halted pending review and final determination by the Vice President and Chief Financial Officer in consultation with University Counsel.
   3. Records are be disposed of in accordance with the methods specified in the Records Retention Schedule.

Back to top

Definitions

1. A record is information or knowledge on a specific subject and preserved in a typed, written, or electronic format.
2. A file is a collection of related records stored together in paper or electronic formats.
3. Primary Record Value in the Human Resource Records Retention Schedule refers to one of four levels:
   1. Administrative: This is a form or work document that has value as a record of an active transaction or work document currently in use.
   2. Legal: This is a form or work document whose use, retention, and /or dissemination are covered by federal or state laws and/or regulations and university policies.
   3. Audit: This is a form or work document whose primary value is aligned with fiscal matters.  It may be thought of as a fiscal version of a legal record.
   4. Historical: This is a form or document that lets us understand what the department/school/university did in the past.  There are less of these types of documents than the other value categories.
4. Level of Data Classification in the Human Resource Records Retention Schedule refers to one of four levels, from most sensitive to least sensitive:
   1. Critical: Inappropriate handling of this data could result in criminal or civil penalties, identity theft, personal financial loss, and/or invasion of privacy.
   2. Limited access/restricted: Because of legal, ethical, or other constraints, this data may not be accessed without specific authorization, or only selective access may be granted.
   3. University-internal: This data may be accessed by all eligible employees of the university, without restriction, in the conduct of university business; should be the default classification for all data.
   4. Public: Few restrictions on this data, general public may be granted access.

Back to top

Sanctions

Managers, supervisors, and employees who violate this policy are subject to disciplinary action, up to and including termination and may be subject to personal liability for civil and/or criminal sanctions.

Back to top

Additional Contacts

Back to top

History

February 2012: This is a new Indiana University Human Resources policy.

Back to top