How to Organize Employee Files: A Guide for Small Businesses

When I hired my fifth employee, I opened a desk drawer and found offer letters from my first two hires mixed in with tax forms, a medical leave request, and an unsigned handbook acknowledgment. All in one folder. No organization, no separation, no system. I had been running a company for a year and a half, and my employee files looked like a recycling bin.

That afternoon I learned three things. First, the ADA requires medical information to be stored separately from personnel records. Second, I-9 forms need their own file so you can produce them during an ICE audit without handing over everything else. Third, I had been violating both of these requirements since day one because nobody had told me, and I had never thought to look it up.

Organizing employee files is not complicated. It follows a simple structure (three types of files, clear rules about what goes where), it takes one afternoon to set up, and it protects your business from compliance violations that carry real penalties. This guide covers the 3-file rule every small business must follow, what documents belong in each file, how long you need to keep them, and how to build a digital system that creates the right structure automatically as you onboard new hires. That automatic structure is how FirstHR approaches file organization: documents are collected, signed, and filed into the correct categories during onboarding, not sorted retroactively from a drawer.

Why Organizing Employee Files Matters

Employee file organization is not administrative busywork. It is compliance infrastructure. Federal agencies (EEOC, ICE, DOL, OSHA) can request specific employee documents during audits, investigations, and inspections. If your files are disorganized, you cannot produce what they need quickly. If your files mix documents that should be separate (medical records in the personnel file, I-9s in the main folder), you have a compliance violation before the audit even begins.

The 3-File Rule Every Small Business Must Follow

Every employee needs three separate files. Not one folder with everything in it. Three distinct files with clear boundaries about what goes where. This structure is not optional: it is required by the ADA (medical separation) and strongly recommended by USCIS (I-9 separation) and employment attorneys universally.

The separation is the critical part. A single folder per employee where everything is mixed together creates two immediate compliance problems: medical records accessible to anyone who opens the personnel file (ADA violation), and I-9 forms that cannot be isolated during an ICE audit without exposing other personal information.

What Goes in the Main Personnel File

The onboarding process creates most of these documents. When onboarding is structured with task workflows (complete W-4, sign offer letter, acknowledge handbook, set up direct deposit), each document is collected, signed, and filed during the first week. When onboarding is informal, these documents trickle in over weeks or get lost entirely.

What Goes in the Medical / Confidential File

The ADA (Section 102(d)(3)(B)) requires that medical information be kept in a separate file with restricted access. This is not a suggestion. The implementing regulation at 29 CFR 1630.14 says medical information is collected and maintained on separate forms and in separate medical files, and it binds every employer with 15 or more employees. Below that threshold the habit is still worth keeping, because it costs nothing and you may cross 15 without noticing.

The most common mistake: putting a doctor's note in the personnel file because it seems related to an absence. It is not a personnel document. It is a medical document. Every piece of paper that reveals a health condition, disability, pregnancy, or medical treatment goes in the medical file, not the personnel file.

I-9 Files: Why They Must Be Separate

Form I-9 (Employment Eligibility Verification) should be kept in its own file, separate from both the personnel file and the medical file. USCIS recommends keeping Form I-9 separate from personnel records to facilitate an inspection request, which is a recommendation rather than a legal requirement, which is a distinction worth knowing: the genuine legal separation duty is the one the ADA puts on medical records.

Follow the recommendation anyway, because of what an audit looks like. An employer must produce its I-9s within three business days of an inspection request from DHS, the Justice Department, or the Department of Labor. If I-9s are mixed into individual personnel files, you open every employee's file to find them, exposing other personal information in the process. With one folder holding all the I-9s, you hand over that folder and nothing else.

The Files Beyond the Big Three

The 3-file rule covers the documents a small business handles every week. It does not cover everything. A handful of document types belong in neither the personnel file nor the medical file nor the I-9 file, and putting them in one of those three is how otherwise organized businesses create problems. The rule of thumb: if a document was created for a purpose other than managing this person's employment, it needs its own home.

One row in that table surprises almost everybody: the disability self-identification form is not a medical record. 41 CFR 60-741.42 tells a federal contractor to keep it confidential in a data analysis file rather than in the medical files of individual employees, so it belongs with your EEO data.

The investigation file is the one small businesses most often get wrong. When a complaint comes in, the instinct is to file the complaint in the complainant's folder and the write-up in the subject's folder. Do the opposite: open a single file for the investigation containing the complaint, the interview notes, the evidence reviewed, the finding, and the action taken. Only the outcome that affected employment (a written warning, a transfer, a termination) goes into the individual's personnel file. That keeps the narrative in one place if you ever have to defend it, and it keeps allegations that were not substantiated out of the file a future manager will read.

How Long to Keep Each Document

Every line in that table comes from a different agency, which is why no single number covers them all. The EEOC rule sits at 29 CFR 1602.14 and the ADEA rule at 29 CFR 1627.3, which asks for three years on payroll records and one year on everything tied to a personnel action.

Three more federal rules run longer. DOL Fact Sheet 21 sets three years for payroll records, ERISA six years for benefits records, and 29 CFR 1910.1020 thirty years for exposure records and the duration of employment plus thirty for medical ones.

The safe default for small businesses: keep everything for 7 years after the final day of employment. That covers the longest common federal and state requirements, the IRS audit window, and the statute of limitations for most employment claims. According to SHRM, up to 20% of employee turnover happens within the first 45 days, and short tenure changes nothing: you cannot destroy records early because someone left quickly.

Destroying Files Safely (and When You Must Not)

Retention minimums tell you the earliest you may destroy something. Actually destroying it requires three separate checks: compute the date, confirm no legal hold applies, and destroy in a way that counts as destruction. Skip any one of them and you have traded a storage problem for a liability problem.

Computing the date is harder than it looks for I-9s, because the rule is not a fixed number of years. You keep the I-9 for three years after the date of hire or one year after the date employment ends, whichever is later. For long-tenured employees the termination date controls. For short-tenured employees the hire date controls, which surprises people.

Once the date passes, check for a hold before you shred anything. The moment you receive an EEOC or state agency charge, a litigation hold letter, a demand from an attorney, or you reasonably anticipate a claim, routine destruction stops for every record connected to that person or that dispute. EEOC regulations require preserving all records relevant to a charge until the charge reaches final disposition, and that obligation overrides your normal schedule. Destroying documents on autopilot after notice is spoliation, and the usual remedy is an instruction to the jury that they may assume the destroyed records would have hurt you. The hold covers more than the file: email, chat messages, scheduling data, and time records all fall inside it.

Whatever you destroy, log it: the date, the record category, the employee or requisition it belonged to, the retention rule that authorized it, the method, and who approved it. The log is what lets you answer "where is this document" two years later with a defensible "destroyed on schedule under our written policy" instead of a shrug. A fill-in destruction log, paired with a tracker that computes each record type's eligible date, is in the record retention guide.

The hold is the half that depends on how your files are organized. A hold notice does not land on "the employee file"; it lands separately on the personnel file, the payroll file, the medical file, the I-9 file, the background file, the investigation file and the recruiting file, plus the systems that hold records living in none of them. The register below tracks one matter at a time and, on its second tab, forces you to walk the same file list you built above and record where deletion was actually stopped.

Paper vs Digital Employee Files

Federal law does not require paper employee files. Digital storage is legally acceptable for all employment documents, and USCIS states plainly that you may retain Form I-9 on paper, on microfilm or microfiche, or electronically, as long as the system keeps the document intact and you can present the forms within three business days of an inspection request.

E-signatures hold up too. Under 15 U.S.C. 7001 a signature or record cannot be denied legal effect solely because it is electronic, and most states apply the same rule through UETA. That covers offer letters, policy acknowledgments, and W-4 forms, which is most of what a personnel file holds in its first week.

How to Organize Employee Files Electronically

Organize electronic files by document category at the top level and by employee inside each category. That order is what makes the separation the ADA requires enforceable, because permissions attach to a folder rather than to individual documents somebody has to remember to protect. Electronic personnel files and digital employee files are two names for this same structure.

Two habits keep the structure from decaying. Use one file-name pattern everywhere, so that a search on a last name returns every document belonging to that person. And record the destruction-eligible date at the moment you save the file, because working it out afterward means reopening the document to find the hire date.

If you are converting a cabinet, scan in the order you would be asked to produce things: I-9s first, then medical, then personnel, then the rest. Check each scan against the paper before the paper leaves your hands, and hold the originals until the whole batch is verified. A page found missing six months later is unrecoverable.

How to Set Up Your Employee File System

The total setup time for a 10-employee company: about 3 to 4 hours, including sorting existing documents. The ongoing maintenance: about 15 minutes per new hire (if your onboarding workflow auto-files) and 1 hour per quarter for the completeness audit.

Employee Records Management: The Recurring Work

Setting the files up is a one-afternoon job. Keeping them right is a small recurring one, and it is the half that decides whether the system still holds two years from now. Employee records management at a company with no HR department comes down to six moments, none of them long.

The annual pass is the one that gets skipped, and skipping it is how a small business ends up holding a decade of files for people who left long ago. That is not a free choice. Records you still hold can be requested in a dispute, including the ones you were entitled to destroy years earlier.

When an Employee Asks to See Their File

There is no federal law giving private-sector employees the right to inspect their personnel file. This is entirely a state question, and the states that grant the right disagree about the deadline, how many requests an employee may make, whether former employees are included, and what "personnel record" even means. Many states have a statute; the rest leave it to the employer.

Each of those rows traces to a statute you can read yourself: California Labor Code 1198.5, the Illinois Personnel Record Review Act, and Connecticut General Statutes 31-128b. Connecticut also caps inspections at two per calendar year and requires you to hand over a copy of a termination notice immediately.

Deadlines and definitions change, so confirm your own state's statute before you build an SOP around a specific number. The mechanics, though, are the same everywhere. Ask for the request in writing and note the date you received it. Assemble a copy of the file rather than handing over originals, and if the employee inspects in person, stay in the room. Most access statutes let you charge the reasonable cost of copying and let you withhold specific categories: letters of reference obtained in confidence, records of an ongoing investigation, documents relating to a criminal investigation, test documents where releasing them would compromise the test, and anything identifying another employee. The medical file is usually governed by different rules than the personnel access statute, so treat a request for medical records as its own question.

Keep one record per request. The two questions that come back later, sometimes years later, are what date the request arrived and what exactly was handed over, and neither is answerable from memory. There is a fill-in log for exactly that in the personnel file guide.

Several states also require you to give employees a copy of anything they sign at the time they sign it, and a few (Michigan among them) let an employee attach a written rebuttal to a record they dispute, which then travels with the file. Building this into normal practice costs nothing: give a signed copy of every warning, review, and acknowledgment to the employee the day it is signed. When a request comes in years later, there are no surprises in the folder for either side.

Common Employee File Mistakes

The most expensive mistake is the fifth one: missing documents discovered during an audit. When an EEOC investigator requests an employee's signed policy acknowledgments and you cannot produce them, the agency assumes the policies were never communicated. When ICE requests I-9s and they are incomplete, the penalty is per-form, not per-audit. Prevention is simple: build document collection into onboarding, track completeness in your HR system, and run a quarterly audit. The moment to do it is the first week, when the documents exist and the new hire is already signing things, not a year later when half of them are in someone's email.

Frequently Asked Questions