For the Paperless HR Department, Security and Accessibility Are Watchwords

Bloomberg Law for HR Professionals is a complete, one-stop resource, continuously updated, providing HR professionals with fast answers to a wide range of domestic and international human resources...

By Martin Berman-Gorvine  

Nov. 4 --Decades after computers took over the office environment, the paperless human resources department remains an enticing goal, but those who pursue it incautiously may come to regret their haste, according to employment attorneys and practitioners interviewed by Bloomberg BNA.

“Security, accuracy, reliability, accessibility, privacy and compliance with specific regulations” are basic requirements for the paperless HR office, Janie Schulman, partner and co-head of the labor and employment group at Morrison & Foerster LLP in Palo Alto, Calif., said Oct. 30.

The aphorism “garbage in, garbage out” definitely applies to electronic HR recordkeeping, Anthony M. Rainone, a partner with Brach Eichler LLC in Roseland, N.J., said Oct. 29. “I'm a huge proponent of paperless for HR or other office functions,” he said.

Still, Rainone cautioned, “You don't just start building a car from scratch, which is what many people do with a paperless office. First, you have to decide is it completely paperless or just an electronic record” of paper records that will still be kept.

“You need to implement checks, balances and controls,” Paul Cowie, a partner with Sheppard Mullin Richter & Hampton LLP in Palo Alto, said Oct. 30.

What Paper Documents Get Retained?

“For HR, it's very important to think about what classes or categories of documents need to be retained” and to train employees accordingly, Matthew Sanchez, an associate at Sheehan & Sheehan P.A. in Albuquerque, N.M., said Nov. 4. The tendency otherwise is for electronic systems to preserve much more than would ever be kept in bulky paper, he said.

It's common to begin the move to a paperless HR office by scanning paper records to create electronic files, Schulman said. If so, “they should be legible, accurate and complete. You need quality control,” he said.

Think before you discard paper originals of certain documents, Sanchez advised. “Keep a small file folder with original documents that may be hotly contested” in case of litigation, he suggested.

For example, Sanchez said, HR should retain paper copies of a former employee's agreement not to sue the company in exchange for a severance payment. If there's no paper original and the former employee sues anyway, he or she may claim that his or her signature on the form in question was “transposed” from another document, Sanchez said.

If litigation is under way, the opposing party may place a hold on documents, so that if “you normally throw paper documents away after scanning, you need to stop” as long as the hold remains in place, Schulman said.

Another consideration when beginning the paper-to-electronic conversion may involve choosing a professional electronic recordkeeping vendor. Trisha Zulic, regional HR director of San Diego-based HR outsourcing company My Efficient Edge, suggested that employers “make sure they talk with someone who is not just a salesperson.”

“The software may look pretty on the screen but not do what you need it to--not just today, but five years from now,” she said Oct. 30. “Use a checklist,” added Zulic, who serves on the Society for Human Resource Management's Technology and HR Management Panel.

Schulman noted that software vendors should “know the basic regulations.”

Security, Internal and External

One of the top items on the checklist for a paperless HR system should be ensuring the security of electronic records in the face of both external threats and internal prying by employees and even management who have no need for and no right to privileged information about others.

“Who needs access to what? Not everyone in HR needs access to the medical information of an employee,” Lisa Orndorff, manager of employee relations and engagement at SHRM, said Oct. 30. The privacy of such information is guaranteed by the Health Insurance Portability and Accountability Act, she noted.

Such records can be kept in a password-protected folder, Sanchez suggested. Other examples of information that needs to be restricted include employment contracts and salary agreements, he said.

“Whatever system you use needs to be secure from outside intruders through the use of passwords, firewalls and encryption, and from insiders you wouldn't give access to such documents,” Schulman said. “Medical data need to be kept segregated and secure, as does race, ethnicity and age data. If a supervisor is looking to fire someone, he or she shouldn't have access to this information.”

Security concerns are heightened if any HR documents are stored on any computer the organization does not control.

“Cloud computing” systems that are becoming increasingly popular need a close, hard look before any HR information is put on them, he said. For example, Sanchez said, Google offers free storage on a cloud computing system that it subjects to data mining, profiling and analytics. It has a separate, paid system that it does not subject to these practices. The first type of system should generally not be used for sensitive HR information, Sanchez said.

Another major consideration is the reliability and accessibility of data stored over time. “In general, the data retention policies of the HR department are still in place, whether it's a paperless system or not,” Sanchez said. “You want to retain evidence and documents for any claim that may be brought against the company for the length of the statute of limitations. So you should have a tailored retention policy.”

HR departments that decide to save all data permanently face “additional concerns,” he said. “How is it maintained; how secure is it; the fidelity of the method--if it's on a server, is it subject to crashing? You have to have it backed up, and the company should have an idea of how to retrieve it from the backup.” If the HR director leaves the company, his or her replacement needs to know how to retrieve all this information, Sanchez added.

Additional Concerns

Yet another area that has received little attention is the preservation of document “metadata,” such as the identity of the author, when the file was created and when it was last accessed, Sanchez said.

Microsoft Windows-based documents usually preserve much of this information automatically, but Sanchez cautioned that a paper document that is scanned into a Microsoft Word document and later converted to an Adobe PDF file may lose much of that information along the way. He said he has seen clients “have to explain in court that it's their usual practice.”

Microsoft Outlook or other calendar-keeping software may capture certain information about when events took place that could be crucial to a litigation defense--and yet, IT departments routinely “wipe” hard drives that departing employees had used of everything that is on them, the better to be ready for their new user, Sanchez noted.

Dorna Moini, an associate with Sheppard Mullin Richter & Hampton LLP in Palo Alto, explained that electronic “e-signatures” on documents can be just as valid as ink signatures under federal and state law. Such signatures are not images of someone's ink signature, she said Oct. 30, but, as federal law says, “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.”


To contact the reporter on this story: Martin Berman-Gorvine in Washington at

To contact the editor responsible for this story: Simon Nadel at

Request Bloomberg Law for HR Professionals