Human Resources Information System (HRIS): What It Means for Employers

What it means in practice

In practice, an HRIS holds employee profiles, job and pay history, time, leave and benefits data, and often feeds payroll. The term has no statutory definition. NIST's glossary, quoting 44 U.S.C. 3502, defines an information system as a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of information, and an HRIS is that idea applied to people records. Hiring data usually starts in an applicant tracking system (ATS) and moves into the HRIS at onboarding. For the wider function the system supports, see human resources (HR).

What the law does and does not require. The FLSA rules say no particular order or form of records is prescribed, but every covered employer must keep the required information. Records may be kept on microfilm or "other basic source document of an automatic word or data processing memory" if viewing equipment is available, reproductions are clear and identifiable by date or pay period, and transcriptions are provided on request (29 CFR 516.1(a)). The FMLA rules add that employers need not revise computerized payroll or personnel systems to comply, but records kept in computer form must be made available for transcription or copying (29 CFR 825.500(b)). Using software never excuses compliance with any other federal, state or local recordkeeping rule (29 CFR 516.1(c)).

Payroll and time fields. For each employee subject to the minimum wage or overtime rules, the FLSA requires: full name as used for Social Security purposes, home address with zip code, date of birth if under 19, sex and occupation, the time and day the workweek begins, the regular hourly rate in any week with overtime, the basis of pay, hours worked each workday and each workweek, straight-time earnings, overtime premium pay, additions to and deductions from wages, total wages each pay period, and the date of payment and pay period covered (29 CFR 516.2(a)). DOL Fact Sheet #21 also lists the Social Security number. For employees on fixed schedules, the system may record the schedule and mark weeks it was followed, but must show exact hours in any week that differs (29 CFR 516.2(c)).

Retention clocks. One system usually holds records with different federal clocks. FLSA payroll records: at least 3 years from the last entry; time cards and wage rate tables: at least 2 years (29 CFR 516.5 and 516.6). FMLA records: at least 3 years (29 CFR 825.500(b)). ADEA payroll data: 3 years; applications and promotion, transfer, layoff and discharge records: 1 year from the personnel action (29 CFR 1627.3). Title VII, ADA and GINA personnel records, including accommodation requests and applications: 1 year from the date the record was made or the action taken, whichever is later, or 1 year from an involuntary termination (29 CFR 1602.14). Equal Pay Act records explaining a pay differential between the sexes: at least 2 years (29 CFR 1620.32). Employment tax records: at least 4 years after the tax is due or paid, whichever is later (26 CFR 31.6001-1(e)(2)). OSHA 300 Logs, summaries and 301 forms: 5 years after the end of the calendar year covered (29 CFR 1904.33).

Records must be kept safe and accessible at the workplace or a central recordkeeping office, and records kept centrally must be made available within 72 hours of notice from the Wage and Hour Division (29 CFR 516.7). When a discrimination charge is filed under Title VII, the ADA or GINA, the employer must keep all relevant personnel records, including those of employees in similar positions, until final disposition of the charge or lawsuit (29 CFR 1602.14). An automatic purge needs a way to place a hold.

Form I-9 retention. An employer must keep each Form I-9 for 3 years after the date of hire or 1 year after employment ends, whichever is later (8 CFR 274a.2(b)(2)). USCIS says never to dispose of a current employee's form or copies. See Form I-9 for completing the form.

Electronic I-9 standards. An employer may complete or keep Forms I-9 electronically, including original paper forms scanned into an electronic format, only in a system that has reasonable controls for integrity, accuracy and reliability; controls to prevent and detect unauthorized or accidental creation, alteration, deletion or deterioration of a form or its electronic signature; an inspection and quality assurance program with regular evaluations and periodic checks; an indexing and retrieval system; and the ability to reproduce legible, readable hard copies (8 CFR 274a.2(e)(1)). The system may not be subject to any contract or license that limits a U.S. government agency's access (274a.2(e)(3)). The employer must keep descriptions of the system and its indexing, and documentation of the business processes that create, modify and maintain the forms and establish their authenticity, such as audit trails; insufficient documentation is itself a violation (274a.2(e)(5) and (f)).

I-9 security and signatures. The security program must ensure only authorized personnel have access, provide backup and recovery, train employees to minimize the risk of unauthorized or accidental alteration or erasure, and create a secure, permanent record of the date, the person and the action whenever a record is created or changed (8 CFR 274a.2(g)). An electronic signature system must confirm the signer read the attestation, affix the signature at the time of the transaction, preserve a record verifying the signer's identity, and give the employee a printed confirmation on request (274a.2(h)). Employers get at least three business days' notice before an inspection and must then produce the requested forms with their audit trails (274a.2(b)(2)(ii) and (e)(8)). When changing systems, existing forms must stay in a system that remains fully accessible (274a.2(e)(4)). USCIS recommends keeping Forms I-9 separate from personnel records to make an inspection easier.

Medical and genetic information. Employers covered by the ADA (generally 15 or more employees, 29 CFR 1630.2(e)) must keep information about an employee's medical condition or history on separate forms in separate medical files, treated as confidential. The exceptions are informing supervisors of necessary work restrictions and accommodations, informing first aid and safety personnel when appropriate, and giving information to government officials investigating compliance (29 CFR 1630.14(c)(1)); see Americans with Disabilities Act (ADA). FMLA certifications, recertifications and medical histories must be kept as confidential medical records separate from the usual personnel files (29 CFR 825.500(g); FMLA covers employers with 50 or more employees, 29 CFR 825.104); see FMLA. GINA requires genetic information to be kept apart from personnel files "including where the information exists in electronic forms and files," though it may share a file with ADA medical information (29 CFR 1635.9(a)). In an HRIS, that means a restricted record type general HR and manager roles cannot open. These duties do not come from HIPAA, whose definition of protected health information excludes employment records a covered entity holds as an employer (45 CFR 160.103).

Form W-2 filing. The 2026 IRS instructions require e-filing of Forms W-2 if you must file at least 10 information returns, counting W-2s together with forms such as the 1099 series; a waiver request on Form 8508 is due at least 45 days before the W-2 due date. For 2026 wages, Copy A is due to the SSA and employee copies are due by February 1, 2027. Keep a copy of Form W-3 and each Copy A for at least 4 years. See W-2 form.

W-2s through self-service. An employer may furnish Form W-2 electronically only if the employee affirmatively consented in a way that reasonably demonstrates access to the format used (26 CFR 31.6051-1(j)(2)). Before or at consent, the employer must disclose that a paper W-2 is the default, the scope and duration of consent, how to get a paper copy, how to withdraw, when electronic delivery ends (for example, when employment ends), how to update contact details, and the hardware and software needed (31.6051-1(j)(3)). A posting notice must say "IMPORTANT TAX RETURN DOCUMENT AVAILABLE," in the email subject line if emailed; a bounced notice must go by mail or in person within 30 days; and the W-2 must stay posted through October 15 of the following year (31.6051-1(j)(5) and (6)).

Background checks and disposal. The FTC says employment background checks are consumer reports and must be disposed of securely. The Disposal Rule requires reasonable measures against unauthorized access when disposing of consumer report information, with examples such as shredding papers, destroying or erasing electronic media so data cannot practicably be read or reconstructed, and using a vetted destruction company (16 CFR 682.3). "Disposal" includes selling, donating or transferring computer equipment on which the information is stored (16 CFR 682.1(c)), which matters when retiring an old system or laptops.

Security guidance. Beyond the I-9 standards, the federal sources reviewed offer guidance rather than a checklist. The FTC's Protecting Personal Information guide (2016) sets five principles: take stock, scale down, lock it, pitch it and plan ahead. It advises not using Social Security numbers as employee identification numbers, limiting access to employees with a need to know, encrypting sensitive data, ending passwords and access when employees leave (see offboarding), and putting security expectations in writing in service provider contracts, then verifying compliance. NIST's Cybersecurity Framework 2.0 (February 26, 2024) groups outcomes into six functions (Govern, Identify, Protect, Detect, Respond and Recover) without prescribing methods, and offers small-business quick-start guides. The FTC's breach guide notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notice of breaches involving personal information.

Where states differ. State rules can change what the system stores and how fast it must produce records. As one example, the California Division of Labor Standards Enforcement FAQ says payroll records must be made available on reasonable request no later than 21 calendar days after the request, with a $750 penalty for failing to allow inspection or copying in that period, and that an itemized wage statement shows the employee's name with only the last four digits of the Social Security number or an employee identification number other than a Social Security number. Other states have their own personnel file and retention rules; the Department of Labor lists state labor offices.

Questions employers ask. Do we need an HRIS to comply? No; federal rules prescribe no particular form of records (29 CFR 516.1 and 825.500(b)). Can we scan paper I-9s? Yes, into a system that meets 8 CFR 274a.2(e) to (g). Can a doctor's note sit in the employee profile? Not in the general personnel file; it belongs in a separate confidential medical file (29 CFR 1630.14 and 825.500(g)). Can we drop old records when we switch vendors? Retention periods keep running, and existing I-9s must stay fully accessible (8 CFR 274a.2(e)(4)). Your employee handbook can tell employees how their records are handled. Confirm specifics with the agency or a qualified professional.

Why it matters and common mistakes

How Remindax helps

Related terms

See all terms in HR Technology & Operations or browse the full HR Glossary.