Privacy Laws for Employee Records: NYC Shredding Guide

Employee records contain some of the most sensitive personal information that any organization handles—Social Security numbers, medical information, salary data, immigration documents, background check results, and performance evaluations. New York’s robust privacy laws impose strict obligations on employers regarding how these records are collected, maintained, accessed, and ultimately destroyed. For HR managers, compliance officers, and business owners across New York City, Long Island, and Westchester, understanding employee records privacy laws NYC shredding requirements is critical to both legal compliance and the protection of current and former employees.

The challenge for most employers is that employee records are subject to multiple overlapping legal frameworks—federal employment law, New York State labor law, HIPAA (if medical information is involved), and the NY SHIELD Act all impose distinct but related obligations. When it comes time to dispose of these records, the destruction method must satisfy all applicable requirements simultaneously. This guide breaks down the key laws, explains retention and destruction obligations, and shows how a certified shredding program protects your organization.

What Employee Records Must Be Kept—And for How Long?

Before you can shred an employee record, you must ensure it has been retained for its legally required period. New York employers must navigate both federal and state retention requirements, keeping whichever is more stringent. Key retention periods include:

• I-9 Employment Eligibility Verification forms: 3 years from the date of hire, or 1 year after termination, whichever is later (federal requirement)
• Payroll records (hours worked, wages paid): 6 years (New York Labor Law § 661)
• Personnel files (applications, performance reviews, disciplinary records): At least 7 years after termination is the recommended best practice, though the minimum under EEOC is 1 year after the personnel action
• FMLA records: 3 years (federal Department of Labor requirement)
• Workers’ compensation records: 18 years from the date of injury (NY Workers’ Compensation Board)
• OSHA records (workplace injury and illness): 5 years following the end of the calendar year to which they relate
• Medical records and ADA accommodation documentation: At least 3 years, kept separate from personnel files

This is why a formal document retention schedule is essential—without one, it’s nearly impossible to consistently track when each category of employee record becomes eligible for destruction.

New York Privacy Laws That Govern Employee Records

Several New York-specific laws create additional privacy obligations for employers that go beyond federal requirements. Understanding these laws is essential for HR professionals managing employee records privacy laws NYC shredding compliance:

• NY Labor Law § 203-d: Prohibits employers from requesting, requiring, or using an employee’s Social Security number except for specific, limited purposes—and imposes obligations to protect this information from unauthorized access
• NY SHIELD Act: Requires businesses to implement reasonable safeguards to protect private information, including employee data. “Reasonable disposal” of no-longer-needed private information is explicitly required.
• NY Human Rights Law: Restricts what information employers can collect and retain about employees, including limitations on medical and genetic information
• New York City Human Rights Law: NYC employers face additional protections regarding employee privacy, including limitations on criminal background check usage and retention

Taken together, these laws create a clear mandate: collect only what you need, retain it only as long as required, and destroy it securely when its useful life has ended.

How Employee Records Must Be Destroyed in New York

Simply tossing old employee files in the recycling bin is not compliant disposal—it is a potential violation of multiple New York privacy laws and can expose your organization to liability if the records are found and exploited. Under the NY SHIELD Act and related statutes, destruction of private information must render it unreadable and non-reconstructible.

For paper records, this means certified shredding. Specifically, compliant destruction of employee records requires:

1. Cross-cut or micro-cut shredding (not strip-cut, which can be reconstructed) that renders documents unreadable
2. A documented chain of custody from collection to final destruction
3. A Certificate of Destruction issued upon completion of each shredding event
4. The destruction being conducted by or under the supervision of a certified, vetted provider

For organizations with ongoing employee record turnover—hiring, termination, retention period expiration—a regularly scheduled shredding program ensures that records are destroyed promptly when they become eligible. New York Shredding Document Destruction, Inc. provides locked consoles for secure on-site collection and regular scheduled pickups throughout New York City and surrounding areas. Learn more about our shredding services for HR records.

Special Considerations: Medical Records and HIPAA

If your organization maintains employee health information—such as FMLA paperwork, disability accommodation documentation, or wellness program records—those records are subject to HIPAA as well as New York privacy law. HIPAA requires that covered entities and business associates destroy protected health information (PHI) using methods that make reconstruction impracticable.

Employee health records must be:

• Stored separately from general personnel files, in locked file cabinets with restricted access
• Accessed only by personnel with a legitimate need-to-know
• Retained for at least 6 years from the date of creation or last use (HIPAA retention requirement)
• Destroyed using certified shredding when their retention period has expired

HIPAA violations can result in civil penalties ranging from $100 to $50,000 per violation, with annual caps of $1.9 million per violation category. Proper destruction documentation—a Certificate of Destruction—is essential for demonstrating HIPAA compliance in the event of an audit or investigation. Visit our compliance page for more on HIPAA-compliant shredding.

Building an HR Records Shredding Program

For New York employers, the most effective approach to employee records privacy laws NYC shredding compliance is a systematic program that integrates into your existing HR workflows. Here’s how to build one:

1. Develop a retention schedule for all employee record types: Map each category to its legal retention period, with clear triggers for when the clock starts
2. Deploy locked shred consoles in HR areas: Ensure that expired or draft documents are deposited in secure containers, not left on desks or discarded in desk wastebaskets
3. Conduct annual file purges: Once per year (or more frequently), review personnel files to identify records that have passed their retention date and schedule them for destruction
4. Keep employee medical records separate: Maintain HIPAA-covered records in a separate, locked location with their own retention schedule and destruction process
5. Document all destruction events: Retain Certificates of Destruction in your compliance files for at least 7 years

New York Shredding can partner with your HR team to create a tailored shredding schedule that keeps your employee record destruction program running smoothly and in compliance. Contact us today for a free consultation, or explore our service area to confirm we serve your New York location.

Why New York Businesses Choose New York Shredding

For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.

Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.

Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.