HR Information Management, Safety, and Security
HR Information Management
Data is an asset with a lifecycle
HR information management covers systems (HRIS, payroll, ATS, LMS), data standards, and the controls that keep information accurate, private, and secure. Data governance assigns ownership, definitions, and quality rules; master data management prevents duplicate records. Privacy governs what may be collected and how it is used (notice, consent, minimization); security governs how it is protected (access controls, encryption, logging, vendor oversight). Confidentiality is the obligation to limit disclosure.
Analytics and reporting
Know the difference between data, metrics, and analytics: metrics describe, analytics explain and predict. Dashboards should answer business questions and mix leading and lagging indicators. Common measures include turnover rate, cost per hire, time to fill, absence rate, training hours, and revenue per FTE. HR audits test accuracy, access, and compliance; system selection follows requirements gathering, RFP, vendor evaluation, implementation, and change management.
Records and retention
Under FLSA, keep payroll records at least three years and supporting time records two years. Form I-9 must be retained for the later of three years after hire or one year after termination. Retention schedules reflect legal requirements plus business need, and litigation holds suspend destruction. E-discovery means relevant electronic records may be requested in disputes.
Traps
Do not confuse privacy with security; a collection policy is not encryption. Do not assume privacy laws such as GDPR reach only EU-based organizations; they can reach organizations handling EU residents' data. Never destroy records under a hold.
Worked example
A manager requests an employee's medical notes. The correct response is to decline routine access, store the information separately from the personnel file, and release it only on a need-to-know and legally permitted basis. Rule of thumb: collect the minimum, protect it strongly, and keep it only as long as required.
Safety and Security
Prevention, protection, and response
Safety and security spans occupational safety, physical security, and information and people security. OSHA's General Duty Clause requires a workplace free from recognized serious hazards. Recordkeeping: work-related injuries and illnesses meeting criteria go on the OSHA 300 log; report fatalities within 8 hours and in-patient hospitalizations, amputations, or loss of an eye within 24 hours. Incidence rates: TRIR equals recordable cases times 200,000 divided by hours worked; DART uses days away, restricted, or transferred cases.
Controls and programs
Hierarchy of controls, most to least effective: elimination, substitution, engineering controls, administrative controls, and personal protective equipment. Programs include hazard assessment, inspections, incident investigation, emergency action plans, ergonomics, workplace violence prevention, and behavior-based safety. Workers' compensation provides no-fault benefits for work injuries and is generally the exclusive remedy against the employer; return-to-work and light duty reduce costs. Drug testing, background screening, and access control implicate privacy and fairness.
Security and culture
Physical security includes perimeter control, access badges, visitor management, and cameras; logical security includes authentication and role-based access. Workplace violence programs use threat assessment teams and clear reporting channels. Retaliation against employees who report hazards is prohibited, and HR must protect whistleblowers.
Traps
Do not place PPE above engineering controls. Do not assume every injury is recordable; first aid is generally not. Do not confuse the 8-hour fatality reporting timeline with the 24-hour timeline for hospitalizations, amputations, and eye loss.
Worked example
A site has 4 recordable cases and 250,000 hours worked. TRIR equals 4 times 200,000 divided by 250,000, or 3.2 per 100 full-time workers. Rule of thumb: eliminate the hazard before training around it or handing out PPE.