HR Data Security Checklist

Export the current list of admin and elevated-permission users from Workday, BambooHR, Rippling, or whichever HRIS the team uses. Include payroll admins, ATS admins (Greenhouse, Lever, Ashby), and benefits-portal admins. Stale admin accounts from former HR coordinators are the most common finding here.

Confirm HRBPs only see their assigned business units, recruiters only see open reqs they support, and managers see only direct and indirect reports. Watch for overly broad "HR Read All" roles that drift onto coordinators during high-hiring quarters.

Check MFA is required on the HRIS, ATS, payroll (Gusto, ADP, Paychex), benefits admin portal, and the background-check vendor (Checkr, Sterling). SAML/SSO tenants should confirm conditional access policies cover all HR apps, not just the HRIS.

Request current SOC 2 Type II reports from the HRIS, ATS, payroll, benefits admin, background-check, and LMS vendors. Reports older than 12 months don't satisfy most enterprise security reviews — flag any vendor whose report is expired, in-progress, or refused.

HIPAA Business Associate Agreements must be on file with the benefits broker, EAP provider, COBRA administrator, and any wellness or telehealth vendor receiving member-level data. Brokers rotate carriers — a BAA signed three years ago may not cover the current carrier.

Scheduled exports (payroll feeds, 401(k) contributions, ACA reporting feeds for 1094-C/1095-C) should travel over SFTP or vendor-native API — never plain email. Audit the last quarter of scheduled jobs and recipient inboxes.

I-9s and supporting documents must be stored separately from the personnel file — both for ICE inspection prep and to limit exposure of national-origin data. Confirm retention is 3 years from hire date or 1 year from termination, whichever is later.

ADA accommodation records, FMLA certifications, workers' comp documentation, and STD/LTD paperwork must live in a separate confidential medical file with restricted access. Managers should never see medical certifications — only the accommodation outcome.

HR Acuity, AllVoices, or NAVEX case files should be visible only to the assigned investigator and ER lead. Pull the access log for the past quarter and confirm no HRBPs viewed cases outside their assigned scope.

Push the annual privacy module via the LMS (TalentLMS, Litmos, LinkedIn Learning) to everyone with HRIS, ATS, or payroll access. Benefits team members get a separate HIPAA module. Track completion against a 30-day deadline.

Anyone with elevated HR data access re-signs the confidentiality and acceptable-use acknowledgment annually. Store signed copies in the personnel file. Missing acknowledgments are a frequent finding in pre-litigation discovery.

Walk through a realistic scenario with HR, IT security, and legal: a phished payroll admin, a misdirected 1095-C batch, an ATS export sent to the wrong hiring manager. Time the response against state breach-notification windows (most states: 30–60 days from discovery).

Capture every confirmed or suspected exposure of employee data — even minor ones like a benefits enrollment email cc'd to the wrong person. Patterns matter as much as severity for the audit narrative.

Engage employment counsel and the privacy officer the same day the incident is logged. State breach-notification clocks (CCPA/CPRA in California, SHIELD Act in New York, and 45+ other state laws) typically start at discovery, not at confirmation. Don't wait for forensic certainty before opening the file.