The Mailbag.

• Author: Delogu, Nancy

When have we kept employee records too long?

Q Is there any legal liability for keeping employee records for too long? For example, for seven years? I know records need to be shredded, but what if we are audited and we have employee files from 15 years ago?--Anonymous, Texas

1. There's probably not a risk. Keeping records in and of itself is not problematic. Keeping records that you don't need could eventually lead to concerns (for example, if private information in those records becomes the subject of a security breach).

   Is it illegal to reveal medical info of nonemployee?

   Q An employee had a death in the family and a supervisor told multiple people the circumstances of the death. Can the employee sue the company?

   --Patty, Wyoming

1. It is, of course, much smarter to respect the grieving employee's privacy. But, generally speaking, employers do not have a legal obligation to maintain as private the medical information of nonemployees. (I assume the communications were accurate and not defamatory.)

   One caveat: If the information communicated involved the employee's genetic information--for example, if the communications made clear that the employee may have a certain genetic predisposition toward illness--the employee might be able to bring a claim against an employer under the federal Genetic Information Nondiscrimination Act (GINA).

   For remote workers, which state's regulations apply?

   Q Our office is in New Jersey and we have an employee working in Georgia. Does that employee fall under the New Jersey Family Leave Act, or is there a Georgia family leave act that she is entitled to?

   --Marta, New Jersey

1. The mobility of workers today--coupled with more work-from-home arrangements--means that determining which laws apply can be challenging. Generally speaking, however, the law of the state in which the employee works is the law that is applied in employment situations. Of course, you can elect to extend benefits offered to your New Jersey employees to remote employees as a matter of policy, even if a particular law does not mandate it.

   Note: While Georgia doesn't have a family-leave law...