You should always treat personnel files just like any other private documents within the company. Normally personnel records are kept within a locked file cabinet that only certain people have access to. You should make sure that these files are only available to the people that have a legitimate and valid reason to look at the files. As a suggestion, you may want to set up a company policy that the only people that are allowed to access an employee's personnel record are the human resources manager, the employee's supervisor or manager, and the employee himself. By setting up such a policy, you will protect the confidentiality of these files, your employee's privacy and also limit the opportunities for false documents to get into the files. In addition, by having a policy in place, you have the right to discipline anyone that breaks the policy. Since, like everything else these days, employee personnel files are likely to be available in electronic form, your policy should also address who has access to the databases where employee records are kept. You should limit electronic access to those people and groups listed above.