Overview
HR Information Management, Safety, and Security is 10% of the SPHR exam and was added in the 2024 outline. Its three responsibilities are aligning HR data privacy and security processes to organizational data protection strategies, evaluating employee safety and security strategies, and leading, implementing and evaluating HR digitalization initiatives. The examples span cyber security and phishing, documentation and employee files, OSHA and HIPAA, emergency response, access control, contingency planning and crisis management, workflows, emerging technologies, gamification, employee self-service, social networking, HRIS and risk management systems.
The area tests whether HR can protect people and information while modernizing how HR works. It connects to Leadership and Strategy through risk management and business continuity, and to every other area because recruitment, rewards and talent data all flow through HR systems.
How it's tested
Questions describe a data incident, a safety or security threat, or a technology project, and ask for the FIRST, BEST or MOST appropriate action. Many test which legal framework applies and what it requires. Digitalization items test implementation sequencing: needs analysis, process redesign, data migration, testing, training and evaluation.
-
Contain, assess, notify
A data breach, phishing compromise or misdirected file is described, and you choose the first step or the right escalation.
-
Which law and what it requires
A safety or health-information scenario asks whether OSHA, HIPAA, the ADA or another rule applies, and what it requires of the employer.
-
Technology project sequencing
An HRIS, self-service or emerging technology initiative is planned or failing, and you identify the missing step, often requirements definition or change management.
A recruiter clicks a phishing link and the attacker gains access to the applicant tracking system. Options include notifying all applicants, disabling the account and engaging IT security to contain and investigate, retraining the recruiter, or replacing the system. Containment and investigation come first, because notification duties and scope depend on what data was actually accessed.
Responsibilities 3
Official responsibilities from the HRCI outline, in outline order.
5.1 Align HR data privacy and security processes to organizational data protection strategiesCyber security, phishing, documentation and employee files.
- What it means
- HR handles some of the organization's most sensitive data, such as Social Security numbers, bank details, medical and performance information, and must align its processes for collecting, storing, accessing, retaining and disposing of that data with the organization's data protection strategy.
- What to understand
- Core controls are data minimization, role-based access with least privilege, encryption, secure disposal and retention schedules. Some records must be kept separately: ADA medical information must be kept in separate confidential files, and keeping I-9 forms apart from personnel files is a recommended practice. Phishing awareness training matters because HR staff are frequent targets of payroll-diversion and W-2 scams.
- How it shows up
- A data handling practice or incident is described and you choose the control or first response that fits the organization's data protection strategy.
- Common confusion
- Believing HR data is protected because it sits in a secure system, while access is broader than job need or records are kept past their retention period.
5.2 Evaluate employee safety and security strategiesOSHA, HIPAA, emergency response plans, access control, contingency planning and crisis management.
- What it means
- HR evaluates the strategies that keep employees safe and secure, including OSHA compliance, protection of health information, emergency response and contingency plans, physical access control and crisis management.
- What to understand
- OSHA's General Duty Clause requires a workplace free from recognized serious hazards even where no specific standard applies. Employers must report a work-related fatality within 8 hours and an in-patient hospitalization, amputation or loss of an eye within 24 hours. HIPAA's Privacy Rule applies to covered entities such as group health plans, not to employment records an employer holds as employer, so health information from a sick-leave note falls under other rules such as the ADA.
- How it shows up
- A hazard, injury, threat or crisis is described and you choose the compliant or most effective action, or you evaluate whether an existing plan is adequate.
- Common confusion
- Assuming HIPAA covers every piece of health information an employer has, when it covers the group health plan's protected health information, not personnel records.
5.3 Lead, implement, and evaluate HR digitalization initiativesWorkflows, emerging technologies, gamification, employee self-service, social networking, HRIS and risk management systems.
- What it means
- HR leads the move of information and workflows onto digital platforms, such as an HRIS, employee self-service, gamified learning, internal social networks and emerging technologies like AI, and evaluates whether they deliver value.
- What to understand
- A sound implementation starts with a needs analysis and process redesign, then vendor selection, data cleansing and migration, testing (including parallel runs for payroll), training, change management and post-implementation evaluation against the business case. Emerging tools such as AI screening must be checked for disparate impact and privacy risk, because Title VII applies to selection decisions regardless of the tool used.
- How it shows up
- A digital initiative is proposed or struggling and you choose the first step, the missing step, or how to evaluate its success.
- Common confusion
- Automating a broken process as is, or choosing a vendor before defining requirements and the problem the technology must solve.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Data minimization
Collect and keep only the personal data needed for a defined purpose, and dispose of it securely when the retention period ends.
- Remember
- Data that is not collected or kept cannot be breached, which makes minimization the cheapest control.
- Tested as
- Data privacy questions under responsibility 5.1 often favor reducing what HR holds.
- Trap
- Keeping all records indefinitely in case they are needed later.
-
Least privilege and role-based access
Users get access only to the HR data their role requires, granted through role-based permissions and reviewed periodically.
- Remember
- Access must be removed promptly when people change roles or leave.
- Tested as
- Questions on managers viewing data beyond their teams or departed employees retaining access.
- Trap
- Giving all HR staff full access for convenience.
-
Phishing and payroll diversion
Attackers impersonate executives or employees to trick HR or payroll into sending W-2 data or changing direct deposit details.
- Remember
- Verify requests to change bank details or release tax data through a separate, known channel.
- Tested as
- Named in responsibility 5.1; scenario items ask for the control that would have stopped the loss.
- Trap
- Relying on an email reply to confirm a request that came by email.
-
Separate medical files
The ADA requires employers to keep medical information about employees in separate, confidential files with limited access.
- Remember
- Supervisors may be told about necessary work restrictions and accommodations, not diagnoses.
- Tested as
- Data handling and safety questions involving medical documentation.
- Trap
- Filing a doctor's note in the general personnel file.
-
I-9 retention
Form I-9 must be kept for three years after the date of hire or one year after employment ends, whichever is later.
- Remember
- Storing I-9s apart from personnel files limits exposure of citizenship information during audits and is recommended practice.
- Tested as
- Retention schedule and documentation questions.
- Trap
- Destroying an I-9 three years after hire for an employee who is still employed.
-
OSHA General Duty Clause
Section 5(a)(1) of the Occupational Safety and Health Act requires employers to provide a workplace free from recognized hazards likely to cause death or serious harm.
- Remember
- It applies even when no specific OSHA standard covers the hazard, such as some workplace violence risks.
- Tested as
- Safety strategy evaluation questions under responsibility 5.2.
- Trap
- Concluding there is no obligation because no specific standard exists.
-
OSHA severe injury reporting
Employers must report a work-related fatality to OSHA within 8 hours and an in-patient hospitalization, amputation or loss of an eye within 24 hours.
- Remember
- These deadlines are separate from recording the case on the OSHA 300 log.
- Tested as
- Incident response questions ask what must happen and when.
- Trap
- Thinking that recording the injury on the log satisfies the reporting duty.
-
HIPAA scope for employers
HIPAA's Privacy Rule protects health information held by covered entities, including group health plans, and their business associates.
- Remember
- Employment records held by the employer as employer are excluded, but plan information cannot be used for employment decisions.
- Tested as
- Health information questions ask whether HIPAA, the ADA or FMLA confidentiality applies.
- Trap
- Citing HIPAA for a manager's sick-leave note.
-
Business continuity and contingency planning
Contingency and continuity plans set how critical operations and people functions continue through disruptions, with defined roles, communication trees and backups.
- Remember
- Plans must be tested through drills or tabletop exercises and updated, or they fail in real events.
- Tested as
- Crisis and emergency questions under responsibility 5.2 and risk items under 1.3.
- Trap
- Treating a written plan as sufficient without testing it.
-
HRIS implementation sequence
A typical sequence is needs analysis, process redesign, requirements and vendor selection, data cleansing and migration, configuration and testing, training, go-live and evaluation.
- Remember
- Requirements and process redesign come before vendor selection, and parallel testing protects payroll accuracy.
- Tested as
- Project questions ask for the first or missing step.
- Trap
- Choosing the vendor from a demonstration before requirements are written.
-
Employee self-service (ESS)
ESS lets employees update personal data, enroll in benefits and view pay information directly in the HR system.
- Remember
- It cuts HR transactions but needs strong authentication, clear workflows and change management to succeed.
- Tested as
- Digitalization evaluation questions measure adoption and transaction cost.
- Trap
- Launching ESS without training and then blaming employees for low adoption.
-
Gamification
Gamification applies game elements such as points, badges, levels and leaderboards to learning, onboarding or wellness to increase engagement.
- Remember
- It should reinforce real objectives; poorly designed leaderboards can demotivate low scorers.
- Tested as
- Named in responsibility 5.3 as an emerging digital approach.
- Trap
- Measuring success by points earned rather than learning or behavior change.
-
AI in selection
AI tools that screen or rank candidates are selection procedures, so disparate impact and accommodation obligations apply just as they do to traditional tests.
- Remember
- The employer remains responsible for outcomes even when a vendor supplies the tool, and some jurisdictions require bias audits.
- Tested as
- Emerging technology questions under responsibility 5.3.
- Trap
- Assuming a vendor's tool is compliant because the vendor says it is unbiased.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
HIPAA vs. ADA vs. OSHA for employee health information
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| HIPAA | Protects health information held by covered entities such as the group health plan | Does not cover employment records the employer holds as employer | Applying it to a doctor's note in a leave request |
| ADA | Requires confidentiality of employee medical information obtained by the employer | Separate confidential files; share only restrictions and accommodations | Telling a supervisor the diagnosis |
| OSHA | Requires recording and reporting work-related injuries and illnesses | Privacy concern cases are recorded without the employee's name | Assuming privacy rules excuse not recording an injury |
Emergency response plan vs. business continuity plan vs. crisis management
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Emergency response plan | Immediate actions to protect life and safety, such as evacuation, shelter and first aid | Minutes and hours, focused on people's safety | Expecting it to restore operations |
| Business continuity plan | How critical functions keep running or resume after disruption | Days to weeks, focused on operations | Forgetting HR functions such as payroll continuity |
| Crisis management | Leadership, decisions and communication during a major event | Covers reputation and stakeholder communication | Leaving employee communication out of the crisis plan |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
HIPAA for everything medical
- What candidates pick
- Cite HIPAA as the reason a manager cannot see an employee's medical certification.
- Why it looks right
- HIPAA is the best-known health privacy law.
- Why it's wrong
- Employment records are outside HIPAA; the ADA and FMLA confidentiality rules govern medical information the employer holds as employer.
Clue to watch for The information came to the employer through a leave request, accommodation or fitness-for-duty process, not the health plan.
-
Notify everyone immediately
- What candidates pick
- Email all employees about a suspected HR data breach right away.
- Why it looks right
- Transparency seems responsible.
- Why it's wrong
- Containment and investigation come first so the organization knows what data was affected and which notification duties apply; premature notice can be inaccurate.
Clue to watch for The scope of the incident is not yet known.
-
No standard, no duty
- What candidates pick
- Take no action on a recognized hazard because no OSHA standard addresses it.
- Why it looks right
- Compliance seems tied to specific standards.
- Why it's wrong
- The General Duty Clause requires employers to address recognized serious hazards even without a specific standard.
Clue to watch for A known, serious hazard such as workplace violence risk is described without a named OSHA standard.
-
Buy the system first
- What candidates pick
- Select the HRIS vendor with the best demonstration and then design processes around it.
- Why it looks right
- Modern systems include best-practice workflows.
- Why it's wrong
- Without defined requirements and redesigned processes, the organization may buy a poor fit or automate inefficiency.
Clue to watch for The question asks for the FIRST step in a technology initiative.
-
Training as the only phishing control
- What candidates pick
- Retrain payroll staff after a fraudulent direct deposit change.
- Why it looks right
- The loss started with a human mistake.
- Why it's wrong
- Training helps, but the control that prevents repeat loss is out-of-band verification of bank changes, plus technical controls and alerts.
Clue to watch for A deposit or tax data request was approved based only on an email.
-
Trust the vendor's AI
- What candidates pick
- Deploy an AI resume screener because the vendor certifies it as bias-free.
- Why it looks right
- The vendor is the expert and offers assurances.
- Why it's wrong
- The employer remains liable for disparate impact; it should validate the tool and monitor selection rates by group.
Clue to watch for A new automated screening or ranking tool is introduced into hiring.
Answer framework
For an information, safety or digitalization scenario, use these steps to find the response a senior HR leader would defend.
- Classify the situation as a data privacy or security issue, a safety or security threat, or a digitalization initiative.
- For incidents, protect people first and then contain the problem, investigating scope before notifying, disciplining or replacing systems.
- Identify the governing rule, such as OSHA, HIPAA, the ADA, I-9 retention or anti-discrimination law, and apply its specific requirement or deadline.
- Choose controls proportionate to the risk, favoring prevention such as data minimization, least privilege and verified requests over cleanup.
- For technology, define the business problem, requirements and redesigned process before choosing tools, then manage change and evaluate results against the business case.
Practice question
Want more like this? The SPHR practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
This area is small but unfamiliar to many candidates, so give it focused rather than proportional time. Start with the legal map, because most errors come from applying the wrong law: build a table of OSHA (General Duty Clause, recording and severe injury reporting), HIPAA (group health plans and their scope), ADA medical confidentiality and I-9 retention.
Next, study data privacy and security as a set of controls: data minimization, least privilege, encryption, retention and disposal, phishing defenses and incident response sequencing. Practice FIRST-step questions on incidents until containment and investigation before notification is automatic.
Then study HR digitalization as a change project: needs analysis, process redesign, requirements, vendor selection, data migration, testing, training and evaluation. The commonly underestimated part is emerging technology risk; understand why AI selection tools carry disparate impact exposure and why the employer, not the vendor, remains responsible.
Afterwards, practice mixed scenarios and revisit responsibility 1.3 in Leadership and Strategy, where business continuity and risk management overlap with this area.
FAQ
How much of the SPHR exam is HR Information Management, Safety, and Security?
It is 10% under the current outline, the smallest of the five areas, with three responsibilities. As a planning estimate that is about 12 of the 115 scored questions; HRCI does not publish per-area counts.
Is this functional area new?
Yes. It was introduced with the 2024 SPHR outline, which added HR data protection, safety and security, and HR digitalization as a dedicated area.
Do I need technical IT knowledge?
No deep technical skill is required. You need to understand controls such as least privilege, encryption and verification of requests, and how to lead an HR technology project and evaluate it.
Does HIPAA apply to my company's HR department?
HIPAA applies to the group health plan as a covered entity, not to employment records the employer holds as employer. Medical information in leave or accommodation files is governed mainly by ADA and FMLA confidentiality rules.
Which OSHA rules should I know for the SPHR?
Know the General Duty Clause, injury and illness recordkeeping on the OSHA 300 log, the 8-hour fatality and 24-hour severe injury reporting deadlines, and the role of emergency action plans.
How do digitalization questions usually work?
They describe an HRIS, self-service or emerging technology project and ask for the first, missing or best step. Defining requirements and redesigning processes before choosing a tool, and managing change after, are the recurring themes.
How does this area connect to the rest of the exam?
It overlaps with risk management and business continuity in Leadership and Strategy, and HR systems hold the recruitment, talent and rewards data used in every other area.
Other Human Resources certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 5 knowledge
You have covered HR data protection, safety and security law, crisis planning and HR digitalization. Test whether you can choose the right first step and the right law under exam conditions.