[ruraljuror]

Good point. My point is that if HR were to retaliate against the employee, HR would open the company to a far greater amount of risk.

I think the point should be not to trust HR with the only copies of any documents or evidence. Again, I would argue that if HR does the steps you suggest, they are exposing themselves to much more risk than if they did pretty much anything else. Not to say they wouldn't do it, but that it would be a foolish thing to do.