Are we mixing employee files inappropriately?

Q: “I've discovered that at our publishing company of 75 people, each employee has a single personnel file into which all documents go—everything from their new-hire paperwork to performance reviews to doctor’s notes. How must we separate this information going forward to keep legally compliant? We’re supposed to split off certain medical information so that each employee will have different sorts of files, correct?” – Theo, Maryland