Summary. Remote and hybrid work raises two distinct sets of questions that companies routinely conflate. The management questions — how people collaborate, how performance is measured, whether hybrid schedules are coordinated — are real and are not legal problems. The legal questions turn almost entirely on one fact: where the employee physically works, which determines the applicable employment law, the payroll registrations, the workers' compensation coverage, and frequently the company's tax nexus. This toolkit addresses both: eligibility and approval, the approved locations control, timekeeping and pay, equipment and expenses, workspace safety, security and monitoring, accommodation, international work, and the practices that determine whether the arrangement works.

What this toolkit is for, and who should use it

Most remote work policies do the management job and skip the legal one. They describe availability expectations, meeting norms, and equipment, and say nothing about where an employee may work — which is the provision that determines whether the company is registered, insured, and compliant in the state where the work is actually performed.

This toolkit is for human resources leaders, operations, and counsel at a company with remote or hybrid employees, whether by design or by accumulation.

Roadmap at a glance

  1. Scope and eligibility.
  2. Where work may be performed — the approved locations control.
  3. Hours, timekeeping, and pay.
  4. Equipment, expenses, and the home workspace.
  5. Safety and workers' compensation.
  6. Information security and monitoring.
  7. Accommodation and leave.
  8. International work.
  9. Hybrid design — scheduling, space, and coordination.
  10. Performance, development, and inclusion.
  11. Maintenance — acknowledgment, ownership, and review.
  12. A worked sequence, and the questions companies ask.

Stage 1 — Scope and eligibility

Define what the policy covers — fully remote, hybrid, and occasional remote work, which raise different questions.

Define eligibility by role, with the criteria stated so the decision does not appear arbitrary, and confirm the criteria do not have a disparate impact on a protected group.

State that remote work is a business arrangement, not an entitlement, and that approval may be modified or withdrawn on stated notice. Treating it as an entitlement makes withdrawing it a dispute rather than a decision.

Define the approval process — who approves, what is considered, and how long it takes.

Separate accommodation requests from the ordinary policy: remote work may be a reasonable accommodation under the ADA or a state analogue, and a request framed that way goes through the interactive process rather than the eligibility criteria.

Stage 2 — Where work may be performed

This is the section most policies omit and the one that carries the legal weight.

Publish an approved work locations list — the states and localities where the company is registered and prepared to employ people.

Require employees to report their primary work location and to obtain approval before changing it, with a lead time sufficient to complete registrations, typically 30 to 60 days.

Explain why: registration, tax, insurance, and employment law obligations attach where the work is performed, and a single unregistered state can cost more than a year of an employee's salary. An explained constraint is followed.

Address temporary work from another location with a stated day threshold beyond which approval is required, because several states impose withholding after a small number of days.

Reserve the right to decline a location, and to require an employee who relocates without approval to return or accept a change in terms.

Require work from a fixed, appropriate location where confidentiality can be maintained — not a moving vehicle or a public space.

Build the relocation checklist the approval triggers: registrations, workers' compensation confirmation, payroll setup, state notices at hire, electronic postings, the handbook addendum, benefits network check, restrictive covenant review, and any geographic compensation adjustment.

Resources

Stage 3 — Hours, timekeeping, and pay

State core hours or availability expectations, and distinguish them from a requirement to be online continuously.

For non-exempt employees, state clearly that all time worked must be recorded, that working outside scheduled hours requires advance approval, and that all recorded time will be paid whether or not approved. Provide the mechanism and require daily entry.

Address meal and rest breaks, including scheduling and a certification process in states requiring them with premium pay — remote work makes compliance harder to demonstrate because nobody observes it.

Prohibit off-the-clock work explicitly, and train supervisors that permitting or encouraging it is a violation regardless of who initiated it.

Address after-hours communication expectations, noting that several jurisdictions have adopted or are considering right-to-disconnect rules.

Confirm the policy does not undermine exempt status through improper deductions or scheduling.

State whether compensation is adjusted by geographic location and how bands are determined, recognizing pay transparency obligations that apply to remote postings and pay equity requirements that a differential be justified by a bona fide factor.

Stage 4 — Equipment, expenses, and workspace

State what equipment the company provides, who owns it, how it is returned, and what happens if it is damaged or lost.

Address personal device use, and if permitted, the security requirements and the company's right to manage, wipe, or access the device — with any state-required consent obtained.

State the expense reimbursement approach. Several states require indemnification of necessary business expenses, including a reasonable portion of home internet and mobile phone. A documented monthly stipend, with the covered categories stated, applied in those states and frequently company-wide for simplicity and morale, is the workable answer.

Address home office setup costs, and travel to the office — whether it is compensable time for non-exempt employees, whether the expense is reimbursed, and how often attendance is required.

Set workspace requirements: a safe, ergonomic, appropriately private space with adequate connectivity, and include an ergonomic self-assessment with a record of completion.

Address dependent care realistically rather than punitively — the concern is availability during working hours, not household composition.

Stage 5 — Safety and workers' compensation

Workers' compensation covers injuries arising out of and in the course of employment at home, and those claims are litigated on the arising-out-of question. Require employees to report any work-related injury immediately through the normal process, and confirm coverage in every state where an employee works, in writing from the broker.

OSHA has stated it will not inspect home offices and will not hold employers responsible for their condition, while home-based work involving hazardous materials or manufacturing is a different matter. A written home workspace policy and the ergonomic self-assessment help both with claims and with employees' actual well-being.

Reserve a right of inspection exercised with notice, recognizing that most employers do not exercise it and that the reservation still helps.

Stage 6 — Information security and monitoring

Require company-approved systems and networks, and prohibit storing company data on personal accounts or unmanaged devices.

Require multifactor authentication, current patching, endpoint protection, and encrypted storage. Address the home network — a changed default router password, WPA2 or better, and no work on public Wi-Fi without the VPN.

Address physical security — locked storage, screens not visible to others, and no confidential calls where they can be overheard, including by household members — and printing and disposal with secure destruction.

Address video and voice meetings: recording only with the consent the applicable state requires, several of which require all-party consent; backgrounds that do not disclose confidential information; and the treatment of transcripts.

Provide monitoring notice and obtain any consent or acknowledgment state law requires — one state requires prior written notice with acknowledgment, and several regulate electronic monitoring.

Address incident reporting — what to do and whom to contact if a device is lost or a system is compromised, within a stated time.

Resources

Stage 7 — Accommodation and leave

Route accommodation requests through the interactive process, documented, rather than through the remote work eligibility criteria — and recognize that remote work has become a commonly requested accommodation whose feasibility the company has now demonstrated for many roles, which affects the undue hardship analysis.

Apply religious accommodation requests similarly.

Confirm leave administration works for remote employees: FMLA where covered, state leave statutes in the employee's state, paid sick leave under the applicable local ordinance, and paid family leave program contributions and notices.

Confirm return-to-work and fitness-for-duty processes function at a distance.

Stage 8 — International work

Prohibit it without written approval, and explain the reasons: the right to work in the host country, which a tourist visa does not provide; local employment law, which in most countries is far more protective and frequently attaches after a short period; payroll and social insurance registration and contributions; permanent establishment risk creating a taxable presence for the company; data protection including transfer requirements; export controls for technical data; sanctions restrictions; and benefits that do not extend abroad.

The workable structures are an employer of record in the host country for one or two people, a local entity at scale, or — the option most often chosen and most often wrong — converting the person to a contractor, which is usually a misclassification under the host country's law.

Set a day threshold for short trips and require approval, because even a few weeks can trigger obligations in some countries.

Stage 9 — Hybrid design

Hybrid arrangements create their own questions.

Coordinate the days, or the office is empty on the days people come in and full on the days they do not. Team-level anchor days work better than individual choice for collaboration and worse for flexibility; decide deliberately.

Space planning — desk sharing, booking systems, and meeting rooms configured for people who are not in the room.

Meeting norms that do not disadvantage remote participants: one person one screen, an explicit facilitator, and documents shared in advance rather than displayed on a conference room monitor.

Attendance expectations stated as a requirement or as a norm, and enforced consistently — inconsistent enforcement is both a management failure and a discrimination risk.

Commuting and travel treatment for non-exempt employees on office days.

Stage 10 — Performance, development, and inclusion

Performance standards are the same for remote and on-site employees; the measurement should be output-based rather than presence-based, which is good management independent of location.

Watch for proximity bias in assignments, promotions, and compensation. Where remote employees are systematically disadvantaged — and the data frequently shows they are — that is a management failure and a potential discrimination exposure, particularly where remote work correlates with caregiving status or disability.

Ensure development and mentoring access, and onboarding designed for remote arrival rather than adapted from an in-person process.

Address communication norms — response time expectations, which channels are for what, and documentation practices that let people work asynchronously.

Stage 11 — Maintenance

Collect a signed or auditable acknowledgment of the policy, and a new one on any material revision.

Cross-reference the state-specific handbook addenda and confirm each approved state's sick leave, break, expense, notice, and posting requirements are addressed.

Deliver postings electronically in a manner employees are affirmatively directed to.

Assign an owner with a review calendar — quarterly for legislative changes in the approved states, annually for the whole document.

Confirm the HRIS work location field is required, populated, and audited, because the policy is unenforceable without it.

Resources

Stage 12 — A worked sequence, and the questions companies ask

A company with 90 employees formalizes what it has been doing informally. Discovery reconciles the HRIS field against payroll addresses and finds people in eleven states and one abroad. Decision: an approved list of eight states, chosen for talent density and compliance burden, with three existing employees outside it grandfathered and supported through an employer of record. Registration in the five unregistered states, with workers' compensation confirmed in writing for each. Policy issued with the approved list, the reporting obligation, a 45-day lead time, timekeeping requirements for non-exempt employees, a monthly expense stipend, workspace and security requirements, monitoring notice, and an international prohibition. Handbook addenda for each approved state. Acknowledgments collected. Maintenance assigned to the head of people, with a quarterly review.

"Can we require people to come back to the office?" Generally yes, if remote work was not promised contractually and the requirement is applied consistently — subject to accommodation obligations and to the practical reality that attrition is the real constraint.

"Do we have to reimburse home internet?" In several states, yes, to the extent it is a necessary expense of the work. A modest stipend resolves it.

"Can we monitor remote employees?" With the notice or consent the applicable state requires, and within the bounds of the acceptable use policy. Monitoring that is technically lawful and culturally corrosive is still a bad idea.

"What if someone moves without telling us?" The obligations attached the day they moved. Require reporting, audit the field, and treat a discovered move as a remediation event rather than only a discipline question.

Master resource index

Articles

Guides

Checklists

Related toolkits

External and primary sources

  • FLSA, 29 U.S.C. §§ 201–219, and 29 C.F.R. Parts 785 (hours worked) and 516 (recordkeeping)
  • ADA, 42 U.S.C. § 12101 et seq., and the interactive process; Title VII, 42 U.S.C. § 2000e et seq.
  • NLRA, 29 U.S.C. § 151 et seq., which constrains overbroad confidentiality and communication rules
  • Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq.; state all-party consent recording statutes and electronic monitoring notice statutes
  • OSHA general duty clause, 29 U.S.C. § 654; state workers' compensation acts and their extraterritorial provisions
  • State expense reimbursement, paid sick leave, pay transparency, and restrictive covenant statutes

This toolkit is educational and not legal advice. Employment, expense reimbursement, monitoring, and recording requirements vary substantially by state and change frequently, and international remote work raises immigration, tax, and data protection issues in the host country. Consult qualified employment counsel before adopting or revising a remote work program.