We experienced the same issues with our regional offices. Not only an old habit but also part of the "us-vs-them" mentality between our central office and regional locations. While personnel forms go through HR they are generated by the supervisors in the specific locations as well as final copies of the actions are usually routed to employees for thier own records (via the lead assistant). Although our policy on Employee Records is pretty explicit in regards to what, who, how, and where employee information is kept I started seeing unofficial "copies" popping up. No one really wanted to fess up to keeping these records so I started doing audits of each location. These audits were disguised as one on one training sessions with the lead assistants to go over ways of protecting personnel information for employees i.e. social security numbers, what you can and can't give out over the phone, performance information which usually let to a "do you have any files we could go through as examples?" type of discussion. I know this sounds a little devious but once they understood they would actually be protecting their coworkers and would not be in trouble they showed a whole lot more support then when I asked/begged/demanded they stop. I did find I had to follow up as old habits do die hard.
This issue was treated separate from the issue of direct supervisors maintaining personnel files on their active employees.