My opinion on this may not be popular here but I think she’s right, HR is a very specific role in most businesses, requiring one very key skill – absolute discretion. IT people have to have a very wide range of skills and while discretion is important it’s not the ‘be all and end all’ that it is with HR. Typically recruitment of IT people is less thorough in this area too.
Perhaps there’s a technical solution to this, how about getting your HR people to backup their own stuff to encrypted external disks that they own/manage/store?
Ultimately you have to protect yourself, if there’s no way you could get at HR data then you’re in the clear, if your management see that you’ve tried your best and provided as secure and private a means to functionally get your job done without exposing yourself to accusations of data prying then they’ll be happy – even if the process is clunky and slow.
Basically don’t be afraid to cover your own arse in this area – most people will understand and the HR people will appreciate that you’re respecting their role and authority. Plus of course you should never piss off HR anyway, these ninny’s help decide your fate for some crazy reason 🙂