This is quite incorrect. I would say dangerously incorrect. At least in most of the U.S.
In general, actionable defamation (of which libel and slander are particular examples) only requires that you express untrue, damaging things to someone other than the party you are referring to.
There is NO specific requirement that it be public.
And "damage" is used loosely here. Damage could mean damage to their career, or damage to their public reputation, or even just damage to a single friend's opinion of them.
If you wrote untrue, damaging things
in a document to your HR department, that could definitely be considered libel, and would likely be actionable. Specific cases vary, but again in general.
Of course, truth is (again in general... most U.S. states) an absolute defense. So if what you wrote is true and you can demonstrate that it is, by a preponderance of evidence, then you're probably safe. But you'd better have that evidence.
In addition, most corporations have as part of their employment conditions that you can't sue the company or other employees as a result of negative opinions expressed as part of "official" company communications, such as an employee review or exit interview.
Again in the U.S., that is simply not true. "Most" corporations do NOT have such a clause in their contract, and there is a very strong push to stop that practice in those states where it is still allowed. Because in some states such clauses are specifically prohibited by law, and the list of those states is growing.