The Massachusetts Department of Criminal Justice Information Services (DCJIS) recently issued final regulations to accompany the Massachusetts Criminal Offender Record Information (CORI) law. The law, which was passed in August 2010, significantly changed the way in which employers screen the criminal histories of applicants and employees. The new regulations, which went into effect immediately, clarify how employers obtain and use criminal history information.
While the regulations are detailed and their application will vary by employer and circumstance, below is a summary of the most pertinent new developments. Employers should review their particular background check policies and practices regarding compliance with the law.
- The regulations clarify that the law applies to applicants for volunteer positions, as well as paid employee positions.
- The regulations contain certain requirements for third-party consumer reporting agencies (CRA) that conduct background checks on behalf of employers.
- Any employer that annually conducts five or more criminal background investigations, whether the information is obtained through DCJIS or otherwise, must maintain a written CORI policy that meets certain minimum standards.
- The regulations outline a detailed process for employers to access the state’s “iCORI” system, which is the new, more widely accessible online system. Employers may now register to obtain iCORI information (for a fee) for the purpose of screening current employees or employment applicants. Prior to requesting CORI from the state, employers must obtain a signed CORI acknowledgement form for the individual, verify the individual’s identity in a specified manner (e.g., examining the individual’s government-issued identification), and sign the form to certify that the individual was properly identified.
- The regulations remind employers of the prohibition against asking employment applicants to provide copies of their own CORI.
- The regulations clarify that the requirement to maintain a secondary log with certain information about the dissemination of CORI applies only to the external dissemination of CORI (i.e., distribution outside the employer’s organization).
- Prior to taking adverse action against an applicant based on his or her criminal history information, the employer must take the following steps:
1. Notify the applicant in person, by phone, fax, or electronic or hard copy correspondence of the potential adverse decision.
2. Provide the applicant with a copy of his or her CORI or other criminal history information. If the information is from a source other than the state CORI system, identify the source of the information.
3. Identify the actual information that is the basis for the potential adverse decision.
4. Provide the applicant with a reasonable opportunity to dispute the accuracy of the information.
5. Provide a copy of the employer’s CORI policy (if applicable).
6. Provide the applicant with a copy of the DCJIS information sheet regarding the process for correcting criminal history information.
7. Document the steps taken to comply with these requirements.
- In addition, prior to asking an individual questions about his or her criminal history, the employer must provide the individual with a copy of his or her criminal record information. If the information was obtained from a source other than the state’s CORI system, the employer also must provide the source of the information.
- Employers must follow certain steps regarding the storage and disposal of CORI (and it is recommended that employers follow these steps with criminal history information obtained from any source to comply with Massachusetts data privacy laws):
1. Hard copy information must be stored in a separate locked and secured location (e.g., a locked file cabinet) to which only certain approved individuals have access.
2. Electronically stored information must be password protected and encrypted, with only certain approved individuals having access.
3. The information may not be stored in a publicly accessible “cloud.”
4. Employers may not retain CORI for longer than seven years from the date of employment or volunteer service, or from the date of the final employment decision (whichever occurs later).
5. When disposing of CORI, hard copies must be shredded and electronic copies must be deleted and properly cleaned from the hard drive and any back-up system.
The release of the regulations provides an opportunity to ensure compliance with all aspects of the CORI law.
