Update: Massachusetts Law Regarding Criminal Background Checks

In a prior Alert dated August 13, 2010, we reported that Massachusetts had overhauled its Criminal Offender Record Information (CORI) system. Additional provisions of the law took effect in May 2012 and the Massachusetts Department of Criminal Justice Information Services (DCJIS) recently published proposed regulations regarding employers' responsibilities. This law has important implications for Massachusetts employers and out-of-state employers seeking to hire Massachusetts employees.

Under the law, which took effect in August 2010, most written job applications can no longer contain any questions about prior criminal convictions. (The law provides an exception for companies and nonprofit organizations that work with vulnerable populations, such as children, disabled and senior citizens, as well as those that are prohibited by federal or state law from hiring ex-offenders.)

Additionally, employers, for a fee, now have access to a new online criminal history request service called iCORI, which they can use to evaluate current and prospective employees including full-time, part-time, contract, internship employees or volunteers. To access the iCORI service, employers must register on the iCORI website and review certain training materials.

Most employers will have "standard access" to the iCORI service, which provides information on: (1) misdemeanor convictions (if the conviction or incarceration date is less than 5 years old); (2) felony convictions (if the conviction or incarceration date is less than 10 years old); (3) murder, manslaughter or sex offense convictions; and (4) pending offenses. If an applicant or employee is convicted of or released from custody for a misdemeanor in the last 5 years or a felony in the last 10 years, employers will have access to all previous misdemeanor and felony convictions, regardless of when the convictions occurred.

It is important to note that the iCORI service only contains information from Massachusetts courts and will not contain any information regarding out-of-state or federal convictions. Consequently, employers will still need to use vendors or other means if they are interested in checking records from other jurisdictions.

What this means for employers

Written Policy: Employers who conduct five or more criminal background checks per year (either using iCORI or a consumer reporting agency) must maintain a written CORI policy. A model policy provided by DCJIS can be found at here.

Notice/Authorization: Prior to requesting a CORI report through iCORI, an employer must obtain signed authorization from the employee or applicant whose criminal record will be checked. A sample CORI acknowledgement form can be found here. Employers who use a consumer reporting agency to request CORI must notify the applicant in writing that a consumer report may be used in the employment decision making process and separately obtain the applicant's written authorization to conduct the background check.

Verification: Prior to submitting a CORI request, the employer must verify the individual's identity by examining a government-issued identification.

Using CORI or Other Criminal Information: If an employer seeks to question an individual about his/her criminal history or seeks to make an adverse employment decision based on the individual's criminal history (regardless of whether it uses iCORI or a consumer reporting agency), the employer must:

1. notify the individual in person, by telephone, fax, or electronic or hard copy correspondence of the potential adverse employment action;
2. provide a copy of the individual's CORI or other criminal history information to the individual;
3. provide a copy of "A Summary of Your Rights Under the Fair Credit Reporting Act" published by the Federal Trade Commission (if using a consumer reporting agency) to the individual;
4. provide a copy of the employer's CORI Policy, if applicable, to the individual;
5. identify the information in the individual's CORI that is the basis for the potential adverse action;
6. provide the individual with the opportunity to dispute the accuracy of the information contained in the CORI or other criminal history information;
7. provide the individual with a copy of DCJIS information regarding the process for correcting CORI or criminal records; and
8. document all steps taken to comply with these requirements.

Record Retention: Employers must retain acknowledgement forms for a minimum of one year from the time it is signed. However, employers must not retain CORI for longer than seven years from the date of employment or volunteer service or from the date of its final decision regarding the individual.

Storage: Hard copies of CORI must be stored in a separate locked and secure location (e.g., a file cabinet) and electronically-stored CORI must be password protected and encrypted. Employers cannot store CORI using public cloud storage methods.

Access: Employers must limit access to only those employees who have been approved to access CORI.

Destruction: Employers must destroy hard copies of CORI by shredding or otherwise before disposing of CORI and must destroy electronic copies by deleting them from the hard drive and from the system used to back up the information.

Penalties: Employers who knowingly violate the CORI laws may be subject to civil fines of up to $5,000 and could face criminal prosecution.

Why use iCORI?

The new law provides a safe harbor for employers who rely solely on official CORI reports and otherwise comply with the requirements of this law. Employers who make hiring decisions within 90 days of receiving a CORI report will not be held liable for negligent hiring or failure to hire claims.

However, as we explained in our recent Alert, an employer's reliance on an individual's criminal record history in making employment decisions may, in some instances, give rise to an employment discrimination claim under Title VII based on race and/or national origin. Accordingly, it is important that employers comply with state and federal law and consistently follow their own policies.

If you would like to discuss these issues further or have questions about this Alert, please contact one of the attorneys listed above.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.