Employment Law Advisor
New Massachusetts Criminal Record Requirements Become Effective On May 4, 2012April 1, 2012
On May 4, 2012, Massachusetts employers will become subject to new requirements for employer criminal background checks. The new requirements are the final implementation of the Massachusetts Legislature’s 2010 overhaul of the Criminal Offender Record Information (“CORI”) law. The law extends eligibility for access to the CORI database to nearly all employers but also puts strict notification, paperwork, and records retention requirements on employers who access and use CORI records.
The CORI database contains information on Massachusetts criminal records but does not include access to information on Federal or out-of-state criminal backgrounds. CORI records are maintained by the Department of Criminal Justice Information Services (“DCJIS”), and employers using CORI will be subject to audits by DCJIS. The law authorizes DCJIS to make complaints to the Criminal Records Review Board (“CRRB”), which may fine an employer that fails to comply with the new CORI rules, up to $5,000 for each knowing violation.
Access To CORI Records
Beginning May 4, all employers will be able to access CORI records upon registration with DCJIS. Access is no longer restricted to employers serving or interacting with vulnerable populations. While the new law expands access to CORI records, it restricts the type of information included in a CORI record. Previously, a person’s CORI record included information on every contact the person had with the Commonwealth’s criminal justice system, even if the matter was dismissed or ended in a not guilty disposition. However, under the new law the scope of a CORI record will be limited to (1) felony convictions for ten years following disposition; (2) misdemeanor convictions for five years following disposition, and (3) pending criminal charges. Murder, manslaughter, and certain sexual offenses will remain permanently on CORI records.
Before an employer may access an applicant’s CORI record, the applicant must sign an acknowledgement form authorizing the request, and the employer must verify the applicant’s identity by reviewing a form of government-issued identification. The person seeking CORI records on behalf of the employer must certify that (1) he/she is an authorized designee of the employer, (2) the request is for an authorized purpose, and (3) the subject of the CORI report has signed an acknowledgement form and the employer has verified the identity of the subject, as noted above. The employer must retain these acknowledgement forms for one year from the date of the applicant’s signature.
The “Ban The Box” Provision
Parts of the reformed CORI law are already in effect. For example, since November 2010 it has been unlawful for employers to request on an “initial written application form” any information about an applicant’s criminal history. Under the so-called “ban the box” provision, employers no longer can include questions on job application forms requiring applicants to disclose whether they have ever been convicted of a felony or have been convicted of a misdemeanor within the last five years, or to provide specific information concerning such convictions.
The reformed CORI law does not prohibit employers from asking appropriate criminal history questions during an interview after an initial application form is submitted. Note, however, that pre-existing Massachusetts law prohibits employers from asking questions in an interview about (1) arrests, detentions, or dispositions not resulting in a criminal conviction, (2) a first conviction for drunkenness, simple assault, speeding, minor traffic violations, affray, or disturbance of the peace, or (3) any misdemeanor conviction that is more than five years old, unless the period of incarceration following the conviction ended within the last five years or the person has been convicted of another offense in the last five years.
If an employer has obtained an applicant’s criminal record, the employer is permitted to question an applicant about the record during the interview process and may take adverse actions based on that record. However, before doing so, the employer must provide the applicant with a copy of the criminal record, regardless of whether the record was obtained through a CORI request or from an independent source. Any employer that fails to provide this information before asking questions about the record or taking an adverse action may be subject to civil and criminal penalties. In addition, an employer may not ask an applicant to provide a copy of the applicant’s own CORI record.
The law requires any employer that conducts five or more criminal background investigations per year to establish and maintain a written criminal records policy. The policy must include provisions requiring the employer to (1) notify any applicant who is the subject of an investigation of the potential for an adverse decision based on the criminal records, (2) provide a copy of the criminal records and the policy to the applicant, and (3) provide information concerning the process for correcting a criminal record. These requirements apply even if an employer obtains criminal background information from an independent source and not through a CORI request.
Disclosures To Applicant
Before an employer either (1) asks the applicant any question about the applicant’s criminal history or (2) makes any adverse employment decision based on the applicant’s CORI record, the employer must provide the applicant with a copy of the CORI record, or a copy of the non-CORI criminal record information upon which the employer is making its decision.
In addition, before taking an adverse employment action, the employer must inform the applicant of the impending action, and must: (1) provide the applicant with a copy of the employer’s CORI policy; (2) identify the information upon which the decision is based; (3) provide the applicant with the opportunity to dispute the accuracy of the information; (4) provide the applicant with a copy of DCJIS information on the process for correcting CORI; and (5) document the steps taken to comply with these requirements.
Retention Of CORI Reports
Employers are only permitted to keep copies of CORI records for a limited amount of time. Under the new law, employers may not maintain CORI records for more than seven years after an employee’s last date of employment or after the date of the final decision not to hire an applicant. The regulations require employers to store hard copies of CORI reports separately from other employee information, in a locked and secure location, such as a file cabinet. If an employer retains electronic copies of CORI reports, they must be password protected and encrypted, and may not be stored using a public cloud storage system.
Employers may not share CORI information except with individuals within the organization who have a “need to know” the CORI information to serve the purpose for which the information was obtained. Employers who share the information in a CORI record must maintain a dissemination log for one year following the dissemination of information. The log should include: (1) the name of the subject of the CORI report; (2) his or her date of birth; (3) the date of the dissemination; (4) the name of the person to whom it was dissemination; and (5) the purpose of the dissemination.
Use Of A Consumer Reporting Agency
Employers that use a third-party Consumer Reporting Agency (“CRA”) to conduct CORI or background checks are subject to additional regulations. If an employer is using a CRA, the subject of the background check must be given written notification that a consumer report will be used in making an employment decision, and the applicant must give written authorization for the background check. This authorization is separate and distinct from a CORI acknowledgement form. An employer using a CRA is required to make certifications about its compliance with applicable CORI laws to the CRA. Further, before making an adverse employment decision based on a CORI provided to it by a CRA, an employer must not only comply with the same disclosures required for use of an employer-accessed report, but the employer must also provide the applicant with a copy of the applicant’s consumer report and a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act” published by the Federal Trade Commission.
If an employer obtains CORI information from the new state database, follows the required procedures, and makes an employment decision within 90 days of obtaining the CORI information, the employer cannot be liable for “negligent hiring.” Further, an employer cannot be liable for discriminatory employment practices (under state law) if the record from the state database contains erroneous information, the employer makes the employment decision within 90 days of obtaining the CORI information, and the employer would not have been liable if the information from the database was accurate. The law does not provide such a “safe harbor” when an employer obtains information from a private third-party vendor.
We strongly recommend that employers conducting criminal background checks review their policies and practices to ensure that they are compliant with the new law. Please note that the DCJIS recently issued proposed regulations to implement the new law. Once these regulations are finalized they will provide additional guidance on employer obligations. We will update clients regarding future developments.
If you have any questions on the CORI law or the use of criminal background checks in making employment decisions, please feel free to contact a member of the Employment Law Group.