The remaining provisions of the comprehensive 2010 legislation amending the Massachusetts Criminal Offender Record Information Act (the “CORI Act”) went into effect on May 4, 2012. These provisions affect any Massachusetts employer that conducts criminal background checks on applicants or employees. Effective immediately, Massachusetts employers that conduct five or more criminal background checks per year must adopt a written policy regarding the use of criminal history information.

Changes to CORI Access

The CORI Act regulates the procedures pursuant to which employers and other parties are permitted access to the Massachusetts government database containing criminal records. Employers that access CORI directly from the Massachusetts government will now do so via a web-based system known as iCORI. The iCORI system is maintained by the Massachusetts Department of Criminal Justice Information Services (“DCJIS”). While all employers will have access to the iCORI system, the amount of information available is limited by the CORI Amendments. Criminal history information available through iCORI will be limited to felonies over a ten-year period and misdemeanors over a five-year period. Information concerning convictions for murder, manslaughter, and certain sexual offenses are not subject to the time limitations.

Recordkeeping Requirements

Employers that access criminal records through iCORI must obtain acknowledgment forms from applicants prior to viewing criminal history on iCORI, and must retain those forms for at least one year following the date the CORI is requested. Employers must limit dissemination of CORI information to employees within the organization on a “need to know” basis. If iCORI records are disseminated outside of the organization, the employer must maintain a “secondary dissemination log” detailing information about the dissemination. This log must be retained for at least one year following the dissemination. Finally, employers may not retain iCORI records for more than seven years after the employee separates employment or, in the case of an applicant who was not hired, the date of the final decision not to hire the applicant. Employers who fail to comply with these recordkeeping requirements are subject to civil and criminal penalties of up to $50,000 per violation.

CORI Policy Required

Employers who conduct five or more criminal background checks per year must adopt and maintain a written policy regarding the use of criminal history information. At a minimum, employers must adopt a policy that requires them to “(i) notify the applicant of the potential adverse decision based on the criminal offender record information; (ii) provide a copy of the criminal offender record information and the policy to the applicant; and (iii) provide information concerning the process for correcting a criminal record.” These obligations applywhether the employer obtains criminal history information through iCORI or from another source.

Obligations Regarding Third-Party Vendors

The CORI Amendments primarily regulate employers’ use of the government database, iCORI. Employers may still use third-party vendors or credit reporting agencies that may obtain criminal background information through other sources, such as court records. However, similar to the federal law known as the Fair Credit Reporting Act (“FCRA”), the CORI Amendments require third-party vendors and employers taking adverse employment action based on this information to adhere to certain notice and due process procedures. Specifically, prior to questioning an applicant about his or her criminal history or making an adverse employment decision based on such history, employers must provide the applicant with a copy of the records.

Ban-the-Box Provision

As discussed in a prior GT Alert, one important aspect of the CORI Amendments, regarding job application forms, went into effect on November 4, 2010. Commonly referred to as the “ban the box” provision, this law makes it illegal for Massachusetts employers to ask about criminal history on an initial written application for employment. The CORI Amendments implement a broad prohibition by making it illegal for employers to request on an “initial written application form criminal offender record information.” The law defines the term “criminal offender record information” to include any records and data compiled by a Massachusetts criminal justice agency that identify an individual and relate to “the nature or disposition of a criminal charge, an arrest, a pre-trial proceeding, other judicial proceedings, sentencing, incarceration, rehabilitation, or release.”

Practical Considerations

The CORI Amendments add another layer of complexity and create additional compliance obligations for Massachusetts employers who use criminal background checks as part of the hiring process. In addition to the requirements imposed by the CORI Amendments, employers who engage third parties to conduct background checks must also comply with the FCRA with respect to authorizations, notices, and disclosures to applicants. Employers that conduct background checks — either by accessing CORI directly or through a third party — should review their practices and policies to ensure that they are complying with the CORI Amendments. Employers that conduct five or more background checks per year must adopt a written policy as required by the CORI Amendments.

The DCJIS has issued proposed regulations related to the CORI Amendments. The public comment period recently closed and DCJIS is reviewing the comments as it promulgates final regulations. We will inform you when the final regulations are published.