THESE UPDATES ARE OFFERED FOR INFORMATIONAL PURPOSES ONLY AND DO NOT CONSTITUTE LEGAL ADVICE OR RECOMMENDATION
The Massachusetts Department of Criminal Justice Information Services (DCJIS) recently amended the Criminal Offender Record Information (CORI) regulations. These regulations govern how employers conduct criminal history checks in the Commonwealth of Massachusetts. Below are some of the more significant changes:
Employees under iCORI system:
Employee is now defined to include “volunteers, subcontractors, contractors, (and) vendors, and special state, county and municipal employees.”
Individuals Younger than 18:
The regulations specifically exclude from the definition of CORI information related to criminal proceedings that were initiated against an individual before that individual turned 18, unless the individual was adjudicated as an adult. (Before the new regulations, the age was 17).
New iCORI Agency Agreement:
The newly enacted regulations require employers to enter into an iCORI Agency Agreement prior to obtaining and/or renewing electronic access to the iCORI system. This agreement requires the employer to agree to
1. comply with CORI laws and regulations;
2. maintain an up-to-date “need to know” list of employees who will conduct and review CORI;
3. only request an authorized level (according to the statue or DCJIS) of CORI access; and
4. acknowledge that the employer will be liable for violations of the regulations.
Need to Know List
Employers must keep a list of all employees with access to CORI and update the list regularly, every six months at a minimum. For example, if a Board Member is appraised of a CORI report, the Board Member must be trained (as described above) and also be included on the Need to Know List. Employers are obligated to provide it to the DCJIS upon request.
CORI Acknowledgment Forms:
DCJIS has made several changes to the regulations that affect the collection, use, and destruction of CORI Acknowledgment Forms.
· The new regulations specifically permit employers to collect CORI Acknowledgment Forms electronically, including as part of an employer’s electronic job application. However, employers need to ensure that any background check forms meet the requirements of other laws including the federal Fair Credit Reporting Act.
The amended regulations also require employers who perform five or more criminal background checks per year to maintain a written CORI policy, which must be provided to the applicant during the pre-adverse process, even when the criminal history information is obtained from a source other than the DCJIS. This policy must meet the minimum requirements of the MA DCJIS Model CORI Policy.
The regulations still require that employers verify the identity of individuals for whom they run a CORI check through a government issued identification. Under the new regulations, suitable forms of identification must contain a photograph, however an employer may verify identity by reviewing either the individual’s birth certificate or social security card.
The new regulations require that if a new CORI check is to be made on a subject within a year of his/her signing of the Acknowledgement Form, the subject must be given seventy-two (72) hours’ notice that a new CORI check will be conducted.
Storage:
Employers may not maintain CORI records for more than seven years after the employee’s last date of employment or the date of the final decision not to hire an applicant. In addition to destroying all CORI reports, employers must also destroy all CORI Acknowledgment Forms. Any hard copies of CORI records, including Acknowledgment Forms, must still be stored in locked and secured locations, and electronic copies must be password-protected and encrypted.
Obtaining CORI from Background Screening Companies:
The new regulations continue to allow background screening companies to obtain CORI on behalf of employers, but maintain the restrictions on the storage of this information. In addition, the regulations require that an employer must provide a statement to the background screening company indicating whether the annual salary of the position for which the subject is being screened is either above or below $75,000.
Adverse Employment Decision Based on CORI or Other Types of Criminal History Information Received from a Source Other than the DCJIS:
Before taking adverse action against an employment applicant or employee based on the
subject’s CORI or criminal history information that was received from a source other than the DCJIS, an employer or volunteer organization shall:
(a) comply with applicable federal and state laws and regulations;
(b) notify the subject in person, by telephone, fax, or electronic or hard copy correspondence of the potential adverse employment action;
(c) provide a copy of the subject’s CORI or criminal history information to the subject;
(d) identify the source of the criminal history information;
(e) provide a copy of the requestors CORI Policy, if applicable;
(f) identify the information in the subject’s CORI or criminal history information that is the basis for the potential adverse action;
(g) provide the subject with the opportunity to dispute the accuracy of the information contained in the CORI or criminal history information;
(h) when CORI is considered as a part of a potential adverse action, provide the subject with a copy of DCJIS information regarding the process for correcting CORI; and document all steps taken to comply with 803 CMR 2.18.