Massachusetts revises CORI regulations for criminal history checks

Recently, the Massachusetts Department of Criminal Justice Information Services (DCJIS) amended the Commonwealth's Criminal Offender Record Information (CORI) regulations that govern employers' criminal history check processes. As a result, employers operating in Massachusetts will need to review their criminal history background screening practices to ensure they are aligned with the updated regulations.

The following is a highlight of some of the key revisions made to the CORI regulations:

The definition of "employee" under the regulations has been expanded to include contractors, subcontractors, vendors and special state, county or municipal employees. This change is consistent with the Criminal Record Review Board's (CRRB) interpretation of the term.

Previously, the regulations did not define "Criminal Offender Record Information," beyond a list of examples of information included or excluded from CORI. Published records of public court, judicial or administrative proceedings continue to be excluded from the definition of CORI. The definition now also excludes information related to criminal proceedings initiated against an individual prior to the age of 18, unless the individual is adjudicated as an adult. This change reflects an increase from the prior age threshold of 17.

iCORI Agency Agreement

The revised regulations now require employers to enter into an iCORI Agency Agreement before obtaining and/or renewing electronic access to the iCORI system. This agreement mandates that the employer:

• Comply with iCORI laws and regulations;
• Maintain a current "need to know" staff list who has been authorized by the employer to request, receive and/or review all iCORI records;
• Provide all "need to know" staff with iCORI training materials;
• Provide "need to know" list to DCJIS upon request and update every six months;
• Will only request the level of CORI access authorized under the statute or by DCJIS; and
• Will be liable for violations of CORI law.

CORI Acknowledgement Forms

The following modifications have been made regarding CORI Acknowledgement Forms:

• Employers may now collect forms electronically, separately or as part of a job application. If employers choose to take this path, they are encouraged to ensure that all background check information collection meets the requirements of the Fair Credit Reporting Act among other laws.
• Model CORI Acknowledgement Forms are now available on the DCJIS website to be used as a stand-alone document by employers or to be incorporated into their own forms.
• Suitable forms of government issued identification reviewed by employers in verifying individuals must now include a photograph. If the individual is unable to produce an identification meeting this criteria, an employer may review the individual's birth certificate or social security card. When employers are unable to conduct verifications in person, regulations permit individuals to submit notarized Acknowledgement Forms in writing or electronically.
• New CORI regulations have eliminated the 72-hour notice requirement. Previously, employers had up to one year to submit a new request for a CORI check from the time the individual signed their CORI Acknowledgement Form, however, the employer was required to provide the individual notice 72 hours prior to submitting the request. The new regulations eliminate the 72-hour notice requirement and allow employers to run an additional check provided that the employer notifies the subject on the Acknowledgment Form that a CORI check may be requested within one year. Once a year has passed, employers are required to obtain a new form. If the information on the second form is identical to the individual's originally completed acknowledgement, the employer does not need to re-verify the individual's identity.

CORI and Cloud Storage

DCJIS modifications to regulations now permit employers to utilize cloud storage options. A written agreement from the storage provider is required indicating the information is encrypted and password protected. DCJIS will be issuing guidelines regarding cloud storage agreements. Furthermore, DCJIS will mandate that these agreements be made available upon request.

Pre-Adverse Action Notification

The new regulations continue to require that employers provide applicants with pre-adverse action notices prior to making an adverse decision based on criminal history, as well as the opportunity for the applicant to dispute the accuracy of the criminal information. However, the revised regulations now also require that the employer "identify the information in the subject's CORI or criminal history information that is the basis for the potential adverse action." Under the prior regulations, the requirement to specifically identify the disqualifying information did not apply to criminal records obtained from sources other than the DCJIS. Additionally, if CORI is the basis for a potential adverse action, the employer must now provide the applicant with a copy of the DCJIS's information on the process for correcting CORI, which is available on the DCJIS website.

CORI and Background Screening Companies

Under the revised regulations, background screening companies continue to be prohibited from storing CORI results, both physically and electronically, unless authorized by the employer to make decisions on its behalf. DCJIS has also clarified the regulation regarding salary and screenings. Employers must disclose to their background screening provider whether the position the individual is applying for is compensated at a rate of more than or less than $75,000.

With a wide array of varying laws and recent modifications, it always good practice for employers to frequently consult with their legal resources and background screening providers to ensure the implementation of best practices and furthermore, compliance.

Source: Seyfarth Shaw LLP, 4/17/2017

Posted: May 2, 2017