Shareholder
In May 2012 there was a change in the manner in which Massachusetts employers may obtain, use, and retain the Criminal Offender Record Information (CORI) they receive on employees and prospective employees alike. This was the next implementation aspect of the Massachusetts CORI legislation that was enacted in the summer of 2010. Under the CORI legislation, employers are now able to access a new online records system. Additionally, the law places additional requirements on employers that utilize private, non-CORI sources for accessing criminal information about a prospective or current employee. This article will highlight some of the more significant provisions in this evolving area.
As some employers likely know, for years the Massachusetts Criminal History Systems Board (CHSB) was the main repository for Massachusetts Criminal Records. Initially intended as a tool for public safety agencies, CORI record access increased as more and more employers which were employing workers who had interactions with protected classes, including young students, elders, etc., were expected to run CORI checks on those employees or prospective employees. Employers who do not employ workers who interact with protected classes of individuals were not allowed access to CORI and instead conducted whatever background checks they were going to conduct by way of utilizing background searching firms they often located via the internet.
CHANGES TO CORI ACCESS
Since 2012, all employers, regardless of the nature of their businesses and regardless of the clientele they service now have access to an online version of the CORI information. That information is now maintained by the Department of Criminal Justice Information Services (DCJIS). The information that all employers will, however, be able to access going forward will not be one’s entire CORI file (as is the present practice for authorized users) it will be a watered-down version for many entities accessing the information. It will be available online via a network called iCORI. For example, while an authorized user used to have access to one’s entire criminal record – including criminal case dismissals and acquittals – the new record that is accessible to most Massachusetts employers is limited to information about recent arrests for pending cases and convictions. Moreover, the time period of information that will be accessible will, for many employers, limited to a ten-year look-back for felonies and a five-year look back for misdemeanors (which dovetails with the anti-discrimination statutes regarding criminal records.) As one might expect, access will still be granted to all employers regarding convictions for certain sexual offenses, murder, and the like, regardless of when they occurred.
THE NEW RECORDKEEPING REQUIREMENTS
Among the most significant recordkeeping requirements of the CORI access reform legislation is the requirement that employers must get signed acknowledgement forms from every employee or prospective employee who they wish to run a CORI check on. Regardless of whether the applicant is or is not hired, the employer must retain the prospective employee’s acknowledgment form for not less than a year after the CORI check is conducted. Another new aspect of the CORI access reform legislation is that employers are obligated to limit access to the results of the CORI records checks to only those persons within the organization who have a need to know the information as part of their job and every such person to whom access is granted must be detailed in a newly required “secondary dissemination log.” The log must include the following: name of person on whom the CORI check was run, his or her date of birth, the name of the recipient of the CORI information, and finally the reason he or she was provided that information. As with the CORI authorization forms, the secondary dissemination log must be maintained for not less than one year following the secondary dissemination. Finally, the third major recordkeeping requirement has to do with the length of time an employer may maintain CORI record information. Under the new law, CORI records may not be retained longer than seven years after the employee has left the employer’s employ or following the date the applicant was no longer in consideration for a position.
PENALTIES
The law authorizes the new DCJIS to perform audits on employers to ensure that they are complying with the law’s above detailed requirements. Employers who access CORI information without proper approvals and authorizations and/or who disseminate authorized CORI information to unauthorized recipients of that information can be fined up to $50,000 per violation. The employees who commit the offenses under this law can be personally subjected to fines of up to $5,000 and even possible imprisonment.
FURTHER IMPLICATIONS OF THE CORI PROVISIONS
While the CORI provisions do represent some significant changes in the area of background checks, several aspects of the already existing criminal background rules still exist. Specifically, as before, employers/prospective employers may not require or request that an employee or applicant divulge any information for which he or she could otherwise reply “no record” in accordance with the antidiscrimination provisions contained in MGL c. 151B. Such information that need not be divulged includes such things as first convictions for a number of misdemeanors which are perceived as being of a less offensive nature – ie. speeding, public drunkenness, disturbing the peace and the like, any misdemeanor for which the conviction was entered more than five years prior to the inquiry, provided that there has not been another conviction in the meantime.
Finally, while there are a few other changes one needs to remain mindful of, employers who run five or more criminal background investigations per year are now required to have a CORI Policy. The CORI law requires that each such CORI policy must contain the following: (a) that the employer will notify the applicant in advance if the decision not to hire the applicant may be made based on the information contained within the applicant’s criminal record; (b) provide the applicant with a copy of the his or her criminal record that was obtained by the prospective or current employer along with a copy of the employer’s criminal record policy; and (c) it must contain information concerning the process for the applicant to correct his or her criminal record if he or she believes it contains errors. To assist in the preparation of a criminal record policy, the DCJIS maintains a model CORI policy on its website. It can be found by searching “CORI” at https://www.mass.gov.