Editor’s note:  The following blog was written by Jean M. Wilson, Barry J. Miller, and Alison Silveira of Seyfarth Shaw, which is a member of AIM’s HR-Labor and Employment Law Committee. 

The Massachusetts legislature passed sweeping reform in May 2012 to the commonwealth’s Criminal Offender Record Information (CORI) law, which regulates the ability of employers to conduct criminal background checks.

Now, prompted by Governor Charlie Baker’s regulatory reform initiative, the Department of Criminal Justice Information Services (DCJIS) has new rules for the CORI law.  Several of these changes will require employers to alter their approach to criminal history checks:

1. Who is an Employee? The regulations expand the definition of employee to include not only traditional employees and volunteers, but also contractors, subcontractors, vendors, and special state, county or municipal employees. DCJIS has, in effect, broadened the definition of employee well beyond its traditional meaning, and in a manner that is at odds with the definition of this term under other state and federal laws, leading to possible uncertainty for employers.

2. What is CORI? The prior regulations did not define “Criminal Offender Record Information,” beyond a list of examples of information included or excluded from the system.   The regulations now define CORI, but the definition leaves uncertainty as to what information, outside of that specifically provided by DCJIS, is inlcuded.  The regulations also now specifically exclude from the definition of CORI information related to criminal proceedings that were initiated against an individual before the individual turned 18, unless the individual is adjudicated as an adult.  Prior to the revisions, this threshold was 17.
3. “Need to Know” List and New iCORI Agency Agreement – The revised regulations require employers to enter into an iCORI Agency Agreement prior to obtaining and/or renewing electronic access to the iCORI system. The iCORI Agency Agreement will, at a minimum, include the employer’s representation that:  (1) it will comply with the CORI laws and regulations; (2) it will maintain an up-to-date “need to know” list of staff that the employer has authorized to request, receive or review CORI information and to provide all staff on the “need to know” list with all CORI training materials; (3) it will only request the level of CORI access authorized under statute or by the DCJIS; and (4) it will be liable for any violations of the CORI law or regulations, and that individual users of the employer’s iCORI account may also be liable for violations of the CORI law or regulations.  The DCJIS has not yet issued the iCORI Agency Agreement.
4. CORI Acknowledgment Forms – DCJIS has made several changes to the regulations that affect the collection, use and destruction of CORI Acknowledgment Forms.
5. Storing CORI in the Cloud – DCJIS now permits employers to store CORI using cloud storage methods.  DCJIS requires employers using cloud storage to have a written agreement with the provider and that the storage method provide for encryption and password protection.
6. Additional Information for Pre-Adverse Action Notices – Employers who contemplate adverse action against an employee because of information in a CORI report obtained through DCJIS are currently required to provide the subject of that report with certain information, including identifying the information in the report that is the basis for potential adverse action.
7. Obtaining CORI from Background Screening Companies: The regulations continue to allow background screening companies to obtain CORI on behalf of employers, but maintain the restrictions on the storage of this information that led many background screening companies to cease providing CORI.  Specifically, the regulations continue to prohibit background screening companies from electronically or physically storing CORI results, unless the background screening company is authorized by the employer to act as the decision maker.

Employers should work with their legal counsel and background check providers to ensure that their procedures and forms comply with these new changes.

Massachusetts businesses should also be aware that there are legislative proposals regarding Criminal Justice reform and other specific proposals that would impact Criminal Offender Record Information (CORI) laws.

Want to learn more about the new CORI regulations or the pending legislation? Please contact Brad MacDougall, Vice President of Government Affairs at AIM.  Based on interest, AIM may host a webinar to provide members with greater information.