CLIENT ALERT: Employers Facing May 4, 2012 Deadline for Compliance with Massachusetts CORI Reform
In August 2010, Governor Deval Patrick signed into law Chapter 256 of the Acts of 2010, “An Act Reforming the Administrative Procedures Relative to Criminal Offender Record Information and Pre- and Post-Trial Supervised Release” (“CORI Reform”). The first phase of CORI Reform, as addressed in MBJ’s client alert dated August 12, 2010, prohibited most employers from asking about an applicant’s criminal history on an initial written employment application (known as the “ban the box” provision). Effective May 4, 2012, CORI Reform will change how employers obtain, utilize, and retain criminal history records. Preliminary guidance has been provided by CORI officials in the form of proposed regulations (the “Regulations”) although this guidance may change if and when final regulations are issued.
Newly Created Internet-Based Database Available to All Employers
Under CORI Reform, a newly created Department of Criminal Justice Information Services (“DCJIS”) will maintain an internet-based criminal offender record information database (“iCORI”) which will be implemented on May 4, 2012. As of that date, the CORI request system will be available to employers beyond those currently given access to CORI data. After May 4, 2012, all government agencies will request and receive CORI via the iCORI service. Employers seeking to screen employees or applicants based on CORI must register for an iCORI account. An employer may do so by providing information that identifies a designated individual user and the business, providing information regarding the purpose for requesting CORI, and paying a registration fee. Additionally, the designated individual must undergo training and agree to iCORI terms and conditions. Under the Regulations, when a third party (known as a Consumer Reporting Agency or “CRA”) obtains CORI on behalf of an employer, the CRA will have the same access as the client on whose behalf the check is performed. The employer must authorize the CRA to request CORI on its behalf. All iCORI registrations expire after a year and will need to be renewed at that time prior to accessing additional CORI.
The iCORI system will return various levels of information based on the requestor type. Most employers will have what the DCJIS is calling “Standard Access” to CORI, meaning that employers will have access to (1) all pending criminal charges (including cases continued without a finding of guilt until they are dismissed), (2) all misdemeanor convictions from the past five years; (3) all felony convictions from the past ten years; and (4) all unsealed convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses. Those employers who must comply with statutory, regulatory, or accreditation requirements regarding employees’ criminal records, such as hospitals, banks, as well as schools, camps and other children-serving organizations, will have “Required Access.” This allows access to additional adult CORI data.
Employers Must Have Subjects Complete an Authorization Form and Verify an Applicant’s Identification
Prior to obtaining CORI information, an employer must obtain an Authorization Form from the subject, and must verify the subject’s identity. The employer making a request must certify under the penalties of perjury that (1) it has obtained a signed Acknowledgement Form from the subject authorizing the employer to obtain the subject’s criminal record information, (2) the request is for an authorized purpose, and (3) the requestor verified the subject’s identity. Employers requesting information must keep Acknowledgement Forms for one year from the date that the request for information is submitted. (Employers would be wise to maintain this record longer, as it is likely part of the personnel record.) The Acknowledgement Form for each subject will be valid for one year from the date the subject signed the form or until the conclusion of the subject’s employment, whichever comes first.
Many Employers Will Need To Develop a CORI Policy
Starting May 4, 2012, employers who annually conduct five or more criminal background investigations, whether requesting CORI from DCJIS or from any other source, will have to maintain a CORI policy.
Employers Must Provide a Copy of the CORI Report and Deliver a Pre-Adverse Action Letter
If a pre-employment criminal background screen reveals information that could lead to an adverse decision (such as the decision not to hire/promote), the employer must notify the subject before a final decision is made. The employer will also have to provide specific information to the individual, depending on the source of the information. Effective May 4, 2012, when a potential adverse decision is based on a criminal record check – regardless of whether or not that check includes CORI obtained from DCJIS – the candidate must be provided with the employer’s CORI policy, including the DCJIS notice “Information Concerning the Process in Correcting a Criminal Record” (available here). The individual is then given an opportunity to correct any inaccurate information. The employer must document all steps taken to comply with these requirements.
CORI Reform provides job applicants with a new due process right. Beginning May 4, 2012, if an employer has obtained the criminal history information about an applicant, regardless of the source of that information, he or she must provide the criminal history to the applicant prior to asking him or her about it. CORI Reform also allows individuals to see if their CORIs were run prior to an interview or job rejection.
Record Storage, Retention and Destruction
Hard copies of CORI must be stored in a separate, locked and secure location. Electronically stored CORI must be password protected and encrypted. CORI may not be stored using public cloud storage methods. Access to the information must be limited to employees who have been approved to access the information. CORI may be retained for no longer than seven years from the date employment or volunteer service ends, or the date of the final decision, whichever is longer.
Hard copies of CORI must be shredded before disposal. Electronic copies must be destroyed by deleting the information from both the hard drive and any backup systems.
Penalties for Non-Compliance
Compliance with the CORI Reform is particularly important given the steep penalties for violating the law. For example, willfully requesting or obtaining CORI under false pretenses can result in imprisonment for up to one year and a fine of up to $5,000.00. Mass. Gen. Laws ch. 6, § 178. The CORI statute amendment maintains these penalties, but also adds a new fine of up to $50,000 per violation for non-natural persons, such as towns or corporations.
Safe Harbor Protection from Negligent Hiring
After May 4, employers will have safe harbor protection from negligent hiring for solely relying on CORI and not conducting additional criminal history checks and certain employment discrimination claims if they obtained CORI from DCJIS. Safe harbor is provided if the employer made its hiring decision within 90 days of receiving the CORI, and if the employer maintained and followed DCJIS regulations pertaining to the verification of the subject’s identity.
Compliance
Employers should be aware that final regulations are forthcoming, and may add or change the rules that employers must follow with regard to requesting criminal information. In addition, employees must also be mindful of the Fair Credit Reporting Act (“FCRA”), which also governs the use of credit reports (including criminal histories) when making employment decisions. Finally, employers must also ensure that they use CORI and other criminal history information in a manner that does not discriminate. For more information on the Equal Employment Opportunity Commission’s April 25, 2012 Enforcement Guidance on the use of criminal histories and arrest records in employment decisions, please see MBJ’s client alert dated April 30, 2012.
Employers are advised to consult with their MBJ attorney to ensure that their use of criminal background checks complies with CORI Reform, the FCRA, and employment discrimination laws.
Jeffrey S. Siegel is a partner at Morgan, Brown & Joy, LLP. Jeff may be reached at jsiegel@morganbrown.com or by calling (617) 523-6666. Andrea Evans, a law student intern, contributed to the preparation of this article. Morgan, Brown & Joy, LLP focuses exclusively on representing employers in employment and labor matters.
This alert was published on May 3, 2012.
This publication, which may be considered advertising under the ethical rules of certain jurisdictions, should not be construed as legal advice or a legal opinion on any specific facts or circumstances by Morgan, Brown & Joy, LLP and its attorneys. This newsletter is intended for general information purposes only and you should consult an attorney concerning any specific legal questions you may have.