Effective May 4, 2012, the Massachusetts Criminal Offender Record Information (CORI) Reform Act (the Act), which was enacted in August 2010 with the controversial "ban the box" legislation, will significantly change the way employers access, use, and maintain information obtained through the Commonwealth's CORI system. The Act will allow all employers access to a new online records system, but also imposes obligations on employers that acquire criminal history information from private sources, such as consumer reporting agencies (background report vendors). Employers should review their hiring and background check policies now to determine whether any updates are necessary.

What is CORI?

CORI refers to the Commonwealth's database of criminal record information, such as arrest and conviction records and data concerning judicial proceedings, sentencing, incarceration, and release. CORI records are limited to crimes investigated and prosecuted by the Commonwealth and do not include information related to federal crimes or crimes committed in other states.

The CORI database is maintained by the Commonwealth's Department of Criminal Justice Information Services ("DCJIS"). Currently, Massachusetts law restricts access to CORI to employers that have successfully petitioned the Commonwealth for access – primarily those that deal with vulnerable populations, such as schools, daycare centers, and long-term care facilities. Employers that are not eligible to access CORI records and/or CORI-qualified employers that want records from federal courts or other states generally rely on background check vendors to conduct such criminal background investigations.

Changes to CORI Access

The first change that existing CORI users will notice is that the updated CORI system will be web-based. The DCJIS is currently developing an iCORI website, which will allow employers to request and obtain access to CORI records online. Recent reports from the DCJIS indicate that the agency intends to release information concerning the new iCORI system, including a revised training curriculum, in March 2012.

Beginning May 4, 2012, all employers, and not just those employers with vulnerable patient/client populations, will have access to the iCORI system. While the Act expands access to CORI records, the legislation limits the scope of available records. Currently, unless sealed, all criminal records are reported in CORI regardless of the record's age or disposition status. This has allowed eligible employers to view records even if a case was dismissed or the individual was found not guilty. Under the Act, on a going forward basis, most employers will only be able to access information related to pending arrests and charges that resulted in a conviction, limited to the past ten years for felonies and the past five years for misdemeanors. All employers, however, will have permanent access to data related to convictions for murder, manslaughter, and certain sexual offenses.

New CORI Requirements

The legislation imposes new recordkeeping requirements and record retention limits on employers that obtain criminal records through iCORI.

• Acknowledgment Forms. To access iCORI records, employers must obtain signed acknowledgement forms from the employee or applicant authorizing the employer to view the iCORI records. Employers must maintain acknowledgment forms for a minimum of one year following the date of the iCORI request.
• Secondary Dissemination Log. Employers must limit the dissemination of iCORI records to only those employees with a need to know within the organization and certain government officials. If an employer disseminates the records, it must maintain a secondary dissemination log to record: (i) the subject's name; (ii) the subject's date of birth; (iii) the dissemination date; (iv) the name of the person to whom the record was disseminated; and (v) the purpose of the dissemination. The log must be kept for a minimum of one year following the date of the dissemination.
• Retention Limits. Employers may not maintain iCORI records for more than seven years after the employee's last date of employment or the date of the final decision not to hire an applicant.

The DCJIS has the authority to audit employers to ensure they are properly maintaining the acknowledgement forms and secondary dissemination log. Employers who unlawfully obtain or disseminate iCORI records are subject to civil liabilities and criminal fines of up to $50,000 per violation. Individuals, including human resource professionals, supervisors and managers, are subject to fines of up to $5,000 and imprisonment for knowingly violating the law.

CORI Protections

The Act establishes certain defenses against state law claims for employers using the iCORI system. If an employer rejects an applicant for employment or volunteer work based on iCORI records that turn out to be erroneous, the employer is not liable for a failure to hire claim. In addition, employers who rely on iCORI records prior to taking on volunteers are not liable for a negligent hiring claim. To be eligible for either defense, the employment decision must have been made within 90 days of receipt of the iCORI records and the employer must follow all of the Act's requirements. Employers should be mindful that such potential defenses only apply to state law claims and are inapplicable to claims brought under federal law. Employers are further cautioned that the extent and applicability of immunity in these circumstances, particularly with respect to negligent hiring claims, has not been tested.

Additional Obligations Imposed on All Employers

The Act also imposes new obligations on all employers that obtain criminal history information, regardless of whether the criminal background information is obtained through iCORI or from a private source. The reach and extent of these obligations is currently unclear, however. But it is anticipated that the DCJIS will issue additional regulations prior to the May 4 effective date. At a minimum, until further guidance or regulations is provided by the DCJIS, employers should adhere to the following commencing on or before May 4, 2012:

• Prior to questioning an applicant about his/her criminal history or making an adverse decision based on an applicant's criminal history, employers who are in possession of criminal history records must provide a copy of those records to the applicant.
• Employers who annually conduct five or more background investigations must maintain a written criminal record information policy. The policy must, at a minimum, require the employer to: (i) notify any applicant who is the subject of a background investigation of the potential for an adverse decision based on the criminal history records; (ii) provide a copy of the criminal history records and the policy to the applicant; and (iii) provide information concerning the process for correcting criminal records through the DCJIS or the consumer reporting agency.

Employers who knowingly fail to provide an applicant with criminal record information under this provision are subject to fines of up to $5,000 per violation.

Changes Applicable to Consumer Reporting Agencies

In addition to limiting the scope of iCORI records available to most employers, the Act eliminates an exemption in the Massachusetts consumer protection law that currently allows consumer reporting agencies to report older adverse information, including criminal history records, concerning applicants and employees in certain positions. Effective May 4, 2012, consumer reporting agencies may only report adverse information for a period of seven years following the final disposition of the event, as defined by state law.

Current Requirements that Remain in Effect

Currently, employers are prohibited from requiring an applicant or employee to produce his or her own CORI records. Employers are also prohibited from requiring an applicant or employee to disclose: (i) arrests that did not result in a conviction; (ii) first convictions for certain misdemeanors (drunkenness, simple assault, speeding, minor traffic violations, affray or disturbing the peace); (iii) convictions for misdemeanors where the date of conviction or completion of incarceration occurred five or more years from the date of the application unless there was an intervening conviction. These restrictions will remain in effect.

Using Criminal History Information

Although criminal history records may provide valuable insight into an applicant's background, employers must exercise caution when relying on such records. The Equal Employment Opportunity Commission (EEOC) and analogous state agencies have expressed renewed interest in this area and are closely scrutinizing employers' use of arrest and conviction records when making employment decisions. Littler recently published an update on the EEOC's position in this area, which provides employers with practical tips and recommendations for avoiding discrimination claims and other litigation related to background investigations and hiring decisions.

Implications for Employers in Massachusetts

Employers currently accessing CORI records or who intend to utilize the iCORI system should review and update their policies to ensure compliance with the new recordkeeping obligations and retention limits. In addition, all employers should review their policies to ensure that, prior to questioning an applicant about his/her criminal history or making an adverse decision based on criminal history information, the employer provides the applicant with a copy of any criminal history records in the employer's possession. Finally, employers who annually conduct five or more background investigations should implement a written policy that complies with the Act's minimum requirements. Littler will issue a new ASAP if the DCJIS releases further guidance or new regulations.

The use of criminal history information in employment is a rapidly developing area of the law. In addition to the EEOC's renewed interest, a growing number of states and municipalities have recently proposed or enacted legislation restricting employers from accessing and using criminal history information during the hiring process. Employers must exercise caution in this area and are advised to consult experienced employment counsel to review hiring and background investigation policies to ensure compliance with all applicable laws.

Christopher Kaczmarek is a Shareholder, and Carie Torrence and Joseph Lazazzero are Associates, in Littler Mendelson's Boston office. If you would like further information, please contact your Littler attorney at 1.888.Littler or info@littler.com, Mr. Kaczmarek at ckaczmarek@littler.com, Ms. Torrence at ctorrence@littler.com,or Mr. Lazazzero at jlazazzero@littler.com.