New York, NY

A number of new regulations come into effect in MA in May 2012 having to do with the use of CORI reports for criminal records in the State of MA.  CORI stands for the Criminal Offender Record Information files maintained by the State of MA but is NOT the same as criminal record checks conducted through the MA courts. 

CORI has always contained multiple restrictions on the type of information that will be released to MA employers and effective in May 2012, the following general rules come into play. That includes a "ban the box" provision that has already been mandated in the State.

The CORI search is NOT the same as a county criminal record search, which is based on records in the county or counties where a person has lived and is usually more complete in the type of information that will turn up in the search because there are no restrictions, other than what has always been restricted under the FCRA regulations.  As a general rule, the only cases that will not turn up in a county search are those that were sealed or involve juvenile offenders.

• Employers who order 5 or more CORI reports annually must have a written policy outlining the method and use of the records.

• Written notification requirements for employers who take adverse action based on the records, including a requirement to provide the applicant with a copy of the report. This requirement is regardless of whether the employer obtains the information directly, or from a third party CRA (Consumer Reporting Agency) such as Fidelifacts.

• Employers using a CRA must make certifications to the CRA that it is compliant with CORI including providing required disclosures.

• Employers must register for an account on the CORI system, and undergo training and retraining as required.

• When employers obtain CORI information directly, they are required to provide consent forms for each applicant, and maintain those forms for one year from the date signed. In addition, the employer must confirm the identity of the applicant by checking government-issued ID, and certify that the applicant has been properly identified.

• Employers are subject to storage rules, and must store copies of CORI reports in a secured, locked location with limited employee access. Electronic CORI records must be password-protected and encrypted and may not be stored using public storage methods.

• Employers may not retain CORI reports for longer than seven years. If an employer disseminates CORI outside of its organization, the employer must maintain a detailed log for at least one year for audit reasons and may be subject to audits and complaints for failure to comply with the law.

• Penalties for violations of the CORI Law include civil fines of up to $5,000 for each knowing violation of the CORI law, and some violations could lead to criminal prosecution.

Employers cannot require an individual to provide a copy their own CORI report for employment purposes.

In addition, most employers are not required to use the CORI system. However, those that do use the CORI system should always also use the county search system, which is in many cases more complete than the CORI search and is not impeded by the restrictions on what the CORI search can release.  

 

The information contained in this e-mail transmission is client privileged and CONFIDENTIAL. This information is intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately at 800-678-0007. We will arrange for the return to us of the documents transmitted.

 

"Your judgment is no better than your information"