In May of 2012, Massachusetts passed the Criminal Offender Record Information (CORI) law which regulates how employers conduct criminal history checks. Most recently, the Massachusetts Department of Criminal Justice Information Services (DCJIS) issued amended CORI regulations that will require employers to modify their criminal history background check procedures.
New Definitions for Employee and CORI
The new CORI regulation expands the definition of employees by including volunteers, subcontractors, contractors, vendors, and special state, municipal, or county employees as those terms are defined in M.G.L. C. 268.
The original CORI regulations did not define CORI but only listed of examples of information included and excluded from CORI. The 2017 regulation defines CORI as “Records and data in any communicable form compiled by a Massachusetts criminal justice agency which concerns an identifiable individual and
The iCORI Agency Agreement
Requestors registering for CORI access must complete the iCORI Agency Agreement which
- Requestor agrees to comply with the CORI laws and regulations;
Requestorwill maintain an up to date “need to know” list,and provide all staff that request, review, or receive CORI with the CORI training materials;
Requestorwill only request the level of CORI access authorized under statute or by the DCJIS; and
- Requestors are liable for any violations of the CORI laws or regulations. Individual users of the requestor’s account may also be liable for said violations.
The new CORI regulation defines the “need to know” list as staff members who have been authorized to request, receive, or review CORI. The list must be updated every six months and must be made available to the DCJIS upon request.
CORI Acknowledgment Form
The DCJIS webpage provides the Model CORI Acknowledgment Forms with the required fields of information. Employers now have the option to use the published CORI Acknowledgment Forms or incorporate the language and information provided on the forms into their application.
The DCJIS also made the following changes regarding the use and disposal of the Acknowledgment Forms:
- Employers can now collect CORI
acknowledgmentforms electronically, including during an electronic application process;
- Employers can verify a person’s identity by examining a suitable form of government-issued identification containing a photograph of the person. If the person does not have an acceptable form of government-issued identification, the employer can use the birth certificate or social security card to as another form of identification;
- Under the 2012 CORI regulation, employers could submit a new request for a CORI check within one year of an individual
havingsigned the Acknowledgment Form,but were also required to provide the individual with written notice at least 72 hours before submitting the request. The new CORI regulation eliminated the 72-hours written notice and now allows employers to run an additional check, provided that the employer notifies the applicant on the Acknowledgment Form that a CORI check may be requested within a year; and
- CORI report and CORI Acknowledgment Forms must be appropriately destroyed by electronic or mechanical means, before disposing of, or repurposing, a computer or other device used to store CORI.
Cloud CORI Storage
Under the new regulation, CORI can be stored using cloud storage methods. In order for employers to store CORI in the cloud storage method, the employer must have a written agreement with the storage provider, and provide encryption and password protection of all CORI.
Additional Information for Pre-Adverse Action Notice
Before taking adverse action against an employment applicant or employee based on their CORI report or criminal history information obtained through DCJIS, the employer must provide the applicant
The regulations continue to require employers that conduct five or more criminal background checks to maintain a background check
Obtaining CORI from Background Screening Companies
The regulation continues to allow background screening companies to obtain CORI on behalf of employers, but the companies must maintain restrictions on the storage of this information. Specifically, the regulations continue to prohibit background screening companies from electronically or physically storing CORI results, unless the background screening company is authorized by the employer to act as the decision maker. In addition, the regulation states that the employer must provide a statement to the background screening company indicating whether the annual salary of the position for which the applicant is being screened is either above or below $75,000.
In the near future, DCJIS will be publishing an updated CORI Acknowledgment Form, a Model CORI Policy, cloud storage guidelines, and the iCORI Agency Agreement.
The 2017 amended CORI regulation is available here for review:
About Michael Klazema The author
Michael Klazema is Chief Marketing Technologist at EY-VODW.com and has over two decades of experience in digital consulting, online product management, and technology innovation. He is the lead author and editor for Dallas-based backgroundchecks.com with a focus on human resource and employment screening developments.