6/8/2012 New CORI Regulations Are Here: How They Affect Employers


The Department of Criminal Justice Information Services (DCJIS), the agency responsible for administering the Massachusetts CORI (Criminal Offender Record Information) statute, recently issued the final version of regulations.  Round two of the Massachusetts CORI reform legislation went into effect on May 4, 2012, changing who has authorized access to CORI and how CORI will be accessed.  With the new provisions, DCJIS has launched a new CORI request service online called ‘iCORI’ that will allow individuals and organizations to request and obtain Massachusetts criminal offender record information over the Internet.

Prior to the May 4th updates, private employers could only have access to CORI through a certification process.  Employers, volunteer organizations, landlords, and individuals can now request, pay for, and receive CORI online using the iCORI online service, but subject to new requirements and mandates. Employers have “Standard Access” to CORI info on any criminal charges pending as of the date of the request; felony or misdemeanor convictions; convictions that have not been sealed; and any murder, manslaughter, and sex offenses. Certain employers who must comply with statutory, regulatory or accreditation requirements regarding employees’ criminal records will have “Required Access” to CORI for additional adult CORI information.

In many respects, the new regulations have spurred more questions than answers. Some of the questions we are hearing include what is actually covered by the new law, does it apply to all employers or just those in Massachusetts, and how do we resolve conflicts of law questions when the new regulations appear to conflict or require more restrictive policies than other statutes like the Fair Credit reporting Act? Many of those questions will need to be addressed in the courts or through legal opinions, but here are some take-aways.  This overview is by no means exhaustive.

•    Employers who conduct five or more criminal background investigations per year must have a CORI Policy. The policy must include that the employer will: (a) notify the applicant if a potentially adverse decision may be made based on the criminal record information; (b) provide the applicant a copy of the criminal record information obtained and a copy of the employer’s criminal record policy; and (c) provide information concerning the process for the applicant to correct his or her criminal record. DCJIS is required to maintain a model CORI policy at the DCJIS website.
•    While most of the provisions apply only to iCORI users, the regulations seem to indicate that new adverse action requirements and new requirements to provide candidates with a copy of the employer’s policy apply to all users of CORI.
•    CORI checks are permitted by a CRA only after a CORI Acknowledgement Form has been completed; and the CORI subject has signed an authorization from.
•    Employers must verify a subject’s identity if a criminal record is received from the DCJIS, and the information is to be closely compared with the information on the CORI Acknowledgement Form and any other identifying information provided by the applicant.
•     If the information in the CORI record provided does not exactly match the identification information provided by the applicant, a determination is to be made by an individual authorized to make such determinations based on a comparison of the CORI record and documents provided by the applicant.
•    An employer (or other decision-maker), must provide a copy of any criminal record information in the employer’s possession before questioning an applicant about his/her record. (§19)
•    When an adverse decision is made based on a criminal record, the employer (or other decision-maker) must give the applicant a copy of the record the decision is based on. (§19)
•    Where adverse action is contemplated based on the results of a criminal history background check (regardless of source), the applicant will be notified immediately, provided with the source(s) of the criminal history,  and given an opportunity to dispute the accuracy of the CORI record.
•    When adverse decisions are based on CORI, subjects shall be provided a copy of DCJIS’ Information Concerning the Process for Correcting a Criminal Record. See: http://www.mass.gov/eopss/docs/chsb/cori-process-correcting-criminal-record.pdf
•    CORI subjects have a right to inspect and obtain a copy of their own records. (§35)
•    Section 21 covers reporting rules of CORI for convictions, non-convictions, pending cases, and special cases for higher level offenses.
•    Both a ‘DCJIS Model CORI Policy’ available at http://www.mass.gov/eopss/docs/chsb/dcjis-model-cori-policy-may-2012.pdf  and  a ‘CORI Acknowledgment Form’ are made available.  The CORI Acknowledgement form is required of organizations using a Consumer Reporting Agency (CRA) for CORI criminal background checks: http://www.mass.gov/eopss/docs/chsb/fillable-cori-acknowledgment-form-organizations-using-a-cra.pdf
•    Reports may not be stored physically or electronically unless it is by a “decision maker,” creating a problem for CRA’s who are required to retain information to comply with provisions of the Fair Credit Reporting Act.

Items  EXCLUDED from the definition of CORI are the following:
o    information regarding criminal offenses or acts of delinquency committed by
any individual before  the individual attained the age of 17 unless the individual was adjudicated as an adult;
o    photographs, fingerprints, or other identifying data of an individual used for
investigative purposes, provided the individual is not identified;
o    evaluative information;
o    statistical and analytical reports and files in which individuals are not directly
or indirectly identifiable;
o    intelligence information;
o    information regarding any offenses which are not punishable by incarceration;
o    public records as defined in M.G.L. c. 4, § 7(26);
o    daily police logs;
o    decisions of the Parole Board;
o    published records of public court or administrative proceedings;
o    published records of public judicial, administrative, or legislative
o    federal criminal record information; and
o    Anything otherwise excluded by law.

If you conduct more than 5 criminal checks in the Commonwealth of Massachusetts per year, or if you are a CRA conducting criminal searches in Massachusetts, contact your legal counsel to determine what changes are required to your current processes and forms.  Violations are punishable by fines up to $5000, with additional penalties and potential criminal charges if the violations are found to be willful or criminal. The new CORI regulations are available here.