The DCJIS has implemented final, amended regulations for the Massachusetts Criminal Offender Record Information (CORI) law that was enacted in May of 2012. 803 CMR 2.00. The goal of CORI is to create more employment opportunities for job applicants with criminal records. However, the new regulations have serious impacts on Massachusetts employers, who continue to face challenges in their access to, and use of, criminal history information of their job applicants. Some of the more significant impacts of the final regulations are listed below.

Definition of CORI (§2.03)

The term “CORI” now has more specific inclusions and exclusions. CORI is limited to the information recorded as the result of criminal proceedings regarding individuals 18 years of age or older for offenses after September 18, 2013. For offenses prior to that date, CORI includes offenses for individuals 17 years of age or older.

Under the new regulations, CORI specifically excludes the following:

(a) information regarding criminal offenses or acts of delinquency committed by any individual younger than 18 years old unless the individual was adjudicated as an adult and except as otherwise noted;

(b) photographs, fingerprints, or other identifying data of an individual used for investigative purposes, provided the individual is not identified;

(c) evaluative information;

(d) statistical and analytical reports and files in which individuals are not directly or indirectly identifiable;

(e) intelligence information;

(f) information regarding any offenses which are not punishable by incarceration;

(g) public records as defined in the regulations;

(h) daily police logs;

(i) decisions of the Parole Board;

(j) published records of public court or administrative proceedings;

(k) published records of public judicial, administrative, or legislative proceedings;

(l) federal criminal record information; and

(m) anything otherwise excluded by law.

Expanded Definition of Employee (§2.02)

The term “employee” now covers much more than traditional employees and volunteers. It also covers contractors, subcontractors, vendors, and special state, county, and municipal employees. This change was intended to be more consistent with the CRRB interpretation and was meant to provide employers with authority to run background checks for all of those positions.

iCORI Agency Agreement (§2.04)

Employers are now required to enter into iCORI Agency Agreements prior to obtaining or renewing electronic access to the system. These agreements include employer representations that the employer has complied with CORI laws and regulations and that they maintain a current “need to know” list (maintained and updated every six months and available to DCJIS upon request) of staff that the employer has authorized to request, review, or receive CORI. Additionally, the requestor may only request the level of CORI access authorized under statute or by the DCJIS and they are liable for any violations of the CORI laws or regulations.

CORI Acknowledgment Forms (§2.09)

Prior to submitting a CORI request, an employer must obtain a signed CORI Acknowledgment Form for each subject to be checked and sign and date the Form certifying that the subject was properly identified with government issued identification. Sample forms are available on the DCJIS website. Employers may either use the sample form or use the same language on their own form. The Form will continue to be valid for one year; however, the prior 72-hour notice requirement to the individual has now been eliminated under the new regulations. All CORI Acknowledgment Forms must now also be destroyed along with CORI reports.

Storing and Retaining CORI (§2.12)

CORI can be stored in three ways, all with appropriate security measures:

(1) Hard copies are to be stored in a separate locked and secure location (eg. file cabinet), access to which is limited to employees who have been approved to access CORI.

(2) Electronically-stored CORI shall be password protected and encrypted. Password access must be limited to employees who have been approved to access CORI.

(3) CORI can now also be stored using cloud storage methods, if the following is adhered to:

(a) The requestor must have a written agreement with the cloud storage provider including the minimum security requirements published by the DCJIS (this agreement is subject to inspection by the DCJIS); and

(b) The cloud storage method must provide for encryption and password protection of all CORI. No matter what form of storage is used, CORI may not be retained longer than seven years from the date of final employment, volunteer, or licensing decision.

Pre-Adverse Action Notices (§2.20)

Before taking adverse action based on CORI, the requestor must follow these steps:

• Provide the subject with a pre-adverse action disclosure that includes a copy of the subject’s consumer report and a copy of A Summary of Your Rights Under the Fair Credit Reporting Act by meeting the subject in person, by telephone, by electronic communication, by fax, or by hard copy correspondence;

• Provide a copy of CORI or criminal history of the subject;

• Identify the source of the criminal history information;

• Provide a copy of the requestor’s CORI policy;

• Identify the specific information in CORI that is the basis for the potential adverse decision;

• Provide the subject an opportunity to dispute the accuracy of the information contained in CORI or criminal history information;

• When CORI is considered as a part of a potential adverse action, provide the subject with a copy of the DCJIS information regarding the process for correcting a criminal record; and

• Document all steps taken to comply with the regulations.

Obtaining CORI from Background Screening Companies (§11.06) 

Background screening companies are still permitted to obtain CORI on behalf of employers, with certain restrictions. Under the final regulations, background screening companies are prohibited from storing CORI results, unless they are authorized to act as the decision maker in the hiring process, which is extremely rare. Despite the impracticability, this restriction for employers remains in effect. Employers must also now provide a statement to the background screening company indicating whether the salary for the position is above or below $75,000.

Take Away for Massachusetts Employers Using CORI

Employers should review their CORI policies and procedures and update them accordingly to ensure compliance under the final regulations. Given the increased attention to the use of criminal history information in employment decisions and the restrictions placed upon employers in Massachusetts and other states, employers must be diligent in their actions and documentation, and are advised to consult their employment counsel before making any changes.