Final Massachusetts CORI Regulations Issued on May 25, 2012, Instructing Employers on How to Comply with the Newest Requirements in the CORI Reform Statute

For employers who have been waiting for final guidance from the Commonwealth on the new requirements imposed under the Massachusetts CORI reform statute, the last piece of the puzzle is now in place. As we reported previously, major changes to the Massachusetts Criminal Offender Record Information ("CORI") law were scheduled to go into effect on May 4, 2012. In March of this year, the Department of Criminal Justice Information Services ("DCJIS") issued proposed regulations implementing the new law. Following a public hearing and submission of written comments, DCJIS issued final regulations on Friday, May 25, 2012. Although the final regulations contain some minor changes, they do not differ substantially from the proposed regulations. A summary of the substantive changes to the regulations is set forth below. Employers who conduct criminal background checks in Massachusetts should review their current policies and procedures to ensure they are in compliance with the new law and regulations. Now that the final regulations have issued, these compliance measures should be implemented as soon as possible.

Final Regulations: Key Changes Made

Definitions - 803 CMR 2.02

The final regulations revise the definition of an "employment applicant" to specifically state that employment applicants "shall also include volunteer applicants." The statute allows employers to obtain CORI information regarding volunteers, and both the statute and regulations make clear that the procedural safeguards set forth in the statute apply to volunteers.

The definition of "youthful offender" was eliminated from the final regulations. In Section 2.03(5)(a) of the proposed regulations, this term was used in reference to information that was excluded from the definition of information that constitutes "CORI." Specifically, this section stated that CORI did not include "information regarding criminal offenses or acts of delinquency committed by any individual before the individual attained the age of 17 and for which the individual was not charged as a youthful offender." This section now omits the reference to "youthful offender," and states that the information will not constitute CORI if the criminal offenses or acts of delinquency were committed before the individual attained the age of 17 "unless the individual was adjudicated as an adult . . . ."

Access to Criminal Offender Record Information - 803 CMR 2.05

The regulations specify the types of information that employers can receive from DCJIS. All employers are entitled to receive "Standard Access," which includes information about: (i) all pending criminal charges, including cases continued without a finding of guilt until such charges are dismissed; (ii) all felony convictions for 10 years following the date of disposition or release from incarceration, whichever is later; (iii) all misdemeanor convictions for 5 years following the date of disposition or release from incarceration, whichever is later; and (iv) all convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses punishable by a term of incarceration in state prison, unless such conviction has been sealed. DCJIS also provides additional CORI information to employers who have a need for such information in order to comply with a particular statute, regulation, or accreditation requirement. DCJIS has established four levels of "Required Access" depending on the underlying basis mandating that the employer obtain CORI.

Both the final and proposed regulations specifically detail the information available to employers depending on the level of "Required Access" granted. The proposed regulations did not specify that employers entitled to Required Access or Open Access (which allows limited information to be provided to anyone) would receive information concerning "all convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses, punishable by a term of incarceration in state prison, unless sealed." The final regulations explicitly include access to this information for all levels of access.

CORI Acknowledgment Forms - 803 CMR 2.09(9)

Employers who obtain information from DCJIS must submit a CORI Acknowledgment Form (available on the DCJIS web-site) signed by the subject of the CORI check to DCJIS prior to obtaining an individual's CORI. A CORI Acknowledgement Form is valid for one year from the subject's having signed the form or until the subject's employment ends, whichever comes first. The proposed regulations provided that an employer could submit a new CORI request within one year of the subject's having signed the Form, as long as the employer provided written notice to the subject at least 24 hours before submitting the request. The final regulations also allow employers to submit an additional request within one year, but require the employer to provide written notice at least 72 hours prior to submission.

Retention of CORI - 803 CMR 2.11(4)

The final regulations clarify the time frame in which employers may retain CORI by adding the following italicized language to this provision: "Each employer or governmental licensing agency shall not retain CORI for longer than seven years from the date of employment or volunteer service, or from the date of the final employment or licensing decision of the requestor regarding the subject, whichever occurs later." While this language clarifies that an employer should utilize the later of the two dates, it does not clarify if the "date of employment" is measured from the date of hire or termination. The CORI statute provides, however, that an employer may not maintain a copy "for more than 7 years from the last date of employment . . . or from the date of the final decision" and thus, indicates that the date of termination is the start of the 7-year period. Employers should note that this portion of the statute applies only to CORI information obtained from DCJIS, not other criminal history information obtained from a source other than DCJIS.

Employer Obligation to Provide Notice and Disclosure of Criminal Information - 803 CMR 2.13

The proposed regulations state that employers must "provide a copy of the CORI information regarding a subject to the subject: (i) before asking the subject any questions regarding the subject's criminal history; and (ii) before making an adverse employment decision . . . based on the subject's CORI." The final regulations specify that an employer must provide a copy of the CORI information "or other criminal history information and the source of the other criminal history information" prior to asking questions or taking adverse action. The additional language clarifies that an employer must provide a copy of any criminal history information it obtains regardless of the source of that information prior to questioning an applicant or taking adverse action based on criminal history information. Employers using a third party background screening company also have additional requirements under the CORI law and the federal Fair Credit Reporting Act.

CORI Policy Requirement - Section 803 CMR 2.15

The final regulations attempt to clarify who must maintain a "CORI" policy. The proposed regulations stated that [a]ny employer . . . that submits five or more CORI requests annually shall maintain a CORI policy." The final regulations have been revised to state that "[a]ny employer . . .that annually conducts five or more criminal background investigations, whether CORI is obtained from DCJIS or any other source, shall maintain a written CORI policy, which must meet the minimum standards of the DCJIS model CORI policy." This language more closely reflects the statutory language and suggests that employers who obtain criminal history information from a source other than DCJIS must have a policy. The use of the term CORI within this provision still leaves some doubt as to whether an employer who obtains only non-CORI information is required to have a policy. The model policy is available on DCJIS' web-site.

Issues Not Addressed in the Final Regulations

DCJIS held a public hearing regarding the proposed regulations on March 30, 2012, and subsequently received and published 77 pages of comments from various groups and individuals in response to the proposed regulations. These comments addressed a wide variety of issues, from the fees that DCJIS will charge for access to the agency's new iCORI system to the provisions of the regulations addressing Consumer Reporting Agencies. The final regulations do not address many of the issues raised in those comments, leaving a number of unanswered questions. For example:

The National Association of Professional Background Screeners proposed that DCJIS clarify the definition of "CORI" in the regulations to make it express that the term does not include information that is available as a matter of public record from courts or other agencies. The agency did not specifically respond to this suggestion.

The Massachusetts Bankers Association suggested that DCJIS include in the regulations greater specificity as to how it would determine the level of Required Access to CORI that would be provided to various categories of employers. DCJIS did not address this issue in the final regulations. The agency did, however, issue an informational document on May 4, 2012 (see here), which specifies the level of access available to certain types of employers but does not explain how those assignments were made.

The Massachusetts Camping Association suggested that DCJIS include a provision in the regulations that would expressly allow employers to verify the identity of individuals being screened based on facsimiles or photocopies of identifying documents, subject to later verification, in order to decrease the burden and expense on employers who screen applicants and volunteers living abroad or in distant parts of the country. The agency did not respond to this comment.

The above are merely a few examples that illustrate the potential for differing interpretations of many provisions of the final regulations implementing the changes to the CORI law. Ultimately, these issues may be addressed in proceedings before DCJIS or in the courts. In the meantime, employers conducting background screening should vet their policies and practices carefully to minimize the exposure to enforcement action by DCJIS or lawsuits brought by private parties under the new law.