On August 6, 2010, Governor Patrick signed into law new legislation that made significant changes to the Criminal Offender Record Information (CORI) law. On May 4, 2012, new CORI provisions go into effect. Employers should be aware of some of the key provisions:
Access for More Employers, but Access to Less Information
All employers may obtain criminal record information to evaluate applicants, current employees (full- and part-time), interns, and volunteers via a new, secure, web-based service called iCORI, which requires annual registration. All employers will have “standard access,” which will allow employers to obtain criminal record information about pending criminal charges, misdemeanor convictions from the past five yers (previously ten years), felony convictions from the past ten years (previously fifteen years), and convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses.
Acknowledgment Forms
Prior to submitting a CORI request, employers must obtain a signed Acknowledgment Form from the applicant or employee.
Data Storage, Retention, and Destruction
Employers must store hard copies of CORI data in locked and secured locations. Electronically stored CORI data must be password protected and encrypted. Employers cannot retain a terminated employee’s CORI information for more than seven years from the last day of employment. Similarly, employers cannot retain an applicant’s information for more than seven years from the date of the decision not to hire. Employers must destroy hard and electronic copies after seven years.
Dissemination Requirements and Restrictions
Employers must provide applicants or employees with a copy of their criminal record information before questioning them about their criminal history. Employers may share CORI information only with people in the organization that have a need to know and the authorization to review the contents of the CORI for the purpose of evaluating an individual’s application for employment.
Written Policy Requirements
Employers that submit five or more CORI requests annually must maintain a written CORI policy.
Use in Employment Decisions
Before making an adverse employment decision based on an applicant’s CORI, employers must (1) provide the applicant a copy of their criminal record information; (2) provide the applicant a copy of the employer’s CORI policy, if applicable; (3) identify the information in the CORI that is the basis for the adverse action; (4) provide the applicant the opportunity to dispute the accuracy of the information contained in the CORI; and (5) provide the applicant information regarding the process for correcting criminal record information. Employers must document all steps taken to comply with these requirements.
In light of these new regulations, employers must carefully review their existing practices and procedures to ensure compliance with these new regulations.