Massachusetts CORI Updated Regulations

May 25th, 2017 | Sterling

In May of 2012, Massachusetts DCJIS issued updated regulations on how employers and consumer reporting agencies could access CORI records. The DCJIS recently amended these regulations. Please find below a summary of the changes.

CORI Acknowledgement forms

  • Cori forms can be collected electronically
  • Employers must verify the identity of individuals by reviewing a photo id. If the person does not have a photo id the employer can review a birth certificate or social security card. If this is not possible to do in person the individual can submit a notarized Acknowledgement form.
  • Cori forms continue to be valid for one year, but the requirement to provide notice of another request during this time period has been removed.
  • In addition to destroying all CORI reports, employers now must destroy all CORI acknowledgement forms. (Seven years from the date of employment or volunteer service, or from the date of the final employment, volunteer, or licensing decision of the requestor regarding the subject, whichever occurs later.

Employees

  • The regulations take a broader definition of an employment applicant. This definition now includes volunteers, subcontractors, contractors or vendor applicants and individuals applying for a special state, municipal, or county employee positions.
  • An employer cannot utilize criminal information before the individual turned 18 unless they were tried as an adult.

ICORI Agency Agreement

  • Employers must enter into an ICORI Agency Agreement and the agreement must include the following:

    1. The employer will comply with the CORI laws and regulations
    2. It will maintain an up to date “need to Know” list of staff that is authorized to request, receive or review CORI information
    3. It will request the level of CORI access authorized under the statute or by DCJIS
    4. The employer and users of the account will be liable for any violation of the CORI law or regulations

Utilizing a Consumer Reporting Agency

  • Consumer reporting agencies are still prohibited from retaining the results unless the employer has authorized them as a decision maker
  • Employers utilizing a consumer reporting Agency must provide a statement to the CRA indicating whether the annual salary will be over $,000.00

Storing CORI in the Cloud

  • The new regulations permit cloud storage.
    1. The employer must have a written agreement with the provider
    2. The cloud method must have encryption and password protection

Adverse Action

  • Prior to taking adverse action, employers should notify the applicant with the information that is the basis for the potential adverse action regardless of the source
  • Employers now only need to provide the DCJIS Information concerning the process in correcting a criminal record to when CORI information is part of the adverse action

    • The new regulations can be located here.

    The information contained herein is for informational purposes only. Clients are encouraged to consult with their legal counsel on the impact of these new regulations. Sterling is not a law firm, and none of the information contained in this notice is intended as legal advice.

    Sterling is not a law firm. This publication is for informational purposes only and nothing contained in it should be construed as legal advice. We expressly disclaim any warranty or responsibility for damages arising out this information. We encourage you to consult with legal counsel regarding your specific needs. We do not undertake any duty to update previously posted materials.