Compliance with iCORI Regulations

Notice to Employers Using GHRR to Obtain Massachusetts Criminal Offender Record Information from the iCORI System

You can download a PDF version of this article by clicking here.

The Commonwealth of Massachusetts revised and updated its regulations governing how employers can access and use Criminal Offender Record Information (“CORI”) obtained from the Commonwealth’s online iCORI system.  This revision and update provides employers with an opportunity to re-assess their current compliance with iCORI regulations and – where appropriate – to modify their compliance practices to conform with the revised and updated regulations.

But first - a refresher on iCORI.

Criminal records can be obtained two different ways in Massachusetts.  One can go to the courthouse where the record was created and is currently maintained, or one can consult the statewide database hosted and maintained by the Department of Criminal Justice Information Services (the “DCJIS”).  This database is known as “iCORI.”  To access iCORI, an employer must register with the DCJIS.  There are three levels of access to iCORI information: required, standard, and open access.  Generally, employers are entitled to the standard level of access, which includes the last five years of misdemeanor convictions, the last ten years of felony convictions, and pending cases.  Employers may choose to authorize a consumer reporting agency like GHRR to obtain the iCORI information on its behalf.  But doing so does not relieve the employer of its obligation to comply with iCORI regulations.

Please note: Under the revised regulation, employers will be required to re-register each year with iCORI.

Now, lets look at five key iCORI mandates. 

1. Your iCORI Policy

All employers using iCORI must maintain a written CORI policy which must meet the minimum standards of the DCJIS Model CORI Policy.  A copy of the model policy can be found here: https://www.mass.gov/files/documents/2017/09/19/Model%20CORI%20Policy_1.pdf.

2. iCORI Consent

The DCJIS requires employers to obtain the applicant’s signature to a very specific form published by the Department.  It is called the “Criminal Offender Record Information (CORI) Acknowledgement Form” and it can be found at the Commonwealth’s website at www.mass.gov[1] or by accessing this link https://www.mass.gov/doc/cori-acknowledgement-form-for-cras-0/download. You must be careful to use version of the form that authorizes a consumer reporting agency to act on your behalf as an intermediary.

Please note: When having an applicant complete the CORI Acknowledgement Form, you must verify the applicant’s identity much in the same manner as you would verify his identity when completing the federal Form I-9.  Preference should be given to government-issued photo IDs.

This CORI Acknowledgement Form must be used in addition to, and not in lieu of, the standard FCRA consent form.  Put differently, you must have both consent forms on file before you order GHRR to obtain iCORI information from the DCJIS.

3.  Due Process Rights

Massachusetts gives specific due process rights to applicants before an employer can act on iCORI information.  An employer must follow these nine steps before it can take adverse action against an applicant:

  • Notify the applicant of the potential adverse employment action;
  • Provide a copy of a document titled, “Information Concerning the Process in Correcting a Criminal Record. which can be found here: http://www.mass.gov/eopss/docs/chsb/cori-process-correcting-criminal-record-2012.pdf;
  • Provide a copy of the document titled, “A Summary of Your Rights Under the Fair Credit Reporting Act” which can be found here: https://files.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf.
  • Provide a copy of the iCORI information to the applicant;
  • Identity the source of the information;
  • Provide a copy of your CORI Policy;
  • Identify the criminal history information that is the basis for the potential adverse action;
  • Provide the applicant with an opportunity to dispute the accuracy of the criminal history information; and lastly,
  • Document all the steps you took to comply with these requirements.

Please note: If an applicant wants to dispute iCORI information, she will need to contact the DCJIS directly.  The iCORI regulations will not permit GHRR to handle this dispute; however, we would like to know if a dispute is pending, so please do direct your applicants to let us know when they are disputing iCORI information.

4. Adverse Action

When your company has determined an applicant is not suitable for the position based on the information contained in the iCORI system, it should send the following letter to the applicant: the “Massachusetts Department of Criminal Justice Information Services MODEL Adverse Action Notification Letter” which can be found here:  https://www.mass.gov/doc/adobe-version-of-model-adverse-action-notification-letter/download?_ga=2.92201242.1622075336.1651670579-2008406294.1651670579.

Please note: This letter must be sent in addition to, and not lieu of, the standard FCRA adverse action letter.  You should be sending two adverse action letters when taking action based upon iCori information.

5. Document Retention

iCORI regulations impose document retention requirements on employers.  CORI Acknowledgement Forms should be kept for one year from the date of the applicant’s signature.  Electronically-stored Cori must be password protected and encrypted.  Password access should be limited only to those employees who have been approved to access iCORI information.  And iCORI information should not be retained for longer than (1) seven years from the date of employment, or (2) from the date of final employment, whichever occurs last.

This publication is provided only for educational purposes; it should not be relied upon as legal advice, and it should not be used, in whole or in part, as a basis for establishing employment practices or policies, nor should it be used for resolving disputes or managing risk. Every reader’s circumstances are unique and legal advice should be obtained only from a lawyer with whom the reader has established an attorney-client relationship. Copyright 2022 © Global HR Research. All material contained within this publication is protected by copyright law and may not be reproduced without the express written consent of GHRR.

[1] All documents are training materials are located at www.mass.gov and at iCORI Training Documents | Mass.gov.