Massachusetts Background Check Law: CORI, Adverse Action, and Penalties

Massachusetts background check law runs on two tracks at once: the Criminal Offender Record Information (CORI) system controls what a state criminal record check returns, and M.G.L. c. 151B, § 4 independently limits what employers can ask about or act on, even when information legally appears on a report. Employers who treat the CORI report as the whole rulebook get in trouble, because the anti-discrimination statute is stricter than the record system it sits alongside.

Criminal History Employers Cannot Ask About or Use

Under M.G.L. c. 151B, § 4(9), the following categories are off-limits at every stage of hiring and employment:

Arrests, detentions, or cases that did not result in a conviction, including cases continued without a finding of guilt.
A first conviction for drunkenness, simple assault, speeding, minor traffic violations, affray, or disturbance of the peace.
Any misdemeanor conviction where the conviction date or release from incarceration was three or more years ago, unless the person has picked up another conviction within that window.
Any record sealed or expunged under Chapter 276.

These restrictions are absolute. An applicant who declines to disclose any of this information cannot be penalized, and the statute protects them from perjury claims for omitting records they have a right to withhold.¹

Here is the trap. Under standard CORI access, misdemeanor convictions show up for five years after the disposition date or release from incarceration.² But 151B forbids employers from acting on misdemeanors older than three years. So a four-year-old misdemeanor can appear on the report and still be legally untouchable. Rejecting an applicant on that basis is a compliance violation regardless of what the report displayed.

Criminal History Questions on Job Applications

Massachusetts was an early Ban the Box state. M.G.L. c. 151B, § 4(9½) prohibits employers from asking about criminal history on an initial written job application.¹ A checkbox or question about criminal records on the application itself is a violation.

Two narrow exceptions exist. An employer may include criminal history questions on the initial application when the position carries a mandatory or presumptive disqualification under federal or state law based on certain convictions, or when the employer is legally forbidden from hiring individuals with specific types of convictions.¹

After the initial application, employers may inquire about convictions that fall within the permissible timeframes. State guidance calls for an individualized assessment weighing the nature and age of the offense against the specific responsibilities of the job rather than a blanket rule.³

How the CORI System Works

The Department of Criminal Justice Information Services (DCJIS) runs the system. Employers cannot pull reports at will. They must register annually for an iCORI account, which requires a federal tax identification number and, where applicable, other license numbers.⁴

Most private employers get “standard access,” which returns:

Pending criminal charges, including cases continued without a finding until dismissed.
Misdemeanor convictions from the past five years, measured from disposition or release from incarceration, whichever is later.
Felony convictions from the past ten years, on the same measurement.
Convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses punishable by state prison time, which remain visible regardless of age unless sealed.

Expunged records never appear at any access level.²

Some employers qualify for “required access,” a broader tier for organizations that must comply with specific statutory or regulatory requirements regarding criminal records: hospitals, banks, schools, camps, daycare centers, nursing homes, and assisted living facilities. Required access reaches back to the individual’s 17th birthday.⁵

What Employers Must Do Before Using a Record

Massachusetts adds a step that catches many employers off guard. Under M.G.L. c. 6, § 171A, if you have an applicant’s criminal history from any source, you must give the applicant a copy of that information before asking them a single question about it.⁶ The rule applies whether the record came from DCJIS or from another source.

Any employer that runs five or more criminal background checks per year must also maintain a written CORI policy covering how the employer notifies applicants of potential adverse decisions, provides copies of records, and explains the process for correcting errors.⁶

When a record does appear and disqualification is on the table, state guidance expects an individualized assessment. Relevant factors include the circumstances of the offense, the person’s age at the time, the number of convictions, post-conviction employment history, rehabilitation efforts, and character references.³ Applying a blanket “no felons” rule is exactly the kind of practice that generates discrimination complaints.

The Adverse Action Process

Two sets of rules run in parallel when an employer plans to reject an applicant based on background information.

The federal Fair Credit Reporting Act applies whenever a third-party consumer reporting agency runs the check. Employers must provide a clear, standalone written disclosure that a background report will be obtained and get written authorization first. That disclosure document must consist solely of the disclosure; burying it inside a longer application violates the statute. If the report contains something that might drive a rejection, the FCRA requires a two-step process: a “pre-adverse action” notice with a copy of the report and the federally prescribed “Summary of Your Rights,” a reasonable waiting period (generally at least five business days) for the applicant to dispute inaccuracies, and only then a final adverse action notice.⁷

Massachusetts stacks its own requirements on top when the decision involves CORI or other criminal history. Under 803 CMR 2.20, before taking adverse action the employer must:

Notify the applicant in person, by phone, fax, email, or hard copy.
Provide a copy of the specific criminal history being relied on.
Identify the source of that information.
Point to the specific items in the record forming the basis for the potential adverse action.
Give the applicant a chance to dispute the accuracy of the information.
Provide DCJIS contact information for correcting CORI errors.
Provide the employer’s written CORI policy where applicable.
Document each step taken to comply.

The state process is more granular than the federal one. Massachusetts requires the employer to pinpoint the exact information triggering the decision and hand over its own CORI policy.⁸ Following only the federal checklist leaves state liability intact.

Storing and Retaining Records

CORI information is sensitive material and must be handled that way. Hard copies belong in a separate locked location such as a file cabinet, with access limited to approved employees. Electronic copies must be password-protected and encrypted, again restricted to authorized personnel.⁹

Employers must maintain an up-to-date list of employees who need CORI access and provide those employees with the DCJIS training materials posted on the agency’s website.¹⁰ An untrained employee handling CORI creates liability for the organization.

The FCRA does not set a specific retention period for background check documents. Because the FCRA’s statute of limitations runs up to five years, the standard practice is to keep reports and related paperwork for at least that long as proof of compliance.

Penalties for Non-Compliance

Enforcement comes from three directions.

The Massachusetts Attorney General’s Office investigates Ban the Box and CORI violations, and past actions have produced fines and compliance agreements with businesses that asked about criminal history on initial applications. The AG has authority to investigate, issue sanctions, and require corrective measures.⁶

Applicants who believe they were discriminated against based on criminal history can file with the Massachusetts Commission Against Discrimination. Criminal record is a protected class under c. 151B, so using prohibited criminal history information in a hiring decision is treated as unlawful discrimination. MCAD investigations can lead to conciliation, compensatory damages, and corrective orders.¹¹

On the federal side, willful FCRA violations carry statutory damages of $100 to $1,000 per violation with no proof of actual harm required, plus possible punitive damages and reasonable attorney’s fees.¹² These cases often become class actions when the same flawed process gets applied to many applicants. Negligent violations expose the employer to actual damages plus costs and reasonable attorney’s fees.¹³ A sloppy disclosure form is negligence; skipping disclosure altogether looks willful.

Industries With Enhanced Access

Schools, daycare centers, camps, nursing homes, assisted living facilities, hospitals, and banks operate under the required-access tier, which returns a broader set of criminal history dating back to the applicant’s 17th birthday. Some of these positions also require fingerprint-based background checks that run through both state and FBI databases, going beyond the name-based CORI system.⁵ The rules on adverse action, applicant notification, and written CORI policies still apply. More information does not mean fewer obligations in how it is handled.

Safe Harbor for Direct CORI Users

The 2010 CORI reform law created a safe harbor that shields employers from negligent hiring claims and certain discrimination claims when specific conditions are met. To qualify, the employer must have obtained the CORI directly from DCJIS, made the hiring decision within 90 days of receiving the report, and complied with DCJIS regulations on verifying the applicant’s identity.⁵ This is a real incentive to use the official system rather than relying on third-party databases that may be incomplete or outdated.

Salary History and Background Checks

Since July 1, 2018, the Massachusetts Equal Pay Act has barred employers from seeking a prospective employee’s salary or wage history before making a compensation offer.¹⁴ MEPA is a pay equity law, not a background check statute, but it intersects with screening in practice. Employers using third-party services should confirm those services do not collect or report compensation data as part of employment verification. If a verification returns salary information before an offer, the employer is in MEPA territory whether or not the information was requested.

1
General Court of Massachusetts. Massachusetts General Laws Chapter 151B, Section 4
2
Legal Information Institute. Massachusetts Code 803 CMR 2.05 – Levels of Access to CORI
3
Mass.gov. Guide to Criminal Records in Employment and Housing
4
Mass.gov. iCORI Registration Requirements
5
Mass.gov. Implementing CORI Reform
6
General Court of Massachusetts. Massachusetts General Laws Chapter 6, Section 171A
7
Federal Trade Commission. Background Checks on Prospective Employees: Keep Required Disclosures Simple
8
Legal Information Institute. Massachusetts Code 803 CMR 2.20 – Adverse Employment Decision Based on CORI
9
Legal Information Institute. Massachusetts Code 803 CMR 2.14 – Storage and Retention of CORI
10
Legal Information Institute. Massachusetts Code 803 CMR 2.04 – iCORI Registration
11
Mass.gov. MCAD Complaints of Discrimination
12
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
13
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
14
Mass.gov. Learn More Details About the Massachusetts Equal Pay Act