TL;DR / Key Takeaway
Massachusetts employer background checks require navigating the state’s Criminal Offender Record Information (CORI) system alongside standard FCRA obligations — and the two frameworks don’t always align cleanly. If your organization hires in Massachusetts, you need a CORI-certified process, updated policies reflecting the state’s ban-the-box and inquiry restrictions, and documented adverse action procedures that satisfy both state and federal law. Getting this wrong exposes you to Massachusetts Commission Against Discrimination (MCAD) complaints, CORI system decertification, and FCRA class action risk.
What HR Teams Need to Know
Massachusetts operates one of the most tightly regulated criminal background check environments in the country. The Criminal Offender Record Information (CORI) system, administered by the Massachusetts Department of Criminal Justice Information Services (DCJIS), controls how employers access and use criminal history data for candidates and employees within the Commonwealth.
Unlike states where you can rely primarily on third-party consumer reporting agencies (CRAs) pulling multi-jurisdictional criminal records, Massachusetts layers an additional state-specific access and certification requirement on top of your existing FCRA-compliant screening vendor relationship. If your HR team hires for Massachusetts-based positions — even remotely, if the role’s duties are performed in-state — you’re operating under CORI rules regardless of where your company is headquartered.
This matters for three operational reasons. First, CORI access requires certification: you cannot simply request a criminal background check the way you would in most states. Second, Massachusetts law dictates when in your hiring process you’re permitted to ask about criminal history, independent of what your CRA report shows. Third, the state imposes specific data handling, storage, and destruction requirements that differ from generic FCRA recordkeeping practices.
For compliance officers, this is a jurisdiction where a “one national policy” approach to background screening creates real exposure. Your Massachusetts hiring workflow needs its own documented sub-process.
Detailed Analysis
How CORI Access Works
CORI is not a public records database in the way many state criminal repositories are. Access is tiered and controlled by DCJIS through a certification process. There are three primary access levels:
| Access Level | Who Qualifies | What It Reveals |
|---|---|---|
| Standard Access | Most private employers | Felony convictions (unlimited lookback for certain serious offenses), misdemeanor convictions within applicable timeframes |
| Volunteer/Housing Access | Nonprofits, housing authorities | Similar to standard, tailored to placement context |
| ICORI (Individual Access) | Employers hiring for certain regulated/vulnerable-population roles | Broader access including some sealed-record exceptions where statutorily permitted |
Most private-sector employers use iCORI, the online portal that requires organizational certification before any employee within your company can submit CORI requests. Certification involves designating a CORI Officer responsible for training, access control, and compliance oversight — this is not optional paperwork, it’s an ongoing accountability function.
Many organizations satisfy this requirement by routing Massachusetts criminal history checks through an FCRA-compliant background check provider that maintains its own CORI certification and DCJIS relationship, rather than certifying every internal HR user individually. This is generally the more scalable approach for multi-state employers, since it centralizes compliance ownership with your vendor while your internal team focuses on adjudication and adverse action.
Ban-the-Box and Inquiry Timing
Massachusetts law prohibits employers from including criminal history questions on the initial written job application for most positions. This is the state’s ban-the-box provision, and it’s broader than many employers assume — it applies regardless of company size in most cases, with limited exceptions for positions where a federal or state law creates a mandatory disqualification (certain financial services, healthcare, and childcare roles).
Practically, this means your applicant tracking system (ATS) intake forms for Massachusetts requisitions cannot include a criminal history checkbox or narrative question at the application stage. You may inquire later in the process — typically after an initial interview — but the exact permissible timing has been the subject of ongoing legal interpretation, so conservative employers wait until a conditional offer is extended.
Lookback Periods and Record Types
Massachusetts also restricts what criminal history information is even reportable, independent of what your CRA’s national database search might otherwise surface:
- Misdemeanors: Generally not reportable if the record is more than three years old (measured from disposition or release, whichever is later), unless the individual was convicted of another offense in the interim.
- Felonies: Generally not reportable if more than seven years old, subject to the same interim-conviction exception.
- Sealed and expunged records: Not accessible or usable in employment decisions, with narrow statutory exceptions for specific licensed occupations.
This creates a compliance gap risk: your national CRA report might return a record that Massachusetts law prohibits you from considering. Your adjudication matrix needs a Massachusetts-specific filter, not just your standard multi-jurisdictional criminal history policy.
CORI vs. Standard FCRA Screening: Key Differences
| Factor | Standard FCRA Criminal Check | Massachusetts CORI |
|---|---|---|
| Access requirement | CRA relationship + FCRA disclosure/authorization | CRA/vendor CORI certification + FCRA compliance |
| Ban-the-box application | Varies by state/city | Statewide, applies to initial application |
| Lookback restrictions | Varies (some states cap at 7 years for FCRA reporting) | 3 years (misdemeanors) / 7 years (felonies), state-mandated regardless of FCRA reporting limits |
| Data retention | Per FCRA and internal policy | DCJIS-mandated secure storage, restricted retention, and destruction requirements |
| Individualized assessment | Required under EEOC guidance | Required under both MCAD guidance and EEOC guidance |
Compliance Considerations
Layered Regulatory Exposure
Massachusetts employers face compliance obligations from three overlapping sources: the federal FCRA, EEOC enforcement guidance on the use of criminal history under Title VII, and Massachusetts-specific CORI and ban-the-box statutes. A background check process that satisfies FCRA alone is insufficient here — you need parallel compliance tracks.
FCRA obligations that still apply in full:
- Standalone disclosure and authorization forms (no liability waivers embedded)
- Pre-adverse action notice with a copy of the report and summary of rights
- Reasonable waiting period before final adverse action (five business days is the commonly used benchmark, though FCRA doesn’t specify an exact number)
- Final adverse action notice with CRA contact information and dispute rights language
Massachusetts-specific obligations layered on top:
- CORI certification maintained by whoever pulls the report (you or your vendor)
- No criminal history question on the initial application
- Individualized assessment before denying employment based on criminal history, documented in writing
- Providing the applicant a copy of their CORI report if you take adverse action based on it — this must include specific language mandated by DCJIS, not just your CRA’s standard notice
- Secure destruction of CORI data within statutorily defined timeframes (generally seven years from the date of decision, or per updated DCJIS guidance)
The Individualized Assessment Requirement
Both MCAD and EEOC guidance require that you evaluate criminal history in context rather than applying blanket exclusions. Your assessment should document:
1. The nature and gravity of the offense
2. Time elapsed since the offense or completion of sentence
3. The nature of the job held or sought
Massachusetts employers who deny employment based on CORI results without this documented analysis are exposed to MCAD discrimination claims, particularly where blanket criminal history exclusions disproportionately affect protected classes.
Multi-State Employer Risk
If your organization screens candidates across multiple states, the temptation is to apply your most permissive state’s process everywhere for administrative simplicity. Resist this in Massachusetts. DCJIS actively audits CORI-certified entities, and decertification cuts off your access to criminal history data for all Massachusetts hires — a significant operational disruption for any employer with ongoing Massachusetts headcount.
Action Steps for Your Team
Immediate (this quarter):
- Audit your ATS application forms for any Massachusetts requisitions to confirm no criminal history questions appear pre-interview
- Confirm your background check vendor’s CORI certification status and request documentation
- Designate or confirm your CORI Officer — typically a compliance or senior HR role — and ensure training records are current
- Review your adjudication matrix to build in Massachusetts-specific lookback filters (3-year misdemeanor / 7-year felony)
Near-term (this year):
- Build a standardized individualized assessment template your hiring managers and HR business partners use whenever a Massachusetts candidate’s CORI report shows a reportable record
- Update your adverse action letter templates to include DCJIS-mandated CORI-specific language, distinct from your generic FCRA adverse action notice
- Train hiring managers on permissible interview-stage timing for criminal history inquiries
Ownership: This should sit jointly with HR compliance/legal (policy design, MCAD exposure) and your talent acquisition operations team (ATS configuration, hiring manager training). Your background check vendor relationship manager should be your point of contact for CORI certification status and DCJIS regulatory updates.
FAQ
Does CORI apply if my company is headquartered outside Massachusetts but hires remote employees who live there?
Yes, if the employee’s duties are substantially performed in Massachusetts, CORI and Massachusetts ban-the-box rules generally apply regardless of your headquarters location. Multi-state employers should treat Massachusetts as a distinct compliance jurisdiction in their screening policy, not an extension of their default state process.
Can we ask about criminal history during a phone screen before an in-person interview?
Massachusetts law prohibits criminal history questions on the initial written application, but the permissible timing afterward is not perfectly bright-line. Most compliance-conscious employers wait until after the first interview or at the conditional offer stage to minimize risk.
What happens if DCJIS finds we mishandled CORI data?
Violations can result in decertification of your CORI access, fines, and civil liability, and decertification halts your ability to run Massachusetts criminal background checks entirely. Repeated or willful violations increase both regulatory and reputational exposure.
Do sealed or expunged Massachusetts records ever appear on a national background check?
They shouldn’t through proper CORI channels, but candidates sometimes have out-of-state records or older multi-jurisdictional database hits that a national CRA search surfaces despite Massachusetts sealing rules. Your adjudication process needs a compliance check specifically for Massachusetts residency to catch this discrepancy before it affects a hiring decision.
Is a background check vendor’s CORI certification the same as their FCRA compliance?
No — these are separate certifications addressing different regulatory frameworks. Confirm your vendor holds both, since FCRA compliance alone does not authorize CORI data access in Massachusetts.
Conclusion
Massachusetts background screening compliance isn’t a single checkbox — it’s a parallel track that runs alongside your standard FCRA program, with its own certification requirements, timing restrictions, and documentation standards. HR teams that treat Massachusetts as “just another state” in their national screening policy are the ones most likely to face MCAD complaints or DCJIS decertification. The fix is procedural: confirm your vendor’s CORI certification, fix your application timing, and build individualized assessment documentation into your adjudication workflow.
BackgroundChecker.com helps HR teams manage exactly this kind of jurisdictional complexity, running FCRA-compliant background checks with built-in adverse action automation and the state-specific compliance guardrails multi-state employers need — including CORI-certified access for Massachusetts hiring. Whether you’re screening a handful of Massachusetts-based hires or running a national program with thousands of annual checks, our platform integrates with your existing ATS/HRIS and gives your compliance team the documentation trail regulators expect. Request a demo or start screening today to see how a purpose-built screening workflow reduces your Massachusetts compliance risk.
—
This article is for informational purposes and does not constitute legal advice. Consult qualified legal counsel for compliance guidance specific to your organization.
