Preemployment Screening and Testing: Massachusetts

Preemployment Screening and Testing requirements for other states

Federal law and guidance on this subject should be reviewed together with this section.

Authors: Catherine E. Reuben and David B. Wilson, Hirsch Roberts Weinstein LLP


  • Massachusetts has detailed requirements for employers using criminal history records for employment purposes. See The CORI Reform Law; Arrest and Conviction Records; Performing Background Checks.
  • There are some best practices employers should follow when conducting background checks to minimize the risk of litigation. See Suggested Practices; Third Party Background Checks.
  • Massachusetts law prohibits employers from using polygraph tests for employment purposes. See Polygraph Tests.
  • Employers may have applicants undergo medical examinations in certain limited circumstances. See Medical Testing.
  • Massachusetts law generally permits private employers to require drug testing of applicants where the employer can demonstrate a legitimate business need for the testing that outweighs the invasion into the employee's privacy. See Drug Testing.
  • Massachusetts prohibits employers from requiring employees to undergo genetic testing. See Genetic Testing.

The CORI Reform Law

In 2010, then Massachusetts Gov. Deval Patrick signed a sweeping overhaul of the various state laws that govern the use of Criminal Offender Record Information (CORI), the intention being to balance the need of employers to make informed hiring decisions with an approach that maintains job opportunities for ex-offenders.

"Ban-the-Box" Provision

The CORI Reform Law effectively "bans the box," referring to the box on many employment applications that applicants are asked to check if they have a record of certain criminal offenses. It is unlawful for a Massachusetts employer to inquire about a job applicant's criminal history on its initial written application form. (Certain employers that are statutorily prohibited from hiring ex-offenders are exempt from this provision.) +ALM GL ch. 151B, § 4 (9 ½).

The definition of employer for purposes of the "ban the box" law contained in +MGL c. 151B, § 4(9 ½) and the restrictions on criminal history inquiries apply to private employers with six or more employees. However, the laws regarding how an employer obtains and uses CORI (e.g., acknowledgement forms, record retention, secondary dissemination logs, pre-adverse action notice, training, etc.) apply to all employers regardless of size.

Subsequent Inquiries

The law does not prohibit certain inquiries about criminal history later in the application process, after an interview has been conducted. Note, however, that employers are barred under the Fair Employment Practices Act from inquiring about certain types of crimes. See Arrest and Conviction Records.

Any employer in possession of an individual's criminal record information must provide the individual with a copy of the record: (i) prior to any questioning concerning his or her criminal history; and/or (ii) if an adverse decision is made on the basis of the criminal record. +ALM GL ch. 6, §172(c). The regulations impose additional disclosure requirements on employers prior to taking adverse action. See Performing Background Checks.

Employers Conducting Five or More Background Inquiries

Employers that annually conduct five or more criminal background investigations will be required to maintain a written policy with certain required provisions.

The Massachusetts Department of Criminal Justice Information Services (DCJIS) has issued a model CORI policy for employers which includes provisions related to how CORI screening is conducted, who shall have access, CORI training, use of CORI in background screening, procedures for verification of a subject's identity, factors to be considered in determining suitability, notifications to be provided in the event of an adverse decision, and maintenance of secondary dissemination logs.

Protection from Liability

Employers will be protected from liability for discriminatory hiring practices for failure to hire a person based on erroneous CORI that is requested and received from the DCJIS if the employer would not have been liable had the information been accurate. In addition, the employer must have made the decision within 90 days of obtaining the CORI and followed DCJIS policies and procedures for verifying the information in order to avoid liability.

This "safe harbor" does not apply if the employer receives the criminal record information from a source other than DCJIS, like a third party background check company. +ALM GL ch. 6, § 172(e)

Look-Back Period

Also significant, the look-back period for criminal offender record information available to employers with standard access to CORI has been reduced from 15 to 10 years for felony convictions, and from 10 to five years for misdemeanors.

Despite this provision, convictions for murder, voluntary manslaughter, involuntary manslaughter and sex offenses that are punishable by a term of incarceration in state prison shall remain permanently in the database and shall be available unless sealed. +ALM GL ch. 6 § 178.

Record Retention, Storage and Disposal

Employers must store hard copies of CORI in a separate locked and secure location, such as a file cabinet, and limit access to those with a need to know. CORI stored electronically must be password protected and encrypted.

Under new regulations issued in 2017, CORI may now be stored using cloud storage methods, but only if the requestor has a written agreement with the provider, including the minimum security requirements published by DCJIS, and the storage method provides for encryption and password protection.

Unless otherwise required by law or court order, an employer must discard CORI obtained from DCJIS no more than seven years from an individual's last date of employment or volunteer service, or from the date of the final decision regarding the individual, whichever is later. Employers must destroy hard copies of CORI by shredding them and electronic copies by deleting them from the hard drive on which they are stored and from any back-up system. +ALM GL ch. 6, 44 172(f).

Secondary Dissemination Logs

Employers are required to keep a "secondary dissemination log" for a period of one year following the dissemination of any individual's criminal offender record information. The log must include:

  • The name of the individual;
  • Their date of birth;
  • The date of the dissemination;
  • The name and organization of the person who received the information;
  • and
  • The purpose of the dissemination. +ALM GL ch. 6, 172(f).

DCJIS Audits

Employers that access CORI are subject to audit by DCJIS, which may inspect any CORI-related documents, including acknowledgement forms, secondary dissemination logs, the employer's policy, and documentation of adverse employment actions based on CORI.


Employers that violate the CORI laws can be subject to criminal penalties. In addition, the law provides individuals with a private right of action.

Arrest and Conviction Records

The state's Ban-the-Box law makes it unlawful for an employer to inquire about a job applicant's criminal history on its initial written application form. +ALM GL ch. 151B § 4(9 ½). The law allows the employer to inquire about certain criminal history later in the application process, i.e., in an interview or by means of a post-interview supplemental application.

Employers, however, may not request, keep a record of, or discriminate against any individual by reason of his or her failure to furnish information regarding:

  • An arrest, detention or disposition regarding any violation of the law in which no conviction resulted;
  • A first conviction for any of the following misdemeanors: drunkenness, simple assault, speeding, minor traffic violations, affray or disturbance of the peace, or
  • Any conviction of a misdemeanor where the date of such conviction or the completion of any resulting period of incarceration, whichever date is later, occurred five or more years prior to the date of application for employment, unless the person has been convicted of any other offense within the immediate past five years. +ALM GL ch. 151B § 4(9).

Mandatory CORI Checks

Under Massachusetts law, persons seeking employment or volunteer positions in certain occupations must be subject to pre-employment CORI checks. Note also that the Massachusetts Executive Office of Health and Human Services (EOHHS), the Board of Early Education and Care (EEC), the Department of Mental Health (DMA) and other agencies have specific regulations related to CORI. Employers that are licensed and/or funded by such agencies must comply with these regulations as well as those issued by DCJIS.

Businesses that are legally required to conduct CORI checks include, but are not limited to, the following:

School Employees, Volunteers and Contractors

All public and private schools are required to obtain CORI reports for any current or prospective employee, or volunteer of the school department, who may have direct and unmonitored contact with children, including any individual who regularly provides school-related transportation to children. This requirement includes employees of taxicab companies providing transportation services to schools, where the employee may have direct and unmonitored contact with children. +ALM GL ch. 6 §172I.

Schools are also required to conduct fingerprint-based state and national background checks.

Employees and Volunteers Providing Services for Elderly and Disabled Persons

Entities and municipalities providing services in a home or in a community-based setting for elderly or disabled persons, or referring workers to perform these services, must obtain CORI reports for all current or prospective employees, volunteers, service providers and any persons referred who have direct or indirect contact with elderly or disabled persons or access to such persons' personal information. +ALM GL ch. 6 §172C. Fingerprint-based state and national background checks are now required as well.

Long-Term Care Facilities

Long-term care facilities, assisted living residences and continuing care facilities must obtain CORI reports for all current or prospective employees, volunteers or service providers who have direct or indirect contact with elderly or disabled persons or access to such persons' personal information. +ALM GL ch. 6 §172E.

Camps for Children

Camps for children must obtain CORI reports for all employees or volunteers prior to the start of employment or volunteer service. +ALM GL ch. 6 §172G.

Children's Programs

Entities and organizations primarily engaged in providing activities or programs to children 18 years of age or less must obtain CORI reports prior to accepting any person as an employee, volunteer, vendor or contractor. +ALM GL ch. 6 §172H.

Performing Background Checks

Virtually all background checks initiated by employers and conducted by third parties on current or prospective employees fall under the purview of the federal Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681A and the Massachusetts credit reporting laws, M.G.L. c. 93 § 50, each of which contains detailed anotice and authorization provisions with which employers must comply. See Recruiting and Hiring > Preemployment Screening and Testing > Complying With the Fair Credit Reporting Act (FCRA).

It is unlawful for an employer to request or require that an individual provide a copy of their own CORI report. Instead, the employer may only obtain this information through the specific procedures authorized in the CORI Reform law.

These procedures include obtaining a written authorization form from the subject, and taking steps to verify the identity of the person submitting the form by reviewing a form of government-issued identification. If a requestor is unable to verify a subject's identity and signature in person, the subject may submit a completed form acknowledged by the subject before a notary public.

In addition, employers accessing CORI from DCJIS must now sign an iCORI Agency Agreement, in which the employer agrees, among other things, to maintain an up to date "need to know" list of staff with access to CORI. This list must be updated at least every six months.

CORI Acknowledgment Forms

Under amended regulations issued in 2017, CORI acknowledgment forms are now valid for one year from the date of signature, and employers may submit a new request for CORI within that year so long as the Acknowledgment Form states that the employer may do so. This provision does not apply, however, if the individual is no longer employed by the employer that obtained the form. +ALM GL ch. 6, §172(c)

CORI Policy

Employers that annually conduct five or more criminal background investigations are required to maintain a written policy that provides that, in addition to any obligations required by the DCJIS by regulation, the employer will:

  • Notify the applicant of the potential of an adverse decision based on criminal offender record information;
  • Provide a copy of the criminal offender record information and the policy to the applicant; and
  • Provide information concerning the process for correcting a criminal record.

DCJIS has issued a model CORI policy for employers containing the above and other provisions, including provisions related to how CORI screening is conducted, who shall have access, CORI training, use of CORI in background screening, procedures for verification of a subject's identity, factors to be considered in determining suitability, handling of adverse decisions, and maintenance of secondary dissemination logs.

Under the CORI Reform Law, in connection with any decision regarding employment, the employer must provide the applicant with the criminal history in the employer's possession, whether obtained from DCJIS or any other source, prior to questioning the applicant about his/her criminal history. +ALM GL ch. 6, § 172(c).

Prior to taking any adverse action against an individual based on the content of a criminal background check, the employer must provide the person with a copy. The regulations additionally require that the employer:

  • Notify the individual of the potential adverse employment action;
  • Provide a copy of the CORI report;
  • Provide a copy of the employer's CORI policy;
  • Identify the information in the individual's CORI report that is the basis for the potential adverse action; (e) provide the applicant with the opportunity to dispute the accuracy of the information in the CORI report,
  • Provide the individual with a copy of DCJIS information regarding the process for correcting CORI; and
  • Document all steps taken to comply with these requirements.

These requirements apply whether the employer obtained the CORI from DCJIS or some other source.

Suggested Practices

As a practical matter, background checks should be performed on all current or prospective employees in a given job classification to avoid an inconsistent practice that could lead to a discrimination allegation.

The EEOC recognizes that selection procedures can be an effective means of determining which applicants are best suited for a particular job, but cautions that the use of these tools can violate antidiscrimination laws if they are used to intentionally discriminate against those in protected classes, or even if they have an unintended disparate impact on a protected class.

To minimize the potential for disparate impact claims, employers should not automatically reject any candidate with a criminal record (unless required to do so by law or regulations) but should instead consistently consider the factors set forth in the DCJIS model criminal background check policy, namely:

  • Relevance of the record to the position sought;
  • The nature of the work to be performed;
  • Time since the conviction;
  • Age of the candidate at the time of the offense;
  • Seriousness and specific circumstances of the offense;
  • The number of offenses;
  • Whether the applicant has pending charges;
  • Any relevant evidence of rehabilitation or lack thereof; and
  • Any other relevant information, including information submitted by the candidate or requested by the organization.

Unionized employers should remain mindful that a duty to bargain may arise concerning conducting background checks on current members of a bargaining unit.

Third Party Background Checks

Employers sometimes mistakenly think that the new CORI law does not apply if they obtain criminal history information from a third party consumer reporting agency (CRA), rather than obtaining it themselves directly from the DCJIS. Some key issues to keep in mind when using a CRA include the following:

  • Under the amended regulations issued in 2017, if the CRA is accessing criminal history information directly from DCJIS, as opposed to public court records, then the employer must authorize the CRA to act as a decision-maker with respect to whether to hire or accept the individual.
  • If an employer wishes to authorize a CRA to accept CORI from DCJIS, the employer must provide a statement to the CRA indicating whether the annual salary for the person being screened is either above or below $75,000. If the salary is above $75,000, the CRA will get broader access.
  • The requirements imposed on employers prior to taking adverse action against an individual based on the content of a criminal background check set forth above apply even if the CRA does not obtain the criminal history information from DCJIS.

Polygraph Tests

Massachusetts employers are prohibited from using, administering or requiring job applicants or employees to take lie detectors tests. +ALM GL ch. 149, § 19B(2)(b). All employment applications in Massachusetts must include the following statutorily-mandated statement reflecting this law:

"It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability."

Medical Examinations

Medical examinations may be required of applicants only after a conditional job offer has been made, and then must be limited to determining if the applicant, with reasonable accommodation, is capable of performing the essential functions of the job. +ALM GL ch. 151B, § 4(16).

Medical examinations may not be selectively administered to certain applicants, but must be required of all applicants for a particular job category. The evaluating physician should be provided with a copy of the job description to understand the essential functions of the position and to help determine if the applicant is capable of performing those essential functions with or without reasonable accommodation.

The employer must pay for the cost of an examination by any employer-designated physician and must provide a copy of the medical report to the applicant. +ALM GL ch. 149, § 159B and +ALM GL ch. 149, § 19A.

HIV or AIDS Testing

Massachusetts employers may not require an HTLV-III antibody or antigen test (also known as an HIV or AIDS test) as a condition of employment. +ALM GL ch. 111, § 70F.

Drug Testing

As part of the preemployment screening process, employers cannot ask questions about the use of legal drugs because such inquiries may reveal an applicant's disability. Employers may inquire, however, about an applicant's current use of illegal drugs.

In addition, there is no statutory prohibition on a private employer's right to require post-offer drug testing of applicants as a condition of employment. However, Massachusetts courts have found drug testing to violate the Massachusetts Privacy Act in certain contexts. In order to conduct random drug testing of its employees, a private Massachusetts employer should be prepared to show that it has a legitimate interest in its employees being drug free. See Folmsbee v. Tech Tool Grinding & Supply, Inc. +417 Mass. 388 (1994); Webster v. Motorola, Inc., +418 Mass. 425. (1994). Simply seeking to provide a general "drug free workplace" will not suffice. See Employee Management > Employee Discipline > Testing Employees for Alcohol and Drug Use.

Medical Marijuana

Massachusetts legalized medical marijuana through a November 2012 ballot initiative. The law eliminates civil and criminal penalties for the use of marijuana by people with cancer, Parkinson's Disease, Hepatitis C, AIDS and other conditions determined by a doctor.

However, Massachusetts does not require employers to reasonably accommodate the use of medical marijuana while at work. HR also should be aware that the courts in states where medical marijuana is legal generally have held that despite such laws, having one's name on a medical marijuana state registry does not justify failing an employer's drug test.

Recreational Marijuana

Effective December 15, 2016, recreational marijuana use also is legal in Massachusetts. Adults 21 and over may possess up to 10 ounces of the drug inside a residence and up to one ounce outside of a residence. However, marijuana use remains prohibited in public places or any other location where smoking is banned.

In additon, the law explicitly states that an employer is not required to permit or accommodate drug use in the workplace. Thus, an employer remains free to maintain a drug-free workplace policy prohibiting marijuana.

Genetic Testing

Massachusetts employers may not use or collect genetic information about job applicants or employees in any way and may not, as a condition of employment, require genetic testing of an applicant or solicit or require any information from which a genetic condition can be inferred. +ALM GL ch. 151B 4(1).

Employers also should be aware of the Genetic Information Nondiscrimination Act (GINA) which restricts their acquisition and disclosure of genetic information subject to limited exceptions. See Recruiting and Hiring > Preemployment Screening and Testing > Genetic Testing.

Future Developments

There are no developments to report at this time. Continue to check XpertHR for the latest information on this and other topics.

Additional Resources

Recruiting and Hiring > Preemployment Screening and Testing

Recruiting and Hiring > Interviewing and Selecting Job Candidates

Recruiting and Hiring > Recruiting