In accordance with the above provisions, employers may not keep CORI records more than seven years after the last date of employment of the worker or the date of the final decision not to hire a candidate. Hard copies of CORI must continue to be kept in closed and secure locations, and electronic copies must be password protected and encrypted. However, the new rules now allow cloud storage methods. If the CORI is to be stored in the cloud, the employer: (1) must have a written agreement with the cloud storage provider that sets out the minimum security requirements published by the DCJIS; and (2) ensure that the cloud method provides encryption and password protection for all CIROs. The new rules require employers to enter into an iCORI Agency Agreement for continued access to the database. This agreement obliges the employer to confirm (1) ongoing compliance with CORI laws and regulations; (2) maintain a recent “need to know” list of staff who solicit and verify CORI; (3) confirm that the employer will only request an authorized level of access to the CORI; and (4) acknowledge that the employer (including individual users of the account) may be held liable for violations of the rules and rules. In recognition of the evolution of technology, DCJIS now allows employers to store CORI with cloud storage methods. DCJIS requires employers who use cloud storage to have a written agreement with the provider and that the encryption storage and password protection method precedes. Initially, the rules required that all cloud storage agreements be verified and approved by DCJIS. After receiving public comments, DCJIS has amended the proposed Regulations to remove this requirement and will instead issue guidance on these cloud storage agreements and will require employers to provide these agreements to DCJIS upon request. The newly adopted provisions require employers to conclude an iCORI agency agreement before receiving and/or renewing electronic access to the iCORI system. This agreement requires the employer to: approve records and data in all transferable forms compiled by a Massachusetts criminal justice authority and relating to the nature or decision of a criminal complaint, arrest, investigation, other judicial proceedings, previous hearings pursuant to M.G.L.c 276, §58A, during which the accused was detained prior to trial or released under the conditions of M.G.L.c 276. § 58A (2), conviction, detention, rehabilitation or acquittal.

To access the records through iCORI, employers must receive a signed confirmation form from the employee or candidate, which authorizes the employer to view the records. . . .