The federal Fair Credit Reporting Act (FCRA) doesn’t apply to background checks conducted in-house, but some state and local laws do, says Angela R. Matney, JD, an attorney with Hirschler Fleischer in Fredericksburg, VA. Employers must know what laws govern background checks in their particular state, Matney says. For example, California has some of the strictest background-check laws in the nation. Additionally, several jurisdictions have enacted “ban-the-box” laws that restrict what an employer can ask regarding an applicant’s criminal history.

“It’s important to be consistent and conduct the same types of background checks for similar positions across the board. Failing to do this can expose employers to claims of discrimination if their background checks are primarily focused on applicants and employees who are members of a particular protected class,” Matney says. “Additionally, when doing criminal searches, it’s a good idea to run as many local searches as possible, in addition to consulting national databases. This is because there is not one entity that has access to all criminal data.”

Employers always should verify past education and employment by contacting schools and employers, Matney advises. Taking extra time to do this at the outset can prevent an employer from making a costly hiring mistake.

Watch for Excluded Individuals

Healthcare employers always should search for an applicant on the List of Excluded Individuals/Entities (LEIE) of the U.S. Department of Health and Human Services Office of Inspector General and the General Services Administration. An employer who hires an individual who has been sanctioned or excluded from participation in federal healthcare programs can expose itself to fines and penalties, she says.

“The biggest mistakes that employers make are failing to obtain proper consent before conducting a background check, and failing to notify employees when information from a consumer report is used in an employment decision,” she says. “Under the FCRA, if an employer is going to obtain a consumer report about an applicant or employee, the individual must receive a document that contains a disclosure of this fact and nothing else. The authorization that the employee must sign can be included with the disclosure, but best practice is to have the disclosure and authorization on separate pages. The disclosure should not contain a release or any other extraneous information.”

Matney cautions that obtaining consent to a background check electronically may be challenged in the courts. Some employers have faced class action lawsuits because they used an “I agree” box to obtain an applicant’s consent to an online job application that included an authorization to obtain a consumer report buried in the application.

Also, be aware that “investigative reports” — reports based on personal interviews concerning a person’s character, general reputation, personal characteristics, and lifestyle — bring additional obligations under the FCRA and other laws. These obligations include providing written notice that you may request or have requested an investigative consumer report, and giving a statement that the person has a right to request additional disclosures and a summary of the scope and substance of the report, Matney explains.

“Employers also can expose themselves to liability if they are not careful in how they use social media in screening applicants. Appearing to rely on demographic information and conducting social media screens on some applicants but not others can lead to claims of discrimination,” Matney says. “There are also a number of laws that restrict when employers can ask an employee to give an employer access to a personal social media profile. These vary by state, so it’s crucial for employers to make sure they understand the law in each jurisdiction where they do business.”

Matney says another area where it’s possible to run afoul of the law is when the employer decides to act on information obtained from the background check. The FCRA and other screening laws contain strict requirements to notify individuals in advance of making an adverse employment decision. Notifying applicants in advance and providing them with a copy of the report on which the decision is based allows them to tell the employer if any information is incorrect.

The FCRA doesn’t state how far in advance notice must be given, but five days has been found to be reasonable, Matney says. Employers also must notify individuals after an adverse decision has been implemented. The FCRA has strict requirements for what this notice must contain, so employers should make sure the notice complies and deliver it in writing to have a record of their compliance, she says.

“Another potential error is failing to properly dispose of consumer reports. When the employer has finished using a consumer report, it must securely dispose of the report and any information gathered from it,” Matney says. “That can include burning, pulverizing, or shredding paper documents and disposing of electronic information so that it can’t be read or reconstructed.”

The liability for not doing all this correctly is significant. Damages available to individuals are capped at $1,000 for each FCRA violation, but courts can require employers to pay attorneys’ fees, court costs, and punitive damages, Matney says. Employers also face civil penalties for FCRA violations in actions brought by the consumer Financial Protection Bureau, which are set at $3,500 per violation.

“Criminal penalties can be imposed in extreme cases,” Matney says. “And if an employer has committed violations with respect to one applicant or employee, it’s likely that the employer has committed many similar violations with other employees.”

Matney notes that several employers, including UPS, Home Depot, and Marriott, have been hit with class action suits for failing to comply with the FCRA either due to lack of an effective consent, or for failure to notify individuals in advance of making adverse employment decisions.

In April 2017, an applicant sued Cathedral Health Care Centers, claiming that she was denied a job as a nurse because of a criminal background check that incorrectly contained multiple felony convictions. The complaint alleges that IDE Management failed to provide the applicant with a copy of the consumer report that was the basis for denying her application and refused to identify the screening agency that provided the report. Each of these actions is a violation of the FCRA, Matney notes.