FCRA Basics for Employers: Disclosure, Authorization and What a CRA Does

The FCRA (15 U.S.C. 1681 and following) was passed to protect the accuracy, fairness and privacy of information that third parties collect about people. It is best known for credit reports, but it reaches much further. Under the law, a consumer report includes information a CRA provides about a person's “character, general reputation, personal characteristics, or mode of living” that is used for employment purposes. That covers criminal record searches, employment and education verifications, motor vehicle records and similar checks when they come from a screening company.

The FCRA applies when all three of these are true:

• You get the information from a third party that assembles or evaluates it for others (a CRA).
• The information is about an individual (an applicant, employee or, in many cases, an independent contractor).
• You use it for employment purposes: hiring, promotion, reassignment or retention.

Company size does not matter. A five-person business ordering one report has the same core obligations as a large employer. Many states and some cities add their own rules on top of the FCRA, so the federal law is the floor, not the ceiling.

A CRA is any person or company that regularly assembles or evaluates information on consumers to furnish consumer reports to third parties for a fee. A background screening company like SaffHire is a CRA. Under the FCRA, a CRA must:

• Confirm a permissible purpose. A CRA may furnish a report for employment only when the employer has certified that it made the required disclosure, obtained authorization and will follow the law (15 U.S.C. 1681b(b)(1)).
• Follow reasonable procedures to assure maximum possible accuracy of the information in the report (15 U.S.C. 1681e(b)). In practice that means careful identity matching and verifying records at the source when needed.
• Respect reporting time limits. Under 15 U.S.C. 1681c, most adverse information older than seven years, including arrest records that did not lead to a conviction, may not be reported. Records of criminal convictions are not subject to that federal seven-year limit. The limits do not apply for a job with an annual salary reasonably expected to be $75,000 or more. Some states, including Texas, have their own rules.
• Take extra care with public records used for employment (15 U.S.C. 1681k): either notify the consumer when reporting public record information likely to hurt their job chances, or keep strict procedures to make sure the record is complete and up to date.
• Handle disputes. If the applicant disputes something in their file, the CRA must reinvestigate, generally within 30 days, and correct or delete information that is inaccurate or cannot be verified (15 U.S.C. 1681i).

What a CRA does not do is make the hiring decision. The employer decides whether the information is relevant to the job. The CRA's job is to report accurate, lawful information.

Before ordering a report, you must give the applicant a “clear and conspicuous” written disclosure that a consumer report may be obtained for employment purposes. The disclosure must be “in a document that consists solely of the disclosure” (15 U.S.C. 1681b(b)(2)(A)(i)). This is the single most litigated part of employment screening, and most problems come from adding things that do not belong.

The applicant must authorize the report in writing before you request it (15 U.S.C. 1681b(b)(2)(A)(ii)). An electronic signature counts. A few practical points:

• Get authorization before the order, never after. A report ordered first and authorized later is a problem you cannot fix.
• Keep the signed disclosure and authorization with the applicant's file so you can prove it later.
• If you plan to rescreen employees during employment, say so in the authorization. The FCRA lets the authorization cover future reports when that is clear.
• For commercial drivers regulated by the DOT, the FCRA has a narrower set of rules that can allow oral, written or electronic consent in some situations. Most employers should still use the standard written process.

Before a CRA can release an employment report, the employer must certify that it has made the disclosure, obtained authorization, will not use the information in violation of equal employment opportunity laws, and will follow the FCRA's other employer requirements (15 U.S.C. 1681b(b)(1)). This usually happens once, when you set up your account with the screening company, and is repeated or confirmed in the ordering workflow.

Read that certification. It is a legal promise, and it is the reason a CRA is allowed to give you the report at all.

1. 1

   Set up your account

   Complete the CRA's employer certification and decide which checks fit each role.
2. 2

   Make a conditional decision about the candidate

   Many employers wait until a conditional offer to screen, and some state and local rules require that.
3. 3

   Give the standalone disclosure

   On its own page or screen, with no extra terms.
4. 4

   Get written authorization

   Signed on paper or electronically, before anything is ordered.
5. 5

   Order the checks

   The CRA searches the sources, verifies records and assembles the report.
6. 6

   Review the report consistently

   Apply the same job-related standards to every candidate in the same role, and keep records.

When ordered from a CRA, all of these are consumer reports:

• Criminal background checks, including county criminal searches and the national criminal database search
• Employment verification and education verification
• Motor vehicle record (MVR) checks
• Healthcare sanctions and OIG exclusion checks

Not sure which searches to include? Our guide to types of criminal background checks explains when to use county, state, federal and national database searches.