As an employer, you have several obligations to fulfill so that you stay within the laws as set out in the Fair Credit Reporting Act:

• If you hire an outside company to perform a background check, you must get the applicant or employee’s written permission. This permission must be on a separate form (not part of the employment application or other documents).
• If you want to include medical information in a background check, you must give the applicant or employee specific notice of that.
• Always keep in mind that the FCRA guidance is the minimum required! Check your state and other local regulations for additional requirements.
• If you decide not to hire someone (or take other adverse action) based on a background screening report, you need to first give the person a ‘pre-adverse action disclosure‘ along with a copy of the report and a ‘summary of rights.’ This applies even if the background report information is not the sole reason for the adverse action (such as deciding not to hire). Once you actually take an adverse action, the FCRA requires you to give a second notice that identifies the report source (the screening company or investigator) and explains the it was not the preparer of the report who made the adverse employment decision. This second notice must also include a notice of the right to dispute the accuracy or completeness of the report.