Most small business owners assume background checks are a simple checkbox in the hiring process. They’re not — and getting them wrong can expose your company to federal lawsuits, state penalties, and lost candidates you actually wanted to hire.
What law governs background checks at the federal level?
The Fair Credit Reporting Act (FCRA) is the baseline federal law that controls how employers can use background check reports obtained through a third-party consumer reporting agency (CRA). It requires you to give candidates a clear written disclosure — a standalone document, not buried in the application — and get their written authorization before you pull any report. If you decide not to hire someone based on what you find, FCRA mandates a two-step adverse action process: first send a pre-adverse action notice with a copy of the report and a summary of rights, wait a reasonable period (typically five business days in practice), then send a final adverse action notice if you’re moving forward with the decision. Skip any of those steps and you’re looking at statutory damages of $100 to $1,000 per violation, plus potential class action exposure. The Federal Trade Commission publishes plain-language guidance on FCRA obligations that’s worth bookmarking.
Does Florida add any extra requirements on top of FCRA?
Florida doesn’t have a statewide “ban the box” law that applies to private employers, which means businesses in Naples, Fort Lauderdale, and elsewhere in the state can generally ask about criminal history on a job application if they choose to. That said, Florida Statute 112.011 limits how state and local government agencies use criminal records, and certain licensed industries — healthcare, childcare, financial services — face mandatory background check requirements under Florida law regardless of what FCRA says. If you’re running a home health agency in Collier County or a financial advisory firm in Broward County, you have additional screening obligations layered on top of the federal floor.
What about Fort Lauderdale and Miami-Dade specifically?
Florida preempts local governments from passing their own ban-the-box ordinances for private employers, so Fort Lauderdale and Miami-Dade don’t have the kind of city-level restrictions you’d find in Philadelphia or Los Angeles. That’s a meaningful operational simplicity for businesses that hire across multiple Florida markets — one consistent policy can work statewide for private sector employers. However, if your company operates across state lines, say you’re headquartered in Fort Lauderdale but have remote employees in California or New York, you absolutely need to layer in those states’ rules, which are considerably more restrictive.
What can you actually screen for, and what’s off-limits?
Under FCRA, consumer reporting agencies can report criminal convictions going back seven years for positions paying under $75,000 annually. For roles above that threshold, there’s no seven-year cap on criminal records. Arrests without convictions are technically reportable under federal law, but several states prohibit employers from using them in hiring decisions, so check before you act on an arrest record. Credit history checks are permissible federally but restricted in at least 11 states and a handful of cities — typically to roles where financial responsibility is directly relevant, like a CFO position or a job handling cash. Social media screening is a gray area: you can look at publicly available profiles, but doing so risks exposing yourself to information about protected characteristics (race, religion, pregnancy status) that you’re not supposed to factor into hiring decisions. The safer practice is to have someone outside the hiring chain do any social review and report back only on job-relevant conduct.
How should you handle the “individualized assessment” requirement?
The Equal Employment Opportunity Commission (EEOC) requires that when you screen out a candidate based on criminal history, you conduct what’s called an individualized assessment — you can’t apply a blanket “no felonies ever” policy, because that can create disparate impact discrimination against protected groups. The assessment means weighing the nature of the crime, how long ago it occurred, and how relevant it is to the specific job. A 10-year-old DUI probably shouldn’t disqualify someone from a data entry role; it might legitimately disqualify someone applying to drive your company vehicle. Document this reasoning for every adverse decision you make based on a criminal record. The EEOC’s enforcement guidance on arrest and conviction records lays out exactly what factors to weigh.
What’s the right process for small businesses that can’t afford an HR department?
Use a reputable third-party background check vendor that is formally accredited by the Professional Background Screening Association (PBSA). A good vendor will handle the FCRA-compliant disclosure and authorization forms, flag which searches are appropriate for your state, and generate the adverse action notices automatically. Expect to pay $30 to $75 per candidate for a standard package covering criminal history, identity verification, and employment verification. That cost is negligible compared to the liability of a bad hire or an FCRA lawsuit. Build a simple internal checklist: written disclosure signed, authorization obtained, report reviewed, individualized assessment documented if criminal history is present, adverse action notices sent if applicable. Five steps, written down and followed every single time.
Are there different rules for contractors versus employees?
FCRA applies to “employees” broadly, but it also covers background checks on independent contractors in many circumstances — specifically when you use a third-party CRA to pull the report. If you’re hiring a 1099 contractor through a staffing platform that runs its own checks, the platform typically handles FCRA compliance on its end. If you’re directly hiring a contractor and ordering a background check yourself through a CRA, you need to follow the same FCRA process as you would for a W-2 employee. The contractor classification doesn’t give you a pass on the disclosure and authorization requirements.
What’s the single most common mistake employers make?
Running the background check before getting written authorization. It happens constantly, especially when hiring managers use informal online search tools or pull a credit report themselves without thinking of it as a “background check.” Under FCRA, using a third-party report without prior written consent is a violation, full stop — even if the candidate later passes the check and gets hired. The second most common mistake is sending the final adverse action notice without first sending the pre-adverse action notice and waiting. That waiting period exists so the candidate can dispute inaccurate information in the report before a decision is finalized. Skipping it doesn’t just create legal exposure; it means you might have rejected someone over a data error that they could have corrected in five days.
How do you build a background check policy that actually holds up?
Write it down as a formal policy document, not just an informal practice. The policy should specify which positions require which types of checks, who is authorized to order and review reports, how individualized assessments are conducted and documented, and how adverse action notices are handled. Review it once a year — state laws are changing faster than most business owners realize, and what was compliant in 2021 may not be today. If you operate in multiple states or are expanding your Florida business into new markets, have an employment attorney review the policy before you start hiring there. A one-time legal review costs a few hundred dollars. Defending an FCRA class action costs several hundred thousand.