What Employers Can and Can't Review in an Employment Background Check

Hiring your first employee can feel risky. You want to protect your business, customers, and team, but you may not know where the line is between a careful hiring process and a legal problem. Many small employers ask the same question: What can I check, and what gets me in trouble?

Legal background checks and employment rules involve background reports, criminal records, medical privacy, state restrictions, and anti-discrimination laws. Some information may legally appear in a report. Other information may be restricted, irrelevant, or unsafe to use in a hiring decision.

This guide explains what employers can legally check, what they should not check or use, what a background check can find, and how to keep the process fair, consistent, and job-related.

Employers can usually review background information that is connected to the job. A check should help the employer decide whether the person can safely and honestly perform the role, not collect private details “just in case.”

When an employer reviews a background report, the decision should focus only on information that is relevant to the job, legally allowed, and reviewed consistently for every candidate applying to the same role.

A background report may include information from different sources, including credit reports and criminal records, when an employer uses a consumer reporting agency. The FTC explains that employment background checks from third-party companies are often "consumer reports" under the Fair Credit Reporting Act, so employers must follow FCRA rules when using them for hiring, promotion, reassignment, or retention decisions.

Those rules cover four main obligations:

✅ Employment background check laws include federal rules for consumer reports, anti-discrimination guidance, ADA limits on medical questions, and state or local rules that may control when certain information can be requested or used.

Employers commonly check:

✅ The EEOC warns that employers cannot use background checks in a way that denies equal employment opportunity based on protected characteristics. 

This is also why the hiring paperwork should match the screening plan. A clear job application form can help employers collect the same basic information from each candidate before deciding whether any extra checks are actually needed. For example, the form may ask about work history, education, licenses, and references, while excluding medical history and other restricted information from the pre-offer stage.

If the employer later needs written consent for a third-party background report, the process should be easy to track. With eSign, hiring teams can collect signed authorizations, offer letters, and screening acknowledgments in one place instead of managing scattered files and email attachments.

The biggest mistake is assuming that any information an employer can find is safe to use. That is not true. Seeing information is not the same as being allowed to use it.

Employers should be especially careful with:

✅ Medical information needs special care. The EEOC says employers may ask applicants whether they can perform the job. They may also ask how the applicant would perform it. However, medical questions and medical exams are generally limited until after a conditional job offer. Even then, they must be handled consistently for all entering employees in the same job category.

This is where the employment offer letter matters. If a background check, post-offer medical exam, or other screening step is part of the hiring process, the offer letter should make the condition clear before the candidate starts work or resigns from another job. The language should stay narrow: it should explain the condition without asking for diagnosis details, treatment history, or other medical information too early.

Do background checks include medical records, or does a background check show medical history? No. A standard background report does not give employers access to someone's medical records or full medical history. Medical information is restricted by employment background check laws, the Americans with Disabilities Act of 1990, and privacy limits. Employers should not treat medical history the same way they treat employment history or education verification.

✅ Social media is a common example of information that is easy to access but unsafe to use. A quick search may reveal a candidate's religion, pregnancy, disability, or family situation, all of which are protected characteristics under federal law. Even if the employer did not intentionally search for that information, using it in a hiring decision creates a risk of discrimination.

There is no universal “full history” database that automatically shows every job, address, mistake, medical event, school record, and personal detail. A background check depends on:

A background report may verify facts the candidate provided. It may also search certain records, such as criminal databases, court records, driving records, education records, license records, or credit information. But the report is only as broad as the check ordered and legally allowed.

If an employer wants to confirm past employment, the process usually starts with the information the candidate provided, not a secret database of every job the person ever held. In some cases, an employment verification letter can help confirm job title, dates of employment, or income details when that information is relevant and properly requested.

What can a background check find, and what can jobs see on a background check? The answer depends on the role, the screening provider, the candidate's consent, and the records legally available.

A background check may include a criminal record. However, employers still need to decide whether that record is accurate, job-related, legally usable, and reviewed at the appropriate stage of the hiring process.

The EEOC's guidance on arrest and conviction records explains that employers can violate Title VII of the Civil Rights Act if criminal-record policies cause unlawful disparate treatment or disparate impact. Disparate treatment means applying criminal-history rules differently to candidates based on race, national origin, or another protected trait.

Disparate impact occurs when an employer implements a neutral policy, like a blanket rejection of any applicant with a criminal history, that disproportionately affects a protected group without a valid business justification.

Timing depends on state and local law. Some jurisdictions require employers to wait until after a conditional offer before asking about criminal history. The rules governing what states prohibit pre-offer background checks typically delay criminal-history questions or criminal-record review until later in the hiring process, rather than banning all background checks outright. 

An arrest is not the same as a conviction. A pending case is not the same as a resolved case. A sealed or expunged record may be restricted. An old, unrelated record may raise different issues than a recent conviction tied to the job’s duties.

Job relevance matters more than fear. Examples:

The safest approach is to link the concern to the role's actual duties. Avoid vague notes like “bad judgment” or “not trustworthy.” Use factual reasoning tied to job responsibilities.

State law adds another layer on top of federal rules, and it varies depending on where the candidate will work. State background check requirements can affect when employers can ask about criminal history, which records they can consider, and the process they must follow before rejecting a candidate based on a record.

If you are wondering what states prohibit pre-offer background checks or what states don't do background checks, the answer is that states generally do not ban them entirely. Instead, they restrict when employers can ask about criminal history and which records they can use.

New York City's Fair Chance Act, for example, delays criminal-history review and requires employers to weigh specific factors before making an adverse decision. Illinois, New Jersey, and Massachusetts each have their own version with different employer-size thresholds, timing rules, and notice requirements.

Some states also restrict which records employers can consider at all. Certain jurisdictions limit how far back a criminal-history search can go, prohibit the use of arrests that did not lead to convictions, or restrict the consideration of records that have been sealed or expunged.

The rule that applies usually depends on the candidate's work location, not the employer's headquarters. An employer based in Texas hiring a remote worker in California may still need to follow California's rules. Checking state-specific requirements before screening is part of running a legally compliant hiring process.

✅ State hiring laws can be long and technical. AI Summary can help you quickly identify the key rules that apply to your candidate's work location before you begin screening.

If you are wondering how employers do background checks in practice, the process usually starts before the report is ordered. The employer decides what is relevant to the role, gives the candidate the required notice, gets consent when needed, and reviews the results consistently. A safe process does not need to feel like a legal manual. For most small employers, the goal is to keep the process relevant, documented, and consistent.

Start with the job duties. Ask:

If the main concern is access to confidential information, a broader background check may not be the best solution. For some roles, an employee NDA may be more relevant because it establishes clear rules for protecting customer lists, financial data, trade secrets, and internal systems after a person is hired.

The candidate must receive a standalone written notice and sign an authorization before you order a background report from a third-party provider.

If your hiring documents are in PDF format, a PDF editor can help update candidate forms, checklists, or screening paperwork before sending them for signature. This is especially useful when you need to adjust job titles, screening steps, candidate details, or state-specific notices without recreating the whole document.

Use the same review process for the same role. A hiring manager should not improvise based on personal impressions. 

Before a conditional offer, focus on whether the applicant can perform the essential job functions. Do not ask about diagnosis, treatment history, prescriptions, past injuries, or disability details.

After a conditional offer, medical questions or exams may be allowed in limited circumstances if they are required for all entering employees in the same job category and handled consistently. 

If a criminal record appears, slow down. Check state and local timing rules. Confirm whether the record is accurate and usable. Consider whether the conduct is job-related.

Follow the required adverse-action process. This helps avoid decisions based on wrong-person matches, outdated records, or incomplete information.

Once screening is complete, the final hiring documents should match the employer's actual approval. The employment contract can confirm the role, pay, schedule, duties, confidentiality terms, and any lawful conditions that still apply. This helps prevent a mismatch between what the candidate accepted, what the background-check process required, and what the employer expects after the start date.

If the business is screening a freelancer or contractor instead of an employee, keep that workflow separate. An independent contractor agreement should focus on the project scope, payment terms, confidentiality, access rules, and contractor status. At the same time, any screening should remain limited to information relevant to the work.

The safest approach is simple: decide what information is relevant to the role, get proper consent, follow federal and state rules, avoid medical and protected-class information, review criminal records carefully, and apply the same standards to every candidate for the same job.