Privacy and preparation
Background checks and drug test results in staffing records
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Background check reports and drug test results should be excluded from any staffing data you license, every time. The FCRA, state screening and medical confidentiality rules, and screening vendor terms may all restrict them. The real work is finding them: they hide in ATS attachments, custom status fields, recruiter notes and vendor emails, not only in a screening module.
Key takeaways
- Exclude background reports, adjudication notes and drug test results outright; no level of redaction makes them suitable to license.
- A clear result is still sensitive, because the status itself reveals that a person was screened and what the outcome was.
- Screening data hides in attachments, custom fields, recruiter notes, candidate texts and vendor email threads.
- Excluding screening records from a license does not change your duty to retain them under applicable rules.
Should screening records ever be part of a licensed dataset?#
Screening records should never be part of a licensed dataset: background check reports, criminal history, motor vehicle records, credit checks, drug and alcohol test results and the notes recruiters write about them all stay out. They carry legal restrictions, they describe people at a vulnerable moment, and they add almost nothing to the workflows AI developers want to study.
The value in staffing records sits elsewhere: job orders and requirements, sourcing and submittal decisions, interview feedback, client communication, placement outcomes and redeployment. Those records show how experienced recruiters match people to work, and removing screening content takes nothing essential from that story.
For a staffing CEO, the exclusion also answers the brand question. A firm that can say screening data never left its systems has a simple, defensible position with candidates, clients and its own recruiters.
Which laws and contracts may restrict screening data?#
Several layers of law and contract may restrict screening data, and counsel assesses them for each firm and each state where it places workers. The table lists the usual sources and what to check; none of them should be read as permitting licensing.
The practical answer does not depend on a close reading of each source. Even where a particular rule might not reach a particular record, the combination makes exclusion the only sensible default, and exclusion removes a long list of questions from the rights review.
| Source of restriction | What it generally covers | What to check |
|---|---|---|
| Fair Credit Reporting Act | Consumer reports from screening companies and the purposes for which they are obtained and used | Your certifications to the screening vendor and the purposes stated in them |
| State consumer reporting and fair chance laws | Use of criminal history and credit information in hiring | Rules in each state and city where you recruit |
| State drug and alcohol testing laws | Testing procedures and confidentiality of results | Confidentiality and disclosure provisions in your states |
| Medical confidentiality rules | Medical information about applicants and employees, often kept in separate files | Where test results and medical notes are stored |
| California Consumer Privacy Act | Applicant and employee personal information, since the exemption expired on January 1, 2023 | Notices given to California applicants in your ATS |
| Screening vendor agreements | Use, storage and redistribution of reports | End-user terms and data handling clauses |
| Client contracts | Screening required for placements and confidentiality of results | Master agreement clauses on candidate information |
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Where screening data hides in an ATS#
Screening data hides in an ATS wherever recruiters and onboarding staff could type or attach something, not just in a dedicated screening module. Bullhorn, for example, lets admins export candidate records to CSV from saved lists or custom searches, and exports like these carry custom fields and notes along with the standard profile.
Integrations add another layer. When a screening vendor connects to the ATS, it often writes order numbers, status updates and links to its own portal back into the candidate record, and those links can open full reports for anyone with portal access. Strip integration fields and portal URLs along with the reports themselves.
Check each of these locations in your own system before scoping any export.
- Attachments on candidate and placement records: screening reports, consent forms, adverse action letters, lab chain-of-custody forms.
- Custom fields and statuses such as screening status, clear or consider, drug panel or MVR result.
- Recruiter and onboarding notes that mention results, delays or explanations from the candidate.
- Email threads with screening vendors, testing labs and medical review officers.
- Text messages and chat with candidates about rescheduling tests or explaining findings.
- Pipeline stage history, where a stage such as pending screen or failed screen records the outcome.
- Client-facing submittal notes confirming that a candidate passed a client-required check.
- Withdrawal and do-not-rehire reason codes tied to screening outcomes.
How to exclude screening data without gutting the record#
Excluding screening data cleanly means removing whole fields, attachments, stages and sentences, then replacing anything the workflow still needs with a neutral marker. The goal is a placement record that still shows the sequence of work without revealing whether or how a person was screened.
Build a keyword and pattern list for detection, then review samples by recruiter and by branch, because each team writes notes differently. Typical terms include background, adjudication, consider, MVR, drug screen, panel, MRO, dilute, chain of custody and adverse action.
| Record element | Treatment | Why |
|---|---|---|
| Screening reports and consent forms | Exclude all attachments of these types | No safe partial version exists |
| Screening status fields | Drop the field entirely, even for clear results | A status reveals that screening happened and its outcome |
| Pipeline stages tied to screening | Collapse into a generic pre-start step | Keeps the sequence without the outcome |
| Withdrawal and rejection reasons | Replace screening-related codes with a generic closed reason | Prevents inference from the code |
| Recruiter notes mentioning results | Remove the sentence or the whole note | Free text can restate outcomes |
| Vendor and lab email threads | Exclude whole threads by sender domain | Every message concerns screening |
| Start dates delayed by screening | Keep the start date, drop the explanation | Timing alone rarely reveals the reason once notes are gone |
Illustrative: a light-industrial staffing firm#
Illustrative: a fictional light-industrial and logistics staffing firm with several branches runs Bullhorn, a texting tool for candidates and Microsoft 365 email. Its leadership wants to license job orders, submittals, interview feedback and placement outcomes to a developer of recruiting coordination tools.
The inventory found screening data in places the team had not expected: PDF reports attached to placement records, a custom field branch managers used for drug screen results, recruiter notes explaining delayed starts, and a shared mailbox that received every vendor report. The screening module itself was the easy part.
The firm excluded the attachments, the custom field and the shared mailbox entirely, collapsed screening stages into one pre-start step, and removed note sentences that matched its pattern list. Sample review by branch found a few leftover mentions in candidate texts, which led to a broader pattern list rather than one-off fixes. The licensed scope described recruiting work; screening never left the firm's systems.
How SourceX treats screening records#
SourceX treats background checks, drug tests and similar screening records as excluded by default during the Rights and Preparation steps of the SourceX five-step transaction. The exclusion list, the detection patterns and the sample review results are recorded in the privacy record of the SourceX Evidence Packet.
The staffing firm approves the final scope before anything moves to Approval and Delivery. Nothing is shared during the initial fit check, which collects only metadata about systems and record types.
Frequently asked questions
What if every background check in our records came back clear?
Exclude them anyway. A clear result still reveals that a person was screened, by whom and when, and the underlying report contains identity details, addresses and personal history. The exclusion rule follows the record type, not the outcome of the check.
Can we license aggregate screening statistics instead?
Aggregate counts are rarely useful to AI developers and can still be sensitive for small branches or rare roles. If a buyer asks, treat it as a separate request for counsel to assess rather than adding screening data to a recruiting workflow package.
Do we still have to keep the screening records we exclude?
Usually yes. Excluding records from a license does not change retention duties under employment, screening and recordkeeping rules, or under client contracts. Keep the records in your systems on your existing schedule and leave them out of the export used for preparation.
Are I-9 forms and identity documents in the same category?
Treat them the same way. Employment eligibility forms, copies of identity documents, work authorization records and tax forms such as W-4s and W-9s carry government identifiers and have no place in a licensed dataset. Exclude them by document type and by folder.
What about licenses, certifications and health screenings for regulated roles?
Exclude them as well. Professional license numbers, immunization records, physical exam results and motor vehicle records are identifiers or health information. A placement record can still say a role required a certification without storing the credential itself.
Sources
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.