This chapter establishes minimum requirements and procedures for a private provider to perform fingerprinting services and demographic data collection for non-criminal justice purposes for the Central Repository. In this chapter, the following terms have the meanings indicated. Terms Defined. “Authorization certificate” means a document issued by the Central Repository to a private provider authorizing the private provider to perform fingerprinting services and demographic data collection for the Central Repository. “Criminal history records check” has the meaning stated in COMAR 12.15.02.02. “Criminal history record information (CHRI)” has the meaning stated in Criminal Procedure Article, §10-201(d), Annotated Code of Maryland. “Criminal Justice Information System—Central Repository (Central Repository)” has the meaning stated in Criminal Procedure Article, §10-201(c), Annotated Code of Maryland. “Criminal justice purposes” has the meaning stated in COMAR 12.15.01.03. “FBI” means the United States Federal Bureau of Investigation. “Network Livescan Applicant Technical Interface Document” means the written minimum specifications for processing a request for a criminal history records check for non-criminal justice purposes. “Non-criminal justice purpose” has the meaning stated in COMAR 12.15.01.03. “Private provider” means a person performing fingerprinting services and demographic data collection for non-criminal justice purposes. “Private provider agreement” means a legally binding document that describes the responsibilities of the Central Repository and a private provider authorizing the private provider to perform fingerprinting services and demographic data collection for the Central Repository. “Record” means any printed, written, or electronic document or file used or created for the purposes of collecting and transmitting fingerprint images and demographic data to the Central Repository for a request for a criminal history records check for non-criminal justice purposes. The Central Repository may authorize a private provider to perform fingerprinting services and demographic data collection for a request for a criminal history records check for non-criminal justice purposes. The Central Repository shall establish minimum administrative and operational requirements for private providers to perform fingerprinting services and demographic data collection for non-criminal justice purposes. Fingerprinting services and demographic data collection for non-criminal justice purposes include: Electronic transmission of an individual's fingerprints and demographic data to the Central Repository for a criminal history records check for non-criminal justice purposes; Completion of forms required for a request for a criminal history records check by obtaining information about the individual being fingerprinted; and Collection of fees and payment of invoices according to Regulation .07 of this chapter. Except for purposes under §E of this regulation, a private provider authorized to perform fingerprinting services and demographic data collection for non-criminal justice purposes under this chapter shall make the private provider's fingerprinting services available to a person requesting a criminal history records check for non-criminal justice purposes. A private provider may not perform fingerprinting services or demographic data collection for the following purposes: Sex offender registration; Hazardous materials endorsements—commercial driver's licenses; or Criminal justice purposes. A private provider may not provide fingerprinting services or demographic data collection for non-criminal justice purposes unless the private provider meets requirements under this chapter. Before the Central Repository enters into a private provider agreement with or issues an authorization certificate, original or renewal, to a private provider requesting to perform fingerprinting and demographic data collection under this chapter, the private provider shall: Submit a written application to the Central Repository in a format established by the Central Repository; Provide the Central Repository with documentation indicating that the private provider or the private provider’s staff has at least 5 cumulative years providing fingerprinting services and demographic data collection; Demonstrate the ability to electronically transmit fingerprint images and demographic data using a secure encrypted connection that meets requirements set forth in the Network Livescan Applicant Technical Interface Document maintained by the Central Repository; Demonstrate compliance with requirements under Regulation .05 of this chapter for the location where Central Repository authorized fingerprinting services and demographic data collection are performed; Provide documents to support the existence of a current surety bond as provided under Regulation .09 of this chapter; and Demonstrate that a criminal history records check was performed on the private provider's employee as required under Regulation .08 of this chapter. The Central Repository shall issue an authorization certificate to a private provider meeting the requirements of this chapter that: Is valid for 3 years from the date of issuance, unless suspended by the Central Repository; and May be renewed every 3 years upon application by a private provider, unless the Central Repository has suspended the authorization certificate. A private provider shall notify the Central Repository within 10 business days of a change in the information submitted as part of an original or renewal application under this chapter. A private provider issued an authorization certificate under this chapter shall display the certificate at the location where the fingerprinting services and demographic data collection are performed. Before the Central Repository enters into a private provider agreement with or issues an original or renewal authorization certificate to a private provider, the Central Repository shall review a private provider's location plan. A private provider's location plan, at a minimum, shall have: A Livescan machine that is approved by the Central Repository; A waiting area that, at a minimum, includes: A reception desk; and Seating for individuals requesting a criminal history records check; A method of securing and maintaining records that meets Central Repository requirements; and Electronic connections, electric power supply, and office climate control that meet manufacturer and Central Repository requirements. A private provider authorized to perform fingerprinting services and demographic data collection under this chapter shall: Retain records related to a request for a criminal history records check for 90 days from the date of the request; and Then destroy the records. Records, at a minimum, include the following for the individual being fingerprinted and supplying demographic data: An identification number; The individual's name and address; The date that the individual was fingerprinted and provided the demographic data; A copy of a driver's license or other acceptable identification; The processing control number; The fingerprint image; The type of transaction; The authorization number; The matrix code associated with transaction; A record of fees collected; and A record of payment to the Central Repository. A private provider shall ensure confidentiality of records that are stored and destroyed according to requirements of this chapter. Records are subject to inspection by the Central Repository or the FBI. A private provider may not receive CHRI. A private provider shall collect fees as specified under COMAR 12.15.01.14 for performing fingerprinting services and demographic data collection for non-criminal justice purposes on behalf of the Central Repository. The Central Repository shall submit a monthly invoice to each private provider for requests for criminal history records checks processed by the private provider and submitted to the Central Repository during the preceding month. Upon receipt of the invoice under §B of this regulation, the private provider shall forward payment to the Central Repository within 7 business days of receipt of the invoice. A private provider may charge fees for providing fingerprinting services and demographic data collection in addition to fees as specified under COMAR 12.15.01.15. If a private provider charges fees in addition to those required under COMAR 12.15.01.15, the private provider shall: Identify, report, and control the additional fees separately from those required to be collected by the Central Repository under COMAR 12.15.01.15; and Include in any public notice of the availability of fingerprinting services and demographic data collection for non-criminal justice purposes: The fees required under COMAR 12.15.01.15; and The additional fees charged by the private provider. As part of the application for an original or renewal authorization certificate, a private provider shall include the fingerprints and demographic data for each individual performing or supervising fingerprinting services and demographic data collection authorized under this chapter. The Central Repository shall conduct a criminal history records check of each individual identified by the private provider as performing or supervising fingerprinting services or demographic data collection authorized under this chapter. The Central Repository may consider CHRI received under §B of this regulation when determining: To authorize a private provider to perform fingerprinting services and demographic data collection under this chapter; or The conditions of the private provider agreement. A private provider requesting authorization to perform fingerprinting services and demographic data collection for non-criminal justice purposes shall have a surety bond of $10,000, in a form approved by the Central Repository. A private provider shall provide the Central Repository with: A certificate from the bonding company listing the individuals of the private provider's company who are covered by the bond; An agreement from the bonding company that the bonding company shall give the Central Repository at least 60 days’ notice by registered or certified mail of cancellation of the private provider's bond; and As part of the agreement under §B(2) of this regulation, written assurance that the bond will be in full force and effect for a period of at least 60 days after notice of cancellation is given to the Central Repository. The bond value shall increase to 10 percent of the total amount invoiced to the private provider the previous fiscal year if the invoiced amount exceeded $100,000. After an original or renewal authorization certificate is issued, the private provider shall maintain the required surety bond throughout the period the private provider is authorized to perform fingerprinting services and demographic data collection for non-criminal justice purposes under this chapter. The Central Repository may suspend an authorization certificate granted under this chapter, if the Central Repository determines that the private provider: Perpetrated a fraud against the Central Repository or the public; Created the impression that the private provider is associated with or is a part of the Central Repository or another State agency; Conducted business in a manner that is detrimental to the interests of the Central Repository, the State, or the public; Has not met the administrative or operational requirements for authorization under this chapter; Has more than a 2 percent rejection rate of fingerprint impressions as determined by the Central Repository or FBI; or Failed to forward payments to the Central Repository as required under this chapter. The private provider may reapply for an authorization certificate after 6 months from the date of a suspension. Criminal Procedure Article, §10-221, Annotated Code of Maryland Effective date: July 16, 2007 (34:14 Md. R. 1246) Regulation .02B amended effective November 25, 2013 (40:23 Md. R. 1935) Regulation .03C amended effective November 25, 2013 (40:23 Md. R. 1935) Regulation .04B, C amended effective November 25, 2013 (40:23 Md. R. 1935) Regulation .05B amended effective November 25, 2013 (40:23 Md. R. 1935) Regulation .06E amended effective November 25, 2013 (40:23 Md. R. 1935) Regulation .07 amended effective November 25, 2013 (40:23 Md. R. 1935) Regulation .08C amended effective November 25, 2013 (40:23 Md. R. 1935) Regulation .09 amended effective November 25, 2013 (40:23 Md. R. 1935)