Why Post-Hire Criminal Monitoring Matters

The standard hire-and-forget model of background screening carries a legal risk most HR teams underestimate: negligent retention.

Negligent retention is a separate legal theory from negligent hiring. While negligent hiring asks whether an employer should have known about a risk before bringing someone on, negligent retention asks whether an employer continued to employ someone after warning signs emerged — or after a qualifying incident occurred that could have been detected. Courts have found employers liable under negligent retention claims when monitoring tools existed and weren't used.

As one legal analysis summarizes it, negligent retention occurs where a party failed to remove an employee from a position of authority after it became apparent that the employee was misusing that authority in a way that posed a danger to others. The key phrase is "became apparent" — and in the context of a monitoring program, that bar includes situations where an employer could have known with reasonable effort.

For roles involving financial responsibility, access to vulnerable populations, driving, or positions of trust, the case for post-hire monitoring is especially strong. A cleared employee who has a DUI in month six of employment is still driving your fleet. A cleared employee who is arrested for fraud in year two is still handling client accounts. Without a monitoring program, there is no mechanism to know — and without a mechanism, "I didn't know" becomes much harder to defend.

According to SHRM, a significant percentage of workplace incidents involve employees with no prior record at the time of hire — meaning the initial background check would not have flagged them regardless of how thorough it was. The only tool that closes this gap is ongoing monitoring.

The Four Main Ways Companies Monitor Employees After Hiring

1. Continuous Criminal Monitoring

Continuous criminal monitoring — sometimes called post-hire monitoring or ongoing background screening — is the most effective and scalable method for tracking new criminal activity in an active workforce.

The process works like this: employees are enrolled in a monitoring program (with their written consent, as required by the FCRA). The monitoring platform then scans criminal databases — national criminal records, county-level records, sex offender registries, watchlists — on a recurring basis. When new reportable activity is detected for an enrolled individual, an automated alert is sent to HR or the designated administrator in near real time.

The critical distinction between continuous monitoring and periodic rescreening is timing. Annual rescreening catches what's in a record on one specific day — leaving up to 364 days where new activity goes undetected. Continuous monitoring catches activity when it appears in the record, not at the next scheduled check.

Bchex's Chex365 is built specifically for this — delivering real-time criminal monitoring alerts for workforces of any size, from small nonprofits to large school systems and employers. For a full explanation of how the technology works, see What Is Continuous Monitoring?

2. Periodic Rescreening

Periodic rescreening is the practice of running full background checks on existing employees on a defined schedule — annually, every two years, or at role changes. It's more thorough than continuous monitoring for any given moment in time (it pulls a complete report, not just new activity), but it is also slower, more expensive per employee, and leaves gaps between cycles.

Periodic rescreening works best as a complement to continuous monitoring rather than a replacement for it. For roles requiring credential verification — professional licenses, certifications, education requirements — a full periodic rescreen catches what a criminal monitoring alert wouldn't. For criminal activity specifically, continuous monitoring is more responsive.

A risk-tiered approach is the industry standard: high-access roles get continuous monitoring plus annual rescreening; moderate-risk roles get rescreening every one to two years; lower-risk roles get rescreening every two to three years. Any role change that increases access or responsibility resets the clock regardless of when the last check ran.

3. MVR Monitoring for Drivers and Fleet Employees

Motor vehicle record (MVR) monitoring is a specific form of post-hire monitoring for employees who drive as part of their role — delivery drivers, fleet managers, sales reps, transportation workers, and anyone whose job involves operating a company vehicle.

MVR monitoring checks for license suspensions, DUIs, major traffic violations, and other reportable driving activity on a continuous or scheduled basis. For employers with commercial vehicle fleets, MVR monitoring isn't optional — DOT regulations and insurance requirements in most states create affirmative obligations to monitor driver records and act on disqualifying events.

For non-fleet employers, MVR monitoring applies wherever a role involves regular driving responsibility. An employee whose license is suspended and continues to drive a company vehicle creates direct liability for the employer — regardless of whether the employer knew about the suspension.

4. Professional License and Sanctions Monitoring

For regulated industries — healthcare, financial services, legal, education — employees are often required to hold active professional licenses or certifications as a condition of employment. License monitoring watches for lapses, revocations, suspensions, and sanctions against those credentials on an ongoing basis.

In healthcare specifically, OIG exclusion monitoring is a compliance requirement: employers cannot bill federal healthcare programs for services provided by individuals who appear on the HHS Office of Inspector General's exclusion list. Running this check at hire is standard. Many employers don't realize they're also required to monitor it on an ongoing basis — at least monthly, according to OIG guidance.

Financial services employers face similar obligations under FINRA and other regulatory bodies. A broker whose license is suspended or who has a regulatory action taken against them needs to trigger an alert to compliance — not be discovered at the next annual audit.

What Continuous Monitoring Actually Covers

The scope of a continuous monitoring program depends on the platform and the employer's configuration. A well-built program typically monitors:

• National criminal databases — arrests, charges, and convictions reported to national aggregated systems
• County criminal records — where jurisdictions have digital access; the most current and complete source of criminal history for most offenses
• Sex offender registry updates — changes to registrations against the National Sex Offender Public Website (NSOPW) and state databases
• Federal watchlists and sanctions — OFAC, terrorist databases, and debarment lists
• Motor vehicle records — for driving roles, license suspensions, DUIs, and major violations
• Professional license and credential status — for regulated industries

Not every program monitors all of these. Employers should configure their monitoring scope based on the access level and role requirements of their workforce — high-access roles warrant broader monitoring; lower-risk roles may need only criminal and sex offender coverage.

FCRA Compliance for Post-Hire Monitoring

Post-hire criminal monitoring is regulated by the Fair Credit Reporting Act when conducted through a third-party screening provider — which is the standard approach for any scalable program. Employers must follow the same FCRA requirements for ongoing monitoring that apply to pre-hire background checks:

Written consent is required before enrollment. Employees must provide written authorization before being enrolled in any continuous monitoring program. This is typically collected during onboarding, but employees hired before a monitoring program was implemented need to provide fresh consent.

Proper disclosure is required. Employees must be informed that a consumer report may be obtained and used for employment purposes — not buried in a general employment agreement, but in a clear, standalone disclosure.

The adverse action process applies. If an employer decides to take action based on a monitoring alert — suspension, termination, role change — the FCRA's two-step adverse action process applies: a pre-adverse action notice with a copy of the report and a summary of rights, followed by a waiting period for the employee to dispute, followed by a final adverse action notice if the decision stands.

Ban-the-box laws and state-specific restrictions apply. Many states limit what criminal records employers can consider — even for post-hire decisions. Arrests that didn't result in convictions, charges that were expunged, or convictions beyond a certain age may be legally off-limits depending on jurisdiction. A monitoring platform that delivers alerts without flagging these legal restrictions can create more compliance risk than it eliminates.

For a full walkthrough of the FCRA compliance process — including what adverse action looks like in practice — see our FCRA compliance guide.

Who Should Be Enrolled in Post-Hire Monitoring

Not every role carries the same risk profile, and not every employee needs the same level of ongoing monitoring. A risk-tiered approach matches monitoring intensity to access level:

Highest priority for continuous monitoring:

• Employees with direct, regular access to children, elderly, or other vulnerable populations
• Healthcare workers, caregivers, and clinical staff
• Employees handling financial accounts, client funds, or sensitive data
• Drivers and fleet employees
• Employees with access to controlled substances or regulated materials
• Staff in schools, daycares, youth programs, and nonprofits serving vulnerable communities

Strong case for periodic rescreening:

• Managers and supervisors with authority over others
• Employees with facility access or security responsibilities
• Contractors and contingent workers with ongoing engagements
• Any employee whose role changes to include higher access or responsibility

Minimum: monitor at role changes

• Lower-risk, supervised roles with limited access to vulnerable populations or sensitive systems

The starting point for any program is a documented written policy that specifies monitoring tiers by role type, applies them consistently, and ties them to the organization's overall risk management framework.

How Bchex Supports Post-Hire Criminal Monitoring

Bchex's Chex365 continuous monitoring platform is built for organizations that can't afford to leave a post-hire blind spot in their safety program — schools, healthcare organizations, nonprofits, employers with vulnerable-population access, and any company that takes negligent retention liability seriously.

Chex365 monitors hundreds of thousands of employees, volunteers, and contractors, scanning daily for new activity. Sex offender registry monitoring covers all 50 states; continuous criminal monitoring is currently live in North Carolina, with additional states planned. When a monitored individual has new activity, an alert reaches the designated HR or safety administrator immediately — not at the next annual review.

For organizations pairing continuous monitoring with a visitor management layer — screening not just employees but everyone who enters the building — ChexPass provides real-time sex offender checks at check-in, completing the safety ecosystem from hire to daily access.

FAQs About Monitoring Employees for Criminal Activity After Hiring

Can employers legally monitor employees for criminal activity after hiring?

Yes — with proper written consent and FCRA-compliant processes. Employers must obtain written authorization before enrolling employees in any continuous monitoring program, and must follow the FCRA's adverse action requirements if they take action based on a monitoring alert. See our FCRA compliance guide for the full process.

What is the difference between continuous monitoring and annual rescreening?

Annual rescreening runs a full background check on a defined schedule — once a year, every two years, etc. Continuous monitoring runs passively between those checks, alerting you when new criminal activity appears for a monitored employee in near real time. Annual rescreening leaves gaps of up to 364 days. Continuous monitoring closes those gaps. For high-access roles, both are recommended together.

What is negligent retention and how does it differ from negligent hiring?

Negligent hiring is a failure to screen appropriately before bringing someone on. Negligent retention is a failure to take action when an employer knew — or should have known — that an existing employee posed a risk. Courts have found employers liable for negligent retention when monitoring tools existed and weren't used. Continuous monitoring is one of the primary defenses against negligent retention claims.

Do employees need to consent to post-hire criminal monitoring?

Yes. Under the FCRA, written consent is required before any third-party monitoring program is initiated. This applies to ongoing monitoring the same way it applies to pre-hire background checks. Employees hired before a monitoring program was implemented need to provide fresh consent — it cannot be assumed from their original onboarding paperwork.

What records does continuous criminal monitoring cover?

Most programs cover national criminal databases, county-level criminal records where digital access exists, sex offender registry updates via NSOPW and state sources, and federal watchlists. Some programs also include MVR monitoring for driving roles and professional license/sanctions monitoring for regulated industries. The scope should be configured to match the access level and risk profile of the role being monitored.

Is criminal monitoring required by law for any industries?

Specific continuous monitoring requirements vary by industry and state. Healthcare employers are required to check the OIG exclusion list on an ongoing basis — at least monthly per OIG guidance — for any employee who may be involved in federal healthcare billing. DOT-regulated employers have specific MVR monitoring obligations for commercial drivers. Other industries have compliance obligations driven by insurance requirements, licensing boards, or state law. Check with your industry's regulatory body and your liability carrier for specifics.

How should employers respond when a monitoring alert comes in?

Assess the alert in the context of the employee's role and your written adjudication policy. Not every criminal record is automatically disqualifying — relevance to the role matters, and ban-the-box and state restrictions may limit what records you can consider. If you decide to take adverse action, follow the FCRA's two-step process: pre-adverse action notice, waiting period, final notice. Apply your policy consistently across all employees in similar situations to avoid discrimination claims.

Related Blogs

• What Is Continuous Monitoring?
• Background Check Compliance Explained (FCRA Guide)
• What Is a Background Check?
• How to Screen Volunteers Safely
• What Is a Visitor Management System?

Conclusion

A background check at hire is a starting point, not a safety program. The employers who face negligent retention liability aren't the ones who screened carelessly at the beginning — they're the ones who screened carefully at hire and then stopped paying attention. Continuous criminal monitoring closes the gap that every point-in-time check leaves open. It's not a premium feature for high-risk industries. For any organization with employees in positions of trust or access, it's the logical next step after a compliant pre-hire screen.

Ready to extend your screening program beyond the hire date? Explore Chex365 continuous monitoring by Bchex — real-time criminal alerts for your active workforce, built on FCRA-compliant infrastructure.