The law makes it clear that you can communicate information on the job performance or qualifications of a current or former employee upon the request of a prospective employer. In addition to the protections offered by this law, you can lessen exposure to liability by establishing uniform procedures for responding to requests for information.
Some companies set a policy of not providing references at all. This is not a wise choice, as it could lead to liability if a former employee has been terminated for violence or is known to be violent. If that employee is hired by another company and commits a violent act on the job, your company could be liable for failing to provide information that could have prevented the incident.