NORTHFIELD (CBS) — A former custodian and cook at Sunset Ridge middle school remains at large after police say he secretly recorded staff and students in the bathroom.

Tonight, there are new questions over the background checks, or lack thereof, into David Garcia Espinal. CBS 2’s Chris Tye reports, parents are irate and the district may have violated the law.

In recent months, police say Garcia Espinal covertly hid cameras inside bathrooms at Sunset Ridge.

While we know his recordings date back to September, the questions we have go back further. Namely to the weeks before he started work at the school.

The school board may have broken the rules.

Sunset Ridge Middle School in Northfield. (CBS)

Since Garcia-Espinal wasn’t a district employee, but employed by cooking and cleaning vendors, the district said in a message still posted online: “Private contractors/vendors are required to provide a criminal background check for assigned staff, as per the contract bidding documents.”

But the Illinois State Board of Education says that’s not enough.

The law requires all Illinois school districts to conduct background checks prior to hiring and every five years that an employee remains with the district.

A policy that covers full-time district employees and vendors like Garcia-Espinal.

How did it happen?

No one is talking—not the district or police

Parents are concerned the images of their children may have been posted online or shared before police, sources tell us, served a search warrant on Garcia Espinal’s home.

The background check that was done–not by the school but by outside vendors–failed to flag a felony conviction for identity fraud in 2012.

He was caught with bogus ID.  He was also seen of video entering a women’s bathroom three times at the Glenview movie theater, and then caught masturbating.

He admitted to similar acts two years earlier at a Northbrook theater.

For a series of reasons that are still not clear, charges of public indecency and disorderly conduct didn’t get prosecuted.

The district said it has conducted additional and updated criminal background checks for all current vendor employees.

If the district conducted the proper background checks on Garcia Espinal, it is possible they’d have seen the charges of indecency, which may have prevented him ever being near kids.

Sunset Ridge school board president Adelbert Spaan released the following statement on Friday:

“There is nothing more important than the safety and security of our students, teachers, and staff.

“Sunset Ridge District 29, like all other school districts, is bound by state guidelines, and it is our responsibility to ensure those are followed.

“As soon as we first learned about this, we started a top-down Internal investigation. After the investigation is completed, the Board will take actions deemed necessary and appropriate. We are doing everything we can to determine the facts of what happened and to ensure our students, teachers, and staff are never put in harm’s way.”