As of 2024, OVC anti-trafficking grantees providing direct services should use a written, time-limited, and informed release of information from a program participant to share any individual personally identifying information about that program participant with anyone outside of your anti-trafficking services program. This includes even confirming that a particular person is receiving or has received services.

NNEDV’s Safety Net program has a model release form  available in English and Spanish. Additionally, the Safety Net Confidentiality Template page has a two-page version for low vision readers in both English and Spanish. If your organization translates the form into other languages, we would love to receive a copy so that we can share it.

Yes, the form can be altered to increase accessibility. Please do not make any adaptations that change its intent.

Yes. The model release is what we recommend as best practice and it is consistent with the requirements of the TVPA award condition to follow VAWA confidentiality. There are several reasons that it is so specific:

• It helps ensure that the program participant is in control and knows what information they are releasing to whom.

• It helps ensure that there is informed consent.

Not always. The best practice is to follow the participant’s instructions. The program participant should be informed that they are in control of how broadly the information is shared, and that they can ask for these constraints.

For Example: A program participant is applying to move into a housing program and writes a release of information for their provider to share the participant’s personal information with the employees of the new program. The participant can instruct their provider to release their specific personal information to:

•    Any of the staff working at the program

•    Only the participant’s case manager at the program

•    Multiple specific staff such the case manager and the case manager’s intern

It is important these instructions are clear and followed appropriately. If the instructions on the release of information do not accurately reflect the participant’s request, the form should be updated. Let the participant know that even if you only share their information with one or more staff, the program may choose to share that information with more or their staff or other organizations (depending on their policies).

Yes. VAWA requires a release to be time-limited, and this is best practice. The release can be reaffirmed and extended if the program participant confirms that it is still valid and authorizes a new expiration date.

Releases should not have a standard expiration date (such as “one year from date of signature”) because that is not tailored to the meeting the individual program participant’s needs.

VAWA requires releases to be “reasonably time-limited. A time limit is reasonable if

• The length of time is necessary to fulfill the purpose of the release

• The length of time fits the circumstances of the participant’s situation.

• The length of time is chosen by the program participant

  • Most disclosures requested by a program participant can be handled right away, so the release does not need to last very long (two weeks to a month is common). If a program participant wants the permission to disclose to last longer, the program participant can make that choice and should not be required to re-sign multiple short-term releases.

  • The time limit should weigh the participant’s goals and reflect their assessment of risks of having their information released versus the benefit of releasing the information over time.

VAWA states that releases have to be “reasonably time-limited,” and that means under the circumstances for individual cases and situations. A 30-day release may be reasonable and appropriate, especially if you have regular phone contact with the program participant.

In addition, it is always good practice to ensure that you regularly check in with program participants about risks and preferences to ensure that the informed consent is based on up-to-date information. You can discuss whether their circumstances have changed and remind them that they have the right to withdraw that release at any point!

💡Tip💡 Program participants can also provide digital releases of information in place of a handwritten ink signature. For more guidance on best practices related to the use of digital tools to obtain written consent to share information see Digital Written Consent to Share Information.

Discussing this with program participants ensures that they are informed of confidentiality risks of different types of communication. For example, there may be a greater confidentiality risk if documents are shared through an online storage site (like Dropbox) than if a phone call is made to that agency. Or, the program participant may be concerned that email is generally not a secure form of communication.

Program participants should be made aware of risks of different communication methods and should be allowed to choose which are used (even if they are not what the agency considers “most secure”). If you don’t specify what form of communication is being used, you may not be giving the participant what they need for true informed consent.

💡Tip💡 Agencies may not always understand the confidentiality risks of different types of communication themselves. Safety Net can help!

Best practice is to have a separate form for each agency that the program participant’s information is being released to. This helps ensure that the program participant is fully informed of

• Who is receiving their information

• The particular impact associated with that agency getting the information.

Programs outside of your agency may have different rules about what may happen with the participant’s information once they have it.

💡Tip💡 If you often work with specific agencies, you could develop forms for each. The pros and cons of the release can then be identified on each form. You must still discuss them with the program participant so they can decide to sign the release or not. For instance, you could have standard forms for:

• Section 8.

• The prosecutor’s office.

• The food pantry.

There are two ways that your agency may be required to share individual personally identifying information  without a release from the program participant:

• You are compelled by state law (such as mandatory reporting), or

• You are required by court order. 

In both instances, you may only share the information required to meet the requirement outlined in state law or the court order.

In most states, a subpoena is not a court order. Thus, it is often not an exemption to the confidentiality obligations. For more information, see How to Prepare for and Respond to a Subpoena.

Even where there is a court order, VAWA requires programs to take measures to protect privacy. This could include going to court to challenge the validity of the subpoena or court order.

To share information with a provider at another agency, you will always need a release based on program participant’s informed instructions. It is not appropriate to seek a release to speak to other agencies just because it makes the agencies feel more comfortable.

No, even in a multi-disciplinary team, direct service providers cannot share information about a specific program participant without a release.  Partners in a multi-disciplinary team may have different confidentiality requirements and different mandatory disclosure requirements, and each partner needs to understand their own obligations. For example, police and prosecutors do not generally need a release to speak about the case. On the other hand, a victim services agency can only speak about a program participant if the program participant signed a release allowing that disclosure to those specific partners. The non-profit agency or representative can talk about many things that are useful to the group such as:

• Services that are available to victims

• Aggregate totals of information about program participants

• General information that is not personally identifying

The participant decides what information they would like the partnership to know and how that information should be shared.

No. Regardless of any MOU’s, victim service providers cannot share personally identifying information with partners of a team (multi-disciplinary team, SART, taskforce, etc.) without written instructions from program participants about what should be shared and with whom. The program participant needs to request and consent to the victim service provider sharing identifying information about their case with the team. This means that the provider’s organization deciding to enter an MOU does not change the provider’s obligation to protect participant information.

Additionally, MOU’s to not share information are typically unenforceable outside of the group, which puts program participant information at risk of forced disclosure.

Each member of the team needs to be aware of their own confidentiality obligations. This includes:

• Obtaining their own releases from program participants to discuss individual information.

• Informing participants of every agency that is part of the team.

• Informing participants if additional people are added to the team.

💡Tip💡 It can be helpful to have a staff person who is not involved with any specific case participate on the team. This helps avoid accidental disclosure of details.

You can:

• Ask follow-up questions about the information being shared with you.

• Discuss general trends in cases.

• Discuss hypothetical cases and common scenarios. For example, this could be how your agency would respond in a variety of situations.

You cannot discuss anything that would identify individual cases or people.

💡Tip💡 There are some types of information that may seem vague, but could be personally identifying, particularly in small communities. Some examples:

• Number of children

• Religious group/affiliation

• Ethnic heritage

Remember that you need a signed release of information to even share that a particular person has received services from your agency.

Your physical location does not change your confidentiality obligations. If you are employed by an organization following VAWA confidentiality obligations, the obligations apply regardless of location or taskforce participation. You cannot share information with law enforcement or anyone outside of your program without a written, specific, time-limited release of information. You must prevent accidental disclosure of confidential program participant information outside of the personnel within your agency.

Even if the officer knows that the program participant is or was at an advocacy office, the provider cannot share program participant information without a release.

The provider can generally thank the officer for caring about program participants, explain that the provider “can neither confirm nor deny if the program participant is receiving services,” and can offer to take a message. The provider can then tell the participant and support them while they decide what the participant wants to do next. 

The program should have a consistent response (e.g., the answer should not differ depending upon the program participant). This is to avoid inadvertently providing information about any individual program participant’s location.

Programs should also share with partners in advance about how they will respond to such requests so it is not surprising to officers when they call.

No. Releases are always necessary to share personally identifying individual program participant information.

💡Tip💡 While you cannot share individual information with partners without a release, you can share aggregate information for reporting to funders. Aggregate information are totals. So, for example, it’s acceptable to report that your program referred 7 people in a particular month, but it is not acceptable to provide any individual identifying details.

Keep in mind that a combination of individual information could also be identifying; for example, sharing that you served a 42-year-old white woman with 4 children, ages 11, 9, 8, and 6 or a 32-year-old Asian woman with a 2-year-old could identify them.

❗ Important ❗ Remember that what is identifying varies from community to community. This applies to both geographic communities such as towns or neighborhoods, and cultural communities such as specific ethnic or language groups. Therefore, it is best practice to err on the side of caution.                                                                          

  It is never appropriate to share certain types of information, such as (but not limited to):

• Names or parts of names,

• Dates of birth, and

• U.S. social security numbers.

Individual “de-identified” profiles can be used to re-identify people in other databases (such as HMIS). Communities and agencies should:

• Consider what information is identifiable for individuals receiving services,

• Only share aggregate, non-identifying information, and

• Not share individual informationunless it meets the program participant’s needs and they have completed a written, specific, and time-limited release.

There is no “arrest warrant” exception, or any other law enforcement/authority exception, in VAWA. There is no federal obligation or law that requires victim service providers to proactively inform authorities.

Consult a local attorney to determine the intersection between confidentiality obligations, privilege requirements, and any state laws about obstruction of justice. Ifyoubecome aware ofa warrant, you can and should notify the program participant and discuss options. If the participant wants toself-reportto authorities and/or get legalassistance, your program can provide advocacy around this.

It is absolutely necessary to get a release from a program participant before informing law enforcement of the program participant’s location. A trafficker could submit missing person reports to try to identify the program participant’s location.

 If a program becomes aware of a missing person report, they can and should notify the program participant and help them decide whether they can safely notify the police that they are not missing.

💡Tip💡 You can proactively discuss with local law enforcement about how traffickers could misuse missing person reports and about the program’s confidentiality requirements. This provides a foundation to collaboratively develop appropriate protocols for if law enforcement suspects a “missing person” is in shelter.

First, check with a TA provider and/or local attorney if you are unsure if your state has a duty to warn law that applies to you, and make sure you know exactly what it requires you to do. If you reveal confidential program participant information without a specific state law mandate or without having a signed release of information, it may be a violation of VAWA confidentiality obligations.

❗ Important ❗ Understand what is required by your state’s or territory’s law before potential duty to warn comes up with participants. This is not something you want to have to figure out in a time-sensitive, high-stress moment.

Some states require reporting to police or to the intended victim of the threat if a program participant is in imminent danger of harming themselves or others. In that case, and if you are legally mandated to report, the report would be an exception to the confidentiality requirements.

VAWA requires that you only disclose the minimum amount of information necessary to comply with the actual law.

Victim/witness advocates should inform program participants of the confidentiality limitations that pertain to victim assistants (victim/witness advocates) employed by a prosecutor’s office. Victim assistants do not necessarily need to obtain a release of information form to share participant information. However, it is best practice to notify the program participant and provide written information to program participants about what happens with their information.

❗ Important ❗ If any of the information a program participant provides to the victim/witness advocate could be shared with other parties, they should inform the victim of this before they choose to begin working with you. “Other parties” includes law enforcement or the attorneys in the prosecutor’s office.

When communicating with participants, it is important to distinguish between:

• A “policy” of not sharing information,

• A law prohibiting the sharing of information, and

• Any laws requiring the sharing of information (such as constitutional requirements that law enforcement share information with criminal defendants).

💡Tip💡 You can read How to Work with Survivors Regarding the Release of Personal Information for more details.

Some organizations, such as law enforcement, may not need a release form signed to be able to share limited information about a program participant, but the partnering victim services program would need a release on their end to share any identifying information.

For multiple agencies that are required to have releases, it is always best practice   for each agency to have its own release. This ensures that program participants are fully informed by each agency of their respective obligations. It also clarifies the specific information to be released by each agency.

Keep in mind that you must ensure there is a truly informed release to share information. If another agency obtains a release from the participant for you to share information with them, it is your responsibility to communicate with the participant about risks/benefits, choices, and reasonable time-limits.

In terms of confidentiality, the strongest and most protective law is what should be followed.

• If you are in a state with strong confidentiality or privilege laws that are more protective than VAWA, follow your state laws.

• If you are in a state that has weak or not as strong confidentiality provisions as VAWA, follow the federal protections.

💡Tip💡 Regardless of which are stronger, state and federal laws can inform best practices about protection of confidential program participant information. For instance, they may have guidance on the use of written, informed, and reasonably time-limited releases of information.

Before this happens, have a plan, including:

• Have an attorney already arranged to call in the event that you receive a subpoena.

• Start by seeking the wishes of the person’s whose information is sought.  If you cannot contact that person or the person does not want you to share the information, then get legal advice and assess the best means to resist the subpoena.  Strategies could include:

  • Contacting the attorney who issued it and asking them to rescind it,

  • Challenging service,

  • Filing a motion to quash the subpoena with the court,

  • Seeking other types of orders to protect the information,

  • Working with the program participant whose information is sought to determine their options to resist the subpoena.

Whatever you do, do not ignore the subpoena and hope it will go away on its own.

❗ Important ❗ Do not destroy documents that may be subject to a subpoena once it has been served on your agency.

For more information, please see How to Prepare for and to Respond to a Subpoena.

Yes. VAWA states that “consent for release may not be given by the abuser of the minor, person with a disability, or the abuser of the other parent of the minor.”

No. VAWA only requires the signature of one non-abusive parent/guardian and the minor child to authorize release of a child’s information. If the minor child is incapable of knowingly consenting, then only a non-abusive parent/guardian needs to sign. The abusive parent is prohibited from signing a release on behalf of the minor child.

If you are working with a minor or a person who has a disability, ask all the questions you would normally ask to identify who the abusive person is. Typically, programs have a policy or practice to determine the abusive party. This usually begins with asking the program participant to identify the abuser. It’s always important to be careful in this assessment, to follow your agency’s policies, and to use your professional training and best judgment.

VAWA regulations specifically state that only the minor’s consent to release information is needed if the minor is legally allowed to access your services on their own without parent notice or permission. No parent or guardian signature is required on releases in those situations.  Remember that the release of information is not to provide services, but to share the program participant’s information with other agencies when requested by the participant. If your organization needs assistance developing a policy on serving minors, please reach out for technical assistance.

If you are able to provide services to a minor without the consent of the parent or guardian, then VAWA allows the minor to sign a release independently. If the services can only be provided with parent/guardian consent, then VAWA requires that the minor and the non-abusive parent/guardian sign the release of information.

VAWA regulation 28 CFR §90.4(b)(3)(ii)(C), provides that if a minor if incapable of knowingly consenting, then the non-abusive parent or guardian signs the consent. It also states that the program should attempt to inform the child, in an age-appropriate way, that the parent/guardian is signing papers to allow you to talk to others in the community. If the child is unable to sign the form, in place of the child’s signature, the provider should note:

• The age of the child,

• The fact that the release was explained to the child, and

• The date. 

The most important thing is to figure out if the person even needs someone else to sign the release of information on their behalf, or if they can sign it themselves.

  Regardless of disability, the only time a guardian is allowed to sign a release is if:

• The person with a disability has been legally adjudicated as unable to sign legal documents, and

• The guardian has been court appointed.

  The best practice is to:

• Ensure involvement of the program participant in all aspects,

• Ensure that they are fully informed, and

• Obtain proof of court-appointed guardianship.

❗ Important ❗ A person with a disability may have a caregiver and still be able to give consent themselves if there has not been a guardian appointed by the court.

  If the person has been found by a court to need a legal guardian and the guardian is a threat, then a new guardian needs to be appointed. Consult with your local disability rights protection and advocacy program to better understand your local laws around guardians and protecting people with disabilities from abusive guardians.

Remember that the release is not to provide services, but to share the program participant’s information with other agencies in the community.

In terms of advocacy and services, there are many things that can be done to address what is happening and to protect the child. Focus on advocacy and non-judgmental supportive practices.

If you are not a mandated reporter, you would only call a CPS hotline with the program participant’s consent. In this context, this means that the program participant who shared information with you gave you instructions to call through a written, informed, time-limited release.

💡Tip💡 If a minor is eligible to work with you without parent/guardian consent, you only need the minor’s consent to call an outside agency.

If a minor is required to have parent/guardian consent to receive your services, you will need the consent of the minor and their non-abusive parent/guardian. Consent may not be given by an abuser.

If you are a mandated reporter under your state’s law, you  are required to make a report to CPS and do not need a release. It is best practice to:

• Inform the program participant that you are making a mandated report.

• Safety plan with the program participant about what comes next after the report is made.

❗ Important ❗ Being compelled to share information (e.g., mandatory reporting) according to state law is an exception to VAWA and VOCA. However, you may only disclose the minimum information that is required under state law.

Best practice is to notify the program participant. If the participant is a minor, also notify the non-abusive parent/guardian unless the participant allowed to work with you without needing parental consent. You should take steps to protect their privacy and safety as much as possible. VAWA requires that agencies make “reasonable attempts” to notify the participant of the report. If it would be dangerous to do so, it could be reasonable to not specifically inform them. For example, it would be reasonable not to inform the survivor if your only way to contact them was by their phone and you know their trafficker monitors their phone.

If you are a mandated reporter, you may make a report to CPS without a release. However, you may only disclose the minimum information necessary under state law. Any information beyond what is required under state law will require a release.

A few state laws require follow-up with CPS during investigations. In these rare instances, you do not need a release for future conversations. However, it is best practice to notify the program participant of your mandate. This includes what steps you must take to fulfill your legal obligation.

If your state does not specifically mandate follow-up with CPS, you would need a release of information in order to provide any information beyond what is required by the report of suspected child abuse or neglect. The participant may decide it is in their best interest to have you share information with CPS and provide written instructions for you to release that specific information.

In assessing what you are required to do, be sure to distinguish between requirements during CPS investigations into suspected child abuse or neglect vs. CPS requests for information when a family has an open case because of abuse or neglect in the past.  It is important to know your state laws and whether your professional role has specific sharing requirements. Check with local legal experts if you are  unsure.

Yes, former program participants are still protected by VAWA confidentiality law. It would be a breach of the former participant’s confidentiality to contact law enforcement or anyone else without a release. Calling law enforcement would reveal that the person previously received services from your organization and reveal a participant’s personally identifying information . This also applies if law enforcement or another agency calls to confirm if someone used your services in the past.

In addition, we know that it is important to respect a program participant’s self-determination in deciding when it is safe and when it is not safe to reach out for assistance, contact a program, or call the police. Doing this without the person’s consent could undermine that self-determination and safety.

💡Tip💡 Even if you are a mandated reporter, a report is only required when there is reasonable suspicion of abuse under the statute. A rumor that abuse is occurring is not typically a basis for a report.

Yes, organizations must have written instructions from a participant on how to share their identifying information. Written instructions may include those signed electronically. See the Basic Release Template section of this document for more information.

All agencies should develop policies and protocols on how to obtain written consent when a participant requests for their individual information with an outside agency over the phone. These will likely incorporate a “case by case” piece, as the best way to obtain consent may vary by individual.  Remember that your organization may be able to make calls to inquire about services and resources without giving out any identifiable information about the participant.

❗ Important ❗ Depending on the situation and community, merely requesting information about a perpetrator may confirm that the program participant is seeking your services. This should be acknowledged and the program participant should be asked if they want the provider to request this information.

In addition, it may be possible and effective to use three-way calling between your own agency, the participant, and another agency from which the participant is seeking information or assistance. This way, the program participant can speak directly to the other agency. A participant can choose to share any of their own information with any agency, including during a three-way call, without a release.

First, consider whether there is another way to meet the program participant’s immediate advocacy needs without releasing their personally identifying information. For example, could the provider:

• Support the participant in making the call to the other agency or professional themselves?

• Use three-way calling to facilitate the connection, so that the participant can provide any personally identifying information themselves?

In cases where you must share personally identifying program participant information, a release is essential. Because VAWA requires a written release, oral releases are not recommended and are never best practice.

💡Tip💡 You can call another service provider and say “I spoke with a participant today who really needs xxx. Can I give them your number and have them call you?”

Yes, and the situation does not need to be urgent. When identifying alternative options to in-person signatures, it’s important to remain survivor-centered in the process. Talk through issues related to preventing impersonation and navigating privacy and safety concerns. Organizations can determine when to suggest an emailed or digitally signed release, but they must ensure that the release was signed by the program participant.

💡Tip💡 In some cases, a trafficker/abuser may be able to access another person’s email account and/or make an email (or digital signature) appear to be from someone else. Confirm an emailed or digitally signed release with the program participant by phone or another means (e.g. video call) prior to sharing their information.

See Digital Written Consent to Share Information to learn more about how programs can provide survivor-centered options to meet participant needs, while also following best practices related to confidentiality.

If a program participant wants an advocate to speak on their behalf in court, the program participant will need to provide the advocate with written instructions on how they want them to participate in court proceedings. Before the hearing, the advocate and the program participant should review what will happen at the hearing, the role of the advocate, and what information the program participant would like shared. If you are appearing in court to support the program participant, but are not actually speaking on behalf of a program participant, notify the program participant that your presence can signal to observers that they are receiving your agency’s services. If you will not be disclosing identifying information, there is no need for a release.

In case of medical emergency, you can contact emergency medical services and tell them the nature of the emergency without telling them identifying information. In many cases, the program participant will be conscious and able to inform EMT staff themselves and decide how much they want to share.

 If a program participant has a medical condition or would like your organization to communicate something to 911 during an emergency, that should be discussed as part of any safety planning discussions. The program participant could give written instructions to share specific information if a medical emergency occurs and the program participant cannot communicate.

Remember that even if it is appropriate to call 911, it is never appropriate to share their whole case history or file. Identifying information is not necessary for 911 to respond. In addition, it is not appropriate to specifically comment on why they were receiving assistance from your organization.

💡Tip💡 A provider can respond “I don’t know” or give non-identifying information (“around 45 years old” instead of actual birth date) when asked these questions by the 911 operator.

Providers may have this discussion, in a delicate way, with a program participant if the program participant is fearful for their life.

❗ Important ❗ It is not best practice to ask every program participant that comes to your program to sign a release of information in the event of death or disappearance. This should only be raised if a participant expresses fear that they become missing or deceased, or if a participant requests it. This should not be a routine practice for all participants.

Safety planning with someone who is concerned they may become missing or deceased may involve the program participant giving written instructions on how the provider should respond.

Discuss how the provider would know if the program participant is missing or deceased vs. if they fled and just didn’t tell anyone. Not knowing and releasing their information could be dangerous to the missing person or surviving family members of a deceased program participant, or to a living participant who has gone into hiding.

Emphasize to program participants that they can change their mind and change their instructions about what you should or should not do if they go missing or are deceased.

VAWA permits disclosure of identifying information to fatality review teams only when specific requirements are met, meaning VAWA confidentiality is expected to be protected after the death of a program participant. Since some jurisdictions also have state-based confidentiality and privilege protections, programs should look to their state law for guidance regarding the survivability of any confidentiality or privilege between a participant and the program.

Yes, oral withdrawal of consent is normal. Less harm (and program liability) can come with withdrawing consent than might result from releasing information without proper consent. This is the case even when waiting to verify the program participant’s identity. Furthermore, when a program participant withdraws consent, it happens immediately, at the time of the request. While withdrawal can be requested orally, best practice is to get it in writing as soon as possible.

The giving or withdrawal of consentforreleaseshouldonlybegivenbytheprogram participant. This makes itimportanttoensure (as in all cases)thatnooneisimpersonatingtheparticipant.Getting the withdrawal in writing can help with this. It is best practice for organizations to  have ways of confirming the participant’s identity.

An emergency contact form should only be used when the program participant wants it used. It cannot be a condition of service. Participants should be explicitly told they have permission to leave it blank if they want to do so.

❗ Important ❗ An emergency contact form is a release of information and must contain all of the required components; it must be informed, written, reasonably time-limited. The circumstances when the emergency contact form is used and the program’s definition of “an emergency” should be made very clear. It may change how the program participant chooses to use or not use the form.

Unencrypted email (which is most email) is not a confidential way to communicate information. Email also encourages long chains of communication. To minimize the amount of information included in email, you can delete the text of the previous message before responding when participant information is being shared, and delete emails regularly to minimize the amount of information being stored. Best practice is to keep all personally identifiable information out of email when possible. For more email best practices, check out Safety Net’s “Best Practices When Using Email.”

If email is often necessary, you may want to consider an encrypted email service that requires passwords to access information. As of April 2026, some examples include Tresorit, Virtru, SecureMyEmail, and Mimecast. You should always do your own due diligence, including on these examples. Products can change or be discontinued, and new products may become available. You can learn more about encryption, and the kinds of encryption best for storing survivor data, with Safety Net’s Encryption Basics for Programs resource.

Participants may request that a program email their identifiable information with a written release of information. Ifaprogram participantasksyoutoshareinformationvia unencrypted email,you shouldinformthemaboutitssecuritylimitations.Regardlessofanyfooteryouplaceinyouremailstatingthatitisprivilegedorconfidentialcommunication,emailcanbebreachedatmultiplepointsduringitstransmission.Confidentialinformationaboutparticipantsshouldnotbeemailed without a participant’s written instruction.

They are bound by the same confidentiality provisions stated in VAWA. The employee should sign the agency’s confidentiality agreement and should receive training on preserving confidentiality.

VAWA regulations require programs to take reasonable measures to prevent inadvertent disclosures of identifiable information to those outsiders.  One way to prevent disclosures to outsiders is to encrypt information and make sure that only the agency holds the key to unlock the encryption.  The contractor should sign a contract that involves acknowledging that they understand and will abide by VAWA confidentiality provisions and can include consequences if those confidentiality provisions are not honored. You can get more information about best practices for agency use of technology at Safety Net's Agency Toolkit.

In general, video surveillance laws are very broad. If a person is in a public place, consent to be recorded is not needed. For example, the street outside of your building is a public place. The interior of your building includes private places, where laws may differ.

Please visit Techsafety.org for more information on best practices for agency use of cameras. Interior cameras are not survivor-centered. This is especially a consideration for participants who may have been monitored by traffickers.

If the external cameras are being used by a victim services agency for security program participants receiving your services should be notified of their  existence and the use of the footage.

• Signs can be posted informing that video surveillance is in use.

• Agencies should have video policies. These policies should be focused on being survivor-centered and maintaining participant confidentiality. They should specify processes on:

  • Video storage (including security policies to protect the data).

  • Retention (including how long you will retain the data).

  • Deletion/disposal (including how and how often you will delete). See the University of California at Irvine’s guidance for proper data disposal.

Releaseswouldbeneededifthevideosweretobesharedoutsideoftheagency. Programs must have a plan to protect confidentiality if a law enforcement agency requests access to surveillance video.

Releases are only required when sharing information outside your agency. However, you need to make sure that:

·       Your agency has full ownership of the data in the database. The vendor should not have any ownership rights.

·       Your agency must ensure that the database (and the information in it) cannot be accessed by anyone else outside your agency (including the vendor). For more information about managing a confidential database, view Safety Net’s resources on Selecting a Database.

If no information is accessible to anyone outside of the program, there is no need for a program participant to sign a release. However, other people having a participant’s personal information, even when it is not being shared, can leave participants feeling vulnerable and disempowered. Sharing the context for why it’s being collected is helpful. Participants should be fully informed of the agency’s data collection processes, the risks and uses of the database, and given the choice to opt out of any data collection that is not necessary for service provision.

Agencies should analyze what information (data) is being collected and why. Some organizations do scheduled review of their forms and database to ensure that they are only collecting minimal data. “Minimal” means what is required to provide the requested services. They also review their data retention policies. This helps ensure that data is only stored for as long as necessary and reduces the work for providers while respecting the privacy of participants. For more information on data retention policies, visit Safety Net’s “FAQs on Record Retention and Deletion.”

Organizations should also think through all data collection and maintenance processes.  TVPA/VAWA regulation 28 CFR § 90.4 requires grantees to take “reasonable efforts to prevent inadvertent releases” of identifying information, especially when using technology to store information.  It is important to safeguard devices used for work to protect participants’ personally identifiable information.

Databases with survivor information should have the data encrypted (locked). Best practice is that only the program’s staff, not the vendor, holds the encryption key.  You can learn more about what these terms mean, and how to implement this practice, via NNEDV’s Safety Net Encryption Basics for Programs resource.  If the database provider holds the key, the agency should take this into consideration when negotiating contracts. Such contracts should have specific confidentiality protections and heightened breach notification procedures.

For more information on databases, see NNEDV’s resources at Safety Net's Agency Use Toolkit or email htconfidentiality@nnedv.org.

Under TVPA/VAWA, the only information a program can release to third-party databases without a release is non-personally identifying information in aggregate form (totals). A third-party database is one that your organization does not own or control. This could include referral databases, databases run by an anti-human trafficking task force, or statewide databases on the prevalence of human trafficking.

An example of aggregate information is “We served 15 adults and 22 children today.” If aggregate information is not identifying, a release from the program participant is not necessary. However, if a government or private funder requires your agency to enter the names and ages for participants into a state database, fulfilling that requirement would violate TVPA/VAWA.

Remember that in some circumstances some aggregate data could be more identifying than you think. This is especially true in small towns or specific cultural communities.

Oregon’s Office of Health Analytics has a useful Small Numbers Reporting Guide that can help you identify what information is non-identifiable and when it needs to be suppressed.

❗ Important ❗ It is not appropriate to ask participants to sign releases for databases that generally support anti-trafficking efforts but do not directly support an individual participant’s goals. This may include third-party state reporting databases. For example, a statewide database that compiles profiles of trafficking program participants to share with law enforcement, may not serve a participant’s individual needs.

Releases are only presented as an option to program participants if the database helps the program participant solve a problem, not to solve agency or funder reporting desires. If a funder is insisting on this information, contact htconfidentiality@nnedv.org for assistance.

If a program participant consents for their personal information to be entered into a third-party database that helps them directly, then the time-limited aspect of the release refers to how long you have to enter the information. Once it is entered into a database, it is likely there to stay. Neither you nor the participant will have control over how long it stays there. Databases offer opportunities for exporting data, creating backup copies in multiple locations, sharing/selling data to outside parties, and merging or re-bundling data. This is something you should investigate with the program participant so they can make an informed decision about participating in the database.

When a program participant expresses a need or desire to have identifying information entered into an outside database (such as a victim notification system), the program should work with them to determine the best way to enter that information.  Before you can enter the information into the database, you should confirm that:

• The data is being entered to meet a survivor-defined goal. Remember that complying with a program’s funding requirements is not a survivor-defined goal).

• The participant is fully informed of all pros and cons of participating in the database, alternative methods to meet the need, and the inability to remove or control information once it is entered.

• The participant understands that this data entry is not a condition of receiving your services, though it may be a requirement of receiving the notification.

• The participant can decide exactly what information is and is not entered. 

If all of the above are confirmed and the participant wishes to have the program enter the information, then you can complete a written, informed release that time-limits when it can be entered. 

For example, if your state has an online system for streamlining housing application processes.  The participant having profile in the database makes finding opportunities much easier for the provider and the application process for the participant significantly easier. Even though completing a profile could make both your job and the client’s search significantly easier, you need a release in order to complete a profile for the participant. During your discussion with the participant about this option, you should make sure they know that you can use it to search for subsidized housing opportunities even without completing a profile for them. You should also make sure they understand that a profile will make it easier to find appropriate opportunities and complete applications. You should discuss with them who will have access to the data, what data they would need to enter, and the potential consequences (if, for instance, the database was hacked or subpoenaed).

❗ Important ❗ Even the program acknowledging that they provided services to a program participant requires a release of information. Discuss the risks of disclosing the receipt of services from the program with the program participant.

The majority of databases used by service providers are cloud-based. Means that you must be careful not to allow the database vendor employees and contractors unrestricted access to program participant identifying information. Doing so would violate TVPA/VAWA confidentiality. It also risks that anyone who gains access to those companies’ computers will have access. 

With databases, it is best practice for you to:

1. Understand potential databases’ security features and customization options. For more information about managing a confidential database, view Safety Net’s resources on Selecting a Database.

2. Choose database systems that do not allow anyone outside your program, including vendors, access to participant information. Doing so requires that the database has particular types of encryption. You can learn more about this issue with Safety Net’s Encryption Basics for Programs guide.

3. Retain control over who within your program is able to see participant information.

Ask potential database providers detailed questions about their team’s access to information (not just what their policies are about access to information).

💡Tip💡 If it is not possible to prevent the database provider’s team from having access at all, consider alternative databases. If these are not an option, ask the database provider how access can be made more restrictive.

If the database provider team can access information, then the agency should include specific confidentiality protections and heightened breach notification procedures in the contract with the provider. Get more information about selecting a database with Safety Net's Agency Toolkit. 

A participant would only need to provide a release of information if the program will be sharing their information with the speaker directly.  Inform program participants before or when they arrive that a guest speaker will be there that day. Tell them the speaker’s name and affiliation. This way, participants can choose whether or not to attend that group. The speaker should sign a confidentiality agreement that outlines the program’s expectations of how the speaker would treat any identifying information they receive or hear during their time at the program. If participants choose to share their personal information to the speaker during or after that session, that is their choice and therefore no release is required.

It is important to distinguish between privilege, privacy, and confidentiality. Confidentiality requires providers to affirmatively protect program participant information. A release from the participant is always needed for a provider to share the participant’s information with another organization. Participants can tell their personal story to whomever they want. However, if a participant shares certain information in some circumstances, this may or may not be interpreted as a waiver under state law of privilege between the participant and the provider. Ask an attorney familiar with your state law around privilege. The information could include:

• Specific details of confidential conversations they had with a provider.

• The particulars of what a provider told them.

Regardless, providers and programs should continue to actively protect information. Share only with releases to ensure compliance with TVPA/VAWA. Respect the program participant’s privacy.

The protections apply to every program participant/survivor/client who requests, receives, or has received services from a direct anti-trafficking services program that receives VAWA or OVC Human Trafficking funds. If the program is part of a larger agency that has many different types of service programs, protections only apply within the anti-trafficking services program, not the whole agency. All participants who use the program’s services should have the same confidentiality protections.

The confidentiality requirements of VAWA apply to all grantees or sub-grantees of those funds. If your organization is an umbrella organization that operates multiple programs, VAWA laws apply to your anti-human trafficking services, violence against women programs, or crime victim programs. Even if VAWA only funds a portion of your victim services, you should provide the same confidentiality protection to all victims who use your services.

Yes. The agency is obligated to follow the confidentiality requirements of VAWA. Every employee or anyone who has access (or potential access) to program participant information (including volunteers, interns, temporary staff, or contracting staff) must follow the VAWA confidentiality provisions.

Your agency should have policies about sharing information internally. In general, information should be shared when it is relevant to:

• Providing requested services to a program participant.

• When a provider needs support from a supervisor or colleague.

• On a limited basis within your agency to help a participant as long as staff are operating under the same confidentiality obligations and disclosure mandates.

It is important to respect the trust that is built between providers and program participants and within support groups. Program participants may share details and information about their situation with certain providers or people within certain settings and still expect a level of discretion.