If you are a non-profit agency that is receiving VAWA, FVPSA, for VOCA funds, you need a written, time-limited, and informed release of information from a survivor to share any individual personally identifying information about that survivor with anyone outside of your agency. This includes even confirming that a particular person is receiving or has received services.

The model release form is available in English and Spanish. Please contact us to receive a copy if you do not have one. If your organization translates the form into other languages, we would love to receive a copy so that we can share it with other organizations.

Yes, the form can be altered to increase accessibility. However, please do not make any adaptations that change the intent of the form.

Yes. The model release is what we recommend as best practice and is consistent with the requirements of VAWA, FVPSA, and VOCA. It helps to ensure that there is informed consent and that the client knows what pieces of information are being released and to whom. Because it is important for survivors to have control of what specific information they would like shared, the more specific the release, the better.

Yes. This is best practice and it is consistent with the requirements of VAWA, FVPSA, and VOCA. If the person or agency to whom the information is being released or the specific information to be shared was not included in the original release of information form that the survivor signed, a new release of information form is needed. While this could add some additional steps for advocates, these steps are designed to protect clients’ personal information.

In addition, advocates can only share the specific information noted in the release form and cannot share information the survivor later reveals to the advocate.

Yes. VAWA, FVPSA, and VOCA require a release to be time-limited, and this is best practice. The release can be reaffirmed and extended if the survivor confirms that it is still valid and authorizes a new expiration date. Releases should not have a standard expiration date (such as “one year from date of signature”) because that is not tailored to the meeting the individual survivor’s needs.

VAWA, FVPSA, and VOCA require releases to be “reasonably time-limited.” Whether a time limit is reasonable should be determined by the purpose of the release and the circumstances of the survivor’s situation.

The length of time that a release is effective should be the minimum length of time necessary under the circumstances, and should be tied to the service the survivor is requesting. It should be as short as necessary to meet the client’s purpose (for example, a release could be for a few minutes, or a few hours, or a few days). This helps to ensure that services are guided by the survivor and take into account situations that may change radically from day to day.

The length of a release is up to the individual survivor. Most disclosures requested by a survivor can be handled right away, so the release does not need to last very long (two weeks to a month is common). If a survivor wants the permission to disclose to last longer, the survivor can make that choice and should not be forced to re-sign multiple short-term releases. In determining the length of the release, put your focus on the survivor’s wishes, goals, and their assessment of relative risk.

VAWA, FVPSA, and VOCA state that releases have to be “reasonably time-limited,” and that means under the circumstances for individual cases and situations. It may be that a 30-day release could be reasonable and appropriate in a situation like this, especially since you have regular phone contact with the survivor.

In addition, it is always good practice to ensure that you regularly check in with survivors to determine whether their circumstances have changed and remind them that they have the right to withdraw that release at any point. This is to ensure that the informed consent is based on up-to-date information.

Discussing with survivors what form of communication will be used when sharing the information in the release ensures that survivors are fully informed of the various confidentiality risks associated with different types of communication. For example, there may be a greater confidentiality risk if documents are shared through an on-line storage site (like Dropbox) than if a phone call is made to that agency. Or, since email is not a secure form of communication, the survivor may be concerned about email, both the email content and attachments. Survivors should be made aware of risks associated with different communication methods and be allowed to choose which are used. Without specifying what form of communication is being used, you may not be giving the survivor the information they need to provide true informed consent.

Best practice is to have a separate form for each agency that the survivor’s information is being released to. This helps ensure that the survivor is fully informed, both of who is receiving their information and of the particular consequences associated with that agency getting the information. If you consistently work with a few particular agencies, individual forms could be developed that list each agency (e.g., one for Section 8 housing, one for the prosecutor, one for the food bank). The benefits and consequences of the release for each agency can then be identified on the form, in addition to being discussed with the survivor before they sign the release.

The only time that individual personally identifying information can be shared by your agency without a release from the survivor is if you are compelled by state law or a court requirement to provide certain information. Mandatory reporting is a common example of a state law that would be an exemption. It is important to note that in most states, a subpoena is not a court order and thus is often not an exemption to the confidentiality obligations. Even where there is a court order, VAWA, FVPSA, and VOCA require programs to take measures to protect privacy, which could include going to court to challenge the validity of the subpoena or court order. VAWA regulations have also interpreted “court mandate” to include a legal requirement created by case law, such as a common law duty to warn.

Different partners in a multi-disciplinary team may have different confidentiality requirements and different mandatory disclosure requirements, and each partner needs to understand their own respective obligations. For example, police and prosecutors do not generally need a release to speak about the case, but an advocate from a non-profit agency can only speak about a survivor if the survivor signed a release of information allowing that disclosure.

However, the non-profit agency or its representatives can talk generally about many things that are useful to the group, such as domestic violence and sexual assault dynamics, services that are available, aggregate totals, and general information that is not personally identifying. The non-profit advocate can also gather information (both by listening and by asking follow-up questions that don’t disclose any survivor identifying information) that is helpful to a survivor in those partnerships and help a survivor decide what information they would like the partnership to know and how that information should be shared.

Regardless of any cooperative or confidentiality agreements, non-profit victim services cannot share personally identifying information with partners of a team (multi-disciplinary team, SART) without a release from the survivor. Such cooperative agreements to not share are typically unenforceable outside of the group, thus putting survivor information at risk of forced disclosure. The survivor needs to request and approve that the non-profit advocate can share identifying information about their case with the team. Survivors should also have the right to choose which aspects of their case are discussed and what members of the team are part of the discussion.

Each participant in the team needs to be aware of their particular confidentiality obligations and needs to obtain their own releases from the survivor to discuss individual information. Survivors need to be informed of every agency that is part of the team and be informed if additional people are added to the team. It can be helpful to have a staff person who is not involved with any specific case to be the member of the team in order to avoid accidental disclosure of details.

An analogy: If your lawyer and your therapist/counselor were to sit on a community health task force together, they could not discuss your private information, the details of your psychological history, your legal advice discussions, or anything else that might be identifying without getting your permission to do so because of their confidentiality obligations.

Quite a bit, actually. You can ask follow-up questions about the information being shared with you. You can discuss general trends in cases. You can address things such as, “I’m hearing that young women on the university campus are having challenges with law enforcement trying to figure out who has jurisdiction: campus police or the municipal police? How do know who has jurisdiction?” You can discuss hypothetical cases, such as how your agency would respond in a variety of situations, and common scenarios, but you cannot discuss anything on any level that would identify individual cases or people. Remember, things like the number of children the survivor has, the faith the survivor practices, or the survivor’s ethnic heritage might be personally identifying, particularly in small communities.

If your agency has an advocate who never works directly with survivors, that person may be the best person to sit on the taskforce because they can provide feedback in these partnerships without accidentally sharing identifying information. It’s important to remember that you need a signed release of information to even share that a particular person has received services from your agency.

Even if the officer knows that the survivor is or was at a non-profit advocacy office, the non-profit advocate cannot share survivor information without a release. The advocate can generally thank the officer for caring about victims, explain that the advocate “can neither confirm nor deny if the survivor is receiving services,” and can offer to take a message and post it on the program’s private bulletin board. The non-profit advocacy program should have a consistent response (e.g., the answer should not differ depending upon the victim) so as to avoid inadvertently providing information about any individual survivor’s location. Non-profit programs should also educate the local police in advance about how they will respond to such requests so it is not surprising to officers when they call.

No. Regardless of the language within a MOU, releases are always necessary to share personally identifying individual client information. However, you can share aggregate information for reporting to funders. Aggregate information are totals, so it’s acceptable to report that your program referred 7 people in a particular month, but it is not acceptable to provide any individual identifying details.

It is important to remember that what is identifying varies from community to community. It is never appropriate to share names, dates of birth, and U.S. social security numbers. Keep in mind that a combination of information could also be identifying; for example, sharing that you served a 42 year-old Caucasian woman with 4 children, ages 11, 9, 8, and 6 or a 32 year-old Asian woman with a 2 year-old could identify them. Individual “de-identified” profiles can be used to re-identify people in other databases (such as HMIS). Communities and agencies should consider what information is identifiable for individuals receiving services, focus on sharing aggregate, non-identifying information, and should always provide the least amount of individual information possible.

The three major U.S. federal funding sources (Office for Victims of Crime, Office on Violence Against Women, and Department of Health and Human Services) do not require you to unduplicate victims between agencies, so there is no need to share personally identifying individual client information to meet federal reporting requirements. In addition, domestic violence programs that receive HUD funding are exempt from entering identifying information into the HMIS database and are not required to participate in tracking client use of services across community agencies.

There is no “arrest warrant” exemption in VAWA, FVPSA, or VOCA. There is no federal obligation or law that requires non-profit advocates to proactively inform the police. Programs should consult a local attorney to determine the intersection between confidentiality obligations, privilege requirements and any state laws about obstruction of justice. If a program becomes aware of a warrant, they can and should notify the victim and help them self-report to the police and/or get legal assistance.

It is absolutely necessary to get a release from a survivor before informing law enforcement of the survivor’s location. Many times, abusers will file missing person reports to try to identify the victim’s location. Victim services programs should proactively educate local law enforcement about how abusers misuse missing person reports, the program’s confidentiality requirements, and collaborate with law enforcement on appropriate protocols when law enforcement suspects a “missing person” is in shelter. If a program becomes aware of a missing persons report, they can and should notify the victim and help them decide whether they can safely notify the police that they are not missing.

First, check and be absolutely sure that you understand your state’s law (including duties established in case law). Some agencies assume that they have a “duty to warn”, but the state law does not actually support that assumption. If you reveal confidential survivor information without a specific state law mandate or without having a signed release of information, it may be a violation of VAWA, FVPSA, VOCA or state law. Some states require reporting to police or to the intended victim of the threat if a survivor is in imminent danger of harming themselves or others, and in that case the report would be an exemption to the confidentiality requirements. In other words, if you are legally mandated to report this situation, then you may do so without a release. Check with your state coalition if you are unsure if your state has a duty to warn law that applies to you, and make sure you know exactly what it requires you to do. VAWA, FVPSA, VOCA require that you only disclose the minimum amount of information necessary to comply with the actual law.

Survivors should be informed of the confidentiality limitations that pertain to victim assistants (victim/witness advocates) employed by a prosecutor’s office. Victim/witness advocates do not necessarily need to obtain a release of information form to share survivor information, but they are required to give notice. It is best practice to provide written information to survivors about what happens with their information and get signatures from survivors indicating that they have read and understand your data collection/information sharing practices. If any or all of the information they provide to you could possibly be released to other parties (including the attorneys in the prosecutor’s office), inform the victim of this before they choose to begin working with you.

When communicating with victims, it is important to distinguish between a “policy” of not sharing information, a law prohibiting the sharing of information, and any laws requiring the sharing of information (such as constitutional requirements that law enforcement share information with criminal defendants).

While it is common for non-profit advocates to have workspaces in courthouses, prosecutor offices, police departments, or other locations, your physical location does not change your confidentiality obligations. If you are employed by the non-profit organization, the VAWA, FVPSA, and VOCA confidentiality protections still apply, and you are not able to share information with the prosecutor or anyone else in co-located situations (including advocates from other agencies) without a written, specific, time-limited, signed release of information. Co-locating has many benefits, but also some challenges, and non-profit advocates must prevent accidental disclosure of confidential client information outside of the personnel within your agency.

Some organizations, such as law enforcement, may not need a release form signed to be able to share limited information, but the partnering non-profit program would need a release on their end to share any identifying information.

For two agencies that are both required to have releases, it is always best practice for each agency to have its own release. This ensures that survivors are fully informed by each agency of their respective obligations and the specific information to be released by each agency.

Keep in mind that you must ensure there is a truly informed release to share information; if another agency obtains a release from the survivor for you to share information with them, it is your responsibility to communicate with the survivor about risks/benefits, choices, and reasonable time-limits.

Yes. VAWA, FVPSA, and VOCA all state that “consent for release may not be given by the abuser of the minor, person with a disability, or the abuser of the other parent of the minor.”

No. VAWA/FVPSA only requires the signature of one non-abusive parent and the minor child to authorize release of a child’s information.

VAWA and VOCA regulations specifically state that only the minor’s consent to release information is needed if the minor is legally allowed to access your services on their own without parent notice or permission. No parent or guardian signature is required on releases in those situations. If you are unsure of your state law, contact your state coalition. Remember that the release of information is not to provide services, but to share the survivor’s information with other agencies when necessary.

VAWA, FVPSA, and VOCA require that the minor and the non-abusive parent sign the release of information. VAWA regulation 28 CFR §90.4(b)(3)(ii)(C), provides that if a minor if incapable of knowingly consenting, then the non-abusive parent or guardian signs the consent and the program should attempt to inform the child, in an age-appropriate way, that the parent/guardian is signing papers to allow you to talk to others in the community. If the child is unable to sign the form, in place of the child’s signature, the advocate should note the age of the child, the fact that the release was explained to the child, and the date.

As stated in the previous answer, it is important to recognize that if you are able to provide services to a minor without the consent of the parent or guardian, then VAWA allows the minor to sign a release independently. Both the minor and parent or guardian would sign when services can only be provided with the parent or guardian’s consent, or if both the minor and the parent or guardian are receiving services.

If you are working with a minor or a person who has a disability, ask all the questions you would normally ask to identify who the abusive person is. Typically, programs have a policy or practice to determine the abusive party. This usually begins with asking the survivor to identify the abuser. It’s always important to be careful in this assessment, to follow your agency’s policies, and to use your professional training and best judgment.

The most important thing is to figure out if the person even needs someone else to sign the release of information on their behalf, or if they can sign it themselves. Regardless of disability, the only time a guardian is allowed to sign a release of specific information is if the person with a disability has been legally adjudicated as unable to sign legal documents and the guardian has been court appointed.

The best practice is to ensure involvement of the survivor in all aspects, ensure that they are fully informed, and obtain proof of court-appointed guardianship. A person with a disability may have a caregiver and still be able to give consent themselves if there has not been a guardian appointed by the court.

If the person has been found by a court to need a legal guardian and the guardian is a threat, then a new guardian needs to be appointed.

Remember, the release is not to provide services, but to share the survivor’s information with other agencies in the community.

The requirements apply to all VAWA, FVPSA, or VOCA grantees and sub-grantees that are serving victims with VAWA, FVPSA, or VOCA funding. All agencies should develop policies and protocols for determining on an individual basis how to obtain consent when talking with a survivor by phone. Your organization may be able to make calls to inquire about services and resources without giving out any identifiable information about the survivor. Although, depending on the situation and community, merely obtaining information about a perpetrator may confirm that the victim is seeking your services. This should be acknowledged and the survivor notified.

In addition, it may be possible and effective to use three-way calling so that the survivor can speak directly to the agencies from which they are seeking information or assistance.

Remember: Releases are only needed when you’re sharing a survivor’s personally identifying or confidential information with someone else. If you are providing information to a survivor, no release is needed.

The first question that should be asked before any release of information is obtained (written or oral) is whether there is another way to meet the survivor’s immediate advocacy needs without the agency releasing personally identifying information about the survivor. For example, could the advocate support the survivor and help them make the call and talk to the other agency or professional themselves? Your agency could also use three-way calling to facilitate the connection and the survivor can provide all personally identifying information themselves.

It’s perfectly reasonable to call another service provider and say “I spoke with a woman today and she really needs xxx. Can I give her your number and have her call you?” In cases where you must share personally identifying client information, a release is essential. Because VAWA, FVPSA, and VOCA require a written release, oral releases are not recommended and oral releases are never best practice.

The best practice is to have a signed release in your file that is signed in-person. Organizations can decide on an individual basis when to accept an emailed or digitally signed release, but they must ensure that the release was signed by the survivor. Since abusers can easily access another person’s email account and/or make an email (or digital signature) appear to be from someone else, always confirm an emailed or digitally signed release with the survivor by phone prior to sharing survivor information.

Because VAWA, FVPSA, and VOCA require a written release, oral releases are not recommended and oral releases are never best practice. However, programs that do, on rare occasion, use oral releases generally go through the full release form, reading it aloud over the phone, and then note on the signature line that oral consent was given and the date it was given. The advocate should verify the person’s identity before reading the form and signing it, and ensure that the survivor signs the form at the next possible opportunity.

Non-profit based court advocates who are allowed by state law to speak in court on behalf of a survivor should have a release of information from the survivor and consent to appear in court. Before the hearing, the advocate should review with the survivor what will happen at the hearing, the role of the advocate, and what information the survivor would like shared. If you are appearing in court to support the survivor, but are not actually speaking on behalf of a survivor, it’s important to notify the survivor that your presence can signal to observers that they are receiving your agency’s services.

You can contact emergency medical services and tell them the nature of the emergency without telling them identifying information. In many cases, the survivor will be conscious and able to inform EMT staff themselves and decide how much they want to share. It is important to remember that even if it is appropriate to call 911, it is never appropriate to share their whole case history or file. Identifying information is not necessary for 911 to respond. What some advocates do is to respond “I don’t know” or give non-identifying information (“around 45 years old” instead of actual birth date) when asked these questions by the 911 operator. In addition, it is not appropriate to specifically comment on why they were receiving assistance from your organization.

Advocates may have this discussion, in a delicate way, with a survivor if the survivor is fearful for their life. It is not best practice to ask every survivor that comes to your program to sign a release of information in the event of death or disappearance. It is a best practice to ask the survivor what they would want the advocate and program to do with their information in the case that something happens to them. It would be important to discuss how the advocate would know if the survivor is missing or deceased or if they fled and just didn’t tell anyone. Not knowing and releasing their information could be dangerous to the missing person or surviving family members of a deceased victim, or to a living victim who has gone into hiding. Additionally, emphasize to clients that they can change their mind and change their instructions about what you should or should not do if they go missing or are deceased.

FVPSA and VOCA confidentiality provisions do not address the issue of deceased victims. VAWA 2022 and regulation 28 CFR §90.4 permits disclosure of identifying information to fatality review teams only when specific requirements are met, indicating that VAWA confidentiality is expected to be protected after death of a client. Since most jurisdictions also have state-based confidentiality and privilege protections, a nonprofit DV/SA program should look to their state law for guidance regarding the survivability of any confidentiality or privilege between a victim and the program.

Less harm (and program liability) can come with withdrawing consent (even when waiting to verify the survivor’s identity) than might result from releasing information without proper consent. Furthermore, when a survivor withdraws consent, it happens immediately, and although the withdrawal should be reduced to writing, the withdrawal of release goes into effect at the time of request.

Consent for release of personal information or withdrawal of consent should usually ONLY be given by the victim, so it’s important to ensure, as always, that no one is impersonating the victim. Best practice is to get the withdrawal in writing as soon as possible.

Releases are only required when sharing information outside your agency, but your agency should have full ownership of the database and must ensure that it (and the information in it) cannot be accessed by anyone else outside your agency. Additionally, best practice is to always get consent by a survivor, or at least provide notice, for all the ways their personal information may be collected or shared. Collecting personal information, even when it’s not being shared, can leave survivors feeling vulnerable and disempowered so sharing the context for why it’s being collected is helpful. Survivors should be fully informed of the agency’s data collection processes and of the risks and the uses of databases.

Organizations should analyze what information is being collected and for what purposes. Some organizations do a periodic assessment of their forms and database to ensure that they are only collecting the minimal information required to provide the requested services. This both minimizes the work for advocates and respects the privacy of survivors.

It is also important for agencies to think through all data collection and maintenance processes. Databases should be maintained by and within individual agencies. VAWA regulation 28 CFR § 90.4 requires grantees to take “reasonable efforts to prevent inadvertent releases” of identifying information, especially when using technology to store information. It is important to safeguard computers to protect victims’ personally identifiable information. For example, many local programs keep sensitive client-level information on computers that are not connected to the Internet. Programs that need to use cloud-based databases should have the data encrypted (locked) and only the program’s staff holds the encryption key. For more information on databases, see NNEDV’s resources on databases and confidentiality at Agencies’ Use of Technology: Best Practices & Policies Toolkit or contact us.

If the information entered into the database is only from public records and you are a government agency, it may be possible to enter survivor’s personally identifying information without a release of information. However, as a best practice, it is important that survivors are notified that their information will be entered into this database. In addition, provisions should be made for cases where the record is sealed or where the abuser works in the system (courts, law enforcement, etc.) and, if possible, a survivor should be allowed to opt out of having their information collected and maintained in this way.

If you are a government entity and a survivor’s information is entered erroneously into a database or that database is breached, you could be liable. It is also important to consider that the information in the database could be subject to a request under the state’s sunshine laws from the media or any citizen.

Survivors should be informed of all uses of their information, as well as the consequences of that data collection, and should be able to decline. Agencies using survivor information should have policies and procedures to protect the information from intentional or unintentional disclosure. Victims may assume that going to court has some level of public disclosure, but they may not have the same assumption about the compilation of the information made by your government office. Therefore, they should be given notice about the information that is being compiled, and you and they should both recognize that, depending on what is collected and how it is maintained, it could become even more harmful if it gets released or used in ways that were unintended.

It also is important to ensure that the information going into the database is only information that is of public record and nothing additional. Whenever contemplating the creation of a database, you should weigh the benefits of collecting and storing the information with the consequences of having the information being used and accessed in ways that are unanticipated. Whether it is helpful to an agency is not the standard for determining whether confidentiality requires a release of information from or notice to an individual whose information is being used, compiled, or shared.

Under VAWA, FVPSA, and VOCA, the only information a program can release to third-party state reporting databases is non-personally identifying information in aggregate form (totals). For example, “We served 15 women and 22 children today.” Since aggregate information is not identifying, a waiver from the survivor is not necessary.

Inherently, databases are not time limited. Once information is entered into a database, it is there to stay. Databases offer multiple opportunities for exporting data, creating many backup copies in multiple locations, and merging or rebundling data. Even if a survivor’s information is later deleted, chances are that a backup of the database has been created at some point and the information will be stored for as long as that backup is retained by the agency administering the databases. For this reason, a release to input personally identifying information into a shared database outside of the agency cannot be time-limited, and therefore it is not a valid release under VAWA, FVPSA, and VOCA. State confidentiality laws may have additional requirements as well.

Where a survivor expresses a need or desire to have identifying information entered into an outside third-party database (such as a victim notification system), the program should work with the survivor to determine the best way to make that information entry. Before an advocate or employee of the program can enter the information into the database for the survivor, you should confirm that: 1) the data is being entered to meet a survivor-defined goal (remember: complying with a program’s funding requirements is not a survivor-defined goal); 2) the survivor is fully informed of all pros and cons of participating in the database, alternative methods to meet the need, and the inability to remove or control information once it is entered; 3) the survivor understands that this data entry is not a condition of service, and the survivor can decide exactly what information is entered and what information is not entered. If all of the above are confirmed and the survivor wishes to have the program enter the information, then a written, informed release that time-limits when the information can be entered needs to be completed.

Note: Even the program acknowledging that they know a survivor counts as a release of information. The risks of disclosing the receipt of services from the program need to be discussed with the survivor.

No, this is not allowable under VAWA, FVPSA, or VOCA. Entering client information into this database would probably violate VAWA, FVPSA, and VOCA as well as state law provisions in many states. You should contact your grant program manager to discuss this.

If you are not a mandated reporter, you need a written, informed, time-limited release to call the Child Protective Services (CPS) hotline; you cannot call CPS or some other outside agency unless you get the consent of the child and the non-abusive parent/guardian of a minor (or just the teen if they are allowed to work with you without needing parental consent). Consent may not be given by an abuser. In terms of advocacy and services however, there are many other things that can be done to address what is happening and to protect the child.

If you are a mandated reporter under your state’s law, you may make a report to CPS without a release.

Being compelled to share information according to state law is an exception to VAWA, FVPSA, and VOCA, and mandatory reporting laws are an example. However, you may only disclose the minimum information required under state law.

Best practice is to notify the victim and the non-abusive parent/guardian of a minor and to take steps to protect their privacy and safety as much as possible. VAWA, FVPSA, and VOCA require that agencies make “reasonable attempts” to notify the survivor of the report. If it would be dangerous to do so, it could be reasonable to not specifically inform them. Best practice would also be to give the survivor an opportunity to self-report and use other services. A few state laws require follow-up with CPS and in these rare instances, you would not need a release for future conversations; although you would be obligated to notify the survivor of your mandate and what steps you must take to fulfill your legal obligation.

If you are a mandated reporter, you may make a report to CPS without a release. However, you may only disclose the minimum information necessary under state law. Any information beyond what is required under state law will require a release.

A few state laws require follow-up with CPS during investigations and in these rare instances, you would not need a release for future conversations; although you would be obligated to notify the survivor of your mandate. If your state does not specifically mandate follow-up with CPS, you would need a release of information in order to provide any information beyond what is required by the report of suspected child abuse or neglect. In assessing what you are required to do, be sure to distinguish between requirements during CPS investigations into suspected child abuse or neglect vs. CPS requests for information when a family has an open case because of abuse or neglect in the past. It is important to know your state laws and whether your professional role has specific confidentiality requirements. Check with your U.S. state or territorial coalition if you are not sure.

Yes, former clients are still protected by confidentiality laws. Yes, it would be considered a breach of confidentiality to contact law enforcement or anyone else without a release. Calling law enforcement would reveal that the person previously received services from your organization. Without consent from the former client, you would be violating their confidentiality. This also applies if law enforcement or another agency calls to confirm if someone used your services in the past.

In addition, we know that it is important to respect a survivor’s self-determination in deciding when it is safe and when it is not safe to reach out for assistance, contact a program, or call the police. Doing this without the person’s consent could undermine that self-determination and safety. It is also important to recognize that even if you are a mandated reporter, that a report is only required when there is suspected abuse under the statute. A rumor that abuse is occurring is not a basis for a report.

Do you explain to each person before filling out the emergency contact sheet that not returning or not communicating with the program is considered an emergency and the contact person will be contacted at that point, thereby informing them that the person is or was in your shelter? The circumstances when the emergency contact form is used and the program’s definition of “an emergency” should be made very clear, as it may change the person who gets listed on the form. The emergency contact form should only be used when the survivors wants it used, it cannot be a condition of service, and survivors should be explicitly told they have permission to leave it blank if they want to do so.

A best practice would be to have an informed, written, reasonably time-limited “Emergency Contact Release” that is the same as a release of information. The form should be along these lines: “In the event that I do not return to the program, I will call the program to let them know I am safe. In certain circumstances, the program is allowed to contact the following person/s. This emergency contact will be valid for the next __ days. The circumstances are….” The advocate should have a conversation with the survivor about the risks and benefits of signing the release, its time limits, and how the advocate would know whether the survivor has purposely left shelter and is ok so that the advocate does not assume an emergency when there is no emergency. In addition, the advocate and survivor should discuss what the program should do if the victim’s identified emergency contact does not know where the victim is and what actions the program will take. A survivor can choose not to name an emergency contact person, and the program cannot make consent to release information to an emergency contact a condition of services.

No, unless the agency is going to be sharing individually identifying information with the speaker (like a list of people who are attending the group). If clients are informed when they arrive that a guest speaker will be there that day and are told the name of the speaker and the speaker’s affiliation, the clients can choose whether or not to attend that group. The speaker should sign a confidentiality agreement. If the clients choose to share their personal information to the speaker during or after that session, that is a choice they make and therefore no release is required.

Because confidentiality requires advocates to affirmatively protect survivor information, a release from the survivor is always needed for an advocate to share a survivor’s information with another advocate or another organization. Survivors can tell their personal story to whomever they want. However, if a survivor shares specifics of confidential conversations they had with an advocate or the particulars of what an advocate told them, in some circumstances this may or may not be interpreted as a waiver under state law of privilege between the survivor and the advocate. Regardless, advocates and programs should continue to actively protect information and share only with releases to ensure compliance with VAWA, FVPSA, VOCA, and respect the survivor’s privacy.

The protections apply to every survivor/client who requests, receives, or has received services from a victim services program that receives VAWA, FVPSA, or VOCA funds. If the program is part of a larger agency that has many different types of service programs, it would only apply within the victim services program, not the whole agency. All survivors who use the program’s services should have the same confidentiality protections.

The confidentiality requirements of VAWA, FVPSA, and VOCA apply to all grantees or sub-grantees of those funds. If your organization is an umbrella organization that operates multiple programs (Salvation Army, YWCA, etc.), VAWA, FVPSA, VOCA laws apply to your victim services, violence against women programs, or crime victim programs. Even if VAWA, FVPSA, or VOCA only funds a portion of your victim services, you should provide the same confidentiality protection to all victims who use your services.

Yes. Every employee or anyone who has access (or potential access) to client information (including volunteers, interns, board members, temporary staff, or contracting staff) must follow the VAWA, FVPSA, and VOCA confidentiality provisions. The agency is obligated to follow the confidentiality requirements of VAWA, FVPSA, and VOCA.

Under VAWA regulation 28 CFR §90.4, personally identifying information entrusted by victims to a victim services program within a larger multi-disciplinary organization cannot be shared outside of the victim services unit unless the victim gives an informed, written, reasonably time-limited release to do so. Other parts of the organization may have different legal requirements and professional approaches to protection and mandatory disclosure of identifying information about victims. Disclosures outside of the non-victim services unit could result in the information becoming more public and being used in ways that could harm the survivor.

VAWA recognizes that, in rare occasions, it may be necessary to share information with organizational leaders who are not in the victim services unit but oversee the unit. Such executive leaders should have access to identifying information only in rare and extraordinary circumstances. Routine monitoring and supervision are not considered to count as a rare or extraordinary circumstance.

Email is absolutely not a confidential way to communicate information, and best practice is to keep all personally identifiable information out of email. If a victim asks you to share information via email, you should inform them about the security limitations of email. Regardless of any footer you place in your email stating that it is privileged or confidential communication, email can be breached at multiple points during its transmission. Confidential information about clients should never be emailed.

If individual IT personnel are contractors or employees of the domestic violence or sexual assault organization, they are bound by the same confidentiality provisions stated in VAWA, FVPSA, and VOCA and should sign the agency’s contractor confidentiality agreement acknowledging that they understand and will abide by those confidentiality provisions. If IT personnel outside the agency work on your systems in remote locations, VAWA regulations requires programs to take reasonable measures to prevent inadvertent disclosures of identifiable information to those outsiders. One way to prevent disclosures to outsiders is to encrypt information and make sure that only the agency holds the key to unlock the encryption. You can get more information about best practices for agency use of technology in the toolkit at Agencies’ Use of Technology: Best Practices & Policies Toolkit.

If you outsource your database and storage of client information to a cloud-based provider, you may be violating VAWA/FVPSA/VOCA confidentiality by giving all the employees of that company and the employees of their sub-contractor companies access to all of the survivor identifying information in your database, and risking that anyone who hacks those companies’ computers will gain access. With databases, it is best practice for the program to 1) understand how the database system actually works, 2) retain control over who is able to see survivor information, and 3) choose database systems that do not give IT personnel who are outside of the program’s control access to survivor information. Ask any database provider detailed questions about how their team is able to access information (not just what their policies are about access to information) and ask them how access can be made more restrictive. Get more information about selecting a database in the toolkit on agency use of technology at Agencies’ Use of Technology: Best Practices & Policies Toolkit.

You can share information with your supervisor or team; although it is best practice that information be shared on a “need-to-know” basis. Agencies should have a policy in place about internal information sharing. For example, it may be appropriate to inform a supervisor or colleague of the status of an individual’s court case or if they are possibly suicidal. It may not be necessary or appropriate, however, to share with a supervisor or co-worker that an individual told you they are an incest survivor in addition to recent violence that brought them to your program.

To share information with an advocate at another agency, you will always need a release.

Your agency should have policies about sharing information internally. In general, information should be shared when it is relevant to providing requested services to a survivor or when an advocate needs support from a supervisor or colleague. Sharing limited information to help a client is permissible within your agency. For example, for grant purposes, the bookkeeper may need to know if the client is receiving services for domestic violence or sexual assault; however, the bookkeeper does not need to know the details of the abuse.

It is important to respect the trust that is built between advocates and survivors and within support groups. Survivors may share details and information about their situation with certain advocates or people within certain settings and still expect a level of discretion.

First, have a plan, including an attorney to call in the event that a subpoena is received. Your plan should start with seeking to find out the wishes of the person’s whose information is sought. If you cannot contact that person or the person does not want to share the information, then get legal advice and assess the best means to resist the subpoena. Strategies could include: contacting the attorney who issued it and asking them to rescind it, challenging service, filing a motion to quash the subpoena with the court, seeking other types of orders to protect the information, working with the survivor whose information is sought to determine their position and whether she they will also be resisting the request for information, among other actions. Whatever you do, do not ignore the subpoena and hope it will go away on its own, and certainly don’t destroy documents that may be subject to a subpoena once it has been served on your agency. To request additional technical assistance (for you or your attorney), contact us.

In general, video surveillance laws are very broad. Anytime a person is in a public place, consent to be recorded is not needed. For example, the street outside of your building is a public place where there may be a security camera that shows who comes and goes.

However, if the cameras are being used by a non-profit agency for security, survivors receiving your services should be notified of its existence and the use of the videotapes. Signs can be posted informing that video surveillance is in use, and agencies should have policies developed that specify the video storage, retention, and deletion processes, which should be focused on maintaining survivor confidentiality. Releases would be needed if the videos were to be shared outside of the agency.

In terms of confidentiality, the strongest and most protective law is what should be followed. So, if you are in a state with strong confidentiality or privilege laws that are more protective than VAWA, FVPSA, or VOCA, then your state laws should be followed. If you are in a state that has weak or not as strong confidentiality provisions as VAWA, FVPSA, and VOCA, then the federal protections should be followed. Either way, state and federal laws can inform best practices about protection of confidential, survivor information, such as the use of written, informed, and reasonably time-limited releases of information.