FAQ's on Survivor
& The Safety Net Project
at the National Network to End Domestic Violence
What this is:
This document addresses common questions regarding confidentiality and releases of information. It takes into account the confidentiality and privacy provisions in the U.S. federal Violence Against Women and Department of Justice Reauthorization Act of 2013 (VAWA 2013) and the Family Violence Prevention Services Act of 2010 (FVPSA 2010). In analyzing the meaning and application of the confidentiality and privacy provisions of these statutes, their purpose (to protect adult, youth, and child victims of domestic violence, dating violence, sexual assault, or stalking and their families) must be kept at the forefront.
What this is not:
Confidentiality and privilege laws vary from state to state, as do other laws that may be impacted by this legislation. The National Network to End Domestic Violence (NNEDV) is not an expert on individual state laws and does not provide legal advice to VAWA and FVPSA grantees. The analysis below is not intended to be a substitute for local, legal advice from an attorney who is familiar with a particular jurisdiction’s laws related to confidentiality and privilege of victim/victim advocate relationships. If you have specific questions or situations that you wish to discuss further, please feel free to contact NNEDV’s Safety Net Project: firstname.lastname@example.org.
In general, this information is intended for advocates employed by nonprofit agencies. Nevertheless, it is also important for other partner agencies and professionals to understand as well. As a partner of a nonprofit agency, when requesting information from another agency, you want to be sure that the information you’re getting has been obtained properly. Furthermore, it is important for partners to understand that nonprofit advocates must abide by certain legal limitations when releasing information.
U.S. state, territorial, and federal laws and regulations apply. Laws may apply differently to different partners who work with survivors.
An agency cannot require a survivor to provide a release of information in order to receive services.
Survivors should be notified of what information a program has about them and how their information will be used.
Releases of information should be client-centered to enhance services provided to the survivor and not for the sole purpose of easing the program’s administration.
Always consider the most protective privacy option. Before obtaining a release of information, determine whether there is another way to accomplish the purpose without the advocate or agency releasing the survivor’s personally identifying information.
Releases of information must be written, informed, and reasonably time-limited.
A release of information is required if an agency or advocate is asked by the survivor to release specific pieces of their individual personally identifying information outside of the advocate’s own agency or program.
A release of information may not be required if there is a court mandate or statutory obligation to report, such as suspected child abuse or neglect.
Survivors should be notified when a release is made under a court mandate or statutory obligation.
Whenever releasing information about a survivor, programs and advocates should keep in mind the “minimum necessary concept,” meaning that even with a release or mandatory report, share only the information necessary to accomplish the survivor’s purpose or to meet the requirements of the reporting obligation, and only have that release open for the amount of time necessary to meet the survivor’s needs.
Table of Contents
(Use this to navigate to a specific section. Within sections, click on the question to view the answer and more information.)
Basic Release Template:
Q: When is a release required under VAWA 2013/FVPSA 2010?
A: If you are a non-profit agency that is receiving VAWA or FVPSA funds, you need a written, time-limited, and informed release of information from a survivor to share any individual personally identifying information about that survivor with anyone outside of your agency. This includes even confirming that a particular person is receiving or has received services.
Q: Is the release template available in other languages?
A: The model release form is available in English and Spanish. Please email email@example.com to receive a copy if you do not have one. If your organization translates the form into other languages, we would love to receive a copy so that we can share it with other organizations.
Q: Do we have permission to alter the form (e.g., increase the font size) for those who may have difficulty seeing the information?
A: Yes, the form can be altered to increase accessibility. However, please do not make any adaptations that change the intent of the form.
Q: The model release seems to be very precise, lending to a very limited scope of information that could be shared. Is this necessary?
A: Yes. The model release is what we recommend as best practice and is consistent with the requirements of VAWA and FVPSA. It helps to ensure that there is informed consent and that the client knows what pieces of information are being released and to whom. Because it is important for survivors to have control of what specific information they would like shared, the more specific the release, the better.
Q: Is it necessary to complete a new release any time a different person needs to be contacted at one agency or anytime a new piece of information needs to be exchanged?
A: Yes. This is best practice and it is consistent with the requirements of VAWA and FVPSA. If the person or agency to whom the information is being released or the specific information to be shared was not included in the original release of information form that the survivor signed, a new release of information form is needed. While this could add some additional steps for advocates, these steps are designed to protect clients’ personal information.
In addition, advocates can only share the specific information noted in the release form and cannot share information the survivor later reveals to the advocate.
Q: Is it necessary to have an expiration date on the release of information?
A: Yes. VAWA and FVPSA require a release to be time-limited, and this is best practice. The release can be reaffirmed and extended if the survivor confirms that it is still valid and authorizes a new expiration date.
Q: What is a proper length of time for a release to be valid?
A: VAWA and FVPSA require releases to be “reasonably time-limited.” Whether a time limit is reasonable should be determined by the purpose of the release and the circumstances of the survivor’s situation. The length of time that a release is effective should be the minimum length of time necessary under the circumstances, and should be tied to the service the survivor is requesting. It should be as short as necessary to meet the client’s purpose (for example, a release could be for a few minutes, or a few hours, or a few days). This helps to ensure that services are guided by the survivor and take into account situations that may change radically from day to day.
In general, there is no reason a waiver should ever be more than 15 days or 30 days since the release can be reaffirmed and extended if the survivor confirms that the release is still valid and authorizes a new expiration date.
Q: What if I only see a client in person once a month but do phone counseling on a regular basis? Some of the survivors we work with are from a rural area and it can be difficult to get a release signed every time the survivor wants information released. In those situations, is it appropriate for the release to be for longer than a few days?
A: VAWA and FVPSA state that releases have to be “reasonably time-limited,” and that means under the circumstances for individual cases and situations. It may be that a 30-day release could be reasonable and appropriate in a situation like this, especially since you have regular phone contact with the survivor.
In addition, it is always good practice to ensure that you regularly check in with survivors to determine whether their circumstances have changed and remind them that they have the right to withdraw that release at any point. This is to ensure that the informed consent is based on up-to-date information.
Q: Why should we specify the form of communication that a release will take?
A: Discussing with survivors what form of communication will be used when sharing the information in the release ensures that survivors are fully informed of the various confidentiality risks associated with different types of communication. For example, there may be a greater confidentiality risk if documents are shared through an on-line storage site (like Dropbox) than if a phone call is made to that agency. Or, since email is not a secure form of communication, the survivor may be concerned about email, both the email content and attachments. Survivors should be made aware of risks associated with different communication methods and be allowed to choose which are used. Without specifying what form of communication is being used, you may not be giving the survivor the information s/he needs to provide true informed consent.
Q: What is best practice: having a separate release for each agency the survivor’s information is being released to or having several agencies listed on one form?
A: Best practice is to have a separate form for each agency that the survivor’s information is being released to. This helps ensure that the survivor is fully informed, both of who is receiving her/his information and of the particular consequences associated with that agency getting the information. If you consistently work with a few particular agencies, individual forms could be developed that lists each agency (e.g., one for Section 8 housing, one for the prosecutor, one for the food bank). The benefits and consequences of the release for each agency can then be identified on the form, in addition to being discussed with the survivor before s/he signs the release.
Q: When can information be shared outside our agency without a release?
A: The only time that individual personally identifying information can be shared by your agency without a release from the survivor is if you are compelled by state law or a court order to provide certain information. Mandatory reporting is a common example of a state law that would be an exemption. It is important to note that in most states, a subpoena is not a court order and thus is often not an exemption to the confidentiality obligations. Even where there is a court order, VAWA and FVPSA require programs to take measures to protect privacy, which could include going to court to challenge the validity of the subpoena or court order.
Confidentiality & Partnerships:
Q: If a community pulls together a team of representatives from law enforcement, victim services, prosecution, and courts, are the victim services representatives prohibited from speaking about the victim without a release?
A: Different partners in a multi-disciplinary team may have different confidentiality requirements, and each partner needs to understand his/her own respective obligations. For example, police and prosecutors do not generally need a release to speak about the case, but an advocate from a non-profit agency can only speak about a survivor if the survivor signed a release of information allowing that disclosure.
However, the non-profit agency or its representatives can talk generally about many things that are useful to the group, such as domestic violence and sexual assault dynamics, services that are available, aggregate totals, and general information that is not personally identifying. The non-profit advocate can also gather information that is helpful to a survivor in those partnerships and help a survivor decide what information s/he would like the partnership to know and how that information should be shared.
Q: What if there’s a cooperative agreement form signed by all professionals involved stating that any information shared during the meeting will not be shared outside of the meeting?
A: Regardless of any cooperative or confidentiality agreements, non-profit victim services cannot share personally identifying information with partners of a team (multi-disciplinary team, SART) without a release from the survivor. Such cooperative agreements to not share are typically unenforceable outside of the group, thus putting survivor information at risk of forced disclosure. The survivor needs to request and approve that the non-profit advocate can talk about his/her case with the team. Survivors also have the right to choose which aspects of their case are discussed and what members of the team are part of the discussion.
Each participant in the team needs to be aware of his/her particular confidentiality obligations and needs to obtain his/her own releases from the survivor to discuss individual information. Survivors need to be informed of every agency that is part of the team and be informed if additional people are added to the team. It can be helpful to have a staff person who is not involved with any specific case to be the member of the team in order to avoid accidental disclosure of details.
An analogy: If your primary care doctor, your lawyer, and your therapist/counselor were to sit on a community health task force together, they could not discuss your private information, the details of your medical or psychological history, or anything else that might be identifying without getting your permission to do so because of their confidentiality obligations.
Q: What information can we discuss with our task force partners without a release?
A: Quite a bit, actually. You can ask follow-up questions about the information being shared with you. You can discuss general trends in cases. You can address things such as, “I’m hearing that young women on the university campus are having challenges with law enforcement trying to figure out who has jurisdiction: campus police or the municipal police? How do know who has jurisdiction?” You can discuss hypothetical cases, such as how your agency would respond in a variety of situations, and common scenarios, but you cannot discuss anything on any level that would identify individual cases or people. Remember, things like the number of children the survivor has, the faith the survivor practices, or the survivor’s ethnic heritage might be personally identifying, particularly in small communities.
If your agency has an advocate who never works directly with survivors, that person may be the best person to sit on the taskforce because he or she can provide feedback in these partnerships without accidentally sharing identifying information. It’s important to remember that you need a signed release of information to even share that a particular person has received services from your agency.
Q: If a police officer drives a survivor to a non-profit DV/SV program and later calls to ask how the survivor is doing, can the advocate share survivor information without a release? What if the officer calls and would like to leave a message for the survivor?
A: Even if the officer knows that the survivor is or was at a non-profit advocacy office, the non-profit advocate cannot share survivor information without a release. The advocate can generally thank the officer for caring about victims, explain that the advocate “can neither confirm nor deny if the survivor is receiving services,” and can offer to take a message and post it on the program’s private bulletin board. The non-profit advocacy program should have a consistent response (e.g., the answer should not differ depending upon the victim) so as to avoid inadvertently providing information about any individual survivor’s location.
Q: Can collaborative agencies with an MOU containing confidentiality language share victim information for funder reporting reasons without getting a release?
A: No. Regardless of the language within a MOU, releases are always necessary to share personally identifying individual client information. However, you can share aggregate information for reporting to funders. Aggregate information are totals, so it’s acceptable to report that your program referred 7 people in a particular month, but it is not acceptable to provide any individual identifying details.
It is important to remember that what is identifying varies from community to community. It is never appropriate to share names, dates of birth, and U.S. social security numbers. Keep in mind that a combination of information could also be identifying; for example, sharing that you served a 42 year-old Caucasian woman with 4 children, ages 11, 9, 8, and 6 or a 32 year-old Asian woman with a 2 year-old could identify them. Individual “de-identified” profiles can be used to re-identify people in other databases (such as HMIS). Communities and agencies should consider what information is identifiable for individuals receiving services, focus on sharing aggregate, non-identifying information, and should always provide the least amount of individual information possible.
The three major U.S. federal funding sources (Office for Victims of Crime, Office on Violence Against Women, and Department of Health and Human Services) do not require you to unduplicate victims between agencies, so there is no need to share personally identifying individual client information to meet federal reporting requirements. In addition, domestic violence programs that receive HUD funding are exempt from entering identifying information into the HMIS database.
Q: What if it is discovered that a client staying in shelter has an outstanding warrant for his/her arrest? Does this fit under any “exemption”? What are the requirements for cooperating with authorities?
A: There is no “arrest warrant” exemption in VAWA or FVPSA. There is no obligation or law that requires non-profit advocates to proactively inform the police. If a program becomes aware of a warrant, they can and should notify the victim and help him/her self-report to the police and get legal assistance.
Q: What if law enforcement asks if a person is in shelter because there is a missing person report for them? Do we need a release to tell them whether the person is in shelter?
A: It is absolutely necessary to get a release from a survivor before informing law enforcement of the survivor’s location. Many times, abusers will file missing person reports to try to identify the victim’s location. Victim services program should proactively educate local law enforcement about how abusers misuse missing person reports, the program’s confidentiality requirements, and collaborate with law enforcement on appropriate protocols when law enforcement suspects a “missing person” is in shelter.
Q: What if our state has a duty to warn law (if survivor is suicidal or homicidal)?
A: First, check and be absolutely sure that you understand your state’s law. Some agencies assume that they have a “duty to warn” but the state law does not actually support that assumption. If you reveal confidential survivor information without a specific state law mandate or without having a signed release of information, it may be a violation of VAWA, FVPSA, or state law. Some states require reporting to police or to the intended victim of the threat if a survivor is in imminent danger of harming herself or others, and in that case the report would be an exemption to the confidentiality requirements. In other words, if you are legally mandated to report this situation, then you may do so without a release. Check with your state domestic violence coalition if you are unsure if your state has a duty to warn law that applies to you, and make sure you know exactly what it requires you to do. VAWA and FVPSA require that you only disclose the minimum amount of information necessary to comply with the actual law.
Q: Does a prosecutor victim witness advocate need to have procedures in place to secure the victim's confidentiality and privacy and use the "Model Release" form when sharing or storing information?
A: Survivors should be informed of the confidentiality limitations that pertain to victim assistants (victim/witness advocates) employed by a prosecutor’s office. Victim/witness advocates do not necessarily need to obtain a release of information form to share survivor information, but they are required to give notice. It is best practice to provide written information to survivors about what happens with their information and get signatures from survivors indicating that they have read and understand your data collection/information sharing practices. If any or all of the information s/he provides to you could possibly be released to other parties (including the attorneys in the prosecutor’s office), inform the victim of this before s/he chooses to begin working with you.
When communicating with victims, it is important to distinguish between a “policy” of not sharing information, a law prohibiting the sharing of information, and any laws requiring the sharing of information (such as constitutional requirements that law enforcement share information with criminal defendants).
Q: We are advocates employed by a non-profit domestic and sexual violence program and housed within the courthouse. Are we able to share information with the prosecutor?
A: While it is common for non-profit advocates to have workspaces in courthouses, prosecutor offices, police departments, or other locations, your physical location does not change your confidentiality obligations. If you are employed by the non-profit organization, the VAWA and FVPSA confidentiality protections still apply, and you are not able to share information with the prosecutor or anyone else in co-located situations without a written, specific, time-limited, signed release of information. Co-locating has many benefits but also some challenges and non-profit advocates must prevent accidental disclosure of confidential client information outside of the personnel within your agency.
Q: Can releases be for mutual exchange (meaning that I can talk to police and the police can talk to me, for example)?
A: Some organizations, such as law enforcement, may not need a release form signed to be able to share limited information, but the partnering non-profit program would need a release on their end to share any identifying information.
For two agencies that are both required to have releases, it is always best practice for each agency to have its own release. This ensures that survivors are fully informed by each agency of their respective obligations and the specific information to be released by each agency.
Keep in mind that you must have a release to share information; another agency cannot obtain a release from the survivor for you to share information with them.
Age, Consent, & Guardians:
Q: Does VAWA/FVPSA prohibit an abusive parent (abusive to child and/or other parent) from signing a release for an unemancipated minor’s records?
A: Yes. Section 3 of VAWA 2013 and FVPSA 2010 state that “consent for release may not be given by the abuser of the minor, person with a disability, or the abuser of the other parent of the minor.”
Q: If parents have shared custody of a minor child, do both the non-abusive and abusive parent need to sign a release?
A: No. VAWA/FVPSA only requires the signature of one non-abusive parent and the minor child to authorize release of a child’s information.
Q: What about unemancipated teenagers without a parent or guardian? Is there a certain age where a young adult no longer needs a parent or guardian’s signature on a release?
A: ”Emancipation” is determined by state law, and teens can be “emancipated” for different purposes (e.g., a 14 year old may be able to consent to receive health care services but not to marry). VAWA 2013 specifically states that only the minor’s consent to release information is needed if the minor is legally allowed to access your services on his or her own. No parent or guardian signature is required. If you are unsure of your state law, contact your state domestic violence coalition. Remember that the release of information is not to provide services, but to share the survivor’s information with other agencies when necessary.
Q: If you are providing services for a child, at what age does the child need to sign a release of information?
A: VAWA and FVPSA require that the unemancipated minor and the non-abusive parent sign the release of information. Although neither VAWA nor FVPSA specifies an age at which children should sign a release, if they are unable to sign they should be informed, in an age-appropriate way, that the parent/guardian is signing papers to allow you to talk to others in the community. If the child is unable to sign the form, in place of the child’s signature, the advocate should note the age of the child, the fact that the release was explained to the child, and the date.
As stated in the previous answer, it is important to recognize that if you are able to provide services to a minor without the consent of the parent or guardian, then VAWA allows the minor to sign a release independently. Both the minor and parent or guardian would sign when services can only be provided with the parent or guardian’s consent, or if both the minor and the parent or guardian are receiving services.
Q: If the signatures need to be of the non-abusive parent or guardian, how does one determine the non- abusive parent or guardian?
A: If you are working with a minor or a person who has a disability, ask all the questions you would normally ask to identify who the abusive person is. Typically programs have a policy or practice to determine the abusive party. This usually begins with asking the survivor to identify the abuser. It’s always important to be careful in this assessment, to follow your agency’s policies, and to use your professional training and best judgment.
Q: If the victim has a cognitive disability and the caregiver is not appropriate to sign the release due to either being the abuser or having obvious bias to the abuser, who can authorize a release?
A: The most important thing is to figure out if the person even needs someone else to sign the release of information on his or her behalf, or if they can sign it themselves. Regardless of disability, the only time a guardian is allowed to sign a release of specific information is if the person with a disability has been legally adjudicated as unable to sign legal documents and the guardian has been court appointed.
The best practice is to ensure involvement of the survivor in all aspects, ensure that they are fully informed, and obtain proof of court-appointed guardianship. A person with a disability may have a caregiver and still be able to give consent themselves if there has not been a guardian appointed by the court.
If the person has been found by a court to need a legal guardian and the guardian is a threat, then a new guardian needs to be appointed. Remember, the release is not to provide services, but to share the survivor’s information with other agencies in the community.
Emergencies, Hotlines, and Written Consent:
Because VAWA and FVPSA require a written release, oral releases are not recommended and oral releases are not best practice. It is understood that agencies may sometimes advocate for or assist survivors over the phone, and it is encouraged that agencies develop polices and protocols for assessing each situation individually to determine how best to serve a survivor requesting services.
An agency should first determine if a release is needed or if there is another way to meet the survivor’s immediate advocacy needs without the agency releasing personally identifying information. Oftentimes advocates can make calls on behalf of a survivor without releasing any identifying information (for example, inquiring about bed space or available services). Since a survivor can choose to share any information about him or herself with any agency, using three-way calling to connect the survivor to the other program could be another option.
If a survivor would like a non-profit advocacy program to share identifying information about him/her, with another agency, then VAWA and FVPSA require a written release. It’s important that a release is signed, either over electronic communication or in person. If neither of these options is possible, or if the situation requires timely assistance, an advocate should read through the release on the phone with the survivor, ensure that the survivor fully understands each aspect, and write on the release that the release was read and oral consent was given. It is best practice to have the survivor sign it in person at a later date if possible.
Q: Do organizations running a hotline or crisis line fall under the requirements of needing a written consent to share identifying survivor information?
A: The requirements apply to all VAWA or FVPSA grantees and sub-grantees that are serving victims with VAWA or FVPSA funding. All agencies should develop policies and protocols for determining on an individual basis how to obtain consent when talking with a survivor by phone. Your organization may be able to make calls to inquire about services and resources without giving out any identifiable information about the survivor. Although, depending on the situation and community, merely obtaining information about a perpetrator may confirm that the victim is seeking your services. This should be acknowledged and the survivor notified.
In addition, it may be possible and effective to use three-way calling so that the survivor can speak directly to the agencies from which s/he is seeking information or assistance. Remember: Releases are only needed when you’re sharing a survivor’s personally identifying or confidential information with someone else. If you are providing information to a survivor, no release is needed.
Q: Most of our communication with survivors is over the phone, making it difficult to obtain written releases. How do we effectively advocate for our clients with other service providers/systems in these situations?
A: The first question that should be asked before any release of information is obtained (written or oral) is whether there is another way to meet the survivor’s immediate advocacy needs without the agency releasing personally identifying information about the survivor. For example, could the advocate support the survivor and help her/him make the call and talk to the other agency or professional herself/himself? Your agency could also use three-way calling to facilitate the connection and the survivor can provide all personally identifying information themselves.
It’s perfectly reasonable to call another service provider and say “I spoke with a woman today and she really needs xxx. Can I give her your number and have her call you?” In cases where you must share personally identifying client information, a release is essential. Because VAWA and FVPSA require a written release, oral releases are not recommended and oral releases are never best practice.
Q: In an urgent situation, can the signed release be emailed or digitally signed?
A: The best practice is to have a signed release in your file that is signed in person. Organizations can decide on an individual basis when to accept an emailed or digitally signed release, but they must ensure that the release was signed by the survivor. Since abusers can easily access another person’s email account and/or make an email (or digital signature) appear to be from someone else, always confirm an emailed or digitally signed release with the survivor by phone prior to sharing survivor information.
Q: When, in an emergency, we get an oral release for a particular piece of information, should we still fill out a form? What do other programs do?
A: Because VAWA and FVPSA require a written release, oral releases are not recommended and oral releases are never best practice. However, programs that do, on rare occasion, use oral releases generally go through the full release form, reading it aloud over the phone, and then note on the signature line that oral consent was given and the date it was given. The advocate should verify the person’s identity before reading the form and signing it, and ensure that the survivor signs the form at the next possible opportunity.
Q: For court advocates who are advocating in court (often the client is right there) are releases needed?
A: Non-profit based court advocates who are allowed by state law to speak in court on behalf of a survivor should have a release of information from the survivor and consent to appear in court. Before the hearing, the advocate should review with the survivor what will happen at the hearing, the role of the advocate, and what information the survivor would like shared. If you are appearing in court to support the survivor but are not actually speaking on behalf of a survivor, it’s important to notify the survivor that your presence can signal to observers that she is receiving your agency’s services.
Q: What about releasing information to Emergency Medical Services?
A: You can contact emergency medical services and tell them the nature of the emergency without telling them identifying information. In many cases, the survivor will be conscious and able to inform EMT staff themselves and decide how much they want to share. It is important to remember that even if it is appropriate to call 911, it is never appropriate to share her/his whole case history or file. Identifying information is not necessary for 911 to respond. What some advocates do is to respond “I don’t know” or give non-identifying information (“around 45 years old” instead of actual birth date) when asked these questions by the 911 operator. In addition, it is not appropriate to specifically comment on why s/he was receiving assistance from your organization.
Q: Can instructions from the survivor about to whom and what information, if any, can be released in the event she/he is missing or deceased be included in a release form?
A: Advocates may have this discussion, in a delicate way, with a survivor if the survivor is fearful for his/her life. It is a best practice to ask the survivor what he/she would want the advocate and program to do with his/her information in the case that something happens to him/her. It would be important to discuss how the advocate would know if the survivor is missing or deceased or if he/she fled and just didn’t tell anyone. Not knowing and releasing his/her information could be dangerous to the missing person or surviving family members of a deceased victim.
Because VAWA and FVPSA confidentiality provisions do not address the issue of deceased victims, a nonprofit DV/SA program should look to their state law for guidance regarding the survivability of any confidentiality or privilege between a victim and the program.
Q: Is it true that oral granting of consent is not best practice but oral withdrawal of consent is ok?Couldn’t someone impersonate the victim when withdrawing consent, too? Why is there a difference?
A: Less harm (and program liability) can come with withdrawing consent (even when waiting to verify the survivor’s identity) than might result from releasing information without proper consent. Furthermore, when a survivor withdraws consent, it happens immediately, and although the withdrawal should be reduced to writing, the withdrawal of release goes into effect at the time of request.
Consent for release of personal information or withdrawal of consent should usually ONLY be given by the victim, so it’s important to ensure, as always, that no one is impersonating the victim. Best practice is to get the withdrawal in writing as soon as possible.
Databases & Confidentiality
Waivers are signed for a very specific purpose. They are not to make our lives as advocates easier or to allow us to collect more personally identifying data to analyze or share with others. Each time a victim signs a release of information, s/he is entrusting you with his/her personal information, and it is extremely important to avoid using this data in other forms or in other ways. Some organizations use an internal database to keep track of services provided and a release is not needed when limited information is collected, protected, and not shared with parties outside of the agency.
Q: Do we need a release from survivors to put their personal information in our organization’s database?
A: Releases are only required when sharing information outside your agency, but your agency should have full ownership of the database and must ensure that it cannot be accessed by anyone else. Additionally, best practice is to always get consent by a survivor, or at least provide notice, for all the ways their personal information may be used. Survivors should be fully informed of the agency’s data collection processes and of the risks and the uses of databases.
Organizations should analyze what information is being collected and for what purposes. Some organizations do a periodic assessment of their forms and database to ensure that they are only collecting the minimal information required to provide the requested services. This both minimizes the work for advocates and respects the privacy of survivors.
It is also important for agencies to think through all data collection and maintenance processes. Databases should be maintained by and within individual agencies. It is important to safeguard computers to protect victims’ personally identifiable information. For example, many local programs keep sensitive client-level information on computers that are not connected to the Internet. Programs that need to use cloud-based databases should have the data encrypted (locked) and only the program’s staff holds the encryption key. For more information on databases, see NNEDV’s resources on databases and confidentiality at techsafety.org or email firstname.lastname@example.org.
Q: What if a government agency is building a database using victim information that is of public record?
A: If the information entered into the database is only from public records and you are a government agency, it may be possible to enter survivor’s personally identifying information without a release of information. However, as a best practice, it is important that survivors are notified that their information will be entered into this database. In addition, provisions should be made for cases where the record is sealed or where the abuser works in the system (courts, law enforcement, etc.) and, if possible, a survivor should be allowed to opt out of having her/his information collected and maintained in this way.
If you are a government entity and a survivor’s information is entered erroneously into a database or that database is breached, you could be liable. It is also important to consider that the information in the database could be subject to a request under the state’s sunshine laws from the media or any citizen.
Survivors should be informed of all uses of their information, as well as the consequences of that data collection, and should be able to decline. Agencies using survivor information should have policies and procedures to protect the information from intentional or unintentional disclosure. Victims may assume that going to court has some level of public disclosure, but they may not have the same assumption about the compilation of the information made by your government office. Therefore, s/he should be given notice about the information that is being compiled, and you and s/he should both recognize that, depending on what is collected and how it is maintained, it could become even more harmful if it gets released or used in ways that were unintended.
It also is important to ensure that the information going into the database is only information that is of public record and nothing additional. Whenever contemplating the creation of a database you should weigh the benefits of collecting and storing the information with the consequences of having the information being used and accessed in ways that are unanticipated. Whether it is helpful to an agency is not the standard for determining whether confidentiality requires a release of information from or notice to an individual whose information is being used, complied, or shared.
Q: Please speak to the issue of time limits of releases with regard to third-party state reporting databases.
A: Under VAWA and FVPSA, the only information a program can release to third-party state reporting databases is non-personally identifying information in aggregate form (totals). For example, “We served 15 women and 22 children today.” Since aggregate information is not identifying, a waiver from the survivor is not necessary.
Inherently, databases are not time limited. Once information is entered into a database, it is there to stay. Databases offer multiple opportunities for exporting data, creating many backup copies in multiple locations, and merging or rebundling data. Even if a survivor’s information is later deleted, chances are that a backup of the database has been created at some point and the information will be stored for as long as that backup is retained by the agency administering the databases. For this reason, a release to input personally identifying information into a shared database cannot be time-limited, and therefore it is not a valid release under VAWA. State confidentiality laws may have additional requirements as well.
Q: Can I enter survivor information into an external database to serve survivor’s needs, such as one for victim-notifications, using a time-limited, written, and informed release of information?
A: Where a survivor expresses a need or desire to have identifying information entered into an outside third-party database (such as a victim notification system), the program should work with the survivor to determine the best way to make that information entry. Before an advocate or employee of the program can enter the information into the database for the survivor, you should confirm that: 1) the data is being entered to meet a survivor-defined goal (remember: complying with a program’s funding requirements is not a survivor-defined goal); 2) the survivor is fully informed of all pros and cons of participating in the database, alternative methods to meet the need, and the inability to remove or control information once it is entered; 3) the survivor understands that this data entry is not a condition of service, and the survivor can decide exactly what information is entered and what information is not entered. If all of the above are confirmed and the survivor wishes to have the program enter the information, then a written, informed release that time-limits when the information can be entered needs to be completed.
Note: Even the program acknowledging that they know a survivor counts as a release of information. The risks of disclosing the receipt of services from the program need to be discussed with the survivor.
Q: Our state has developed a central database program and requires personally identifying information about our clients such as name, birth date, addresses, types of violence committed, narrative descriptions of work with the client, etc. We have a really hard time understanding how we are being confidential while we are transmitting all of this identifying data to people outside of our office. Is this allowable under VAWA or FVPSA?
A: No, this is not allowable under VAWA or FVPSA. Entering client information into this database would probably violate VAWA and FVPSA as well as state law provisions in many states. You should contact your grant program manager to discuss this.
Mandated Reporters & Confidentiality:
NOTE: If you are a mandated reporter, you should tell the victim up front the scope and limits of your ability to provide confidentiality.
Q: We work in a state in which advocates are NOT mandated by law to report child abuse. If an advocate observes something they think should be reported and the parent refuses to provide a release, under VAWA and FVPSA, can we do anything to protect the child?
A: If you are not a mandated reporter, you need a written, informed, time-limited release to call the Child Protective Services (CPS) hotline; you cannot call CPS or some other outside agency unless you get the consent of the child and the non-abusive parent/guardian of an unemancipated minor. Consent may not be given by an abuser. In terms of advocacy and services however, there are many other things that can be done to address what is happening and to protect the child.
If you are a mandated reporter under your state’s law, you may make a report to CPS without a release.
Being compelled to share information according to state law is an exception to VAWA and FVPSA and mandatory reporting laws are an example. However, you may only disclose the minimum information required under state law.
Q: Do I need to notify a survivor if I make a report to CPS and I am a mandated reporter?
A: Best practice is to notify the victim and the non-abusive parent/guardian of an unemancipated minor and to take steps to protect their privacy and safety as much as possible. VAWA and FVPSA require that agencies make “reasonable attempts” to notify the survivor of the report. If it would be dangerous to do so, it could be reasonable to not specifically inform him/her. Best practice would also be to give the survivor an opportunity to self-report and use other services. A few state laws require follow-up with CPS and in these rare instances, you would not need a release for future conversations; although you would be obligated to notify the survivor of your mandate and what steps you must take to fulfill your legal obligation.
Q: Is a release required for ongoing communication with CPS for follow-up services during the investigation?
A: If you are a mandated reporter, you may make a report to CPS without a release. However, you may only disclose the minimum information necessary under state law. Any information beyond what is required under state law will require a release.
A few state laws require follow-up with CPS during investigations and in these rare instances, you would not need a release for future conversations; although you would be obligated to notify the survivor of your mandate. If your state does not specifically mandate follow-up with CPS, you would need a release of information in order to provide any information beyond what is required by the report of suspected child abuse or neglect. In assessing what you are required to do, be sure to distinguish between requirements during CPS investigations into suspected child abuse or neglect vs. CPS requests for information when a family has an open case because of abuse or neglect in the past. It is important to know your state laws and whether your professional role has specific confidentiality requirements. Check with your U.S. state or territorial coalition if you are not sure.
Q: Are former clients still protected under confidentiality laws? What if we hear that a survivor could be in danger – is it a breach of confidentiality to call law enforcement if the person is no longer a client?
A: Yes, former clients are still protected by confidentiality laws. Yes, it would be considered a breach of confidentiality to contact law enforcement or anyone else without a release. Calling law enforcement would reveal that the person previously received services from your organization. Without consent from the former client, you would be violating his/her confidentiality. This also applies if law enforcement or another agency calls to confirm if someone used your services in the past.
In addition, we know that it is important to respect a survivor’s self-determination in deciding when it is safe and when it is not safe to reach out for assistance, contact a program, or call the police. Doing this without the person’s consent could undermine that self-determination and safety. It is also important to recognize that even if you are a mandated reporter, that a report is only required when there is suspected abuse under the statute. A rumor that abuse is occurring is not a basis for a report.
Q: When a client enters our shelter, s/he completes an emergency contact sheet. If s/he does not return to the program one evening and we’re not sure where she is, we contact the emergency contact to find out if s/he is okay or in danger. Is this okay?
A: Do you explain to each person before filling out the emergency contact sheet that not returning or not communicating with the program is considered an emergency and the contact person will be contacted at that point, thereby informing them that s/he is or was in your shelter? The circumstances when the emergency contact form is used and the program’s definition of “an emergency” should be made very clear, as it may change the person who gets listed on the form.
A best practice would be to have an informed, written, reasonably time-limited “Emergency Contact Release” that is the same as a release of information. The form should be along these lines: “In the event that I do not return to the program, I will call the program to let them know I am safe. In certain circumstances, the program is allowed to contact the following person/s. This emergency contact will be valid for the next days. The circumstances are….” The advocate should have a conversation with the survivor about the risks and benefits of signing the release, its time limits, and how the advocate would know whether the survivor has purposely left shelter and is ok so that the advocate does not assume an emergency when there is no emergency. In addition, the advocate and survivor should discuss what the program should do if the victim’s identified emergency contact does not know where the victim is and what actions the program will take. A survivor can choose not to name an emergency contact person, and the program cannot make consent to release information to an emergency contact a condition of services.
Q: If a speaker comes to a survivor support group, will each client attending need to sign a release of information waiver?
A: No, unless the agency is going to be sharing individually identifying information with the speaker (like a list of people who are attending the group). If clients are informed when they arrive that a guest speaker will be there that day and are told the name of the speaker and the speaker’s affiliation, the clients can choose whether or not to attend that group. The speaker should sign a confidentiality agreement. If the clients choose to share their personal information to the speaker during or after that session, that is a choice they make and therefore no release is required.
Q: If a survivor talks to the advocate and then talks to someone else (mother, friend, sister) would that be considered a waiver of her privilege?
A: A release from the survivor is always needed for an advocate to share a survivor’s information with another advocate or another organization. Survivors can tell their personal story to whomever they want. However, if a survivor shares specifics of confidential conversations they had with an advocate or the particulars of what an advocate told them, in some circumstances this may or may not be interpreted as a waiver under state law of confidentiality or privilege between the survivor and the advocate. Regardless, advocates and programs should continue to actively protect information and share only with releases to ensure compliance with VAWA and FVPSA and respect the survivor’s privacy.
Q: Do the VAWA protections apply only to clients of VAWA or FVPSA-funded staff or to all clients of a VAWA or FVPSA-funded domestic violence program?
A: The protections apply to every survivor/client who requests, receives, or has received services from a domestic violence, sexual assault, dating violence or stalking program that receives VAWA or FVPSA funds. If the program is part of a larger agency that has many different types of service programs, it would only apply within the victim services program, not the whole agency. All survivors who use the program’s services should have the same confidentiality protections.
Q: We are not a domestic violence program, but a homelessness service program that receives funding from the Office on Violence Against Women. Do the VAWA laws regarding confidentiality apply to us?
A: The confidentiality requirements of VAWA and FVPSA apply to all grantees or sub-grantees of VAWA or FVPSA funds. If your organization is an umbrella organization that operates multiple programs (Salvation Army, YWCA, etc.), VAWA and FVPSA laws apply to your victim services or violence against women programs. Even if VAWA or FVPSA only funds a portion of your victim services or violence against women program, you should provide the same confidentiality protection to all victims who use your services.
Q: Does the obligation to hold confidentiality with survivors extend to the entire staff of our non-profit sexual assault and domestic violence program?
A: Yes. Every employee or anyone who has access (or potential access) to client information (including volunteers, interns, board members, temporary staff, or contracting staff) must follow the VAWA and FVPSA confidentiality provisions. The agency is obligated to follow the confidentiality requirements of VAWA and FVPSA.
Q: What about information that is emailed? What about Information Technology (IT) personnel who have access to sensitive information on our computers?
A: Email is absolutely not a confidential way to communicate information, and best practice is to keep all personally identifiable information out of email. If a victim asks you to share information via email, you should inform her/him about the security limitations of email. Regardless of any footer you place in your email stating that it is privileged or confidential communication, email can be breached at multiple points during its transmission. Confidential information about clients should never be emailed.
If individual IT personnel are contractors or employees of the domestic violence or sexual assault organization, they are bound by the same confidentiality provisions stated in VAWA and FVPSA and should sign the agency’s contractor confidentiality agreement acknowledging that they understand and will abide by those confidentiality provisions.
Q: Is our program able to enter identifying survivor information into a cloud-based database?
A: If you outsource your database and storage of client information to a cloud-based provider, you may be violating VAWA/FVPSA confidentiality by giving all the employees of that company and the employees of their sub-contractor companies access to all of the survivor identifying information in your database. With databases, it is best practice for the program to 1) understand how the database system actually works, 2) retain control over who is able to see survivor information, and 3) choose database systems that do not give IT personnel who are outside of the program’s control access to survivor information. Ask any database provider detailed questions about how their team is able to access information (not just what their policies are about access to information) and ask them how access can be made more restrictive.
Q: Can one advocate who has received information from a client share it with a supervisor in the same agency or share it with a non-profit based advocate in another agency (because a client is moving to another jurisdiction, for example)?
A: You can share information with your supervisor or team; although it is best practice that information be shared on a “need-to-know” basis. Agencies should have a policy in place about internal information sharing. For example, it may be appropriate to inform a supervisor or colleague of the status of an individual’s court case or if they are possibly suicidal. It may not be necessary or appropriate, however, to share with a supervisor or co-worker that an individual told you s/he is an incest survivor in addition to recent violence that brought her to your program.
To share information with an advocate at another agency, you will always need a release.
Q: When is it appropriate to share information talked about by clients in a support group session with other staff that were not in the session?
A: Your agency should have policies about sharing information internally. In general, information should be shared when it is relevant to providing requested services to a survivor or when an advocate needs support from a supervisor or colleague. Sharing limited information to help a client is permissible within your agency. For example, for grant purposes, the bookkeeper may need to know if the client is receiving services for domestic violence or sexual assault; however, the bookkeeper does not need to know the details of the abuse.
It is important to respect the trust that is built between advocates and survivors and within support groups. Survivors may share details and information about their situation with certain advocates or people within certain settings and still expect a level of discretion.
Q: What should our DV/SA program do if we get a subpoena?
A: First, have a plan, including an attorney to call in the event that a subpoena is received. Your plan should start with seeking to find out the wishes of the person’s whose information is sought. If you cannot contact that person or the person does not want to share the information, then get legal advice and assess the best means to resist the subpoena. Strategies could include: contacting the attorney who issued it and asking them to rescind it, challenging service, filing a motion to quash the subpoena with the court, seeking other types of orders to protect the information, working with the survivor whose information is sought to determine her position and whether she will also be resisting the request for information, among other actions. Whatever you do, do not ignore the subpoena and hope it will go away on its own, and certainly don’t destroy documents that may be subject to a subpoena once it has been served on your agency. To request additional technical assistance (for you or your attorney) or to request assistance from a pro bono attorney, contact the American Bar Association Commission on Domestic and Sexual Violence here and go to the “Need Help?” section.
Q: What about the use of surveillance cameras?
A: In general, video surveillance laws are very broad. Anytime a person is in a public place, consent to be recorded is not needed. For example, the street outside of your building is a public place where there may be a security camera that shows who comes and goes.
However, if the cameras are being used by a non-profit agency for security, survivors receiving your services should be notified of its existence and the use of the videotapes. Signs can be posted informing that video surveillance is in use, and agencies should have policies developed that specify the video storage, retention, and deletion processes, which should be focused on maintaining survivor confidentiality. Releases would be needed if the videos were to be shared outside of the agency.
Q: Do state confidentiality and privilege laws supersede Federal laws, such as VAWA and FVPSA?
A: In terms of confidentiality, the strongest and most protective law is what should be followed. So, if you are in a state with strong confidentiality or privilege laws that are more protective than VAWA or FVPSA, then your state laws should be followed. If you are in a state that has weak or not as strong confidentiality provisions as VAWA and FVPSA, then VAWA and FVPSA protections should be followed. Either way, state and federal laws can inform best practices about protection of confidential, survivor information, such as the use of written, informed, and reasonably time-limited releases of information.
This project was supported by Grant No. 2007-TA-AX-K012 awarded by the Office on Violence Against Women, U.S. Department of Justice. The opinions, findings, conclusions, and recommendations expressed in this publication/program/ exhibition are those of the author(s) and do not necessarily reflect the views of the Department of Justice, Office on Violence Against Women.