Victim service providers may be approached by community partners or database vendors suggesting they use a certain product to record personally identifying information (PII) about survivors. Since victim service providers are obligated to keep survivor data confidential, it’s important that organizations understand how the database functions in order to both inform survivors and make choices about whether to use a database product or not. Victim service providers can follow the step-by-step guide below to evaluate a shared database and identify steps they should take to protect survivor PII.

1. Does the database allow access to or share the information it holds with anyone outside of your victim services agency or the victim services unit of your umbrella agency?

a. If YES, then the survivor decides whether you can put information in the database and move on to Question 2.

b. If NO, this is not a shared database. Your organization can choose to use the database, and it is best practice to inform survivors about it. For more information on implementing strong internal protections for survivor data, visit the Data Management section of the Agency Use Toolkit.

c. If you are UNCERTAIN, request technical assistance from Safety Net at safetynet@nnedv.org. It can be very tricky to figure out whether a database is sharing information with people outside of your organization For example, if someone else is paying for the database and asking you to use it, this could mean the information you enter is being shared with someone else.

2. Is the database part of a Homeless Management Information System (HMIS)?

a. If YES, then stop. Federal law prohibits victim service providers from putting PII into an HMIS system. Victim service providers must instead provide aggregate data to their Continuum of Care by entering information in a comparable database. For more information on comparable databases, visit the Comparable Database 101 resource.

b. If NO, then move on to Question 3.

3. Does putting survivor PII into the database help address a SURVIVOR problem (not an agency or a funder problem)?

a. If YES, then it is appropriate to discuss the possibility with the survivor and move on to Question 4.

b. If NO, then it is not trauma-informed and not survivor-centered to ask survivor to consent to put information into the database. If a funder or community partner is seeking this information, consider explaining your confidentiality obligations to them and exploring other ways to meet the need (e.g. providing aggregate, de-identified statistics on number of clients served by the program).

4. After having the database explained, does the survivor believe that having your agency put information into the database is the best next step?

a. If YES, then move on to Question 5 about best practices for releases of information.

b. If NO, then support the survivor to implement a different strategy, such as disclosing the information for themselves.

5. Discuss the written instructions that the survivor wants to give you about the database. “Written Instructions” is an alternate way of framing Releases of Information that is centered on the person, not the permission.

Let the survivor decide what and how much information and how long your agency has permission to continue entering information into the database. For more information on best practices for release of information, visit the FAQs on Survivor Confidentiality Releases.

NOTE: Applying the time-limited requirement to databases can feel a little confusing. Releases must have a deadline after which the agency will stop disclosing information, however, the time-limit in the release has no impact on how long the recipient of the information will hold/use/manage survivor’s information. This is true of all releases, but in this case, the database will hold that information in line with the owner’s data retention policies. How the recipient might use the survivor information shared with them is part of the survivor’s decision whether to share it, and they must weigh the risks and benefits.

© 2024 Confidentiality Institute and National Network to End Domestic Violence, Safety Net Project. This project was supported by Grant No. 15JOVW-23-GK-05144-MUMU awarded by the Office on Violence Against Women, U.S. Department of Justice. The opinions, findings, conclusions, and recommendations expressed in this publication are those of the author(s) and do not necessarily reflect the views of the Department of Justice, Office on Violence Against Women.