Technology & Confidentiality Toolkit

Do state confidentiality and privilege laws supersede Federal laws, such as VAWA?

In terms of confidentiality, the strongest and most protective law is what should be followed. So, if you are in a state with strong confidentiality or privilege laws that are more protective than VAWA, then your state laws should be followed. If you are in a state that has weak or not as strong confidentiality provisions as VAWA, then VAWA protections should be followed. Either way, state and federal laws can inform best practices about protection of confidential, survivor information, such as the use of written, informed, and reasonably time-limited releases of information.

What about the use of surveillance cameras?

In general, video surveillance laws are very broad. Anytime a person is in a public place, consent to be recorded is not needed. For example, the street outside of your building is a public place where there may be a security camera that shows who comes and goes.

However, if the cameras are being used by a non-profit agency for security, survivors receiving your services should be notified of their existence and the use of the videotapes. Signs can be posted informing that video surveillance is in use, and agencies should have policies developed that specify the video storage, retention, and deletion processes, which are focused on maintaining survivor confidentiality. Releases would be needed if the videos were to be shared outside of the agency.

What should our DV/SA program do if we get a subpoena?

First, have a plan, including an attorney to call in the event that a subpoena is received. Most importantly, get legal advice and assess the best means to resist the subpoena, which could include: contacting the attorney who issued it and asking them to rescind it, challenging service, filing a motion to quash the subpoena with the court, seeking other types of orders to protect the information, working with the survivor whose information is sought to determine her position and whether she will also be resisting the request for information, among other actions. Whatever you do, please do not ignore the subpoena and hope it will go away on its own, and certainly don’t destroy documents that may be subject to a subpoena once it has been served on your agency.

When is it appropriate to share information talked about by clients in a support group session with other staff that were not in the session?

Your agency should have policies about sharing information internally. In general, information should be shared when it is relevant to providing requested services to a survivor or when an advocate needs support from a supervisor or colleague. Sharing limited information to help a client is permissible within your agency. For example, for grant purposes, the bookkeeper may need to know if the client is receiving services for domestic violence or sexual assault; however, the bookkeeper does not need to know the details of the attack.

It is important to respect the trust that is built between advocates and survivors and within support groups. Survivors may share details and information about their situation with certain advocates or people within certain settings and still expect a level of discretion.

Can one advocate who has received information from a client share it with a supervisor in the same agency or share it with a non-profit based advocate in another agency (because a client is moving to another  jurisdiction, for example)?

You can share information with your supervisor or team; although it is best practice that information be shared on a “need-to-know” basis. Agencies should have a policy in place about internal information sharing. For example, it may be appropriate to inform a supervisor or colleague of the status of an individual’s court case or if they are possibly suicidal. It may not be necessary or appropriate, however, to share with a supervisor or co-worker that an individual told you s/he is an incest survivor.

To share information with an advocate at another agency, you will always need a release.

What about information that is emailed? What about Information Technology (IT) personnel that have access to sensitive information on our computers?

Email is absolutely not a confidential way to communicate information, and best practice is to keep all personally identifiable information out of email. If a victim asks you to share information via email, you should inform her/him about the security limitations of email. Regardless of any footer you place in your email stating that it is privileged or confidential communication, email can be breached at multiple points during its transmission. Confidential information about clients should never be emailed.

If IT personnel are contractors or employees of the domestic violence or sexual assault organization, they are bound by the same confidentiality provisions stated in VAWA and should sign the agency’s contractor confidentiality agreement acknowledging that they understand and will abide by those confidentiality provisions.

Does the obligation to hold confidentiality with survivors extend to the entire staff of our non-profit sexual assault and domestic violence program?

Yes. Every employee or anyone who has access (or potential access) to client information (including volunteers, interns, board members, temporary staff, or contracting staff) must follow the VAWA confidentiality provisions. The agency is obligated to follow the confidentiality requirements of VAWA.

We are not a domestic violence program, but a homelessness service program that receives funding from the Office on Violence Against Women. Do the VAWA laws regarding confidentiality apply to us?

The confidentiality requirements of VAWA apply to all grantees or sub-grantees of VAWA funds. If your organization is an umbrella organization that operates multiple programs (Salvation Army, YWCA, etc.), VAWA laws apply to your victim services or violence against women programs. Even if VAWA only funds a portion of your victim services or violence against women program, you should provide the same confidentiality protection to all victims who use your services.

Do the VAWA protections apply only to clients of VAWA-funded staff or to all clients of a VAWA-funded domestic violence program?

The protections apply to every survivor/client who requests, receives, or has received services from a domestic violence, sexual assault, dating violence or stalking program that receives VAWA funds.  If the program is part of a larger agency that has many different types of service programs, it would only apply within the victim services program, not the whole agency.  All survivors who use the program’s services should have the same confidentiality protections.

If a survivor talks to the advocate and then talks to someone else (mother, friend, sister) would that be considered a waiver of her privilege?

A release from the survivor is always needed for an advocate to share a survivor’s information with another advocate or another organization. Survivors can tell their personal story to whomever they want. However, if a survivor shares specifics of confidential conversations they had with an advocate or the particulars of what an advocate told them, in some circumstances this may or may not be interpreted as a waiver under state law of confidentiality or privilege between the survivor and the advocate. Regardless, advocates and programs should continue to obtain releases to ensure compliance to VAWA and respect the survivor’s privacy.

If a speaker comes to a survivor support group, will each client attending need to sign a release of information waiver?

No, unless the agency is going to be sharing individually identifying information with the speaker (like a list of people who are attending the group). If clients are informed when they arrive that a guest speaker will be there that day and are told the name of the speaker and the speaker’s affiliation, the clients can choose whether or not to attend that group. The speaker should sign a confidentiality agreement. If the clients choose to share their personal information to the speaker during or after that session, that is a choice they make and therefore no release is required.