A partir de 2024, los beneficiarios de subvenciones de la OVC para la lucha contra la trata que ofrezcan servicios directos deberán contar con una autorización escrita, limitada en el tiempo y otorgada con pleno conocimiento de causa por parte del participante del programa, para compartir cualquier información de identificación personal con personas ajenas al programa de servicios contra la trata. Esto incluye incluso confirmar si una persona en particular está recibiendo o ha recibido servicios.

El programa Safety Net de la NNEDV cuenta con un formulario modelo de autorización disponible en inglés y en español. Además, la página de la plantilla de confidencialidad de Safety Net incluye una versión de dos páginas para lectores con baja visión, tanto en inglés como en español. Si su organización traduce el formulario a otros idiomas, nos encantaría recibir una copia para compartirla.

Sí, el formulario puede modificarse para mejorar su accesibilidad. Por favor, no realice ninguna adaptación que altere su propósito.

Sí. El formulario de autorización de muestra es lo que recomendamos como mejor práctica y es coherente con los requisitos de la condición de adjudicación de la Ley de Protección de Víctimas (TVPA) para garantizar la confidencialidad de la VAWA. Existen varias razones por las que es tan específico:

• Ayuda a garantizar que el participante del programa mantenga el control y sepa qué información cede y a quién.

• Esto ayuda a garantizar el consentimiento informado.

No siempre. La mejor práctica es seguir las instrucciones del participante. Se debe informar al participante del programa que tiene el control sobre el alcance de la divulgación de la información y que puede solicitar dichas restricciones.

Por ejemplo: Un participante del programa solicita ingresar a un programa de vivienda y redacta una autorización para que su proveedor comparta su información personal con los empleados del nuevo programa. El participante puede indicar a su proveedor que divulgue su información personal específica a:

•    Cualquier miembro del personal que trabaje en el programa

•    Solo al administrador de su caso en el programa

•    Varios miembros específicos del personal, como el administrador de casos y el pasante de dicho administrador

Es importante que estas instrucciones sean claras y se sigan adecuadamente. Si las instrucciones sobre la divulgación de información no reflejan con precisión la solicitud del participante, se debe actualizar el formulario. Informe al participante de que, aunque usted solo comparta su información con uno o más miembros del personal, el programa podría optar por compartirla con más miembros del personal u otras organizaciones, según sus políticas.

Sí. La Ley VAWA exige que una exención tenga una vigencia limitada, lo cual constituye una buena práctica. La exención puede reafirmarse y prorrogarse si el participante del programa confirma que sigue siendo válida y autoriza una nueva fecha de vencimiento.

Las autorizaciones no deben tener una fecha de vencimiento estándar (como “un año a partir de la fecha de la firma”), ya que no se adapta a las necesidades específicas de cada participante del programa.

La ley VAWA exige que las autorizaciones tengan una “duración razonablemente limitada”. Un plazo se considera razonable si

• La duración sea necesaria para cumplir con el propósito de la autorización

• El plazo se ajusta a las circunstancias del participante.

• El plazo lo elija el participante del programa

  • La mayoría de las divulgaciones solicitadas por un participante del programa pueden gestionarse de inmediato, por lo que la autorización no necesita tener una vigencia prolongada (lo habitual es de dos semanas a un mes). Si un participante del programa desea que la autorización para divulgar información tenga una vigencia más prolongada, puede tomar esa decisión y no se le debe exigir que firme múltiples autorizaciones a corto plazo.

  • El plazo debe sopesar los objetivos del participante y reflejar su evaluación de los riesgos que implica divulgar su información frente a los beneficios de hacerlo a lo largo del tiempo.

La VAWA establece que las autorizaciones deben tener una “duración razonablemente limitada”, lo que significa que deben ajustarse a las circunstancias de cada caso y situación en particular. Una autorización de 30 días puede ser razonable y apropiada, especialmente si se mantiene un contacto telefónico regular con el participante del programa.

Además, siempre es una buena práctica consultar periódicamente con los participantes del programa sobre los riesgos y sus preferencias, a fin de garantizar que el consentimiento informado se base en información actualizada. ¡Puede preguntarles si sus circunstancias han cambiado y recordarles que tienen derecho a retirar ese consentimiento en cualquier momento!

💡Consejo💡: Los participantes del programa también pueden proporcionar autorizaciones digitales para compartir información en lugar de una firma manuscrita. Para obtener más orientación sobre las mejores prácticas para utilizar herramientas digitales para obtener el consentimiento escrito para compartir información, consulte “Consentimiento escrito digital para compartir información”.

Al abordar este tema con los participantes del programa, se garantiza que estén informados sobre los riesgos de confidencialidad asociados a los distintos tipos de comunicación. Por ejemplo, puede haber un mayor riesgo para la confidencialidad al compartir documentos a través de un servicio de almacenamiento en línea (como Dropbox) que al realizar una llamada telefónica a esa agencia. O bien, es posible que al participante del programa le preocupe que el correo electrónico, en general, no sea un medio de comunicación seguro.

Se debe informar a los participantes del programa sobre los riesgos de los distintos métodos de comunicación y permitirles elegir cuáles utilizarán (incluso si no son los que la agencia considera “más seguros”). Si no se especifica qué forma de comunicación se está utilizando, es posible que al participante no se le esté brindando lo que necesita para otorgar un consentimiento verdaderamente informado.

💡Consejo💡: Es posible que las propias agencias no siempre comprendan los riesgos de confidencialidad que conllevan los distintos tipos de comunicación. ¡Safety Net puede ayudar!

La mejor práctica consiste en contar con un formulario independiente para cada organismo al que se revele la información del participante del programa. Esto ayuda a garantizar que el participante del programa esté plenamente informado de

• Quien recibe su información

• El impacto específico asociado a que dicha agencia reciba la información.

Los programas ajenos a su agencia pueden tener normas distintas sobre lo que puede ocurrir con la información del participante una vez que la tengan en su poder.

💡Consejo💡: Si suele trabajar con organismos específicos, podría elaborar formularios para cada uno. De este modo, se podrán identificar las ventajas y desventajas de la autorización en cada formulario. No obstante, deberá analizarlas con el participante del programa para que este decida si firma estas autorizaciones o no. Por ejemplo, podría contar con formularios estándar para:

- La Sección 8.

- La fiscalía.

- El banco de alimentos.

Existen dos situaciones en las que su agencia podría verse obligada a compartir información de identificación personal sin una autorización del participante del programa:

·       Está obligada por la ley estatal (por ejemplo, la obligación de hacer una denuncia obligatoria), o

·       Se le exige por orden judicial.

En ambos casos, solo podrá compartir la información necesaria para cumplir con el requisito establecido por la ley estatal o por la orden judicial.

En la mayoría de los estados, una citación judicial no constituye una orden judicial. Por lo tanto, a menudo no constituye una excepción a las obligaciones de confidencialidad. Para obtener más información, consulte “Cómo prepararse y responder a una citación judicial”.

Incluso cuando existe una orden judicial, la Ley VAWA exige que los programas adopten medidas para proteger la privacidad. Esto podría incluir acudir a los tribunales para impugnar la validez de la citación o de la orden judicial.

Para compartir información con un proveedor de otra agencia, siempre se requerirá una autorización basada en las instrucciones proporcionadas por el participante del programa. No es apropiado solicitar autorización para comunicarse con otras agencias solo porque eso las haga sentir más cómodas.

No, incluso en un equipo multidisciplinario, los proveedores de servicios directos no pueden compartir información sobre un participante específico del programa sin autorización. Los socios de un equipo multidisciplinario pueden tener distintos requisitos de confidencialidad y de divulgación obligatoria, y cada socio debe comprender sus propias obligaciones. Por ejemplo, la policía y los fiscales generalmente no necesitan autorización para hablar del caso. Por otro lado, una agencia de servicios a las víctimas solo puede hablar sobre un participante del programa si este ha firmado una autorización que permita dicha divulgación a esos socios específicos.

La agencia sin fines de lucro o su representante pueden hablar sobre muchos temas que resulten útiles para el grupo, tales como:

•    Los servicios disponibles para las víctimas

•    Datos agregados sobre los participantes del programa

•    Información general que no permite la identificación personal

El participante decide qué información desea que la asociación conozca y cómo debe compartirse.

No. Independientemente de cualquier memorándum de entendimiento (MOU), los proveedores de servicios a las víctimas no pueden compartir información de identificación personal con los socios de un equipo (equipo multidisciplinario, Equipo de Respuesta ante Agresiones Sexuales (SART), grupo de trabajo, etc.) sin instrucciones por escrito de los participantes del programa sobre qué información compartir y con quién. El participante del programa debe solicitar y otorgar su consentimiento para que el proveedor de servicios a víctimas comparta la información de identificación de su caso con el equipo. Esto significa que el hecho de que la organización del proveedor decida firmar un MOU no modifica la obligación del proveedor de proteger la información de los participantes.

Además, los memorandos de entendimiento que establecen la no divulgación de información suelen ser inaplicables fuera del grupo, lo que pone en riesgo la información de los participantes del programa ante una divulgación obligatoria.

Cada miembro del equipo debe ser consciente de sus propias obligaciones de confidencialidad. Esto incluye:

• Obtener el consentimiento de los participantes del programa para discutir información individual.

• Informar a los participantes sobre cada una de las agencias que integran el equipo.

• Informar a los participantes si se incorporan personas adicionales al equipo.

💡Consejo💡: Puede resultar útil contar con un miembro del personal que no esté involucrado en ningún caso específico para que forme parte del equipo. Esto ayuda a evitar la divulgación accidental de detalles.

Usted puede:

• Hacer preguntas de seguimiento sobre la información ya compartida.

• Discutir las tendencias generales de los casos.

• Analizar casos hipotéticos y situaciones comunes. Por ejemplo, podría consistir en cómo respondería su agencia ante diversas situaciones.

No puede discutir nada que permita identificar casos o personas concretas.

💡Consejo💡: Hay ciertos tipos de información que pueden parecer vagos, pero que podrían permitir la identificación personal, especialmente en comunidades pequeñas. Algunos ejemplos:

-  Número de hijos

-  Grupo o afiliación religiosa

-   Origen étnico

Recuerde que necesita una autorización firmada para divulgar información, incluso para compartir que una persona en particular ha recibido servicios de su agencia.

Su ubicación física no modifica sus obligaciones de confidencialidad. Si usted trabaja para una organización que cumple con las obligaciones de confidencialidad de la VAWA, dichas obligaciones se aplican independientemente de su ubicación o de su participación en un grupo de trabajo. No puede compartir información con las autoridades policiales ni con ninguna persona ajena a su programa sin una autorización por escrito, específica y de duración limitada para divulgarla. Debe evitar la divulgación accidental de información confidencial sobre los participantes del programa a personas ajenas al personal de su agencia.

Even if the officer knows that the program participant is or was at an advocacy office, the provider cannot share program participant information without a release.

The provider can generally thank the officer for caring about program participants, explain that the provider “can neither confirm nor deny if the program participant is receiving services,” and can offer to take a message. The provider can then tell the participant and support them while they decide what the participant wants to do next. 

The program should have a consistent response (e.g., the answer should not differ depending upon the program participant). This is to avoid inadvertently providing information about any individual program participant’s location.

Programs should also share with partners in advance about how they will respond to such requests so it is not surprising to officers when they call.

No. Releases are always necessary to share personally identifying individual program participant information.

💡Tip💡 While you cannot share individual information with partners without a release, you can share aggregate information for reporting to funders. Aggregate information are totals. So, for example, it’s acceptable to report that your program referred 7 people in a particular month, but it is not acceptable to provide any individual identifying details.

Keep in mind that a combination of individual information could also be identifying; for example, sharing that you served a 42-year-old white woman with 4 children, ages 11, 9, 8, and 6 or a 32-year-old Asian woman with a 2-year-old could identify them.

❗ Important ❗ Remember that what is identifying varies from community to community. This applies to both geographic communities such as towns or neighborhoods, and cultural communities such as specific ethnic or language groups. Therefore, it is best practice to err on the side of caution.                                                                          

  It is never appropriate to share certain types of information, such as (but not limited to):

• Names or parts of names,

• Dates of birth, and

• U.S. social security numbers.

Individual “de-identified” profiles can be used to re-identify people in other databases (such as HMIS). Communities and agencies should:

• Consider what information is identifiable for individuals receiving services,

• Only share aggregate, non-identifying information, and

• Not share individual informationunless it meets the program participant’s needs and they have completed a written, specific, and time-limited release.

There is no “arrest warrant” exception, or any other law enforcement/authority exception, in VAWA. There is no federal obligation or law that requires victim service providers to proactively inform authorities.

Consult a local attorney to determine the intersection between confidentiality obligations, privilege requirements, and any state laws about obstruction of justice. Ifyoubecome aware ofa warrant, you can and should notify the program participant and discuss options. If the participant wants toself-reportto authorities and/or get legalassistance, your program can provide advocacy around this.

It is absolutely necessary to get a release from a program participant before informing law enforcement of the program participant’s location. A trafficker could submit missing person reports to try to identify the program participant’s location.

 If a program becomes aware of a missing person report, they can and should notify the program participant and help them decide whether they can safely notify the police that they are not missing.

💡Tip💡 You can proactively discuss with local law enforcement about how traffickers could misuse missing person reports and about the program’s confidentiality requirements. This provides a foundation to collaboratively develop appropriate protocols for if law enforcement suspects a “missing person” is in shelter.

First, check with a TA provider and/or local attorney if you are unsure if your state has a duty to warn law that applies to you, and make sure you know exactly what it requires you to do. If you reveal confidential program participant information without a specific state law mandate or without having a signed release of information, it may be a violation of VAWA confidentiality obligations.

❗ Important ❗ Understand what is required by your state’s or territory’s law before potential duty to warn comes up with participants. This is not something you want to have to figure out in a time-sensitive, high-stress moment.

Some states require reporting to police or to the intended victim of the threat if a program participant is in imminent danger of harming themselves or others. In that case, and if you are legally mandated to report, the report would be an exception to the confidentiality requirements.

VAWA requires that you only disclose the minimum amount of information necessary to comply with the actual law.

Victim/witness advocates should inform program participants of the confidentiality limitations that pertain to victim assistants (victim/witness advocates) employed by a prosecutor’s office. Victim assistants do not necessarily need to obtain a release of information form to share participant information. However, it is best practice to notify the program participant and provide written information to program participants about what happens with their information.

❗ Important ❗ If any of the information a program participant provides to the victim/witness advocate could be shared with other parties, they should inform the victim of this before they choose to begin working with you. “Other parties” includes law enforcement or the attorneys in the prosecutor’s office.

When communicating with participants, it is important to distinguish between:

• A “policy” of not sharing information,

• A law prohibiting the sharing of information, and

• Any laws requiring the sharing of information (such as constitutional requirements that law enforcement share information with criminal defendants).

💡Tip💡 You can read How to Work with Survivors Regarding the Release of Personal Information for more details.

Some organizations, such as law enforcement, may not need a release form signed to be able to share limited information about a program participant, but the partnering victim services program would need a release on their end to share any identifying information.

For multiple agencies that are required to have releases, it is always best practice   for each agency to have its own release. This ensures that program participants are fully informed by each agency of their respective obligations. It also clarifies the specific information to be released by each agency.

Keep in mind that you must ensure there is a truly informed release to share information. If another agency obtains a release from the participant for you to share information with them, it is your responsibility to communicate with the participant about risks/benefits, choices, and reasonable time-limits.

In terms of confidentiality, the strongest and most protective law is what should be followed.

• If you are in a state with strong confidentiality or privilege laws that are more protective than VAWA, follow your state laws.

• If you are in a state that has weak or not as strong confidentiality provisions as VAWA, follow the federal protections.

💡Tip💡 Regardless of which are stronger, state and federal laws can inform best practices about protection of confidential program participant information. For instance, they may have guidance on the use of written, informed, and reasonably time-limited releases of information.

Before this happens, have a plan, including:

• Have an attorney already arranged to call in the event that you receive a subpoena.

• Start by seeking the wishes of the person’s whose information is sought.  If you cannot contact that person or the person does not want you to share the information, then get legal advice and assess the best means to resist the subpoena.  Strategies could include:

  • Contacting the attorney who issued it and asking them to rescind it,

  • Challenging service,

  • Filing a motion to quash the subpoena with the court,

  • Seeking other types of orders to protect the information,

  • Working with the program participant whose information is sought to determine their options to resist the subpoena.

Whatever you do, do not ignore the subpoena and hope it will go away on its own.

❗ Important ❗ Do not destroy documents that may be subject to a subpoena once it has been served on your agency.

For more information, please see How to Prepare for and to Respond to a Subpoena.

Yes. VAWA states that “consent for release may not be given by the abuser of the minor, person with a disability, or the abuser of the other parent of the minor.”

No. VAWA only requires the signature of one non-abusive parent/guardian and the minor child to authorize release of a child’s information. If the minor child is incapable of knowingly consenting, then only a non-abusive parent/guardian needs to sign. The abusive parent is prohibited from signing a release on behalf of the minor child.

If you are working with a minor or a person who has a disability, ask all the questions you would normally ask to identify who the abusive person is. Typically, programs have a policy or practice to determine the abusive party. This usually begins with asking the program participant to identify the abuser. It’s always important to be careful in this assessment, to follow your agency’s policies, and to use your professional training and best judgment.

VAWA regulations specifically state that only the minor’s consent to release information is needed if the minor is legally allowed to access your services on their own without parent notice or permission. No parent or guardian signature is required on releases in those situations.  Remember that the release of information is not to provide services, but to share the program participant’s information with other agencies when requested by the participant. If your organization needs assistance developing a policy on serving minors, please reach out for technical assistance.

If you are able to provide services to a minor without the consent of the parent or guardian, then VAWA allows the minor to sign a release independently. If the services can only be provided with parent/guardian consent, then VAWA requires that the minor and the non-abusive parent/guardian sign the release of information.

VAWA regulation 28 CFR §90.4(b)(3)(ii)(C), provides that if a minor if incapable of knowingly consenting, then the non-abusive parent or guardian signs the consent. It also states that the program should attempt to inform the child, in an age-appropriate way, that the parent/guardian is signing papers to allow you to talk to others in the community. If the child is unable to sign the form, in place of the child’s signature, the provider should note:

• The age of the child,

• The fact that the release was explained to the child, and

• The date. 

The most important thing is to figure out if the person even needs someone else to sign the release of information on their behalf, or if they can sign it themselves.

  Regardless of disability, the only time a guardian is allowed to sign a release is if:

• The person with a disability has been legally adjudicated as unable to sign legal documents, and

• The guardian has been court appointed.

  The best practice is to:

• Ensure involvement of the program participant in all aspects,

• Ensure that they are fully informed, and

• Obtain proof of court-appointed guardianship.

❗ Important ❗ A person with a disability may have a caregiver and still be able to give consent themselves if there has not been a guardian appointed by the court.

  If the person has been found by a court to need a legal guardian and the guardian is a threat, then a new guardian needs to be appointed. Consult with your local disability rights protection and advocacy program to better understand your local laws around guardians and protecting people with disabilities from abusive guardians.

Remember that the release is not to provide services, but to share the program participant’s information with other agencies in the community.

In terms of advocacy and services, there are many things that can be done to address what is happening and to protect the child. Focus on advocacy and non-judgmental supportive practices.

If you are not a mandated reporter, you would only call a CPS hotline with the program participant’s consent. In this context, this means that the program participant who shared information with you gave you instructions to call through a written, informed, time-limited release.

💡Tip💡 If a minor is eligible to work with you without parent/guardian consent, you only need the minor’s consent to call an outside agency.

If a minor is required to have parent/guardian consent to receive your services, you will need the consent of the minor and their non-abusive parent/guardian. Consent may not be given by an abuser.

If you are a mandated reporter under your state’s law, you  are required to make a report to CPS and do not need a release. It is best practice to:

• Inform the program participant that you are making a mandated report.

• Safety plan with the program participant about what comes next after the report is made.

❗ Important ❗ Being compelled to share information (e.g., mandatory reporting) according to state law is an exception to VAWA and VOCA. However, you may only disclose the minimum information that is required under state law.

Best practice is to notify the program participant. If the participant is a minor, also notify the non-abusive parent/guardian unless the participant allowed to work with you without needing parental consent. You should take steps to protect their privacy and safety as much as possible. VAWA requires that agencies make “reasonable attempts” to notify the participant of the report. If it would be dangerous to do so, it could be reasonable to not specifically inform them. For example, it would be reasonable not to inform the survivor if your only way to contact them was by their phone and you know their trafficker monitors their phone.

If you are a mandated reporter, you may make a report to CPS without a release. However, you may only disclose the minimum information necessary under state law. Any information beyond what is required under state law will require a release.

A few state laws require follow-up with CPS during investigations. In these rare instances, you do not need a release for future conversations. However, it is best practice to notify the program participant of your mandate. This includes what steps you must take to fulfill your legal obligation.

If your state does not specifically mandate follow-up with CPS, you would need a release of information in order to provide any information beyond what is required by the report of suspected child abuse or neglect. The participant may decide it is in their best interest to have you share information with CPS and provide written instructions for you to release that specific information.

In assessing what you are required to do, be sure to distinguish between requirements during CPS investigations into suspected child abuse or neglect vs. CPS requests for information when a family has an open case because of abuse or neglect in the past.  It is important to know your state laws and whether your professional role has specific sharing requirements. Check with local legal experts if you are  unsure.

Yes, former program participants are still protected by VAWA confidentiality law. It would be a breach of the former participant’s confidentiality to contact law enforcement or anyone else without a release. Calling law enforcement would reveal that the person previously received services from your organization and reveal a participant’s personally identifying information . This also applies if law enforcement or another agency calls to confirm if someone used your services in the past.

In addition, we know that it is important to respect a program participant’s self-determination in deciding when it is safe and when it is not safe to reach out for assistance, contact a program, or call the police. Doing this without the person’s consent could undermine that self-determination and safety.

💡Tip💡 Even if you are a mandated reporter, a report is only required when there is reasonable suspicion of abuse under the statute. A rumor that abuse is occurring is not typically a basis for a report.

Yes, organizations must have written instructions from a participant on how to share their identifying information. Written instructions may include those signed electronically. See the Basic Release Template section of this document for more information.

All agencies should develop policies and protocols on how to obtain written consent when a participant requests for their individual information with an outside agency over the phone. These will likely incorporate a “case by case” piece, as the best way to obtain consent may vary by individual.  Remember that your organization may be able to make calls to inquire about services and resources without giving out any identifiable information about the participant.

❗ Important ❗ Depending on the situation and community, merely requesting information about a perpetrator may confirm that the program participant is seeking your services. This should be acknowledged and the program participant should be asked if they want the provider to request this information.

In addition, it may be possible and effective to use three-way calling between your own agency, the participant, and another agency from which the participant is seeking information or assistance. This way, the program participant can speak directly to the other agency. A participant can choose to share any of their own information with any agency, including during a three-way call, without a release.

First, consider whether there is another way to meet the program participant’s immediate advocacy needs without releasing their personally identifying information. For example, could the provider:

• Support the participant in making the call to the other agency or professional themselves?

• Use three-way calling to facilitate the connection, so that the participant can provide any personally identifying information themselves?

In cases where you must share personally identifying program participant information, a release is essential. Because VAWA requires a written release, oral releases are not recommended and are never best practice.

💡Tip💡 You can call another service provider and say “I spoke with a participant today who really needs xxx. Can I give them your number and have them call you?”

Yes, and the situation does not need to be urgent. When identifying alternative options to in-person signatures, it’s important to remain survivor-centered in the process. Talk through issues related to preventing impersonation and navigating privacy and safety concerns. Organizations can determine when to suggest an emailed or digitally signed release, but they must ensure that the release was signed by the program participant.

💡Tip💡 In some cases, a trafficker/abuser may be able to access another person’s email account and/or make an email (or digital signature) appear to be from someone else. Confirm an emailed or digitally signed release with the program participant by phone or another means (e.g. video call) prior to sharing their information.

See Digital Written Consent to Share Information to learn more about how programs can provide survivor-centered options to meet participant needs, while also following best practices related to confidentiality.

If a program participant wants an advocate to speak on their behalf in court, the program participant will need to provide the advocate with written instructions on how they want them to participate in court proceedings. Before the hearing, the advocate and the program participant should review what will happen at the hearing, the role of the advocate, and what information the program participant would like shared. If you are appearing in court to support the program participant, but are not actually speaking on behalf of a program participant, notify the program participant that your presence can signal to observers that they are receiving your agency’s services. If you will not be disclosing identifying information, there is no need for a release.

In case of medical emergency, you can contact emergency medical services and tell them the nature of the emergency without telling them identifying information. In many cases, the program participant will be conscious and able to inform EMT staff themselves and decide how much they want to share.

 If a program participant has a medical condition or would like your organization to communicate something to 911 during an emergency, that should be discussed as part of any safety planning discussions. The program participant could give written instructions to share specific information if a medical emergency occurs and the program participant cannot communicate.

Remember that even if it is appropriate to call 911, it is never appropriate to share their whole case history or file. Identifying information is not necessary for 911 to respond. In addition, it is not appropriate to specifically comment on why they were receiving assistance from your organization.

💡Tip💡 A provider can respond “I don’t know” or give non-identifying information (“around 45 years old” instead of actual birth date) when asked these questions by the 911 operator.

Providers may have this discussion, in a delicate way, with a program participant if the program participant is fearful for their life.

❗ Important ❗ It is not best practice to ask every program participant that comes to your program to sign a release of information in the event of death or disappearance. This should only be raised if a participant expresses fear that they become missing or deceased, or if a participant requests it. This should not be a routine practice for all participants.

Safety planning with someone who is concerned they may become missing or deceased may involve the program participant giving written instructions on how the provider should respond.

Discuss how the provider would know if the program participant is missing or deceased vs. if they fled and just didn’t tell anyone. Not knowing and releasing their information could be dangerous to the missing person or surviving family members of a deceased program participant, or to a living participant who has gone into hiding.

Emphasize to program participants that they can change their mind and change their instructions about what you should or should not do if they go missing or are deceased.

VAWA permits disclosure of identifying information to fatality review teams only when specific requirements are met, meaning VAWA confidentiality is expected to be protected after the death of a program participant. Since some jurisdictions also have state-based confidentiality and privilege protections, programs should look to their state law for guidance regarding the survivability of any confidentiality or privilege between a participant and the program.

Yes, oral withdrawal of consent is normal. Less harm (and program liability) can come with withdrawing consent than might result from releasing information without proper consent. This is the case even when waiting to verify the program participant’s identity. Furthermore, when a program participant withdraws consent, it happens immediately, at the time of the request. While withdrawal can be requested orally, best practice is to get it in writing as soon as possible.

The giving or withdrawal of consentforreleaseshouldonlybegivenbytheprogram participant. This makes itimportanttoensure (as in all cases)thatnooneisimpersonatingtheparticipant.Getting the withdrawal in writing can help with this. It is best practice for organizations to  have ways of confirming the participant’s identity.

An emergency contact form should only be used when the program participant wants it used. It cannot be a condition of service. Participants should be explicitly told they have permission to leave it blank if they want to do so.

❗ Important ❗ An emergency contact form is a release of information and must contain all of the required components; it must be informed, written, reasonably time-limited. The circumstances when the emergency contact form is used and the program’s definition of “an emergency” should be made very clear. It may change how the program participant chooses to use or not use the form.

Unencrypted email (which is most email) is not a confidential way to communicate information. Email also encourages long chains of communication. To minimize the amount of information included in email, you can delete the text of the previous message before responding when participant information is being shared, and delete emails regularly to minimize the amount of information being stored. Best practice is to keep all personally identifiable information out of email when possible. For more email best practices, check out Safety Net’s “Best Practices When Using Email.”

If email is often necessary, you may want to consider an encrypted email service that requires passwords to access information. As of April 2026, some examples include Tresorit, Virtru, SecureMyEmail, and Mimecast. You should always do your own due diligence, including on these examples. Products can change or be discontinued, and new products may become available. You can learn more about encryption, and the kinds of encryption best for storing survivor data, with Safety Net’s Encryption Basics for Programs resource.

Participants may request that a program email their identifiable information with a written release of information. Ifaprogram participantasksyoutoshareinformationvia unencrypted email,you shouldinformthemaboutitssecuritylimitations.Regardlessofanyfooteryouplaceinyouremailstatingthatitisprivilegedorconfidentialcommunication,emailcanbebreachedatmultiplepointsduringitstransmission.Confidentialinformationaboutparticipantsshouldnotbeemailed without a participant’s written instruction.

They are bound by the same confidentiality provisions stated in VAWA. The employee should sign the agency’s confidentiality agreement and should receive training on preserving confidentiality.

VAWA regulations require programs to take reasonable measures to prevent inadvertent disclosures of identifiable information to those outsiders.  One way to prevent disclosures to outsiders is to encrypt information and make sure that only the agency holds the key to unlock the encryption.  The contractor should sign a contract that involves acknowledging that they understand and will abide by VAWA confidentiality provisions and can include consequences if those confidentiality provisions are not honored. You can get more information about best practices for agency use of technology at Safety Net's Agency Toolkit.

In general, video surveillance laws are very broad. If a person is in a public place, consent to be recorded is not needed. For example, the street outside of your building is a public place. The interior of your building includes private places, where laws may differ.

Please visit Techsafety.org for more information on best practices for agency use of cameras. Interior cameras are not survivor-centered. This is especially a consideration for participants who may have been monitored by traffickers.

If the external cameras are being used by a victim services agency for security program participants receiving your services should be notified of their  existence and the use of the footage.

• Signs can be posted informing that video surveillance is in use.

• Agencies should have video policies. These policies should be focused on being survivor-centered and maintaining participant confidentiality. They should specify processes on:

  • Video storage (including security policies to protect the data).

  • Retention (including how long you will retain the data).

  • Deletion/disposal (including how and how often you will delete). See the University of California at Irvine’s guidance for proper data disposal.

Releaseswouldbeneededifthevideosweretobesharedoutsideoftheagency. Programs must have a plan to protect confidentiality if a law enforcement agency requests access to surveillance video.

Releases are only required when sharing information outside your agency. However, you need to make sure that:

·       Your agency has full ownership of the data in the database. The vendor should not have any ownership rights.

·       Your agency must ensure that the database (and the information in it) cannot be accessed by anyone else outside your agency (including the vendor). For more information about managing a confidential database, view Safety Net’s resources on Selecting a Database.

If no information is accessible to anyone outside of the program, there is no need for a program participant to sign a release. However, other people having a participant’s personal information, even when it is not being shared, can leave participants feeling vulnerable and disempowered. Sharing the context for why it’s being collected is helpful. Participants should be fully informed of the agency’s data collection processes, the risks and uses of the database, and given the choice to opt out of any data collection that is not necessary for service provision.

Agencies should analyze what information (data) is being collected and why. Some organizations do scheduled review of their forms and database to ensure that they are only collecting minimal data. “Minimal” means what is required to provide the requested services. They also review their data retention policies. This helps ensure that data is only stored for as long as necessary and reduces the work for providers while respecting the privacy of participants. For more information on data retention policies, visit Safety Net’s “FAQs on Record Retention and Deletion.”

Organizations should also think through all data collection and maintenance processes.  TVPA/VAWA regulation 28 CFR § 90.4 requires grantees to take “reasonable efforts to prevent inadvertent releases” of identifying information, especially when using technology to store information.  It is important to safeguard devices used for work to protect participants’ personally identifiable information.

Databases with survivor information should have the data encrypted (locked). Best practice is that only the program’s staff, not the vendor, holds the encryption key.  You can learn more about what these terms mean, and how to implement this practice, via NNEDV’s Safety Net Encryption Basics for Programs resource.  If the database provider holds the key, the agency should take this into consideration when negotiating contracts. Such contracts should have specific confidentiality protections and heightened breach notification procedures.

For more information on databases, see NNEDV’s resources at Safety Net's Agency Use Toolkit or email htconfidentiality@nnedv.org.

Under TVPA/VAWA, the only information a program can release to third-party databases without a release is non-personally identifying information in aggregate form (totals). A third-party database is one that your organization does not own or control. This could include referral databases, databases run by an anti-human trafficking task force, or statewide databases on the prevalence of human trafficking.

An example of aggregate information is “We served 15 adults and 22 children today.” If aggregate information is not identifying, a release from the program participant is not necessary. However, if a government or private funder requires your agency to enter the names and ages for participants into a state database, fulfilling that requirement would violate TVPA/VAWA.

Remember that in some circumstances some aggregate data could be more identifying than you think. This is especially true in small towns or specific cultural communities.

Oregon’s Office of Health Analytics has a useful Small Numbers Reporting Guide that can help you identify what information is non-identifiable and when it needs to be suppressed.

❗ Important ❗ It is not appropriate to ask participants to sign releases for databases that generally support anti-trafficking efforts but do not directly support an individual participant’s goals. This may include third-party state reporting databases. For example, a statewide database that compiles profiles of trafficking program participants to share with law enforcement, may not serve a participant’s individual needs.

Releases are only presented as an option to program participants if the database helps the program participant solve a problem, not to solve agency or funder reporting desires. If a funder is insisting on this information, contact htconfidentiality@nnedv.org for assistance.

If a program participant consents for their personal information to be entered into a third-party database that helps them directly, then the time-limited aspect of the release refers to how long you have to enter the information. Once it is entered into a database, it is likely there to stay. Neither you nor the participant will have control over how long it stays there. Databases offer opportunities for exporting data, creating backup copies in multiple locations, sharing/selling data to outside parties, and merging or re-bundling data. This is something you should investigate with the program participant so they can make an informed decision about participating in the database.

When a program participant expresses a need or desire to have identifying information entered into an outside database (such as a victim notification system), the program should work with them to determine the best way to enter that information.  Before you can enter the information into the database, you should confirm that:

• The data is being entered to meet a survivor-defined goal. Remember that complying with a program’s funding requirements is not a survivor-defined goal).

• The participant is fully informed of all pros and cons of participating in the database, alternative methods to meet the need, and the inability to remove or control information once it is entered.

• The participant understands that this data entry is not a condition of receiving your services, though it may be a requirement of receiving the notification.

• The participant can decide exactly what information is and is not entered. 

If all of the above are confirmed and the participant wishes to have the program enter the information, then you can complete a written, informed release that time-limits when it can be entered. 

For example, if your state has an online system for streamlining housing application processes.  The participant having profile in the database makes finding opportunities much easier for the provider and the application process for the participant significantly easier. Even though completing a profile could make both your job and the client’s search significantly easier, you need a release in order to complete a profile for the participant. During your discussion with the participant about this option, you should make sure they know that you can use it to search for subsidized housing opportunities even without completing a profile for them. You should also make sure they understand that a profile will make it easier to find appropriate opportunities and complete applications. You should discuss with them who will have access to the data, what data they would need to enter, and the potential consequences (if, for instance, the database was hacked or subpoenaed).

❗ Important ❗ Even the program acknowledging that they provided services to a program participant requires a release of information. Discuss the risks of disclosing the receipt of services from the program with the program participant.

The majority of databases used by service providers are cloud-based. Means that you must be careful not to allow the database vendor employees and contractors unrestricted access to program participant identifying information. Doing so would violate TVPA/VAWA confidentiality. It also risks that anyone who gains access to those companies’ computers will have access. 

With databases, it is best practice for you to:

1. Understand potential databases’ security features and customization options. For more information about managing a confidential database, view Safety Net’s resources on Selecting a Database.

2. Choose database systems that do not allow anyone outside your program, including vendors, access to participant information. Doing so requires that the database has particular types of encryption. You can learn more about this issue with Safety Net’s Encryption Basics for Programs guide.

3. Retain control over who within your program is able to see participant information.

Ask potential database providers detailed questions about their team’s access to information (not just what their policies are about access to information).

💡Tip💡 If it is not possible to prevent the database provider’s team from having access at all, consider alternative databases. If these are not an option, ask the database provider how access can be made more restrictive.

If the database provider team can access information, then the agency should include specific confidentiality protections and heightened breach notification procedures in the contract with the provider. Get more information about selecting a database with Safety Net's Agency Toolkit. 

A participant would only need to provide a release of information if the program will be sharing their information with the speaker directly.  Inform program participants before or when they arrive that a guest speaker will be there that day. Tell them the speaker’s name and affiliation. This way, participants can choose whether or not to attend that group. The speaker should sign a confidentiality agreement that outlines the program’s expectations of how the speaker would treat any identifying information they receive or hear during their time at the program. If participants choose to share their personal information to the speaker during or after that session, that is their choice and therefore no release is required.

It is important to distinguish between privilege, privacy, and confidentiality. Confidentiality requires providers to affirmatively protect program participant information. A release from the participant is always needed for a provider to share the participant’s information with another organization. Participants can tell their personal story to whomever they want. However, if a participant shares certain information in some circumstances, this may or may not be interpreted as a waiver under state law of privilege between the participant and the provider. Ask an attorney familiar with your state law around privilege. The information could include:

• Specific details of confidential conversations they had with a provider.

• The particulars of what a provider told them.

Regardless, providers and programs should continue to actively protect information. Share only with releases to ensure compliance with TVPA/VAWA. Respect the program participant’s privacy.

The protections apply to every program participant/survivor/client who requests, receives, or has received services from a direct anti-trafficking services program that receives VAWA or OVC Human Trafficking funds. If the program is part of a larger agency that has many different types of service programs, protections only apply within the anti-trafficking services program, not the whole agency. All participants who use the program’s services should have the same confidentiality protections.

The confidentiality requirements of VAWA apply to all grantees or sub-grantees of those funds. If your organization is an umbrella organization that operates multiple programs, VAWA laws apply to your anti-human trafficking services, violence against women programs, or crime victim programs. Even if VAWA only funds a portion of your victim services, you should provide the same confidentiality protection to all victims who use your services.

Yes. The agency is obligated to follow the confidentiality requirements of VAWA. Every employee or anyone who has access (or potential access) to program participant information (including volunteers, interns, temporary staff, or contracting staff) must follow the VAWA confidentiality provisions.

Your agency should have policies about sharing information internally. In general, information should be shared when it is relevant to:

• Providing requested services to a program participant.

• When a provider needs support from a supervisor or colleague.

• On a limited basis within your agency to help a participant as long as staff are operating under the same confidentiality obligations and disclosure mandates.

It is important to respect the trust that is built between providers and program participants and within support groups. Program participants may share details and information about their situation with certain providers or people within certain settings and still expect a level of discretion.