Online Coordinated Care Networks & Referral Systems: Confidentiality Considerations for Victim Service Providers
What is a referral database?
Referral databases (or coordinated care network databases) electronically store and share information across many community partners, and are similar in purpose and design to Homeless Management Information Systems (“HMIS”).
Referral databases are built to easily share personally identifying information (“PII”) between different service providers, as well as facilitate tracking of what services were provided and what the outcomes were.
For some community providers, funding or reimbursement for services may be tied to whether PII, services, and outcomes are entered in the database.
What if databases have a special process for VSPs?
If a referral database advertises a special process so PII entered by VSPs won’t be shared, it begs the question: why does the survivor PII that won’t be shared need to go into a database built for the special purpose of sharing? In other words, if the innovation of the database is that it easily shares PII across the community, then why create an exception where VSPs are using the database but don’t share PII? Is this just setting up the VSP to be the “problem child who won’t cooperate” – a feeling described by many VSPs participating in comparable databases, which are a special exception to HMIS participation rules.
How does a VSP know if it should participate in a referral database?
When VSPs are asked to participate in referral databases, there are difficult questions to answer:
Under local law and federal rules, is the VSP allowed to enter PII into a shared referral database?
Will the program be ok with asking trauma survivors if they want to consent to putting PII into the shared referral database so they can access help?
Does the VSP understand who can access PII that is put into the database?
Can the VSP explain it clearly to survivors?
Does the contract ensure that access will not change once use has begun?
What staff resources and training will be required to be able to use the database in a survivor-centered manner? Is that more or less resources than the VSP currently invests in making successful referrals?
What will the vendor and/or other referral database members do with the PII that they are allowed to see? Are they allowed to sell it, conduct research with it, or otherwise use it for organizational purposes unconnected to referring survivors for services?
Will the VSP remain the owner of the data that is inputted?
If the VSP does participate in the referral database, will saying “yes” to the referral database become the only way survivors can access services?
Are survivors in the community having a problem connecting to services?
If they are, does this referral database actually address the real problem for survivors?
How will data breaches and breach notifications be handled safely? How will the vendor respond if it receives a request for survivor PII?
What will be the benefit to the VSP and the survivors the program serves? Will it outweigh the necessary workload of participating?
What does it mean if the database vendor says “we follow the law”?
Legal confidentiality for VSPs tends to look very different than legal confidentiality for healthcare providers and other social services. It is not necessarily good enough for a VSP if a referral database was designed to meet the legal requirements for healthcare or other kinds of social service providers (such as “HIPAA”, “SAMHSA” or other privacy laws). If a referral database makes promises to comply with a specific law or laws in general, VSPs still need to do a very careful analysis as to whether it complies with the laws that actually apply to VSPs.
How does the VSP know what its rights and responsibilities are?
Participation in referral databases will likely come with Terms and Conditions agreements, and other documents drafted by lawyers for the referral database vendor. These will be written to protect the interests of the vendor. Programs should seek their own legal advice to understand these agreements and potentially seek additional agreements to protect the interests of the VSP and the survivors it serves.
Summary
Referral databases are becoming increasingly common and victim service providers will increasingly be encouraged to participate. While community collaborations are incredibly important to providing holistic services to survivors, there are many considerations to think through before joining into a referral database system. Confidentiality is key to maintaining safety and confidence in victim service providers. Participation in any collaborative process should be both beneficial to the survivors served by the program and feasible for the program in terms of staffing and capacity.