Frequently Asked Questions

This section provides an overview on questions that commonly come up concerning confidentiality releases, U.S. Federal Laws on confidentiality, record retention and deletion, mandatory reporting, the use of surveillance cameras, answering subpoenas and much more. For ease, this section is set up in an easy-to-read question and answer format.

Additional General Questions

Is our program able to enter identifying survivor information into a cloud-based database?

If you outsource your database and storage of client information to a cloud-based provider, you may be violating VAWA/FVPSA confidentiality by giving all the employees of that company and the employees of their sub-contractor companies access to all of the survivor identifying information in your database.  With databases, it is best practice for the program to 1) understand how the database system actually works,  2) retain control over who is able to see survivor information, and 3) choose database systems that do not give IT personnel who are outside of the program's control access to survivor information.  Ask any database provider detailed questions about how their team is able to access information (not just what their policies are about access to information) and ask them how access can be made more restrictive.

Do state confidentiality and privilege laws supersede Federal laws, such as VAWA and FVPSA?

In terms of confidentiality, the strongest and most protective law is what should be followed. So, if you are in a state with strong confidentiality or privilege laws that are more protective than VAWA or FVPSA, then your state laws should be followed. If you are in a state that has weak or not as strong confidentiality provisions as VAWA and FVPSA, then VAWA and FVPSA protections should be followed. Either way, state and federal laws can inform best practices about protection of confidential, survivor information, such as the use of written, informed, and reasonably time-limited releases of information.

What about the use of surveillance cameras?

In general, video surveillance laws are very broad. Anytime a person is in a public place, consent to be recorded is not needed. For example, the street outside of your building is a public place where there may be a security camera that shows who comes and goes.

However, if the cameras are being used by a non-profit agency for security, survivors receiving your services should be notified of its existence and the use of the videotapes. Signs can be posted informing that video surveillance is in use, and agencies should have policies developed that specify the video storage, retention, and deletion processes, which should be focused on maintaining survivor confidentiality. Releases would be needed if the videos were to be shared outside of the agency.

What should our DV/SA program do if we get a subpoena?

First, have a plan, including an attorney to call in the event that a subpoena is received. Your plan should start with seeking to find out the wishes of the person's whose information is sought. If you cannot contact that person or the person does not want to share the information, then get legal advice and assess the best means to resist the subpoena. Strategies could include: contacting the attorney who issued it and asking them to rescind it, challenging service, filing a motion to quash the subpoena with the court, seeking other types of orders to protect the information, working with the survivor whose information is sought to determine her position and whether she will also be resisting the request for information, among other actions. Whatever you do, do not ignore the subpoena and hope it will go away on its own, and certainly don't destroy documents that may be subject to a subpoena once it has been served on your agency. To request additional technical assistance (for you or your attorney) or to request assistance from a pro bono attorney, contact the American Bar Association Commission on Domestic and Sexual Violence at and go to the "Need Help?" section.

When is it appropriate to share information talked about by clients in a support group session with other staff that were not in the session?

Your agency should have policies about sharing information internally. In general, information should be shared when it is relevant to providing requested services to a survivor or when an advocate needs support from a supervisor or colleague. Sharing limited information to help a client is permissible within your agency. For example, for grant purposes, the bookkeeper may need to know if the client is receiving services for domestic violence or sexual assault; however, the bookkeeper does not need to know the details of the abuse.

It is important to respect the trust that is built between advocates and survivors and within support groups. Survivors may share details and information about their situation with certain advocates or people within certain settings and still expect a level of discretion.

Can one advocate who has received information from a client share it with a supervisor in the same agency or share it with a non-profit based advocate in another agency (because a client is moving to another jurisdiction, for example)?

You can share information with your supervisor or team; although it is best practice that information be shared on a "need-to-know" basis. Agencies should have a policy in place about internal information sharing. For example, it may be appropriate to inform a supervisor or colleague of the status of an individual's court case or if they are possibly suicidal. It may not be necessary or appropriate, however, to share with a supervisor or co-worker that an individual told you s/he is an incest survivor in addition to recent violence that brought her to your program.

To share information with an advocate at another agency, you will always need a release.

What about information that is emailed? What about Information Technology (IT) personnel that have access to sensitive information on our computers?

Email is absolutely not a confidential way to communicate information, and best practice is to keep all personally identifiable information out of email. If a victim asks you to share information via email, you should inform her/him about the security limitations of email. Regardless of any footer you place in your email stating that it is privileged or confidential communication, email can be breached at multiple points during its transmission. Confidential information about clients should never be emailed.

If individual IT personnel are contractors or employees of the domestic violence or sexual assault organization, they are bound by the same confidentiality provisions stated in VAWA and FVPSA and should sign the agency's contractor confidentiality agreement acknowledging that they understand and will abide by those confidentiality provisions.

Does the obligation to hold confidentiality with survivors extend to the entire staff of our non-profit sexual assault and domestic violence program?

Yes. Every employee or anyone who has access (or potential access) to client information (including volunteers, interns, board members, temporary staff, or contracting staff) must follow the VAWA and FVPSA confidentiality provisions. The agency is obligated to follow the confidentiality requirements of VAWA and FVPSA.

We are not a domestic violence program, but a homelessness service program that receives funding from the Office on Violence Against Women. Do the VAWA laws regarding confidentiality apply to us?

The confidentiality requirements of VAWA and FVPSA apply to all grantees or sub-grantees of VAWA or FVPSA funds. If your organization is an umbrella organization that operates multiple programs (Salvation Army, YWCA, etc.), VAWA and FVPSA laws apply to your victim services or violence against women programs. Even if VAWA or FVPSA only funds a portion of your victim services or violence against women program, you should provide the same confidentiality protection to all victims who use your services.

Do the VAWA protections apply only to clients of VAWA or FVPSA-funded staff or to all clients of a VAWA or FVPSA-funded domestic violence program?

The protections apply to every survivor/client who requests, receives, or has received services from a domestic violence, sexual assault, dating violence or stalking program that receives VAWA or FVPSA funds. If the program is part of a larger agency that has many different types of service programs, it would only apply within the victim services program, not the whole agency. All survivors who use the program's services should have the same confidentiality protections.

If a survivor talks to the advocate and then talks to someone else (mother, friend, sister) would that be considered a waiver of her privilege?

A release from the survivor is always needed for an advocate to share a survivor's information with another advocate or another organization. Survivors can tell their personal story to whomever they want. However, if a survivor shares specifics of confidential conversations they had with an advocate or the particulars of what an advocate told them, in some circumstances this may or may not be interpreted as a waiver under state law of confidentiality or privilege between the survivor and the advocate. Regardless, advocates and programs should continue to actively protect information and share only with releases to ensure compliance with VAWA and FVPSA and respect the survivor's privacy.

If a speaker comes to a survivor support group, will each client attending need to sign a release of information waiver?

No, unless the agency is going to be sharing individually identifying information with the speaker (like a list of people who are attending the group). If clients are informed when they arrive that a guest speaker will be there that day and are told the name of the speaker and the speaker's affiliation, the clients can choose whether or not to attend that group. The speaker should sign a confidentiality agreement. If the clients choose to share their personal information to the speaker during or after that session, that is a choice they make and therefore no release is required.