FAQ on the VAWA Confidentiality Provision

Frequently Asked Questions (FAQs)

on the VAWA Confidentiality Provision

(34 U.S.C. § 12291(b)(2))

October 2017

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 2

I. In General

1. What is the “VAWA Confidentiality Provision”?

The VAWA Confidentiality Provision refers to 34 U.S.C. 12291(b)(2), a provision of the

Violence Against Women Act (VAWA) that requires all grantees and subgrantees

receiving VAWA funding from the Department of Justice, Office on Violence Against

Women, to protect the confidentiality and privacy of persons to whom those grantees

and subgrantees are providing services. The VAWA Confidentiality Provision is

designed to ensure the safety of adult, youth, and child victims of domestic violence,

dating violence, sexual assault, and stalking.

2. Who is covered by the VAWA Confidentiality Provision?

All grantees and subgrantees providing services to victims and receiving VAWA funding

from the Office on Violence Against Women are covered by the VAWA Confidentiality

Provision.

3. What does it mean to be “covered” by the VAWA Confidentiality Provision?

Grantees and subgrantees “covered” by the VAWA Confidentiality Provision must

adhere to the requirements of that Provision; that is, they may not disclose, reveal, or

release personally identifying information or individual information collected in

connection with services requested, utilized, or denied through grantees’ and subgrantees’

programs, regardless of whether the information has been encoded, encrypted, hashed, or

otherwise protected.

4. What is “personally identifying information”?

“Personally identifying information” means information about an individual that may

directly or indirectly identify that individual. In the case of a victim of domestic violence,

dating violence, sexual assault, or stalking, it also means information that would disclose

the location of that individual. Personally identifying information includes information

such as an individual’s name, address, other contact information, and social security

number, but it also can include information such as an individual’s race, birth date, or

number of children if, in the particular circumstances, that information would identify the

individual. Personally identifying information also may include information that is

encoded, encrypted, hashed, or otherwise protected.

5. Are there circumstances in which a grantee or subgrantee may share personally

identifying information?

By statute, a grantee or subgrantee may share personally identifying information in three

specific circumstances:

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 3

(1) When the victim provides written, informed, and reasonably time-limited consent

to the release of information (“a release”);

(2) When a statute compels that the information be released; or

(3) When a court compels that the information be released.

If a statute or court compels the release of information, the grantee or subgrantee

releasing the information must (1) make reasonable attempts to provide notice of the

release to affected victims and (2) take steps necessary to protect the privacy and safety

of persons affected by the release.

II. Scope of the VAWA Confidentiality Provision

6. Are subgrantees covered by the VAWA Confidentiality Provision?

Yes, subgrantees are covered by the VAWA Confidentiality Provision.

7. Are grant partners (such as MOU partners) covered by the VAWA Confidentiality

Provision?

MOU partners and other partners are covered if they are receiving funds under the grant

as subgrantees.

8. Are partners that do not receive funding through the grant covered by the VAWA

Confidentiality Provision?

Partners that do not receive VAWA funding are not covered by the VAWA

Confidentiality Provision. OVW encourages such partners to voluntarily “opt-in” to the

requirements of the VAWA Confidentiality Provision; opting in is a best practice for

keeping victims safe. Consider, for example, a scenario in which Rape Crisis Center gets

a VAWA grant in partnership with Local Housing Agency. Rape Crisis Center and Local

Housing Agency have a memorandum of understanding, but Local Housing Agency is

not funded under the VAWA grant. If Victim A comes to Rape Crisis Center, and Rape

Crisis Center contacts Local Housing Agency on behalf of Victim A, Rape Crisis Center

will need a signed, written, informed, and reasonably time-limited release before Rape

Crisis Center can share the victim’s personally identifying information. If Victim A goes

first to Local Housing Agency for services that are covered by the memorandum of

understanding, however, then Local Housing Agency can contact Rape Crisis Center on

Victim A’s behalf and share Victim A’s information without Victim A’s consent, because

Local Housing Agency is not receiving any funds under the grant. Although the release

of information by Local Housing Agency is permissible, such a practice is not

recommended because it could threaten the safety and privacy of the victim.

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 4

9. What if the grantee is a large umbrella organization but only one division of the

organization is providing grant-funded services?

Under the VAWA Confidentiality Provision, the division of the organization that is

providing grant-funded services may not share personally identifying information with

other divisions of the organization. Per regulation, 28 CFR 90.4(b)(2)(iii), the VAWA

Confidentiality Provision applies to disclosures from “the victim services divisions or

components of an organization, agency, or government” to other non-victim services

divisions within an organization, agency, or government.

“Victim services division or component of an organization, agency, or government” is

defined as “a division within a larger organization, agency, or government, where the

division has as its primary purpose to assist or advocate for domestic violence, dating

violence, sexual assault, or stalking victims and has a documented history of work

concerning such victims.” 20 CFR 90.2(h).

 Example 1: A grantee organization operates a domestic violence shelter, a

counseling program, and a food bank. The organization partners with a medical

service provider. If Client A comes to the domestic violence shelter, the shelter

would need a release from the client before the shelter may contact the food bank

on the client’s behalf. If Client B comes to the food bank because she is homeless

(even if she is homeless as a result of domestic violence), and the food bank

contacts the partner medical provider, the food bank would not need a release

from the client because the client had never sought victim services from the

organization. As with the example in Question 8 above, although the food bank is

not required to obtain a client’s consent before sharing the client’s information,

OVW would encourage the food bank to “opt-in” to the VAWA Confidentiality

Provision in order to better protect the safety and privacy of all of the grantee

organization’s clients.

 Example 2: The grantee is a tribal government. The tribal domestic violence

program is providing victim services through the grant. The tribal domestic

violence program cannot share identifying information about victims with other

divisions of the tribal government without a statutory or court mandate or a

signed, written, informed, and reasonably time-limited release from the victim.

10. Can a victim services division or component of an organization, agency, or

government share victim information with the leadership of the larger organization,

agency, or government (e.g., executive director or chief executive)?

In the absence of a statutory or court mandate or a signed, written, informed, and

reasonably time-limited release, the victim services division or component may only

share identifying information about victims with the leadership of the larger organization,

agency, or government in extraordinary and rare circumstances. Such circumstances do

not include routine monitoring or supervision. One example of an extraordinary and rare

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 5

circumstance that would justify release to an organization’s leadership is where there are

allegations of fraud against the victim services division or one of its staff members.

11. Does the VAWA Confidentiality Provision apply to the entire victim service

provider or victim services division/component, or only the funded activities?

The VAWA Confidentiality Provision applies to all operations of the victim service

provider or victim services division/component, even if the OVW funding is only for a

small part of those operations.

12. Are victim-witness assistants at police departments and prosecutors’ offices

covered?

Victim-witness assistants are not covered because they are not providing “victim

services.” Although the services they provide help victims, they are also assisting with

investigation and prosecution. The VAWA Confidentiality Provision expressly applies to

“victim services,” which do not include the work of victim-witness assistants.

13. Does the VAWA Confidentiality Provision cover identifying information about

offenders if a grantee or subgrantee is providing offender services (such as

batterers’ intervention or sex offender treatment)?

No. The VAWA Confidentiality Provision does not cover identifying information about

offenders.

14. Are Sexual Assault Nurse Examiner (SANE) programs or Sexual Assault Forensic

Examiner (SAFE) programs covered by the VAWA Confidentiality Provision?

No, SANE and SAFE programs are not covered, although they may be subject to other

confidentiality provisions such as the Health Insurance Portability and Accountability Act

(HIPAA). For more information on this topic, see the Office for Victims of Crime SANE

Development and Operations Guide at: https://www.ovcttac.gov/saneguide/legal-and-

ethical-foundations-for-sane-practice/federal-laws/.

III. Victim releases

15. Are there criteria that releases must meet?

Releases must be written, informed, reasonably time limited, and signed by the victim or,

if appropriate, a parent or guardian. Grantees and subgrantees may not use a blanket

release and must specify the scope and limited circumstances of any disclosure. At a

minimum, grantees and subgrantees must:

 Discuss with the victim why the information might be shared, who would have

access to the information, and what information could be shared under the release;

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 6

 Reach agreement with the victim about what information would be shared and

with whom; and

 Record the agreement about the scope of the release.

The release must specify the duration for which the information may be shared.

16. What time period should a release cover?

Releases should be for a “reasonable” time period. The reasonableness of the time period

will depend on the specific situation.

17. Who should sign a release for a minor child?

In the case of an unemancipated minor, both the minor and a parent or guardian must sign

the release. Consent may not be given by the abuser of the minor or by the abuser of the

other parent of the minor. If the minor is incapable of knowingly consenting, the parent

or guardian may consent on the minor’s behalf. In such cases, the grantee should attempt

to notify the minor as appropriate. If the minor is permitted by law to receive services

without the parent’s or guardian’s consent, the minor may consent to release information

without additional consent from a parent or guardian.

18. Who should sign a release for a legally incapacitated person?

The release for a legally incapacitated person must be signed by the person’s legally-

appointed guardian. Consent may not be given by the abuser of the legally incapacitated

person. If the person is permitted by law to receive services without the guardian’s

consent, then the person may consent to release information without further consent from

a guardian.

19. Can a victim be required to sign a release as a condition of service?

No, a grantee or subgrantee may not require a victim to sign a release as a condition of

services. The release must be voluntary and fully informed. It should spell out the

purpose for which the information will be used, what information may be shared, with

whom it may be shared, and the duration of the release (which must be reasonably time

limited).

20. In the case of telephonic services, such as a hotline call, is an oral release

acceptable?

The statute does not allow for oral releases. Written releases are required. One option

for this situation would be for the victim to remain on the call while a third party is

contacted, so that the victim can provide his or her own information without the need for

a release. Another option would be to consider having the victim email or fax a written

release.

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 7

IV. Court and Statutory Mandates

21. What if the jurisdiction has a common-law duty to warn?

If the jurisdiction has a common-law duty to warn (i.e., courts have established through

case law that certain professionals have a duty to warn others of specific, imminent

danger), this would equate to a “court mandate,” and thus allow for the release of

information without the victim’s consent. For example, in some jurisdictions, a common-

law duty requires therapists to warn others of a serious threat of harm to or by their

patients. In such jurisdictions, a therapist working for an OVW grantee or subgrantee

could make the required warning without violating the VAWA Confidentiality Provision.

Nonetheless, the therapist would have to both notify the victim of the disclosure of

information and take steps necessary to protect the privacy and safety of all persons

affected by the disclosure.

22. Can grantees and subgrantees comply with state or tribal mandatory child abuse

reporting laws?

If the grantees’/subgrantees’ personnel or volunteers are covered by a mandatory child

abuse reporting law, then the release of information in a child abuse report would be

statutorily mandated and therefore allowed under the VAWA Confidentiality Provision.

The grantee or subgrantee, however, would need to both make reasonable attempts to

provide notice to victims affected by the disclosure and take steps necessary to protect the

privacy and safety of all persons affected by the release of the information.

23. What if the jurisdiction has a law allowing for release in circumstances such as child

abuse or clear and present danger, but does not require it?

If the release of information is allowed, but not required, under a state or tribal law, then

the state or tribal law would not constitute a “statutory mandate” for purposes of the

VAWA Confidentiality Provision. Therefore, a VAWA-funded organization in that

jurisdiction could not release identifying information without a signed, written, informed,

and reasonably time-limited release from the victim or a court order.

V. Confidentiality Acknowledgement Form

24. What is the purpose of the “Confidentiality Acknowledgement Form” at

https://www.justice.gov/sites/default/files/ovw/pages/attachments/2015/01/20/confide

ntiality_acknowledgement_form_42015.pdf?

The purpose of the form is for grantees and subgrantees to acknowledge that they are

aware of the confidentiality requirements imposed by the VAWA Confidentiality

Provision.

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 8

25. Who needs to sign the “Confidentiality Acknowledgement Form” at

https://www.justice.gov/sites/default/files/ovw/pages/attachments/2015/01/20/confide

ntiality_acknowledgement_form_42015.pdf?

The authorized representatives for grantees must sign the form. In the case of subawards,

the grantee should ensure that subgrantees also sign the form.

VI. Other Questions

26. What if a victim discloses victimization to a grantee or subgrantee during a

community educational presentation?

If the victim is only disclosing victimization without seeking services, then the VAWA

Confidentiality Provision does not apply. If, however, the victim comes forward and

seeks services from the grantee or subgrantee, then the grantee or subgrantee would need

a signed, written, informed, and reasonably time-limited release to share the victim’s

information with other providers, unless one of the other exceptions set forth in the

VAWA Confidentiality Provision (i.e., court or statutory mandate) applies.

27. When can a grantee or subgrantee release information about a minor involved in a

custody dispute?

A grantee or subgrantee can disclose information about a minor involved in a custody

dispute if there is a court mandate requiring the release of the information or if the minor

and the parent or guardian of the minor provide a signed, written, informed, and

reasonably time-limited release. By statute, neither the abuser of the minor nor the

abuser of the other parent of the minor may provide a release on the minor’s behalf.

28. How can grantees monitor subgrantees without seeing confidential victim

information?

Grantees can monitor the services provided by a subgrantee without seeing confidential

victim information in various ways. For example, the grantee can ask the subgrantee to

pull a random selection of files and redact the identifying information from the files. If

the files are electronic, there may be easy ways to replace the victim identifying

information with case numbers that are not related to the identifying information (for

example, the first client in 2014 is 2014-1) and to generate reports on victims served and

the services received that do not contain identifying information. Another option is for

victim service providers to keep checklists, without personally identifying information, to

track the numbers of victims served and what services were provided.

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 9

29. Can grantees and subgrantees share non-personally identifying information in the

aggregate?

Yes, grantees and subgrantees can share aggregated information as long as it does not

include personally identifying information. Be aware that in rural or homogeneous areas,

information such as race or number of children could be used to identify a victim and

thus may constitute personally identifying information.

30. What should shelter programs do if law enforcement asks to speak to someone who

they think is a client at the shelter?

Identifying information about victims cannot be shared without a signed, written,

informed, and reasonably time-limited release or a court order. Even to identify that the

person is a client at the shelter would be revealing identifying information. Without

revealing identifying information, however, the shelter can take the following steps:

 Verify that the person reaching out to the program is, in fact, law enforcement.

 Explain that the shelter cannot confirm or deny whether it is serving the

individual in question, and indicate willingness to discuss law enforcement

needs without confirming whether the shelter is serving the individual.

 Law enforcement officers should be able to explain their needs and reasons for

contacting the shelter. If the shelter is serving the individual, the shelter should

convey law enforcement requests and needs to the victim.

31. Can grantees and subgrantees share identifying information about deceased victims

with fatality reviews?

Grantees and subgrantees may share information with fatality reviews but only in the

following circumstances:

 Information is only shared to the extent permitted by the jurisdiction’s law;

 The underlying objectives of the fatality review are to prevent future deaths,

enhance victim safety, and increase offender accountability;

 The fatality review includes policies and protocols to protect identifying

information, including information about the victim’s children, from further

release outside the fatality review team;

 The grantee or subgrantee makes a reasonable effort to get a release from the

victim’s personal representative (if one has been appointed) and from any

surviving minor children or the guardian of such children (but not if the guardian

is the abuser of the deceased parent), if the children are capable of knowingly

consenting; and

 The information is limited to that which is necessary for the purposes of the

fatality review.

U.S. Department of Justice, Office on Violence Against Women

Frequently Asked Questions on the VAWA Confidentiality Provision (34 U.S.C. § 12291(b)(2)) | 10

32. Can grantees and subgrantees place victim information on third-party or “cloud”

servers?

Yes, with sufficient precautions. In all cases, grantees and subgrantees are required to

make reasonable efforts to prevent inadvertent releases of personally identifying

information. In cases involving storage of information with a third party, reasonable

precautions include, but are not limited to, ensuring that the contract with the storage

provider specifies that the service provider owns the information and ensuring that

sufficient protocols are in place to protect personally identifying information.