Chapter 7 Confidentiality & Informed Consent
Each agency that receives a grant from the Crime Victim Assistance Division (CVAD) to provide direct services to victims of crime must have a confidentiality policy in place to protect confidential, personally identifying information. This policy should include a description of informed consent, a description of any circumstances in which a program would release confidential information, as well as steps to be taken by the agency in the event of a breach and/or intentional or accidental release of personally identifying information. Furthermore, a confidentiality assurance should be signed by all staff, volunteers, interns, board members and anyone else who could potentially have contact with survivors. At a minimum, the policy should state the individual will protect the personally identifying information of all persons contacting the agency for service, regardless of whether these persons actually receive services from the agency.
Under no circumstances should any victim of crime be required to provide consent to release personally identifying information as a condition of eligibility for the services provided by the grantee or subrecipient.
Informed consent means giving a survivor information about who will be receiving the information, the expected purpose of the release and any potential dangers or negative outcomes of releasing information, if known.
Personally identifying information or personal information means individually identifying information for or about an individual including anything likely to disclose the location of a victim, including but not limited to:
- First and last name;
- Home or other physical address;
- Contact information (including, but not limited to, email address, telephone/fax number, web address or postal address);
- Social security number
- Driver’s license number
- Passport number
- Student identification number; and
- Any other information including date of birth, racial or ethnic background, or religious affiliation that would serve to identify an individual.
Agencies should ensure all client information containing personally identifying information is kept out of view from other clients, visitors, volunteers and others who are not authorized to view the information. Furthermore, client records not in use should be stored in a secure area, locked cabinet, drawer or similar storage item. If client files are stored electronically, agencies must ensure appropriate security measures are taken to protect client data such as firewalls, authorized user accounts, password protection, etc.
In order to ensure the safety and anonymity of victims and their families, subrecipients shall protect the confidentiality and privacy of persons receiving services.
In addition to federal statutes (FVPSA 42 U.S.C. 10402(a)(2)(e); VOCA 42 U.S.C. 10601-10604; VAWA 42 U.S.C. 13925(b)(2)), Iowa Code Section 915.20A (Victim Counselor privilege) prohibits a subrecipient from disclosing, revealing, or releasing confidential client information without the informed, written, reasonably time-limited consent of the person (or in the case of an unemancipated minor, the minor and the parent or guardian or in the case of legal incapacity, a court-appointed guardian) about whom information is sought, whether for this program or any other Federal, State, tribal, or territorial grant program, except that consent for release may not be given by the abuser of the minor, an incapacitated person, or the abuser of the other parent of the minor. If a minor who is of sufficient age and maturity to understand the ramification of waiving privilege, or is a person with a legally appointed guardian, permitted by law to receive services without the parent or guardian's consent, the minor or person with a guardian may give informed consent to release information.
Grantees may use the CVAD General Release of Information form to obtain consent from the client to release their information
A Victim Counselor (915.20A) is not identified as a mandatory reporter under Iowa law (232.69). A Victim Counselor, however, may be a permissive reporter. A permissive reporter is defined in Iowa law (232.69(2)) as, “any other person who believes that a child has been abused.” A permissive reporter may make a report of child abuse to the Department of Human Services, County Attorney, or law enforcement agency. Decisions to report should be made in accordance with agency policy, with adherence to the “Release” provisions noted below.
If release of information is compelled by statutory or court mandate and/or if a subrecipient is compelled to release confidential client information in accordance with agency policy (i.e. if a victim is threatening to harm themselves or others):
- subrecipients shall make reasonable attempts to provide notice to victims affected by the disclosure of information; and
- subrecipients shall take steps necessary to protect the privacy and safety of the persons affected by the release of the information; and
- subrecipients shall document the release, notification, (or attempts to notify) and justification for the release in the client’s file/electronic record.
In the event of an unintentional breach of confidentiality, or an intentional breach of confidentiality in violation of agency policy and/or CVAD policy, the subrecipient shall provide immediate notification to CVAD electronically, or via phone.
Subrecipients may share non-personally identifying data in the aggregate, regarding services to their clients, and non-personally identifying demographic information in order to comply with Federal, State, Tribal, or territorial reporting, evaluation, or data collection requirements.
No personally identifying information is to be provided for Federal, Tribal, or State reporting, evaluation, or data collection requirements, whether for this program or any other Federal, Tribal, or State grant program.