PROGRAM STANDARD 4.1: A written guideline describes the program's procedures for maintaining client privacy, including:

• Terms of service.
• Methods used to identify, contact, and obtain information about service users.
• Nature of personal information that will be requested or obtained.
• Settings in which the victim/survivor will interact with program staff.
• Victim/survivor release of information.
• Ongoing procedures for privacy protection, such as locked storage options for client files.

Commentary: Privacy refers to individuals' control over the information others have about them. Maintaining client privacy is integral to building trust and rapport with survivors. All program staff, including maintenance and reception staff, and volunteers should receive training on all privacy and confidentiality policies.

Programs should consider ways that victims' privacy may potentially be compromised by using program services. This might include discussing confidential information in semi-private areas, unsecure access to electronic posts or messages, or highly visible entrances to facilities such as domestic violence shelters.

Programs should disclose to victims/survivors any safety or privacy limits of service use, including what personal information the program will obtain, how it will be used and stored, and who will have access to it; settings in which services will be provided; and any electronic records or “footprints” that may be left on users' computers when they access services online.

Programs should also consider victim-centered approaches when developing protocols for releasing personally identifiable information. For example, victims/survivors may want to decide when and how their identifiable information will be shared across programs under memorandums of understanding, or to opt out of having their identifiable information recorded electronically. Whenever possible, victim/survivor requests for increased privacy (e.g., opting out of interagency data sharing) should not be grounds for refusing or terminating service.

Privacy limitations should be clearly stated in the written terms of service, and victims/survivors should agree to these terms as a condition of receiving ongoing services. Victims/survivors should be informed of any outreach or research used to identify or obtain information about program participants. Programs are strongly discouraged from collecting unnecessary information from service recipients; for instance, researching victims/survivors via social networking sites is not typically an appropriate use of technology and may violate an individuals' privacy.

Obtain written media release agreements for any victim/survivor who wants to “go public” with his or her information. Programs are obligated to inform victims/survivors who blog or post messages online about their experiences that such activity may impact pretrial discovery, prosecution, liability issues, or vulnerability to further victimization.

Obtaining written releases of information from service recipients should not only ease program administration but also enhance individual and collective services for victims/survivors. Programs should consider implementing the most protective privacy options, and assess methods for accomplishing goals without releasing personally identifying information.

Conducting periodic privacy audits with help ensure that privacy policies and procedures are legal and consistent with the program's mission. A privacy audit examines the necessity of each type of data, how it is collected, notice and options provided to service users, and how the information flows through the program and to other professionals or to the general public. Areas to consider in a privacy audit include local, state, and federal laws; professional or organizational policies; program records on clients, staff, and services; any billing or payment procedures; the physical premises, onsite resources for service users (e.g., internet access), and electronic communications; and procedures for retaining, transferring, storing, and disposing of records. Any risks to privacy should be addressed quickly and effectively.

PROGRAM STANDARD 4.2: A written guideline describes the program's procedures for documenting service provision, including:

• Dates of service provision.
• Staff member providing service.
• Individuals to whom services were provided.
• Types of service or referral provided.
• Content of interaction.
• Provision of interpretation or translation services for limited English proficient individuals, or auxiliary aids or services for individuals with disabilities.
• Provisions for future or ongoing service.

Commentary: Programs should have written guidelines for documenting the information listed above and maintain records consistent with local, state, and federal laws and program regulations. Documentation protocols should include noting the preferred language and method of communication, especially for clients who are Deaf or hard of hearing or who have limited English proficiency. It is important to be knowledgeable about local, state, and federal laws regarding privilege and confidentiality within the provision of victim services. Although some agencies' and professionals' records may be protected under law, it is still very important to be judicious about how much to document (e.g., extent of “content of interaction” may vary depending on program goals). Many programs record a description of the crime, problems resulting from the crime, an action plan, follow-up and referral services, and the method or location of services (e.g., by phone, in home, online). Decisions about what information to document should be carefully considered. Whenever possible, programs should document any referrals they provide, even if direct services were not provided to the victim/survivor. Documenting user demographics (e.g., age, race/ethnicity, sex) may be helpful for determining eligibility for services and referrals, for making staff assignments, and for program evaluation.

PROGRAM STANDARD 4.3: A written guideline describes the program's procedures for storing and maintaining paper and electronic records, including:

• Types of records to be maintained.
• Format in which records are to be maintained.
• Media and/or devices for short-term and long-term storage of records.
• Ongoing backup and security procedures to protect data.
• Methods and criteria for destroying records.
• Notice to victims if sensitive data is stolen or if a data device is lost.

Commentary: The guideline establishes procedures for central records; electronic and paper files; backup; and virtual, onsite, and offsite storage. The policy should address who has access to records, methods of data encryption, how long files and communications (electronic and paper) are retained, and processes for backup and disposal.

Electronic files should comply with record retention laws and regulations and be backed up on a regular schedule. Operating systems and security software should be updated regularly (e.g., security patches, antivirus software, antispyware, firewalls). Procedures should dictate changes to and security of alphanumeric passwords (e.g., combination of upper- and lowercase letters, numbers, and symbols).

All files, tapes, disks, hard drives, USB drives, and other electronic media should be stored in a secure facility or area. If personal computers are used or if program staff telecommute to work, procedures should be established for security of home computers, laptops, netbooks, cellular and smart phones, and other devices, as well as for virtual private networks (VPN), cloud computing, hotline routing, and so on. Procedures should include regular security reviews (i.e., reviews by technology safety and access experts), as well as termination of access (e.g., to online systems) for staff who leave the program.

Records should be destroyed and disposed of in compliance with applicable legal and ethical requirements. Programs should consider whether clients must be contacted before their records are destroyed. Destruction methods, including recycling, should guarantee that data are not retrievable from the discarded materials.

The guideline also outlines procedures for distributing reports, including which reports are routed where (e.g., for storage, follow-up, distribution outside of the program). Policies should address regular security training for staff at all program levels (e.g., volunteers, program staff, human resources, information and technology staff). If identifiable information is stolen (e.g., hacked) or a data device containing client records is lost, programs should notify the victims of the breach of security and provide suggestions for protective action.

PROGRAM STANDARD 4.4: A written guideline describes procedures for maintaining confidentiality of records, including:

• Clearly defined terms/limits of confidentiality.
• Disclosure of these terms to those served and to paid and unpaid staff.
• Confidentiality agreements between those served and providers.
• Confidentiality agreements between staff and the program.
• As applicable, policies/forms on confidentiality of interagency communications.

Commentary: Confidentiality refers to the agreement between the program and the victim/survivor about how his or her personally identifiable information will be handled. Confidentiality should not be confused with privilege. Rules for each differ by profession (e.g., attorneys, social workers, victim advocates, interpreters) and by certain demographics (e.g., age, disability). Protecting victims requires the understanding of relevant privacy rules and regulations, evidentiary privileges, state and federal statutes, and the unique rights and protections of minors, persons with disabilities, or other groups of victims.

Each program should have a written confidentiality policy that ensures the confidentiality of communication between victims/survivors and victim assistance providers. This policy should allow for appropriate supervision and consultation. Staff should make reasonable efforts to limit access to victim/survivor information to appropriate program staff whose duties require access. Service providers should not discuss confidential case material in public areas or forums. All client information remains confidential, even when the victim is no longer receiving services or when staff members leave the program. Any violation of confidentiality by a staff member or former staff member may result in dismissal and/or legal action by the program or by the victim/survivor.

Programs should maintain written records in a secure storage area that can be accessed only by authorized staff and volunteers. All paid and unpaid staff with access to records should have a signed confidentiality agreement on file with the program. Such agreements should be secured before providing access to records to people conducting site visits for program monitoring reviews, funding/grant source compliance reviews, research, or financial audits.

Programs should disclose and discuss limitations on confidentiality when they begin providing services in a language the victim/survivor can understand. Confidentiality agreements should be simple, clear, and appropriate to the service setting. Agreements should specify when providers will breach confidentiality (e.g., when required by mandated reporting laws, to protect the victim/survivor from imminent harm). Victims/survivors who consent to release their information should be fully advised of risks, benefits, the timeframe of the waiver, and how to revoke consent. A consent to release of information should be written, voluntary, fully informed, time limited, and in a language those served can understand.

PROGRAM STANDARD 4.5: A written guideline describes procedures for providing services to individuals or groups via electronic technologies, including:

• Whether specific technologies are permitted in service delivery.
• Rules of use and response protocols for such technologies.
• Pre-service and ongoing precautions for safety and security of electronic communications.

Commentary: Programs should consider the rationale, risks, and benefits for using technology to provide services, including acceptability of use, rules of use, and response protocols for professional communication. Programs should also pay special attention to victims' safety and security, and try to match their use of technology to the needs of the individuals they serve. If a program plans to use social networking to provide services, or to market the program or its representatives, the guideline should specifically address the purpose of websites and electronic posts as they relate to the program's goals; the types of information that will be shared; policies for blocking or removing harmful or malicious content; policies for allowing or disallowing members; written releases or consents for sharing information about victims/survivors and staff members; monitoring of content; and response times and protocols.

Prior to implementing services that use new technologies, programs should strongly consider conducting a pre-service program audit on readiness for use, as well as periodic reviews of safety and security of use. These audits and reviews should take into account the program's capacity to:

• Develop new modes of service delivery without negatively impacting core service.
• Incorporate victim/survivor-centered standards for communication into existing program practices and policies.
• Consider jurisdictional issues (e.g., in-state, out-of-state, international) and vulnerability issues (e.g., services to minors or vulnerable adults) and how the program will screen for and address requests for service.
• Assess and increase victims' and staff's level of comfort in receiving and providing services electronically.
• Provide training to service recipients and staff, and disclose security and technology limitations (e.g., vulnerability to spyware, varied Internet speeds, or periodic service disconnections) so that users may make informed choices.

Protocols for providing and terminating services should include policies for obtaining clients' agreement to the terms of service, notifying clients when cases are closed, reviewing and updating websites regularly, and removing defunct or obsolete web pages or online content. Programs should clearly display the date of the last update on each web page, provide written contact information for the web master and program administrators, and make sure policies on terms of use and privacy are readily accessible.

PROGRAM STANDARD 4.6: A written guideline describes procedures for service provision using assistive technologies, including:

• Availability of such technologies in accord with requirements for program accessibility.
• Appropriate uses, and precautions against misuse, of assistive technologies.
• Procedures for ensuring that staff are competent in their use of assistive technology and that service users have ongoing access to the program via this technology.

Commentary: Assistive technologies and auxiliary aids and services include mobility devices, voice synthesizers, speech recognition or point-of-gaze software, screen readers, telecommunication relay services, audio and video remote interpreters, vibrating or flashing doorbells and alarms, and other methods or devices for ensuring that program services are accessible to persons with disabilities including persons who are Deaf or hard of hearing; persons with limited English proficiency; and individuals with other specific needs. Program staff should understand the program requirements for compliance with applicable laws, regulations, and ethical requirements, including the Americans with Disabilities Act of 1990, Section 504 of the Rehabilitation Act of 1973, and Title VI of the Civil Rights Act of 1964, and should know how to access necessary technologies. Precautions should be taken to promote proper use—and prevent intentional misuse—of such technologies. Conduct regular accessibility assessments of physical facilities and media and Internet content to ensure ongoing compliance and assess new technologies and resources.