45 C.F.R. § 1370.4 – What confidentiality requirements apply to these programs?

(a) In order to ensure the safety of adult, youth, and child victims of family violence, domestic violence, or dating violence, and their families, grantees and subgrantees under FVPSA shall protect the confidentiality and privacy of such victims and their families. Subject to paragraphs (c), (d), and (e) of this section, grantees and subgrantees shall not—
1. (1) Disclose any personally identifying information (as defined in § 1370.2) collected in connection with services requested (including services utilized or denied) through grantees' and subgrantees' programs;
2. (2) Reveal any personally identifying information without informed, written, reasonably time-limited consent by the person about whom information is sought, whether for this program or any other Federal, Tribal or State grant program, including but not limited to whether to comply with Federal, Tribal, or State reporting, evaluation, or data collection requirements; or
3. (3) Require an adult, youth, or child victim of family violence, domestic violence, and dating violence to provide a consent to release his or her personally identifying information as a condition of eligibility for the services provided by the grantee or subgrantee.
(b) Consent shall be given by the person, except in the case of an unemancipated minor it shall be given by both the minor and the minor's parent or guardian; or in the case of an individual with a guardian it shall be given by the individual's guardian. A parent or guardian may not give consent if: he or she is the abuser or suspected abuser of the minor or individual with a guardian; or, the abuser or suspected abuser of the other parent of the minor. If a minor or a person with a legally appointed guardian is permitted by law to receive services without the parent's or guardian's consent, the minor or person with a guardian may release information without additional consent. Reasonable accommodations shall also be made for those who may be unable, due to disability or other functional limitation, to provide consent in writing.
(c) If the release of information described in paragraphs (a) and (b) of this section is compelled by statutory or court mandate:
1. (1) Grantees and sub-grantees shall make reasonable attempts to provide notice to victims affected by the release of the information; and
2. (2) Grantees and subgrantees shall take steps necessary to protect the privacy and safety of the persons affected by the release of the information.
(d) Grantees and subgrantees may share:
1. (1) Non-personally identifying information, in the aggregate, regarding services to their clients and demographic non-personally identifying information in order to comply with Federal, State, or Tribal reporting, evaluation, or data collection requirements;
2. (2) Court-generated information and law enforcement-generated information contained in secure, governmental registries for protective order enforcement purposes; and
3. (3) Law enforcement- and prosecution-generated information necessary for law enforcement and prosecution purposes.
4. (4) Personally identifying information may be shared with a health care provider or payer, but only with the informed, written, reasonably time-limited consent of the person about whom such information is sought.
(e) Nothing in this section prohibits a grantee or subgrantee, where mandated or expressly permitted by the State or Indian Tribe, from reporting abuse and neglect, as those terms are defined by law, or from reporting imminent risk of serious bodily injury or death of the victim or another person.
(f) Nothing in this section shall be construed to supersede any provision of any Federal, State, Tribal, or local law that provides greater protection than this section for victims of family violence, domestic violence, or dating violence.
(g) The address or location of any shelter facility assisted that maintains a confidential location shall, except with written authorization of the person or persons responsible for the operation of such shelter, not be made public.
1. (1) Shelters which choose to remain confidential pursuant to this rule must develop and maintain systems and protocols to remain secure, which must include policies to respond to disruptive or dangerous contact from abusers, and
2. (2) Tribal governments, while exercising due diligence to comply with statutory provisions and this rule, may determine how best to maintain the safety and confidentiality of shelter locations.