(a) Applicability. In addition to the grant conditions in paragraphs (b) and (c) of this section, the grant conditions in 42 U.S.C. 13925(b) apply to all grants awarded by the Office on Violence Against Women and all subgrants made under such awards.
(b) Nondisclosure of confidential or private information—(1) In general. In order to ensure the safety of adult, youth, and child victims of domestic violence, dating violence, sexual assault, or stalking and their families, grantees and subgrantees under this part shall protect the confidentiality and privacy of persons receiving services.
(2) Nondisclosure. (i) Subject to paragraph (b)(3) of this section, grantees and subgrantees shall not disclose any personally identifying information or individual information collected in connection with services requested, utilized, or denied through grantees' and subgrantees' programs, regardless of whether the information has been encoded, encrypted, hashed, or otherwise protected.
(ii) This paragraph applies whether the information is being requested for a Department of Justice grant program or another Federal agency, State, tribal, or territorial grant program. This paragraph also limits disclosures by subgrantees to grantees, including disclosures to Statewide or regional databases.
(iii) This paragraph also applies to disclosures from the victim services divisions or components of an organization, agency, or government to other non-victim service divisions within an organization, agency, or government. It also applies to disclosures from victim services divisions or components of an organization, agency, or government to the leadership of the organization, agency, or government (e.g., executive director or chief executive). Such executives shall have access without releases only in extraordinary and rare circumstances. Such circumstances do not include routine monitoring and supervision.
(3) Release. (i) Personally identifying information or individual information that is collected as described in paragraph (b)(2) of this section may not be released except under the following circumstances:
(A) The victim signs a release as provided in paragraph (b)(3)(ii) of this section;
(B) Release is compelled by statutory mandate, which includes mandatory child abuse reporting laws; or
(C) Release is compelled by court mandate, which includes a legal mandate created by case law, such as a common-law duty to warn.
(ii) Victim releases must meet the following criteria—
(A) Releases must be written, informed, and reasonably time-limited. Grantees and subgrantees may not use a blanket release and must specify the scope and limited circumstances of any disclosure. At a minimum, grantees and subgrantees must: Discuss with the victim why the information might be shared, who would have access to the information, and what information could be shared under the release; reach agreement with the victim about what information would be shared and with whom; and record the agreement about the scope of the release. A release must specify the duration for which information may be shared. The reasonableness of this time period will depend on the specific situation.
(B) Grantees and subgrantees may not require consent to release of information as a condition of service.
(C) Releases must be signed by the victim unless the victim is a minor who lacks the capacity to consent to release or is a legally incapacitated person and has a court-appointed guardian. Except as provided in paragraph (b)(3)(ii)(D) of this section, in the case of an unemancipated minor, the release must be signed by the minor and a parent or guardian; in the case of a legally incapacitated person, it must be signed by a legally-appointed guardian. Consent may not be given by the abuser of the minor or incapacitated person or the abuser of the other parent of the minor. If a minor is incapable of knowingly consenting, the parent or guardian may provide consent. If a parent or guardian consents for a minor, the grantee or subgrantee should attempt to notify the minor as appropriate.
(D) If the minor or person with a legally appointed guardian is permitted by law to receive services without the parent's or guardian's consent, the minor or person with a guardian may consent to release information without additional consent.
(iii) If the release is compelled by statutory or court mandate, grantees and subgrantees must make reasonable efforts to notify victims affected by the disclosure and take steps necessary to protect the privacy and safety of the affected persons.
(4) Fatality reviews. Grantees and subgrantees may share personally identifying information or individual information that is collected as described in paragraph (b)(2) of this section about deceased victims being sought for a fatality review to the extent permitted by their jurisdiction's law and only if the following conditions are met:
(i) The underlying objectives of the fatality review are to prevent future deaths, enhance victim safety, and increase offender accountability;
(ii) The fatality review includes policies and protocols to protect identifying information, including identifying information about the victim's children, from further release outside the fatality review team;
(iii) The grantee or subgrantee makes a reasonable effort to get a release from the victim's personal representative (if one has been appointed) and from any surviving minor children or the guardian of such children (but not if the guardian is the abuser of the deceased parent), if the children are not capable of knowingly consenting; and
(iv) The information released is limited to that which is necessary for the purposes of the fatality review.
(5) Inadvertent release. Grantees and subgrantees are responsible for taking reasonable efforts to prevent inadvertent releases of personally identifying information or individual information that is collected as described in paragraph (b)(2) of this section.
(6) Confidentiality assessment and assurances. Grantees and subgrantees are required to document their compliance with the requirements of this paragraph. All applicants for Office on Violence Against Women funding are required to submit a signed acknowledgement form, indicating that they have notice that, if awarded funds, they will be required to comply with the provisions of this paragraph, will mandate that subgrantees, if any, comply with this provision, and will create and maintain documentation of compliance, such as policies and procedures for release of victim information, and will mandate that subgrantees, if any, will do so as well.
(c) Victim eligibility for services. Victim eligibility for direct services is not dependent on the victim's immigration status.
(d) Reports. An entity receiving a grant under this part shall submit to the Office on Violence Against Women reports detailing the activities undertaken with the grant funds. These reports must comply with the requirements set forth in 2 CFR 200.328 and provide any additional information that the Office on Violence Against Women requires.
