VAWA Confidentiality Requirements for Survivor Information

Any organization that accepts a grant under the Violence Against Women Act must keep survivor information confidential under 34 U.S.C. § 12291(b)(2), and the VAWA confidentiality requirements reach every employee, volunteer, and subgrantee that touches those dollars. The core rule is a prohibition: grantees cannot share a survivor’s personally identifying information with anyone, including law enforcement, without written consent that meets specific federal standards. The exceptions are narrow, and the consequences for ignoring them can include the loss of federal funding.

Who Is Bound by the Rules

The confidentiality mandate applies to every entity that receives VAWA grant funding, whether it is a primary grantee or an organization funded downstream as a subgrantee.¹ That covers shelters, rape crisis centers, legal aid programs, transitional housing providers, campus advocates, and any other service organization that draws on VAWA dollars. Inside each organization, the duty runs to every employee, volunteer, and board member who could encounter survivor data.

The duty does not end when services stop. Information collected about someone who stayed at a shelter five years ago remains protected today. And a large grantee that passes funds to smaller community organizations must ensure that every subrecipient at every tier follows the same rules.²

What Counts as Protected Information

The statute defines “personally identifying information” broadly. It covers the obvious identifiers — name, home address, phone number, email, Social Security number, driver’s license, and passport number — and then extends to any information that would identify the individual, including date of birth, racial or ethnic background, and religious affiliation.¹

The protection applies “regardless of whether the information is encoded, encrypted, hashed, or otherwise protected.” Scrambling data does not satisfy the requirement. Protected information also includes details about a survivor’s children and other family members, because abusers routinely use those records to locate the person they are looking for.³

The Default Rule: No Disclosure

Grantees and subgrantees “shall not disclose any personally identifying information or individual information collected in connection with services requested, utilized, or denied.”⁴ The phrase “or denied” matters: if someone calls a hotline and gets turned away because the shelter is full, the fact that they called is still protected.

The prohibition applies no matter who is asking. Police, researchers, government auditors, family members, other social service agencies — the answer is the same. Good intentions or a claimed public-safety purpose do not create authority to share.

Law Enforcement Requests

A VAWA-funded agency must refuse to hand over survivor information to law enforcement unless one of two conditions is met: the survivor has signed a valid written release authorizing the specific disclosure, or a court has issued an order compelling it.⁴ A verbal request from an officer, an informal subpoena, or a claim that records are needed for an active investigation does not clear either bar. Even a formal subpoena warrants a call to counsel about whether it qualifies as a court mandate and whether it can be narrowed or quashed.

When Disclosure Is Allowed Without Consent

VAWA carves out two narrow categories where information can be released without a signed release, and both come with additional obligations to the survivor.

Court orders and statutory mandates. A valid court order or a specific statute requiring disclosure must be followed. Compliance is not passive, though. The agency must make reasonable efforts to notify the survivor and must take active steps to protect their safety, such as asking the court to seal the records, limiting the scope of what is turned over, or requesting a protective order.¹

Mandatory reporting of abuse or neglect. VAWA does not override state laws requiring reports of suspected child abuse, elder abuse, or neglect. A mandated reporter can make the required report without violating confidentiality, but should disclose only the minimum information needed rather than the survivor’s full case file.¹

Outside these two categories, the door stays closed. Research projects, government program evaluations, and data-sharing agreements with partner agencies all require the survivor’s written consent.

What a Valid Release Looks Like

When a survivor decides that sharing information would help — to work with a lawyer, apply for housing, coordinate with a medical provider — VAWA allows disclosure, but only through a release that meets the criteria at 28 CFR 90.4(b).⁴

The release must be in writing. Verbal permission is never enough. It must name what information will be shared, with whom, and for what purpose. Blanket releases authorizing “any and all information” to unspecified parties are prohibited.
Consent must be informed. Before signing, the survivor and the advocate must discuss why the information might be shared, who would have access, and what specifically could be disclosed.
The release must be time-limited. There is no default period. A release for a single court hearing might last a day; one for ongoing legal representation might last several months.
Consent must be voluntary. An agency cannot condition services on signing a release. A shelter cannot require authorization as a prerequisite for a bed, food, or legal help.
The form must be accessible. It must be in a language the survivor understands, with reasonable accommodations for anyone who cannot provide written consent due to a disability or other functional limitation.

A survivor can revoke consent at any time before the release expires, and the agency must stop sharing immediately. Special rules apply when the survivor is a minor or has a court-appointed guardian, and an abuser of the minor — or of the minor’s other parent — can never sign the release on the minor’s behalf.³

How VAWA Sits Alongside Other Privacy Laws

Programs that also fall under HIPAA, FERPA, or FVPSA operate under more than one framework at once. When rules differ, the stricter one controls, and VAWA is usually the stricter one.

HIPAA allows healthcare providers to share information for treatment, payment, and healthcare operations without individual consent. VAWA does not; any disclosure of personally identifying information requires written consent. HIPAA also permits certain disclosures to law enforcement about abuse victims and gives providers discretion to share with family members in the patient’s interest. VAWA prohibits both without a written release.

FERPA lets schools release student information to officials with a “legitimate educational interest” and in health or safety emergencies. A campus-based victim advocate funded through an OVW grant cannot rely on those FERPA exceptions; the VAWA standard governs their work.

The Family Violence Prevention and Services Act adds its own protections, including explicit confidentiality for shelter locations and a provision allowing disclosure when there is imminent risk of serious bodily injury or death, a circumstance VAWA does not separately address. Programs funded by both statutes follow whichever rule is stricter in a given situation.

Extra Protections for Immigrant Survivors

A separate statute, 8 U.S.C. § 1367, adds confidentiality protections for immigrant survivors who apply for immigration relief through VAWA self-petitions, T-visas for trafficking victims, or U-visas for crime victims.⁵ It restricts officials at the Department of Justice, the Department of Homeland Security, and the Department of State from disclosing information about these applicants to anyone outside the department, except for legitimate internal purposes.

The statute also bars immigration authorities from using information provided solely by the abuser to make an adverse decision against the survivor. An abuser’s tip to immigration enforcement cannot, by itself, drive a deportation case against the person they abused.⁵

Section 1367 carries a specific monetary penalty. A government official who willfully discloses protected information or makes a false certification faces disciplinary action and a civil fine of up to $5,000 per violation.⁵ Complaints about DHS personnel go to the DHS Office for Civil Rights and Civil Liberties.

Data Security and Breach Response

Confidentiality means more than declining to answer questions. VAWA-funded programs must put technical and physical safeguards in place: encrypted electronic records with access limited to direct-service staff, locked storage for paper files, and secure destruction of old records.

One rule matters especially in the homeless services system. VAWA amended the McKinney-Vento Homeless Assistance Act to prohibit victim service providers from entering any personally identifying information into the Homeless Management Information System, even in encoded or scrambled form. These providers must use a comparable database that meets HMIS reporting requirements without feeding the shared system.⁶

When a breach happens, grantees must report an actual or imminent compromise of personally identifying information to their OVW Program Manager within 24 hours. The organization must also make reasonable attempts to notify affected survivors, but the notification method itself cannot reveal that the person received services. A letter to a survivor’s home addressed from a domestic violence shelter can expose exactly the person it is meant to protect.

Enforcement Against Grantees

OVW enforces the confidentiality requirements through grant administration. Every grantee must maintain written policies and procedures for handling survivor information and processing releases.² When an organization falls short, OVW can withhold funding, disallow costs already spent, or suspend or terminate the grant.

The DOJ Inspector General also audits VAWA recipients. An unresolved audit finding gives the grantee two fiscal years of technical assistance to fix the problem; if the finding is still unresolved after that, the organization becomes ineligible for further VAWA grants, and any grant funds improperly awarded during the bar period must be repaid to the U.S. Treasury.¹ The 2022 VAWA reauthorization also required federal agencies to establish formal compliance review processes examining adherence to confidentiality provisions in the housing context.⁷

VAWA does not appear to create a private right of action allowing an individual survivor to sue for damages after a wrongful disclosure, though state privacy laws or other federal statutes may provide remedies depending on the circumstances.

If a VAWA-Funded Program Discloses Your Information

If you are a survivor and a VAWA-funded organization shares your information without your consent and outside the narrow exceptions above, the most direct step is a complaint to the Office on Violence Against Women at the Department of Justice. OVW can investigate the organization and impose consequences that range from mandatory corrective action to grant termination.

For housing-related violations, such as a landlord or housing program disclosing that you are a domestic violence survivor, you can also file with HUD’s Office of Fair Housing and Equal Opportunity. Housing-related VAWA violations may constitute sex discrimination under the Fair Housing Act, giving HUD independent enforcement authority.

If the disclosure involved immigration records and was committed by a government official at DHS, DOJ, or the State Department, file with the DHS Office for Civil Rights and Civil Liberties. Those violations carry the $5,000 civil penalty under 8 U.S.C. § 1367.⁵

Whichever route applies, document what happened: what information was shared, with whom, when, and how you learned about it. If the disclosure has put you in immediate danger, contact a local domestic violence hotline or legal aid organization for safety planning. Every state also runs an address confidentiality program that provides a substitute mailing address so your real location does not appear in public records.

1
Office of the Law Revision Counsel. 34 USC 12291 – Definitions and Grant Provisions
2
U.S. Department of Justice. FY 2026 General Terms and Conditions
3
U.S. Department of Justice, Office on Violence Against Women. Frequently Asked Questions on the VAWA Confidentiality Provision
4
eCFR. 28 CFR 90.4 – Grant Conditions
5
Office of the Law Revision Counsel. 8 USC 1367 – Penalties for Disclosure of Information
6
HUD Exchange. HMIS Comparable Database Manual
7
Federal Register. The Violence Against Women Act Reauthorization Act of 2022