SECTION 75:30-5-4. Client confidentiality

(a)   Protecting the confidentiality of human sex trafficking victims is critical to protecting their safety and establishing trust. Case or client records, files or notes, of a certified sexual assault program for adult victims of human sex trafficking program shall be confidential and shall only be released under certain prescribed conditions pursuant to Oklahoma law (74 O.S. § 18p-3).

(b)   The program shall have written policies and procedures to ensure confidentiality of client information and identity the shelter location and govern the disclosure of information including verbal disclosure contained in client records. When a client record is established, the program shall discuss the confidentiality requirements and limitations with each client and maintain documentation in the client record that they have reviewed the circumstances under which confidential information may be revealed. Assisting human sex trafficking victims requires the release of confidential information more often, and to more organizations, than when assisting non-trafficked victims. This is particularly true if the victim is seeking certification from HHS or ORR. Staff or volunteers should always obtain the informed, written consent of the victim when relaying confidential information to any person, including law enforcement, federal prosecutors, state attorneys, victim advocates and social services agencies. The written consent forms must be translated into the victim's native language, state the name of the person or organization receiving the information, and contain an expiration date.

(c)   The human sex trafficking program must comply with both the state and federal laws that govern confidentiality and any exceptions to those laws.

(1)   State Law: Case or client records, files or notes, of a human sex trafficking program shall be confidential and shall only be released under certain prescribed conditions (74 O.S. § 18p-3):

(A)   The case records, case files, case notes, client records, or similar records of a human sex trafficking program certified by the Attorney General or of any employee or trained volunteer of a program regarding an individual who is residing or has resided in such program or who has otherwise utilized or is utilizing the services of any human sex trafficking program or counselor shall be confidential and shall not be disclosed;

(B)   For purposes of this subsection, the term "client records" shall include, but not be limited to, all communications, records, and information regarding clients of human sex trafficking programs; and

(C)   The case records, case files, or case notes of programs specified in paragraph 1 of this subsection shall be confidential and shall not be disclosed except with the written consent of the individual, or in the case of the individual's death or disability, of the individual's personal representative or other person authorized to sue on the individual's behalf or by court order for good cause shown by the judge in camera.

(2)   Federal Law:

(A)   The U.S. Violence Against Women Act (VAWA) at 42 U.S.C. § 13925 (b)(2), mandates programs that receive VAWA funds shall not reveal personally identifying information about victims without "reasonably time-limited," written, and informed consent. Under this provision, VAWA-funded programs are prohibited from disclosing personally identifying victim information to any third party, including to any database operated by any party outside of the domestic violence program. "Reasonably time-limited" is not defined in the statute, but it is determined by the circumstances and the purposes for which the client is requesting the release of information. It could be a few minutes, a few hours, or a few days. In no event should it be for more than 60 days;

(B)   The Family Violence Prevention and Services Act (FVPSA) at 42 U.S.C. 10406(c)(5), mandates specific confidentiality protections that apply to many programs. In order to ensure the safety of adult, youth and child victims of family violence, domestic violence or dating violence, and their families, FVPSA grantees and subgrantees under this chapter shall protect the confidentiality and privacy of such victims and their families. Grantees and subgrantees shall not:

(i)   Disclose any personally identifying information collected in connection with services requested, utilized, or denied through grantees' and subgrantees' programs; or

(ii)   Reveal personally identifying information without the informed, written, reasonably time-limited consent of the person (or in the case of an unemancipated minor, the minor and the parent or guardian or in the case of an individual with a guardian, the individual's guardian) about whom information is sought, whether for this program or any other Federal or State grant program, except that consent for release may not be given by the abuser or suspected abuser of the minor or individual with a guardian, or the abuser or suspected abuser of the other parent of the minor.

(C)   Housing Assistance Emergency Solutions Grants, at 42 U.S.C. § 11375 (c)(5), require recipients to develop and implement procedures to ensure confidentiality of records pertaining to any individual provided family violence prevention or treatment services under this part and that the address or location of the family violence shelter project assisted under this part will not be made public without written authorization of the person or persons responsible for the operation of such shelter; and

(D)   Stewart B. McKinney Homeless Assistance Act, at 42 U.S.C.§ 11363, mandates that any victim service provider that is a recipient or subgrantee shall not disclose for purposes of the Homeless Management Information System (HMIS) any personally identifying information about any client. Subgrantees may be required to disclose for purposes of HMIS non-personally identifying information that has been de-identified, encrypted, or otherwise encoded. The Violence Against Women Act also contains a provision that specifies a domestic violence program provider shall not disclose any personally identifying information about any client to the Homeless Management Information System (HMIS).

(d)   Compliance with 75:30-5-4 shall be determined by a review of the program's policies and procedures; and on-site observation of the handling and review of client records.

[Source: Added at 28 Ok Reg 1931, eff 7-11-11; Amended at 31 Ok Reg 820, eff 9-12-14; Amended at 33 Ok Reg 1226, eff 9-11-16; Amended at 36 Ok Reg 1390, eff 9-13-19]