Privacy Compliance Framework
All closed-loop referral activities must operate within the following legal and regulatory framework. Review with legal and compliance before implementation.
| Law/Requirement | Key Requirement for IPV/DV Referral Partnerships |
|---|---|
| HIPAA / HITECH | Minimum necessary standard; BAA required; PHI safeguards; breach notification.1 |
| California CMIA | Additional protections for medical information. Applies to health plans and providers.2 |
| Evidence Code §1037 | DV counselor-victim privilege. Communications with DV advocates are confidential and legally protected.3 |
| W&I Code §18291 | DV shelter location and client identity confidentiality. Prohibits disclosure of shelter addresses.4 |
| Address Confidentiality Program (ACP) | State program (Secretary of State) providing substitute address for survivors. Never use real address in referral systems.5 |
| CalAIM / DHCS Data Use Policy | DHCS requires data governance policies for all ECM/CS entities. De-identified data preferred for aggregate reporting. |
| Survivor-Centered Consent | Survivors must affirmatively consent before any identifying information is shared. Consent may be withdrawn at any time. |
Implementation Tip: Data Elements to NEVER Share Without Consent
Survivor privacy and confidentiality must be upheld. The following details should not be shared with explicit consent from the survivor:
- Survivor physical location or new address (ACP-protected);
- details of abuse or abuser identity;
- children’s school or childcare location;
- immigration status;
- financial or employment details.
When in doubt, default to de-identified aggregate data only.
- 45 C.F.R. Parts 160 and 164 (HIPAA Privacy, Security, and Breach Notification Rules); Health Information Technology for Economic and Clinical Health (HITECH) Act, Pub. L. No. 111-5 (2009). ↩︎
- Cal. Civil Code §§ 56-56.37 (Confidentiality of Medical Information Act), leginfo.legislature.ca.gov. CMIA predates HIPAA and in several respects imposes stricter disclosure and breach-notification requirements on California providers, health plans, and contractors. ↩︎
- Cal. Evidence Code §§ 1037-1037.8 (Domestic Violence Counselor-Victim Privilege), leginfo.legislature.ca.gov. ↩︎
- California Welfare & Institutions Code §§ 18290-18309.8 (Domestic Violence Shelter-Based Programs Act), leginfo.legislature.ca.gov. ↩︎
- California “Safe at Home” Address Confidentiality Program, Cal. Government Code §§ 6205-6216, administered by the California Secretary of State (sos.ca.gov/registries/safe-home). ↩︎