VAWA Confidentiality and Records Compliance Audit

This template covers the confidentiality controls that protect VAWA-funded victim services records, including release of information, HMIS exemption handling, access controls, staff training, and corrective actions. It is designed to document whether protected victim information is shared only with valid consent or another permitted basis. The findings section also gives you a place to record deficiencies and assign follow-up. It is a records and privacy audit, not a general program performance review.

Use it during routine compliance reviews, internal monitoring, pre-monitoring preparation, or after a privacy incident. It is also useful when a program changes staff, systems, or data-sharing partners. Many organizations run it on a scheduled cycle so they can confirm that consent forms, access controls, and training remain current. If your program handles sensitive victim records, this audit helps verify that confidentiality practices still match policy.

A compliance lead, program manager, privacy officer, or designated records custodian can run it, depending on how your organization is structured. The reviewer should understand confidentiality rules, file handling, and the program’s approved disclosure process. If the audit includes electronic access controls, an IT or systems administrator may need to confirm role-based permissions. The final sign-off should come from the program manager or another accountable owner.

The template is built to check whether the program is protecting victim information in line with VAWA-funded service confidentiality expectations. It focuses on written consent, minimum necessary disclosure, HMIS boundaries, and secure record handling. It also helps document when disclosure is required by law and how that decision was recorded. Because confidentiality requirements can interact with other federal, state, or local rules, the audit should be used alongside your organization’s policies and legal guidance.

Common issues include expired or revoked consents still being used, release forms that do not clearly state what may be shared, and release logs that are incomplete. Auditors also often find shared passwords, unlocked paper files, or screens visible to unauthorized staff or visitors. Another frequent gap is unclear HMIS exemption handling or data-sharing agreements that do not match confidentiality limits. The template is meant to surface these non-conformances before they become privacy incidents.

Yes. You can tailor the scope to a shelter, advocacy program, legal services unit, or multi-site victim services network. You can also add local policy checks, state confidentiality requirements, or program-specific disclosure approvals. If your organization uses different record systems or has separate intake and case management workflows, adjust the access-control and training sections to match those processes.

The right cadence depends on program risk, staffing turnover, and how often records are shared with outside parties. Many programs review confidentiality controls on a regular internal cycle and again after major changes such as new software, new partners, or a reported incident. High-turnover environments may benefit from more frequent checks on training completion and access permissions. The template supports either scheduled audits or event-driven reviews.

An ad hoc review usually catches only the issue that prompted it, while this template walks through the full chain of confidentiality controls. It ensures you check consent, disclosure logs, HMIS boundaries, file security, and staff awareness in a consistent order. That makes it easier to compare results across sites or over time. It also gives you a cleaner record of findings and corrective actions if a regulator, funder, or internal leader asks for evidence.