6: Confidentiality

I. Understand the purpose of confidentiality 
II. Review the five elements of confidentiality 
III. Chart federal and state laws, professional ethics, and other authority 
IV. Create a confidentiality policy, protocol, form, and address data security 
V. Pause periodically to re-evaluate your policy, protocol, and form

Each step is described in detail below. 

There are innumerable misunderstandings about confidentiality. Reviewing the five elements below will bring greater clarity to confidentiality of client information, whether verbal or written.

1. Who is Sharing the Information?

Each member of the MDT is guided by their profession’s confidentiality mandates. However, professions have adopted varying degrees of confidentiality, from no exceptions to sharing information without a victim waiver (e.g., victim advocates, attorneys, LTC Ombudsmen) to some exceptions (e.g., health care provider teams, social workers on some MDTs). The team will need to gauge the level of confidentiality and possible exceptions for each MDT member.

2. Sharing Information with Whom?  

Next consider with whom the information is being shared. Is the MDT member sharing the information with an authorized team member or a service provider versus a colleague, friend, or spouse. These latter three individuals may not have a “need to know” MDT client information, but a team member or a service provider might. Sharing information is a duty; it ensures the MDT client is receiving a holistic response while facilitating investigative aims. At the same time, both parties must assume the duty of protecting that information from those who do not need to know.

3. Information Sharing for What Purpose? 

MDT client information must be held confidential and must only be shared with individuals on a “need to know” basis. Some legitimate purposes for information sharing include: 

• Care and care plan development and coordination
  Client information must be held confidential and must only be shared with individuals who need the information to provide services or who have a legitimate need for the information (e.g., investigators).
• Required by law
  Disclosure of information may be required by law, for example, mandated reporting laws (reporting abuse or harm to self or others). If mandated reporting is required, it is advisable to provide an explanation to the MDT client about why their information is being shared, and to the extent possible, engage the MDT client in the disclosure process.  
• Research
  Sharing atomized information means confidentiality (the identifying information) is protected yet allows for the data to be used for the purposes of research (check your state statute for exceptions for research). 

If the purpose for sharing information is for the sake of interest or gossip, sharing client information is always prohibited.

4. How Much Information is Shared? 

The amount of information released should be limited to the “need to know” amount. Not every detail of every case needs to be shared. The information shared should be relevant, necessary and proportional to the needs of the case.

5. Where is Information Being Shared? 

Think carefully about where information is being shared. Is the information being shared behind closed office doors where privacy can be assured versus public areas such as in an elevator, in a restaurant, or at home. Take precautions to ensure that when information is being shared, there are adequate protections in place to maintain the confidentiality of the information being shared. 

Confidentiality Policy 

Now that you possess a better understanding of confidentiality, your MDT will need to draft a confidentiality policy. The confidentiality policy provides guidelines on how MDT members should handle and protect MDT client information. Be sure the policy includes team training about confidentiality policies and procedures. Note that in some states, a confidentiality policy may be:

• Embedded in the state’s MDT statute (see Toolkit item: MDT Statutory Review 2025)
• Embedded in the MOU (see Toolkit item: Sample MOUs)
• A stand-alone confidentiality policy.

Data security as a component of a confidentiality policy. In the context of elder abuse MDTs, data security refers to the measures and practices implemented to protect sensitive information related to elder abuse cases from unauthorized access, disclosure, alteration, or destruction, whether written or oral. It is a critical component of ensuring confidentiality as well as preserving the integrity of investigations and potential prosecutions.

When developing your team’s data security policy, consider both the in-office and virtual environments. Common in-office textual data security practices include:

• Locking documents in file cabinets
• Using password protected computers and software
• Prohibiting team members from taking files home
• Ensuring files that are in use are kept out of the view of passersby
• Providing clear boundaries around intake and distribution of information
• Collecting and shredding documents shared during case review meetings

Since 2020, many teams have moved to virtual or hybrid (virtual and in-person) meetings. To enhance security in this environment, both written and verbal, develop policies that include:

• Using password protected Wi-Fi
• Holding calls in private spaces
• Using an appropriate meeting platform and a tier that includes enhanced security features. Most virtual meeting platforms now have HIPPA-compliant for-pay tiers.
• Keeping software updated
• Fully utilizing the software security features that are available to you such as:
  • Using waiting rooms to accept participants into meetings
  • Having a unique meeting link for each meeting
  • Utilizing unique meeting passwords
  • Blocking attendees whose identity you cannot verify or who have not submitted a signed confidentiality agreement prior to the meeting

Confidentiality Protocol 

Now that you have a policy in place, you need to develop a confidentiality protocol. How is confidentiality going to be managed on a day-to-day basis? 

Innovative MDTs have developed approaches for managing – not ignoring – confidentiality that allow MDTs to share information among team members while maintaining MDT client confidentiality. 

Drawn from practicing elder abuse MDTs, below is a partial list of possible solutions. Solutions for verbal discussions during case review meetings might include: 

• All MDT members signing a confidentiality agreement at each meeting.
• MDT members using pseudonyms, initials, or case ID numbers when discussing cases during a case review meeting.
• Providing written reminders about confidentiality (with applicable state code sections) at each case review meeting, with a confidentiality reminder on the case review meeting agenda.
• Requiring individuals who are not MDT members, but are attending a case review meeting for a specific purpose, to sign a confidentiality pledge prior to the meeting.

Solutions for documents used or generated at case review meetings might include: 

• Prohibiting note taking during case review meetings except for the MDT Coordinator.
• As mentioned, collecting and shredding all paper documentation at the close of the meeting.
• Keeping a list of action items and referrals to assist with case tracking and requesting updates for MDT member agencies rather than keeping case consultation meeting minutes.
• Keeping reports and medical records with the parties originally requesting that information, and simply noting where cross-reporting and legal mandates require or permit the sharing of information. For example, in some jurisdictions an APS worker may have the ability to request medical records and share them with law enforcement. Their MDT might note that APS had requested medical records and shared them with law enforcement, but the MDT would not house those records within their files. Instead, they would make a note that APS and law enforcement can be contacted for updates related to this action.

Confidentiality Form 

Finally, the MDT will need to create a confidentiality form based on the confidentiality policy and protocol. The MDT Guide and Toolkit has several sample confidentiality forms you can review when drafting your own confidentiality form.

Discovery

Discovery has implications primarily for prosecutors, in this case, serving on the MDT. In terms of procedure, prosecutors are required by law to turn over information material to the case to the defense attorney prior to trial (each office has its own method of doing this therefore consult with legal counsel), and Brady requires all exculpatory information to be shared with the defense attorney at any point it is learned (prosecutors do not have to disclose statements made by the victim unless, under Brady, the information presents evidence that the defendant committed a lesser crime or did not commit a crime). For this reason, MDT members should be extremely careful about the information (verbal or written) that is disclosed during an MDT meeting as information that becomes known to the prosecutor during case review may be discoverable. Some states address (limit) discovery through their MDT statute.  

Conflicts of Interest

A conflict of interest in the context of elder abuse MDTs refers to situations where personal or professional interests may compromise the objectivity or integrity of an investigation, or the collaborative work being done on behalf of MDT clients. Identifying and managing conflicts of interest is crucial for maintaining confidentiality.

A conflict of interest can arise in any case on any team, but is more frequently an issue in smaller or more rural communities, where there are a limited number of professionals to serve on the MDT. MDT members in rural communities often reside in or near the community that they serve and may personally know someone involved in the elder abuse allegation being investigated by the MDT.  

With the help of legal counsel, develop a protocol for handling conflicts of interest. These protocols should include steps to take to ensure conflicts of interest are identified and what to do when they arise. Best practice is to remove anyone from the investigation who knows the parties involved in the elder abuse allegation, including the person who may have been abused, the suspected abuser, or other close family members. In reality, this is challenging in smaller communities where everyone knows one another.