Privacy protections and information-sharing laws

BTAUs must operate with a comprehensive understanding of individual rights to privacy with a particular focus on the handling and protection of personally identifiable information (PII).

Agencies should consult with their counsel or privacy personnel knowledgeable about the applicable laws and regulations related to individual privacy within their jurisdiction.

Some questions to consider regarding PII include, but are not limited to: • What rules allow the BTAU to request from individuals information that would otherwise be protected? • Where and how will the BTAU maintain documents and files (e.g., completed forms, case plans, and supporting documentation)? • Who will have access to these files? • How will the BTAU facilitate the sharing of information internally and externally with relevant agencies and partners while also ensuring appropriate protections of PII?

In addition to the above considerations, BTAUs should develop an understanding of the rules and laws that govern the sharing of information held by their community partners.

For example, the Health Insurance Portability and Accountability Act (HIPAA) protects the privacy of individual health and medical information held by healthcare providers and healthcare businesses.

Similarly, the Family Educational Rights and Privacy Act (FERPA) protects the privacy of individual education records held by education agencies and institutions receiving funds from any program administered by the U.S. Department of Education.

Units should have a firm understanding of exactly what information these laws protect and what exceptions allow for sharing information when a risk to public safety exists.

Even if mental health providers and local education agencies cannot share information with the BTAU, those agencies can receive whatever information the BTAU is authorized to share. Sharing information with these entities will inform the strategies used by the mental health providers and local education agencies to promote the wellbeing of individuals under their care.

BTAUs may then triage reports for relevancy to the units’ objectives and share information with parties external to the units as necessary.

BTAUs should seek access to records from formal systems when authorized and in accordance with all relevant privacy protections. BTAUs may be able to access records from other law enforcement agencies, courts, and community organizations.

While some information sharing may be “one-way” due to privacy regulations, criminal justice practitioners must be informed and have the appropriate context upon which to base their judgements, treatment decisions, and mitigation strategies.

BTAUs must also be prepared to share information with treatment providers.

While HIPAA may restrict the provider from sharing information in return, the BTAU may be able to share information obtained during a behavioral threat assessment with the provider.