Every record is about someone who has already been judged
A person coming home from prison or jail has already had their life examined in a courtroom, recorded in a file and summarized on a form. When they walk into a reentry or community program, they are deciding whether to trust one more institution with the details. Some of what they share, a conviction, a treatment history, a supervision condition, can cost them a job, a lease or custody of a child if it reaches the wrong person. Handling those records well is a legal obligation, and it is also the condition for the program working at all.
The rules come from several directions at once: federal confidentiality rules for substance use treatment, health privacy law where a provider is a covered entity, the Privacy Act where records belong to a federal agency, criminal justice information rules where data comes from justice systems, state law on records and breach notification, and the terms of each grant or contract. No single rule covers everything a reentry program holds. The practical answer is a set of safeguards strong enough to satisfy the strictest rule that applies to each record, built into the system rather than left to memory.
None of what follows is legal advice. Which rules apply to your program depends on what you are, who funds you and where your data comes from, and counsel should confirm it. What follows is how to build the handling so that, once counsel has answered, the system can do what the answer requires.
Know what kinds of records you hold
Start with an inventory. Most programs hold more record types than they think, spread across a case management system, shared drives, email, paper files and the phones of outreach staff. For each type, write down where it comes from, which rules commonly apply and how it should be handled.
| Record type | Usual source | Rules that often apply | Handling |
|---|---|---|---|
| Criminal history | The participant, a referral partner, a court or supervision agency | State law; the FBI CJIS Security Policy when the data comes from criminal justice information systems; the terms of any sharing agreement | Record only what eligibility or services require; no copies of rap sheets; restricted free-text notes |
| Supervision conditions and officer contacts | Probation, parole or pretrial services | The information sharing agreement with that agency; participant consent | Separate field set, visible only to staff who coordinate with the officer |
| Substance use treatment records | A treatment program, or your own program if it provides treatment | 42 CFR Part 2 for federally assisted treatment programs; HIPAA where it also applies; state law | Segmented from other records, disclosed only on a compliant consent or a listed exception, with a redisclosure notice |
| Health and mental health records | Clinical partners, the participant | HIPAA if the provider is a covered entity or business associate; state health privacy law | Minimum necessary access; clinical notes held in the clinical system, not the case file |
| Records held for a federal agency | Collected under a federal contract to operate a system for the agency | The Privacy Act, where the system is a system of records; the contract's privacy and security clauses | Used and disclosed only as the agency's notice and contract allow; requests for access routed to the agency |
| Identity documents | The participant, for eligibility or benefits applications | State law; funder terms | Verify and record that it was verified; do not keep copies unless a requirement says so |
The inventory almost always surfaces a surprise: a shared folder of scanned intake packets, a spreadsheet of supervision officer contacts that someone emails around each month, a text thread between a case manager and a participant about a relapse. Each of these is a record. Bring it into a controlled system or delete it under your retention rules.
Criminal history: collect what eligibility needs and stop
Programs ask for criminal history for a reason, usually eligibility or service planning. The reason sets the limit. If eligibility requires release within the last twelve months, the record needs a release date and a yes. It does not need the charges, the sentence or a copy of the judgment.
Free-text case notes are where criminal history spreads. A case manager writes a sentence about the offense to explain a housing barrier, and that sentence is now visible to everyone with access to the case file, forever. Train staff to record the barrier ("needs housing that accepts applicants with a felony conviction") rather than the history. Where the details genuinely matter for service planning, keep them in a restricted field, not in narrative notes.
If your program receives information directly from criminal justice information systems, rather than from the participant, the FBI CJIS Security Policy may govern how that data is stored, accessed and transmitted, usually through an agreement with the agency that provides it. Ask the agency partner which requirements flow to you before the first file arrives, because retrofitting them is much harder.
Substance use treatment records and 42 CFR Part 2
Federal confidentiality rules at 42 CFR Part 2 protect records that identify a person as having a substance use disorder when those records come from a federally assisted program that holds itself out as providing diagnosis, treatment or referral for treatment. The protections are generally stricter than ordinary health privacy rules. Disclosure typically requires the patient's written consent in a specific form, recipients are restricted from redisclosing, and the rules limit the use of those records against the patient in criminal, civil or administrative proceedings without a court order meeting specific standards.
That last protection matters directly to justice-involved participants, and it is why supervision agencies, courts and treatment programs need clear agreements about what flows where. Part 2 includes a specific path for consented disclosures to the criminal justice agency that referred a participant into treatment as a condition of their case, and consent in that setting can carry different revocation terms than ordinary consent. The rule was revised in 2024 to align several provisions more closely with HIPAA, including consent for treatment, payment and operations and breach notification. Have counsel confirm whether your program, or a partner, is a Part 2 program and which provisions apply.
The systems consequence is the same either way. Treatment records need to be segmented: tagged at the record or field level, visible only to roles with a need, disclosed only when a valid consent or a listed exception is on file, and accompanied by the required notice when they go out. A case management system that cannot segment a record from the rest of the file cannot hold Part 2 data safely.
When the records belong to a federal agency
The Privacy Act of 1974 governs federal agencies' systems of records: collections from which information is retrieved by a person's name or identifier. When a contractor operates a system of records on an agency's behalf, the Act's requirements extend to the contractor through the contract, and federal contracts carry Privacy Act clauses for that purpose. The agency's published system of records notice defines what may be collected and the routine uses for which records may be disclosed.
In practice that means three things for a program team. First, use and disclose records only as the notice and the contract allow; a disclosure that would be ordinary between community partners may not be permitted for agency records. Second, route a participant's request to see or correct their record through the agency's process, as the contract describes. Third, expect the agency to require security controls, privacy training and incident reporting on its own timeline.
Grant-funded programs are often in a different position: the records may be the provider's own, governed by the grant terms and state law rather than the Privacy Act. Do not assume either way. Read the award or contract, and if it is unclear, ask the agency in writing whose records they are.
Minimum necessary access and role-based permissions
Most privacy failures in community programs are not hacks. They are a peer mentor who could see clinical notes, a volunteer with a login that never expired, a data analyst with names they did not need. Access control fixes most of them, and it is cheap to build at the start.
Define roles by what each one needs to do its job: intake staff, case managers, peer mentors, employment specialists, clinicians, data staff, program leadership, auditors. Grant each role only the fields it needs. Data staff work with participant IDs, not names. Peer mentors see goals and appointments, not histories. Clinicians see clinical records; case managers see that a referral was made and attended, not the content of treatment.
Log every view of a sensitive record, not just every change. Allow an emergency override for real emergencies, require a reason, and review every use of it. Review access quarterly against the staff roster, and remove access the day someone leaves.
Consent participants can understand and revoke
A consent form a participant cannot understand protects the program's file, not the participant. Write consent in plain language, at a reading level most adults can manage, and in the participant's language. Say who will receive the information, which information, for what purpose and until when. Read it aloud and answer questions. A participant who believes the program will tell their parole officer everything will tell the program nothing, and a program that knows nothing cannot help.
Keep consents separate by recipient and purpose, so a participant can agree to share employment progress with a workforce partner without agreeing to share treatment attendance with the court. Do not bundle consent to share with the paperwork to receive services; participants who feel they had no choice treat the program as one more arm of the system.
Store consent as structured data in the system, not as a scanned page in a folder. Each consent has a recipient, a scope, a start date, an end date and a status. The system checks it before anything is shared. When a participant revokes consent, staff record it in one place, the system stops further disclosures from that moment and partners that received data are notified as the agreement requires.
Data sharing agreements between providers
Reentry runs on coordination: housing, employment, treatment, health care, supervision and family services, each held by a different organization. Every flow of participant data between them should sit on a written data sharing agreement, signed before the first record moves.
A useful agreement names the parties and the purpose, lists the data elements, states the legal basis for sharing, sets security requirements, limits redisclosure, sets a timeline for notifying each other of a breach, defines retention and destruction, gives each party the right to verify compliance, and says what happens to the data when the agreement ends. Attach the consent form the parties will rely on, so nobody has to guess whether a given consent covers a given flow.
When something goes wrong
Write the breach response plan before you need it, and rehearse it once a year with a realistic scenario: a lost laptop, a misdirected email with a participant list attached, a partner's system compromised. The plan names who decides, who investigates, who calls counsel and who talks to participants.
The steps are consistent. Contain it: disable the account, recall the email, wipe the device. Assess it: which records, whose, how sensitive, and whether they were actually accessed. Notify as the law and your agreements require; state breach laws, health privacy rules, Part 2 and federal contract clauses each set their own triggers and timelines, and some federal contracts require reporting to the agency within hours. Then tell affected participants plainly what happened and what you are doing about it. For this population, an exposed record can cost a job or housing, so offer practical help, not just a letter.
Retention and destruction
Records kept past their useful life are risk with no return. Set a retention period for each record type, based on the longest requirement that applies: funder terms, contract clauses, state law and any professional standard for clinical records. Federal awards under the Uniform Guidance generally require financial and program records to be kept for three years from the final financial report, with exceptions for audits and litigation, and specific programs and contracts can require longer.
When the period ends, destroy the records and log it: what was destroyed, when, how and by whom. Use sanitization methods suited to the media, following NIST SP 800-88 guidance for electronic media, and cross-cut shredding or a certified service for paper. Remember backups and partner copies; a record deleted from the case system but alive in last year's backup is not destroyed.
Dignity is a design requirement
The way a system describes people shapes how staff treat them. Use person-first language in forms, fields and reports: "participant" and "person returning from incarceration," not "offender" or "ex-con." Ask only the questions the program needs, and tell the participant why each one is asked.
Let participants see their own records on request and correct what is wrong. Keep criminal history off dashboards, summary screens and printed rosters. Report outcomes in aggregate, with small numbers suppressed so no one can be identified. Programs that employ staff with lived experience, which the best reentry programs do, should give those staff the same role-based access as anyone else in the same role, and the same expectation of confidentiality.
A safeguards checklist
- An inventory of every record type, its source, the rules that apply and where it lives
- Criminal history limited to what eligibility and services require, out of free-text notes
- Treatment records segmented and disclosed only against a valid consent or listed exception
- A written answer from counsel on which rules apply, including whether any program is a Part 2 program
- Role-based access by field, with every view of a sensitive record logged
- Plain-language consents, separate by recipient and purpose, stored as data with revocation in one step
- A signed data sharing agreement for every flow between organizations
- A breach response plan with named roles, rehearsed once a year
- A retention schedule by record type and a destruction log that covers backups and partner copies
- Quarterly access reviews and same-day removal when staff leave
Situations staff ask about
A parole officer calls and asks whether a participant attended this week. Can we answer?
Only if a valid consent covers that disclosure to that officer, or another basis applies that counsel has confirmed. Build the answer into the system: staff look up the participant's consents, and if sharing attendance with supervision is on file and current, they answer within its scope. If it is not, they say they cannot confirm and offer to ask the participant. If the attendance is at substance use treatment, Part 2 may set additional conditions.
Do participants need to consent for us to report to our funder?
It depends on the data, the rules that apply and the funder's terms. Many programs avoid the question by reporting de-identified or aggregate data, which most funders accept for routine reporting. Where the funder needs identified records, the intake consent should say so plainly, and counsel should confirm the basis.
A participant asks us to delete everything we hold about them.
Honor what you can and explain what you cannot. Retention requirements in your grant, contract or state law may require keeping some records for a set period. Stop using the records for anything beyond those requirements, restrict access to them, tell the participant which records you must keep and until when, and destroy them on schedule.
A partner wants our full case files to coordinate services.
Share the minimum the coordination needs, under a data sharing agreement and a consent that covers it. A housing partner usually needs contact details, the housing goal and the barrier, not the case history. If the partner insists on the full file, ask what decision each part informs.
Frequently asked questions
No. It applies to federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment or referral for treatment, and to records received from them. Many reentry programs are not Part 2 programs but work with ones that are. Counsel should confirm your status and your partners'.
Giving each person access to only the information their role requires. In a case management system, that means permissions by field rather than by whole record, so a peer mentor sees goals and appointments while a clinician sees clinical notes, and data staff work with IDs instead of names.
Staff record the revocation once, in the system, and the system stops further disclosures under that consent immediately. Partners that received data under it are notified as the data sharing agreement requires. Revocation generally does not undo disclosures already made, and in some criminal justice referral settings consent can carry different revocation terms.
For the longest period required by the rules that apply: funder and contract terms, state law and clinical record standards. Federal awards generally require three years from the final financial report, with exceptions. When the period ends, destroy the records, including backups and partner copies, and log the destruction.