Coordinating referrals through IRIS involves collecting, storing, and sharing sensitive family information. Protecting that information requires clear policies on data collection, access, and use. Strong consent practices are essential to data privacy and help ensure families feel informed, respected, and in control of how their information is shared.

This guide is intended to help organizations within an IRIS Community develop and implement clear, client-centered consent practices. While each organization is responsible for designing its own consent protocols, this guide outlines recommended components and provides adaptable language to support alignment with privacy laws and IRIS best practices. In addition to the guidance provided here, the IRIS team also offers consent templates that organizations may use or modify to support their local implementation. 

Considerations

The following questions regarding consent may be answered at the organizational level but are also valuable topics of discussion among IRIS partners.  

• What privacy laws and/or confidentiality regulations impact organizations’ client consent processes?
• Can clients grant consent over the phone? What workflows support verbal consent?
• How will referrals be made if a client does not consent?
• Will information collected in IRIS be used for purposes other than coordinating services?
• Does the consent form expire?
• What happens if a client revokes consent?

In some cases, limits on the client information an organization can share will impact partners’ workflows. The IRIS Local Leadership Team should work with the organization to communicate and address these 

Key Consent Principles

Clients must: 

• Understand what information will be collected and how it will be used.
• Be informed about who will access their information and for what purpose.
• Be given a chance to ask questions.
• Voluntarily agree to share their information before it is entered into IRIS.

Consent should never be a condition of receiving services. If a client declines IRIS consent, organizations should have an alternate workflow for making referrals.

Recommended Consent Components

Outlined below are key components of informed IRIS consent and sample language to help organizations add IRIS-specific language to existing forms or verbal consent practices. They can support efforts to ensure families clearly understand and voluntarily agree to how their information will be shared.

Introduction to IRIS and Referral Purpose

Explain how IRIS Community partners work together and establish the role of referrals in ensuring clients’ needs are addressed. Note that client choice drives referrals.

Example Language:

“Our agency is part of a network of community partners working together to support families. Based on what you've shared, we believe another organization in the community might be able to help. If you give permission, we can refer you through a secure online system called IRIS.”

Security and Privacy

Emphasize that client information is secure in IRIS and that service providers will handle sensitive information appropriately.

Example Language:

“IRIS is a secure system. Your information will only be shared with the programs you select and the local IRIS Data Manager, who supports the system. Everyone who accesses your information agrees to keep it confidential and use it only to support services for your family.”

Information That May Be Shared

Disclose the client information that your IRIS Community and organization will share with referrals. Include specifics about the assessments, screening tools, or other documents that will be uploaded, if applicable. 

Acknowledge that the program receiving the referral will also share client information in IRIS. Consider whether clients should be informed of specific information organizations in your IRIS Community will share with referral responses. 

Example Language: 

“If you agree, your name and date of birth will be shared with service providers in the online system. Your date of birth will be used for identification purposes only. Other details will be shared only with staff at the program(s) we refer you to and the local IRIS Data Manager(s). They will only use your family’s personal information to coordinate services by sending a referral or contacting you to offer services. This personal information may include: [IRIS Community specific referral information]

Our agency and the program we refer you to will also provide updates about the referral, including whether you receive services.”

Consent to Referral 

Clients should actively opt in or out of an IRIS referral; however, IRIS consent should never be a prerequisite for receiving a referral to services. Train staff on procedures for referring clients who do not consent to IRIS.

Example Language:

“Do you agree to allow us to share your and/or your family’s information with partners who provide services in our community?”

Special Considerations

Minors

If the referred person is a minor, organizations should ensure consent is obtained from a parent or legal guardian and follow any regulations related to minor privacy and consent.

Consent Expiration (if applicable)

Entities bound by regulations that require a consent expiration date should include an expiration clause. 

Example Language

“This consent is valid until you choose to revoke it.”

Revoking Consent

Entities bound by regulations that require clients to have an option to revoke consent should include a consent revocation clause and establish procedures for addressing revocation.

Example Language:

“You may take back your permission at any time by submitting a signed, written request. This will not affect services you have already received.”