Data Sharing and Consent in Crisis Diversion Governance: Making 988, Mobile Crisis, and Receiving Centers Work as One System

In a diversion pathway, the most common operational failure is not clinical skill—it is information loss. Risk history, current triggers, medication details, and safety agreements often sit in separate systems across 988 contact centers, mobile crisis, and receiving providers. Good crisis diversion governance aligns consent, minimum-necessary sharing, and documentation rules so that a diversion decision is defensible and the next provider can deliver care without re-triaging from scratch. This is also a core reliability requirement across modern crisis response models, where speed matters but safety and rights protections cannot be traded away.

Two oversight expectations routinely shape how funders and system leaders evaluate data governance in diversion. First, they expect clear, role-based access and audit trails that show who viewed or transmitted sensitive information and why. Second, they expect that consent workflows are operationally realistic—captured in real time, documented consistently, and not dependent on a single “expert” staff member being present.

What “Good” Data Sharing Looks Like in Diversion

Data sharing in crisis diversion should be designed around real-world workflows: a call that becomes a mobile response; a mobile response that becomes a short-stay; a short-stay that becomes follow-up, medication support, housing navigation, or outpatient linkage. Governance must define what information is required for safe handoff, how it is captured, what can be shared without consent, what needs explicit consent, and how exceptions are handled. The goal is not maximal sharing; the goal is sufficient sharing to prevent foreseeable harm, repeated questioning, and failed follow-up.

Operational Example 1: Real-Time Consent Capture That Survives the Handoff

What happens in day-to-day delivery
The system uses a single consent workflow that can be completed by 988 staff, mobile teams, or receiving centers, and it produces the same consent artifact each time. In practice, a caller who agrees to a mobile response is offered consent language that is brief, plain-English, and specific about which partners will receive information. The consent is captured in the contact center platform or mobile documentation tool, then attached to the referral packet so the receiving site can see (a) what was consented to, (b) when it was consented to, and (c) any limits the person requested. If consent is declined, staff record what was declined and what information can still be shared under minimum-necessary or emergency provisions.

Why the practice exists (failure mode it addresses)
This practice exists to prevent “consent collapse,” where information cannot move because the next provider cannot verify authorization. The system failure pattern is that each organization uses different forms, wording, or storage locations, so partners cannot find or trust the consent record during time-critical handoffs.

What goes wrong if it is absent
The receiving provider re-asks the person to sign new forms, which increases agitation and reduces engagement. Mobile teams withhold relevant risk context because they cannot confirm whether it may be shared. Follow-up providers receive a “cold” referral with minimal details, leading to missed appointments, avoidable re-contact, and repeat 988 calls because the person experiences the system as fragmented and repetitive.

What observable outcome it produces
Programs see fewer “referral rejected for missing consent” events, faster acceptance decisions at receiving sites, and stronger continuity because follow-up partners can act immediately with a verified authorization. Governance can evidence compliance through standardized consent artifacts and audit logs showing consistent storage and retrieval across settings.

Operational Example 2: Minimum-Necessary Referral Packets With a Defined “Safety Core”

What happens in day-to-day delivery
Governance defines a required safety core for all diversion referrals: presenting concern, immediate risk indicators, protective factors, current supports, medication and allergy notes if available, and any active safety plan elements (means restriction steps, coping strategies, contact preferences). Staff complete this core in a structured template that travels with the referral regardless of which agency generated it. Anything beyond the safety core is segmented into “optional detail” fields that require either explicit consent or a clearly documented exception pathway. Receiving sites train intake staff to review the safety core first, then consult optional sections only when needed.

Why the practice exists (failure mode it addresses)
The failure mode is uncontrolled variance: some referrals contain almost nothing, while others include excessive narrative detail that creates privacy risk and slows review. Without a defined safety core, staff do not know what is essential for safe handoff and default to either over-sharing or under-sharing.

What goes wrong if it is absent
Under-sharing produces unsafe duplication of assessment and missed risk signals, such as recent attempts, medication nonadherence patterns, or violence exposure. Over-sharing produces partner reluctance to accept referrals, fear of noncompliance, and inconsistent redaction practices that waste time. Both patterns reduce diversion reliability, because acceptance decisions become inconsistent and providers lose confidence in the referral stream.

What observable outcome it produces
Systems can demonstrate higher first-time acceptance rates at receiving sites, fewer delayed handoffs, and improved documentation consistency. Quality teams can audit a random sample of referrals and show that the safety core is present and complete at a high rate, while optional details are shared only when justified and properly documented.

Operational Example 3: Closed-Loop Follow-Up Information Sharing With Role-Based Controls

What happens in day-to-day delivery
Diversion governance establishes a closed-loop process where follow-up providers return outcome signals to the originating crisis service without disclosing unnecessary clinical details. For example, the follow-up team can report whether contact was made within 24–72 hours, whether the person attended the first appointment, whether medication access was secured, and whether a new safety concern emerged that requires re-engagement. These updates are submitted through a structured “status return” form with role-based access. Supervisors review exceptions where more detail might be needed, and all access is logged so the system can evidence appropriate use.

Why the practice exists (failure mode it addresses)
The failure mode is one-way referral flow. When crisis services never learn what happened after diversion, they cannot improve triage accuracy, and they cannot identify repeat callers who are failing to connect. Closed-loop sharing prevents blind spots that otherwise allow high-risk individuals to cycle repeatedly through 988 contacts without sustained stabilization.

What goes wrong if it is absent
Crisis services assume diversion “worked” because a referral was made, even if the person never engaged. Repeat contacts rise, staff morale falls, and leaders cannot distinguish between true service demand and avoidable bounce-backs caused by failed linkage. In serious cases, a person deteriorates after diversion and no agency recognizes the pattern quickly enough to intervene.

What observable outcome it produces
Systems can show improved follow-up timeliness, reduced repeat contacts for individuals who receive closed-loop engagement, and clearer performance management because leaders can see where linkage breaks down. Governance can evidence compliance through access logs, standard status categories, and documented supervisory review of exceptions.

Governance Guardrails That Keep Sharing Safe and Defensible

Effective data governance is not a legal memo; it is a workflow design. The system must define who can share what, when, and how it is documented, then train and audit against that reality. When consent capture is standardized, safety cores are consistent, and follow-up is closed-loop, diversion decisions become safer, more defensible, and more reliable under real operating conditions.