Children's Advocacy Centre Software Problems: The 7 That Put a Case Record at Risk

Why does a centre software project turn into a multi agency governance programme?

The brief is usually operational. Somebody wants case review agendas to build themselves, or wants interview scheduling to stop living on a shared calendar. Then the first design session asks who may see what, and the answer requires a decision from each partner agency, because a detective, a child protection investigator, a prosecutor, a clinician and a victim advocate work for different organisations with different legal authorities and different confidentiality obligations.

That is the actual project. The software is the smaller half. A centre exists to coordinate agencies that do not report to it, and the coordination has to be documented because accreditation depends on demonstrating that the team functioned as a team. Any system that touches the case record therefore encodes agreements that may not exist yet in writing.

The fix is to start the agreements before engineering, not alongside it. Get each partner to state what they may see, what they may enter and what leaves the system, and capture it as a role definition with a data scope rather than as a memorandum nobody reads. A defensible first release is the case record with cross agency access control, forensic interview scheduling, recording chain of custody and case review documentation. Medical and mental health tracking, victim advocacy services, prosecution outcomes, accreditation evidence packs and any clinical integration belong in a later phase. Centres with documented memoranda and clear case review criteria move considerably faster than those where practice is informal.

What goes wrong when you migrate case records and interview recordings?

Migration here is two different jobs sharing a line item, and only one of them looks like data work.

Case records carry the usual problems: children appearing under more than one spelling, siblings recorded as separate unlinked cases, referral sources entered as free text, and disposition fields that were used inconsistently as practice changed. Historical case review notes exist as documents rather than as structured decisions, so the accreditation reporting you want cannot be produced retrospectively and should not be promised.

Recordings are the harder half and the one that carries real exposure. A forensic interview recording is potential evidence in a criminal prosecution, so moving it means proving it is still the original. Files may be spread across a recording appliance, a shared drive and an external disk from an older system, with folder permissions somebody set years ago and no record of who accessed what. Some copies will exist that nobody can account for, and discovering that during migration is uncomfortable and necessary.

The fix is to hash every recording at ingest and verify on retrieval so integrity becomes demonstrable rather than assumed, and to record the migration itself as an event with a source and a date. Reconcile the file inventory against the case list and treat unmatched files as an explicit exception list rather than quietly importing them. Migrate structured case data at the level you can genuinely trust, and carry historical notes as attached documents rather than pretending they are structured decisions.

Why do the partner agency, scheduling and clinical integrations break after go live?

Because the people on the other side do not work for you. A detective will not adopt a second system to update a case, so an integration that depends on partner staff entering data reliably will decay within a quarter. The same is true of prosecutors, whose case management systems are usually closed to you and whose offices have no obligation to feed yours.

Scheduling breaks in a more mundane way. Forensic interviews depend on a room, an interviewer, an observation space and the availability of several agencies at once, and satellite sites add travel time and connectivity that a calendar does not model. A scheduling feature built without those constraints produces bookings the centre cannot actually staff.

Clinical integration for hospital based programmes is the single largest cost multiplier in this category, because it brings interoperability standards, health privacy requirements and a hospital information security review into scope. Teams underestimate the review rather than the interface.

The fix is to design partner interaction around the minimum that a busy person will actually do, usually a scoped view and a short structured update, with anything richer treated as a bonus rather than a dependency. Model scheduling constraints explicitly, including satellite travel. And for clinical work, keep the clinical record in the health system and hold a linked summary in the case system, involving hospital information security before design rather than after, because their requirements will shape the architecture rather than sit on top of it.

What happens when access control and chain of custody are not enforced?

Access granted per case and removed by memory accumulates into a list nobody can defend. The specific harm is not usually a dramatic breach. It is that a detective who transferred, a contract clinician whose term ended, and a prosecutor who moved offices all still appear on a case, and when access is questioned the centre cannot show that the record was controlled.

The fix is to derive access from case assignment rather than granting it manually. Each agency has a role definition with a data scope, each person's access to a specific case follows from their assignment, and it ends when their involvement ends rather than when someone sends an email. Sensitive categories, particularly mental health and medical records, sit behind an additional boundary that requires an explicit basis to cross. Every access is logged with user, time and record type, because that log is what you produce when access is challenged. Design the offboarding path first, because that is where stale access comes from.

Chain of custody needs the same structural treatment. Compute a hash at ingest and verify it on every retrieval. Store recordings encrypted with keys your organisation controls. Make every view, download and transfer an immutable log entry including recipient and purpose. Support a formal release workflow so a copy provided to a prosecutor is a recorded event with an authorisation behind it. Retain according to your state's requirements with legal hold that suspends deletion, confirming those periods with your counsel rather than with general guidance. And do not let a build put recordings into a general purpose file sharing service because it is convenient, since that decision is the one most likely to be raised later.

Should you build custom or configure what you already own?

Use NCAtrak, and put the money into interviewers and therapists, if you are a single accredited centre working with one county's partner agencies and standard reporting. It was built for this model, understands multidisciplinary team case tracking and the reporting accredited centres need, and a build would take funding away from services to reproduce something that already fits. We would say the same on a call, and we have.

Before commissioning anything, exhaust the process side. Write down each partner's access expectations, because a system cannot express an agreement that does not exist. Define case review criteria explicitly, since agenda generation depends on a rule rather than a habit. And check what reporting your current tool already produces against accreditation questions, because some of the assembly work is a report nobody has configured.

Build when a state chapter wants one consistent system across member centres with comparable data, when a centre covers several counties with materially different partner agencies and satellite sites, when a hospital based programme has to connect the medical evaluation to clinical systems, or when access control has become a manual discipline that depends on someone remembering to remove a detective who transferred last spring. The trigger is cross organisational complexity, not case volume.

How do hidden costs get into the quote?

Through work that protects the record rather than work that appears on a screen.

• Partner agency variation. Each agency whose access rules differ is its own role model and its own agreement conversation.
• Satellite and mobile interview sites. Connectivity, device management and scheduling constraints that a single site build never encounters.
• Clinical integration. The largest multiplier here, and most of it is the hospital information security review rather than the interface.
• Security work. Penetration testing before go live, and a rule that no real case data appears in any development or test environment, which means realistic synthetic data has to be produced.
• Recording migration. Inventory reconciliation, hashing and an exception list for files that do not match a case.

What keeps the number down is launching with the case record, scheduling and case review, deferring outcomes and clinical integration, and using established managed infrastructure with strong controls rather than anything bespoke. Multi centre deployment for a state chapter is the one factor that reduces cost per centre dramatically, which is why the economics work there and rarely work for one site.

What separates a centre build that works from one that fails?

Ask how they would model access so a detective assigned to a case sees the investigative record and never the mental health notes, and so that access ends when the assignment ends. If the answer is user roles and case permissions set manually, ask what happens when the detective transfers. The follow up answer tells you whether they have thought about the actual failure mode.

Ask what they would do to make a recording's integrity provable two years later. Hashing at ingest, verification on retrieval, immutable access logs and a formal release workflow should come back without prompting rather than after a hint.

Ask whether they have built systems where records may be produced in a criminal proceeding, and how that shaped their logging and retention design. Then ask specifically what they will do for security review before go live, and require that no real case data appears in development or test environments.

Settle ownership before kickoff: the repository, the cloud accounts and the right to hire another firm should be yours in writing. With records tied to child protection and criminal prosecution, needing a supplier's cooperation to reach your own data or to answer a legal request is not a position a board should accept.