Choosing Secure Case-Management Software for Frederick Nonprofits

Choosing case-management software is a decision about who can see a person's story, how staff coordinate help, and whether records remain usable when systems change. For a Frederick, Maryland nonprofit, a polished demonstration should lead to a hands-on test using the organization's actual workflows. Before signing or migrating, work through this checklist with a program lead, the system administrator, and whoever owns privacy and records decisions.

1. Define the smallest useful client record

List the information each program genuinely needs at intake. For every field, record its purpose, who uses it, and whether it can be collected later. Separate essential service information from optional demographic reporting. Challenge requirements for identity documents, detailed health histories, and unrestricted narrative notes.

The FTC's personal-information guide recommends collecting only necessary information and limiting access. Apply that principle to the migration: old spreadsheets should be reviewed before they become permanent fields in a new database.

2. Identify the rules that apply to your programs

Confirm relevant contractual, legal, funder, and confidentiality requirements before comparing vendors. Nonprofit status alone does not establish HIPAA coverage. HHS explains that HIPAA applies to covered entities and business associates. Have qualified counsel or your compliance lead assess your organization's activities and relationships. If a business associate agreement is required, resolve that requirement before placing protected health information in the platform.

Document who can approve referrals, disclosures, and exceptions. Software settings need to reflect those decisions.

3. Demonstrate staff and volunteer boundaries

Create fictional cases for two programs and test separate accounts for an intake volunteer, caseworker, supervisor, and administrator. A volunteer scheduling appointments may need contact details without access to case narratives. A development employee preparing aggregate reports may have no reason to open individual client files.

• Can permissions separate viewing, editing, exporting, deleting, and changing access?
• Can a worker see only assigned cases or an approved program?
• Does removing a departing worker also end existing sessions?
• Can an administrator review who changed or exported a record?

Check these boundaries in search results, dashboards, notifications, and downloads as well as the main record screen.

4. Ask for evidence behind vendor assurances

Request a demonstration of multifactor authentication, account administration, and available security logs. Confirm which capabilities are included in the proposed subscription. CISA's Secure by Demand guide provides questions customers can use to evaluate software security, including authentication and logging.

Ask who can access customer records for support, how that access is approved, and which subcontractors handle information. Obtain written answers about encryption, incident notification, support escalation, and deletion after termination. If the vendor supplies an independent assessment, check its date, scope, and exceptions. Record unanswered questions and assign someone to resolve them before purchase.

5. Test a real referral workflow safely

Using invented data, send a referral to a test recipient through the proposed sharing process. Confirm the recipient receives only the intended fields and attachments. Check whether access can expire or be revoked and whether the system records the disclosure.

Review email and text previews for exposed case details. Decide how staff verify recipient addresses and document the authority to share. If a partner needs a spreadsheet, define an approved transfer route, a limited field set, and responsibility for the downloaded copy. A secure portal does not control files after someone downloads them.

6. Prove you can recover and leave

Ask the vendor to distinguish service recovery from restoring your organization's accidentally deleted records. Establish available recovery points, expected restoration time, costs, and who submits a request. CISA recommends regularly testing backup availability and integrity. Request evidence of the vendor's testing and perform a permitted recovery exercise for your own workflow.

Separately, export fictional cases with notes, attachments, relationships, dates, and identifiers. Open the export outside the platform and check whether another system could reconstruct a usable history. Confirm export fees, format documentation, termination deadlines, and how long access remains available. Assign secure storage and access controls to exported files.

7. Migrate in stages and assign retention ownership

Start with a small test import. Compare record counts, attachment links, dates, duplicate handling, and permissions against the source. Have caseworkers inspect representative cases before approving the full move. Set a cutover time, identify the authoritative system, and agree on a rollback decision before staff begin entering live records.

Name a records owner to maintain retention rules by record category, review applicable requirements and holds, and approve disposal. Include legacy systems, exports, temporary migration files, and backup expiration in that plan. Keep the old system protected until validation and required retention decisions are complete.

Train staff with a short scenario: a family changes contact details, a worker changes teams, and a referral is withdrawn. Each person should demonstrate the correct action in a test account. Include an outage procedure for urgent appointments and a named contact for access problems. Keep training materials free of real client information, including screenshots and documents revealing client identities.

Finish with a written acceptance record: tests performed, gaps accepted, responsible owners, and the next review date. That gives a Frederick nonprofit a practical basis for choosing a platform its team can operate responsibly.