A nonprofit should treat a story from someone it serves as something that person lends, not something the organization owns. Get informed, written consent that names every place the story will appear and for how long, let the person read the final wording before it runs, and give them a simple way to take it back. Then write it accurately, with only the details it needs, and keep it tied to the program it illustrates.
Stories carry a lot of weight in nonprofit communications. One interview can feed a program page, a year-end appeal, a grant report, and a gala video. The person who shared it usually agreed to one conversation, often with a staff member they depend on, and may not picture how far a public web page can travel once search tools and AI assistants can excerpt it.
This is a content-planning question for development and communications staff, not legal advice. Which privacy rules apply depends on what kind of organization you are, what you do, and where you operate, so your counsel, and your privacy officer if you have one, make that call.
Consent is a conversation before it is a form
The person asking for the story matters. If the caseworker who controls someone's services makes the request, saying no can feel risky, even when it is not. Have someone outside the service relationship ask when you can, and say out loud that declining changes nothing about the help the person receives. A signed release is not informed consent. Consent is informed when the person understands where the story goes, who will see it, and what they can change later.
| Consent record field | What to write down |
|---|---|
| Uses approved | Each channel by name: website, appeal letters, social posts, grant reports, video. |
| Identity level | Full name, first name only, a changed name, or no name; photo or no photo. |
| Details excluded | Anything the person asked to leave out, in their words. |
| Review | The date they read the final text and what they changed. |
| Expiration | When the organization will check back before reusing the story. |
| Withdrawal contact | The named staff role that handles a request to remove it. |
For young people, set a policy with counsel that covers both a parent or guardian's permission and the young person's own agreement, and decide in advance what happens when that young person turns eighteen and wants the story gone.
When privacy rules reach the story
Some nonprofits are health care organizations under federal law, and that changes the question. Under 45 CFR 160.103, a covered entity includes "A health care provider who transmits any health information in electronic form" in connection with a covered transaction, which can describe a community clinic, a counseling center, or a dental program. For a covered entity, 45 CFR 164.508 sets the default: except as the rules otherwise permit, it "may not use or disclose protected health information" without a valid authorization, and, apart from two narrow exceptions the section lists, it "must obtain an authorization for any use or disclosure of protected health information for marketing."
Development teams at health nonprofits often know the fundraising provision. Section 164.514(f) lets a covered entity use limited categories for its own fundraising, such as "Demographic information relating to an individual," "Department of service information," and "Outcome information," and each fundraising communication must offer "a clear and conspicuous opportunity to elect not to receive any further fundraising communications." Read that list next to a published patient story and the gap is plain: a story usually carries far more than those categories. Bring every patient or client story to your privacy officer before drafting begins.
If you serve people in a setting with its own confidentiality duties, such as a shelter, a school program, or a legal clinic, ask counsel which rules attach to that setting before anyone records an interview.
Write the story with the person, not about them
Record the interview with permission and build the story from what the person said. Quotes should be their words, trimmed for length with their approval. The writer should not have to invent a quote, a turning point, or a happy ending, and if the interview did not produce one, the story does not have one yet. Composite stories, built from several people, need a clear label saying so.
Let the person choose which details define them. Many people do not want to be introduced by the worst month of their life. Ask what they would want a stranger to know first, and start there. Keep the organization in its real role: a story shows what one person experienced in a program, and it does not prove the program's results. Our page on explaining programs and outcomes accurately covers how to state results with their sources, so a story never has to stand in for a number.
A fictional example: one story, three uses
A fictional adult literacy nonprofit in Ohio interviews a learner, called R. here, who passed a high school equivalency exam after two years in its evening classes. R. agrees to a first name, no photo, and no mention of her employer.
| Use | What consent covered | What the writer did |
|---|---|---|
| Program page | First name, class schedule, exam result | Placed the story beside the class description, with the program's own completion data cited separately. |
| Year-end appeal | Same details, one quote | Used R.'s quote unchanged and sent her the final letter before it mailed. |
| Grant report | Not covered | Asked R. again. She said yes for one funder and no for public posting of the report. |
Eighteen months later R. asks to be taken down because a new manager found the page. The organization removes the web story within a week, pulls it from the next print run, and tells her plainly that copies already mailed cannot be recalled, which it had told her at the start.
Keep stories maintained after they publish
A story page has a shelf life. Put every story in one log with its consent record, the pages and files where it appears, and its check-back date. When that date arrives, contact the person before reusing the story, and retire it if you cannot reach them. One question exposes most gaps. Ask your program director, "If someone asked us tomorrow to take their story down, who would do it, and how many places would we need to check?" If nobody can answer in a minute, the log is the first project.
Write stories so they keep their meaning when excerpted. A public page can be quoted or summarized in places the organization does not control, so each story should carry its context: which program, roughly when, and what the person chose to share. Our guide to keeping a consistent voice across staff writers covers how the people writing stories can follow the same rules.
In Hudson South's four steps, the Authority Asset gathers the organization's approved knowledge and evidence, and a story belongs there only with its current consent record attached. Hudson Twenty-One records how the organization communicates across 21 dimensions, including how it speaks about the people it serves. Market Intelligence researches what donors and funders ask, and AEO Creation turns those inputs into answer-first pages. The overview of content for nonprofits and associations lists the federal disclosure topics that sit around this work.
Tell stories people are glad they shared
On a free 30-minute call, Hudson South walks you through how your program and story pages read next to the organizations donors compare you with.
Get your free competitor analysisSources
- 45 CFR 160.103: Definitions. Electronic Code of Federal Regulations. Read 2026-10-16.
- 45 CFR 164.508: Uses and disclosures for which an authorization is required. Electronic Code of Federal Regulations. Read 2026-10-16.
- 45 CFR 164.514: Other requirements relating to uses and disclosures of protected health information. Electronic Code of Federal Regulations. Read 2026-10-16.