A board member discloses confidential information outside the board.
What happens next?
Carver and Charney ask the board to govern its own conduct in rehearsal 5.6 of The Board Member’s Playbook.[1]
The board should act.
First, establish what happened. What information was shared? With whom? Was it marked or understood as confidential? What policy, agreement, law, privilege, or duty applies? What harm has occurred or may occur?
Rumor is not enough for discipline.
Neither is embarrassment.
BoardSource places confidentiality inside a broader code of conduct and ethics.[2] That context matters because not every uncomfortable board discussion is properly secret. Confidentiality should protect legitimate interests such as personnel matters, legal advice, sensitive negotiations, private beneficiary information, and material nonpublic information.
It should not conceal misconduct or prevent a trustee from using a lawful reporting channel.
I would ask the chair and authorized counsel to preserve the facts and advise the board on immediate obligations. The organization may need to notify affected people, an insurer, a regulator, a contract partner, or law enforcement. It may need to protect privilege or secure information systems.
Then the board should address the member.
Give the person notice of the concern and an opportunity to respond. Intent matters, but impact and duty matter too. An accidental forwarding error and a deliberate disclosure may require different consequences.
Possible action includes training, a written warning, loss of access to particular materials, removal from an officer or committee role, censure, or removal under the bylaws and applicable law.
The response should be consistent with policy.
The board should also inspect its own practice.
Does every member know what is confidential and why?
Are executive sessions used for defined purposes?
Are minutes and records handled correctly?
Do members know where to report suspected wrongdoing?
Does the board distinguish “do not disclose” from “do not discuss publicly until the board decides”?
A vague culture of secrecy creates breaches and abuse at the same time.
I would add a short statement to sensitive materials: the basis for confidentiality, who may receive the information, how it may be stored, and when the restriction ends. That is more useful than stamping every page “confidential.”
The Chief Governance Officer must not investigate and punish alone. The board owns member discipline. A committee may gather facts, but the body should make any decision reserved to it.
There is a relational cost too. A breach can make members guarded with one another. Repair requires more than a penalty. The board may need to explain what changed, reaffirm standards, and create a safe way to ask whether a matter can be shared.
You can reduce future confusion with one meeting question:
“Before we close, which information from this session is confidential, on what basis, and who is authorized to communicate?”
Write the answer in the record.
Trust does not mean everyone keeps everything secret.
Trust means the board protects what deserves protection and tells the truth about what does not.
The board should decide who communicates after the breach. A single accurate statement may be necessary for affected people or the public. Multiple trustees offering explanations can compound the disclosure and create contradictions. The authorized spokesperson should say what can be confirmed, what is being protected, and what corrective process is underway.
Accountability is not served by gossip about the person who gossiped.
Footnotes
[1] Miriam Carver and Bill Charney, The Board Member’s Playbook (Jossey-Bass, 2004), rehearsal 5.6, pages 164–167.
[2] BoardSource, “Codes of Conduct and Ethics”.
Additional reading
BoardSource’s The Nonprofit Board Answer Book gives practical guidance on executive sessions, confidentiality, and board discipline.
Richard P. Chait, William P. Ryan, and Barbara E. Taylor’s Governance as Leadership helps boards build candor without confusing candor with disclosure.