Shepherd Case Management System

Certification is the step that unlocks federal assistance. It ran on email.

The Office on Trafficking in Persons certifies survivors so they can reach housing, legal aid, benefits, and case management. In 2018 the office received three times more service requests than in any previous year, and the process behind certification had been built for a smaller caseload.

A document workflow with people attached to it.

Before the redesign a request arrived as a password-protected document attached to an email. Case specialists printed it, signed it, scanned it, and entered the details by hand into a tracking database. Correspondence, consultations, and referrals were managed separately through more email. The process was slow, difficult to keep secure, and burdensome for the office and for the person waiting on the other end of it.

The burden fell hardest on the person the system existed to help. Because each agency ran its own application process, survivors had to recount their victimization repeatedly, to separate offices, to qualify for services that all rested on the same underlying determination. The process required survivors to repeat their account to another stranger before they could receive help.

Those operational failures exposed a more specific design problem. In most software, a mistyped field is an annoyance; here it delayed someone who had already waited too long. That field also sat inside a case file that four federal agencies would later need to reconcile, under policy requirements that touched nearly every screen. The office’s own director described the same process: requests arrived as password-protected documents in email, case specialists tracked every case manually in a database, and referrals and correspondence ran through email.

What could not change.

Policy fields could not be removed

Every required field existed because a statute or regulation put it there. The work was not simplification by deletion. It was making sure the requirements did not bury the actual job.

Three separately deployed services

Request, Review, and Case each shipped on their own schedule. Interaction patterns and role-based permissions had to stay consistent even when the pieces behind them moved independently.

Four agencies downstream

Homeland Security, Justice, Housing and Urban Development, and Labor all touch these cases. A record that made sense only inside ACF was not good enough.

Two audiences, one system

A member of the public submitting on someone else’s behalf, and a trained case specialist working a queue. The same data, entirely different needs.

Confidentiality under load

The old process kept victim information secure by passing password-protected files between inboxes, which was burdensome to sustain and fragile at volume.

Whatever replaced it had to be safer without being slower.

Personas first, then the journeys they take.

I built personas for the people the system serves: a member of the public submitting on a child’s behalf, a case specialist working a queue, a funded grantee receiving referrals, a downstream agency needing to verify a letter. Then I mapped each of their journeys through the existing process.

Laying those journeys side by side is what produced the reframing everything else follows from. Every one of them was organized around a document changing hands. None of them were organized around a decision being made. The requester was assembling a package. The case specialist was processing a package. The agencies downstream were re-opening a package that had already been assembled twice. The redesign therefore started with the decisions rather than the forms.

Decisions became the organizing principle.

I reorganized the journey around the decisions a case specialist makes rather than around the documents the agency needed filled in. The old process moved documents from person to person; in the redesign, each decision determined which documents followed.

It also set the goal for everything downstream: one account, told once. Consolidating services and support from multiple federal agencies into a single access point meant a common certification that participating agencies would accept, so a survivor no longer had to prove their victimization separately to each one. That is a policy achievement as much as a design one, and it took the joint team to get there. What design owned was making the single account complete enough, and legible enough, that four agencies could act on it without sending the person back to the beginning.

The front door, and the place a person in crisis meets the federal government.

I broke one long form into six sections, sequenced so a requester is asked what they already know before they are asked what they may have to go and find out.

These screens were captured from the live system in 2026. The redesign described here was done in 2020 and 2021, and other teams have maintained the system since. The section structure is the part that carried forward.

Enlarge image

Requester information comes first because anyone submitting knows it. The child’s details second. Then the concerns, what has been observed. Then the narrative, in the requester’s own words, because a structured field cannot hold an account of what happened to someone. Then the structured detail. Consent last, once the person understands what they are consenting to.

Three safeguards, where an error carried the most weight.

Caseworkers estimated these patterns cut data-entry errors at critical decision points by around 30 percent. That figure came from their feedback rather than from instrumentation, and it is stated that way everywhere it appears.

Enlarge image