HMIS Personal Protected Information Policy

I. Confidentiality

A. Agencies will uphold relevant Federal and State confidentiality regulations and laws that protect client
records, and the Agency will only release confidential client records with written consent by the client, or the
client’s guardian (if minor under 18), unless otherwise provided for in the regulations or laws. A client is
anyone who receives services and whose information is entered into the Homeless Management Information
System (HMIS) from the Agency and a guardian is one legally in charge of the affairs of a minor or of a
person deemed incompetent.
1. The Agency will abide specifically by Federal confidentiality regulations as contained in the Code
of Federal Regulations, 42 CFR Part 2, regarding disclosure of alcohol and/or drug abuse records.
In general terms, the Federal regulation prohibits the disclosure of alcohol and/or drug abuse
records unless disclosure is expressly permitted by written consent of the person to whom it pertains
or as otherwise permitted by 42 CF R Part 2. A general authorization for the release of medical or
other information is not sufficient for this purpose. The Agency understands that Federal rules
restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse
patients.
2. If a HIPAA covered entity, the Agency will abide specifically with the Health Insurance Portability
and Accountability Act (HIPAA) of 1996 and corresponding regulations passed by the U.S.
Department of Health and Human Services. In general, the regulations provide consumers with new
rights to control the release of medical information, including advance consent for most disclosures
of health information, the right to see a copy of health records, the right to request a correction to
health records, the right to obtain documentation of disclosures of information may be used or
disclosed. The current regulation provides protection for paper, oral, and electronic information.
3. The Agency will abide specifically by Rhode Island State law, which in general terms requires an
individual to be informed that any and all medical records she/he authorizes to be released, whether
related to physical or mental health, may include information indicating the presence of a
communicable or venereal disease. The Agency is required to inform the individual that these
records may include, but are not limited to the inclusion of information on diseases such as
hepatitis, syphilis, gonorrhea, tuberculosis, and HIV/AIDS.
4. The Agency will abide specifically by Rhode Island law in that this law prohibits agencies from
releasing any information that would identify a person as a client of a mental health facility, unless
client consent is granted.
5. The Agency will provide a verbal explanation of the RIHMIS and arrange for a qualified interpreter
or translator in the event that an individual is not literate in English or has difficulty understanding
the consent form(s).
6. The Agency will not solicit or input information from clients into the RIHMIS unless it is essential
to provide services or conduct evaluation or research.
7. The Agency will not divulge any confidential information received from the RIHMIS to any
organization or individual without proper written consent by the client unless otherwise permitted
by relevant regulations or laws or signed client consent form.
8. The Agency will ensure that all persons who are issued a User Identification and Password to the
RIHMIS within that particular agency abide by this Partnership Agreement, including the
confidentiality rules and regulations. The Agency will ensure that each person granted RIHMIS
access at the Agency receives RIHMIS training. Training will include information on how to use the
RIHMIS as well as basic steps to ensure confidentiality. The Agency will be responsible for
managing any of its own requirements that individual employees comply with RIHMIS
confidentiality practices, such as having employees sign a user agreement form. It is understood that
those granted Agency Administrator access within each RIHMIS agency account must become an
RIHMIS Agency Administrator through training provided by RIHMIS.
9. The Agency understands that the database server-which will contain all client information,
including encrypted identifying client information-will be physically located in the database
warehouse in Shreveport, Louisiana.

B. The Agency agrees to maintain appropriate documentation of client consent or guardian-provided consent to
participate in the RIHMIS

10. The Agency understands that informed client consent is required before any basic identifying client
information is entered into the RIHMIS for the purposes of interagency sharing of information.
Informed client consent will be documented by completion of the standard RIHMIS client Consent
to release and exchange basic information to authorized HMIS participants.
11. The Client Consent form mentioned above, once completed, authorizes identifying client data
to be entered into the RIHMIS, as well as service transaction information. This consent form
permits client identifying information to be shared among all RIHMIS Member Agencies and
service transactions with RIHMIS Member Agencies.
12. If a client denies authorization to share identifying information and service transaction data via the
RIHMIS, identifying information shall only be entered into the RIHMIS if the client information is
made accessible only to the HMIS participating agencies. If the client refuses to sign the client
consent form the RIHMIS will not be used as a resource for that individual client and her/his
dependents. Data can still be COLLECTED in HMIS but the HMIS Administrator must lock down
this record.
13. The Agency will incorporate an RIHMIS Clause into existing Agency Authorization for Release of
Information form(s) if the Agency intends to input and share confidential client data with the
RIHMIS. The Agency’s modified Authorization for Release of Information form(s) will be used
when offering a client the opportunity to input and share service information. The Agency will
communicate to the client what information, beyond identifying data and services transactions will
be shared if client consent is given. The Agency will communicate to the client that while the
Agency can restrict information to be shared with select agencies, those other agencies will have
access to the information and are expected to use the information professionally and to adhere to
the terms of the RIHMIS Partnership Agreement. Agencies with whom information so shared are
each responsible for obtaining appropriate consent before allowing further sharing of client records.
The RIHMIS will conduct periodic audits to enforce informed consent standards, but the primary
oversight of this function is between agencies.
14. If a client denies authorization to have information beyond identifying data and beyond service
transactions both entered and shared among the RIHMIS, then this record must be locked and made
available only to the entering agency program, therefore, precluding the ability to share
information. If the client does not sign the client consent form the RIHMIS will not be used as a
resource for information for that individual client and her/his dependents.
15. The Agency agrees to place all Client Authorization for Release of Information forms related to the
RIHMIS in a file to be located at the Agency’s business address and that such forms are made
available to the Continuum of Care for periodic audits. The release should also be uploaded into
the RIHMIS system. The Agency will retain these RIHMIS related Authorization for Release of
Information forms for a period of 7 years, after which time the forms will be discarded in a manner
that ensures client confidentiality is not compromised.
16. The Agency understands that in order to update, edit, or print a client’s record, the Agency must
have on file a current authorization from the client as evidenced by a completed standard RIHMIS
Client Consent form pertaining to identifying data, and/or a modified Agency form with a RIHMIS
clause pertaining to confidential information.
17. The Agency understands the Rhode Island Continuum of Care (RICoC) does not require or imply
that service be contingent upon a client’s participation in the RIHMIS.

Participation in data collection, although optional, is a critical component of the community’s
ability to provide the most effective services and housing possible. Please understand that
access to shelter and housing services is available without participation in data
collection.*
The information gathered and prepared by the Agency will be included in a HMIS database of
collaborating agencies (list available upon request), and only to collaborating agencies,
who have entered into an HMIS Agency Participation Agreement and shall be used to:
a) Produce a client profile at intake that will be shared by collaborating agencies
b) Produce anonymous, aggregate-level reports regarding use of services
c) Track individual program-level outcomes
d) Identify unfilled service needs and plan for the provision of new services
e) Allocate resources among agencies engaged in the provision of services
f) Provide individual case management

Information Collected

1. Identifying information (Name, birth date, social security number)
2. Demographic information (gender, race, residential information, family composition)
3. Letter to number code conversion for name and Date of Birth, Demographic information
(gender, race, residential information, family composition)
4. Case management care coordinators recommendations and direct observations, HUD
Universal and Program Specific data elements.
5. Financial information (income verification, public assistance payments, food stamps)
6. HIV/AIDS diagnosis (Yes, No)
7. HUD required substance abuse information.
8. Information to determine chronic homeless status required for housing placement
9. Any documents relevant for housing placement may be uploaded into HMIS.
The release that the client signs for HMIS can be revoked by the client at any time – but it
must be done in writing; the revocation must be signed and dated by the client. This consent is
subject to revocation at any time, except to the extent that the Agency has already taken action
in reliance on it. These records are protected by federal, state, and local regulations governing
confidentiality of client records and cannot be disclosed without client’s written consent
unless otherwise provided for in the regulations.

* Participation in data collection is optional, and clients are able to access shelter and housing services if they choose not to participate in data collection.