Privacy

Homeless Management Information System (HMIS) Agency Privacy Policy Notice

This Notice describes the Privacy Policy of the Rhode Island Continuum of Care (RICoC) Homeless Management Information System (HMIS). The RICoC has executed a Memorandum of Understanding with Rhode Island Coalition for the Homeless (RICH) to act as the HMIS Lead Agency, administering the HMIS on behalf of RICoC, is governed by the RICoC HMIS Steering Committee.

Each CHO (Covered Homeless Organization or Participating Agency) is required to adopt this privacy policy related to the use of the RICoC HMIS. This requirement includes agencies defined as Victim Service Providers and who are required to use a comparable database.

Not all RICoC stakeholders have direct access to HMIS. Throughout the RICoC, there are certain agencies, usually the service provider agencies that are directly interacting with homeless clients, that actively use and contribute to the HMIS. Any agency with access to the HMIS is required to sign an Agency Partnership Agreement. All HMIS Lead Agency personnel (including employees, volunteers, affiliates, contractors and associates), and all participating agencies and their personnel, are required to comply with this notice. All personnel in the RICoC with access to HMIS must receive and acknowledge receipt of a copy of this Notice, agree in writing to comply with it, and receive training on this Privacy Policy before being given access to HMIS.

This Privacy Policy applies to all Personally Identifiable Information that is collected and maintained in the RICoC HMIS, including electronic and hard copies derived from the HMIS.

Personally Identifying Information, also known as Protected Personal Information (PPI), is defined by the 2004 HUD Data and Technical Standards as: “Any information maintained by or for a Covered Homeless Organization about a living homeless client or homeless individual that:

1. Identifies, either directly or indirectly, a specific individual;
2. can be manipulated by a reasonably foreseeable method to identify a specific individual; or
3. can be linked with other available information to identify a specific individual.”

The RICoC HMIS will use only unidentified, aggregate data for homeless policy and planning decisions, in preparing federal, state, or local applications for homelessness funding, to demonstrate the need for and effectiveness of programs, and to obtain a system-wide view of program utilization in the state.

Federal law may require participating agencies to have their own agency-​specific privacy policies. Information entered and accessed by participating agencies may therefore also be covered by additional, agency-​specific privacy policies. Participating agencies may be more restrictive in their privacy policies but may not be less restrictive than this Privacy Policy. In accordance with federal law, all participating agencies are required to post the HMIS Data Statement at their intake desks, offices, or website, as applicable, explaining the reasons information is requested.

The RICoC and the HMIS Lead Agency reserves the right to amend this Privacy Policy at any time. It is possible that an amendment may affect PII that we obtained before the effective date of the amendment. We will maintain a record of the changes made in amendments and post new versions of this Privacy Policy on the website located at: https://www.rihomeless.org/

RICoC has adopted an approach to client consent for use and disclosure of information consistent with regulations set forth by HUD in Federal Register/ Vol. 69, No. 146 / Friday, July 30, 2004 / Notices and with the Coordinated Entry Management and Data Guide (published October 2018) at https://files.hudexchange.info/resources/documents/coordinated-entrymanagement-and-data-guide.pdf

● “Use” means, with respect to PII, the sharing, employment, application, utilization, examination, or analysis of such information internally within the HMIS participating agency that maintains such information or within the HMIS Lead.

● “Disclosure” means, with respect to PII, the release, sharing, transfer, provision of access to, or divulging of information to an organization outside the HMIS participating agency holding the information or outside the HMIS Lead Agency. Disclosure of any information to any entity that has not signed a Data Sharing MOU and is not required by law can only occur with written client consent

Only information that is needed for 1) coordination of services and case management, 2) administration, 3) billing, and 4) analytics are collected. Uses and disclosures are further defined below:

• Coordination of services and case management: Agencies may use or disclose client information for case management purposes to provide or coordinate services for you and your family to help you end your homelessness. Participating agencies may use or disclose your information to locate suitable services or housing, to conduct referrals and assessments, to determine program eligibility, and to otherwise collaborate to address your specific needs and circumstances.
• Administrative Uses: Agencies may use client information to carry out administrative functions internally including but not limited to legal, audit, personnel, oversight, and management functions.
• Billing Use: Agencies may use client information for functions related to payment or reimbursement for services if required by the funder/billing agency.
• To carry out maintenance and operation of the RICoC HMIS;
• To create reports for the RICoC that include your data but only in a manner in which your identity is not disclosed
• Research Use: Agencies may use client information for internal analysis including but not limited to evaluating program effectiveness, creating an unduplicated database on clients served within the system, understanding local and regional needs and trends in homelessness, and assessing an agency’s progress towards achieving goals and objectives. PII that could be used to identify a client should never be included in these reports. The release of aggregate HMIS data to an entity that is not a CHO/Participating Agency must be approved by the RICoC Data and HMIS Committee and RICoC Board of Directors

Required by Law: Agencies may disclose client personal information that meets the minimum standard necessary for the immediate purpose to comply with legal requirements. Agencies may only disclose client information to law enforcement entities in response to appropriate legal requests including subpoena or court order. Agencies may disclose client PII to an agency authorized by law to receive reports of abuse, neglect, or domestic violence if this agency believes the clients are the victim of such treatment provided any of the following apply:

• the disclosure is required by law, such as “mandated reporting"
• the agency believes the disclosure is necessary to prevent serious harm, or to lessen a serious or imminent threat to the health and safety of an individual or public and the information is given to law enforcement or other person reasonably able to prevent or reduce that threat.

Client Rights

• Clients have the right to get services even if they choose NOT to share data in the RICoC HMIS; this right is limited by the nature of the project; some projects are required by law or regulation to collect certain data to establish and document program eligibility.
• Clients have the right to ask who has seen their information.
• Clients have the right to see or receive a copy of their information and to change it if it is not correct. Requests to view or receive a copy of their information shall be in writing and clients must provide proof of identity; the request and proof of identity shall be maintained in the client file (electronic or hard copy). To change information, clients must show documentation verifying the correct information.

If clients do not want their information shared with a specific agency, it is their responsibility to let their case manager or intake worker know, who must then take the proper action to honor that request.

If a client has any questions about the use of their personal information or are concerned about client privacy or safety, they should share their questions or concerns with agency management. If a client feels that the security or integrity of their information has been violated by an end-user or the CHO itself, clients should file a complaint with the Agency, following their procedures that are in place. Clients may also file a complaint with the HMIS Lead Agency; all CHOs/Participating Agencies are required to provide a client with a Grievance Filing Form at their request and submit the completed form to the HMIS Lead Agency; in instances where the HMIS Lead Agency is the subject of a grievance, it will be submitted to the RICoC Data and HMIS Committee for review and action. The HMIS Lead Agency, in conjunction with the RICoC Data and HMIS Steering Committee, will investigate each grievance and submit suggested actions to the CHO/Participating Agency within 30 days. Clients that submit a grievance filing form will not be retaliated against for filing a complaint. Clients may also ask for a copy and/or an explanation of the privacy policy