Join us for the NVOP Veterans Day Golf Classic! Register or learn more here.Click Here
Contact UsDonate

NVOP

Housing Forward Privacy Policy

Have any questions? Reach out our team using the button below.

Contact Us

League Policies

This policy outlines how Housing Forward collects, uses, and protects personal information in the HMIS and CAS systems, ensuring confidentiality while allowing responsible data use.

  1. Housing Forward

    The Housing Forward HMIS Privacy Policy describes standards for the privacy of personal information collected and stored in the Housing Forward Homeless Management Information System (Housing Forward HMIS), as well as personal information collected for the purposes of the Housing Forward Coordinated Access System (Housing Forward CAS). The Privacy Policy (hereinafter referred to as “Policy”) to protect the confidentiality of personal information while allowing for reasonable, responsible, and limited uses and disclosures of data. This Policy defines the privacy standards that will be required of any organization within the Housing Forward CoC that records, uses, or processes personally identifiable information (PII) on clients at-risk of or experiencing homelessness for the Housing Forward HMIS or the Housing Forward CAS. Organizations must also comply with federal, state, and local laws that require additional confidentiality protections, where applicable.

    This Policy recognizes the broad diversity of organizations that participate in the Housing Forward HMIS and/or the Housing Forward CAS, and the differing programmatic and organizational realities that may demand a higher standard for some activities. Some organizations (e.g., such as those serving victims of domestic violence, HIV/AIDS and youth) may choose to implement higher levels of privacy standards because of the nature of the clients they serve and/or service provision. At a minimum, however, all organizations must meet the privacy standards described in this Policy. This approach provides a uniform floor of protection for clients at-risk of or experiencing homelessness with the possibility of additional protections.

    The following sections discuss the Housing Forward HMIS and the Housing Forward CAS privacy standards.

  2. I. Housing Forward HMIS and CAS Privacy Standards

    a. Definition of Terms

    1. Personally Identifiable Information (PII): Any information maintained by or for a Covered Homeless Organization about a client at-risk of or experiencing homelessness that: (1) identifies, either directly or indirectly, a specific individual; (2) can be manipulated by a reasonably foreseeable method to identify a specific individual; or (3) can be linked with other available information to identify a specific individual. HMIS Compliance Document
    2. Covered Homeless Organization (CHO): Any organization (including its employees, volunteers, affiliates, contractors, and associates) that records, uses, or processes PII on clients at-risk of or experiencing homelessness for an HMIS or CAS. This definition includes both organizations that have direct access to the Housing Forward HMIS and/ or the Housing Forward CAS, as well as those organizations who do not but do record, use, or processPII.
    3. Processing: Any operation or set of operations performed on PII, whether or not by automated means, including but not limited to collection, maintenance, use, disclosure, transmission, and destruction of the information.
    4. HMIS and CAS Uses and Disclosures: The uses and disclosures of PII that are allowed by this Policy.
    5. Uses and Disclosures: Uses are those activities internal to any given CHO that involves interaction with PII, whereas disclosures are those activities in which a CHO shares PII externally.

  3. II. Applying the Housing Forward HMIS and CAS Privacy Policy

    This Policy applies to any homeless assistance organization that records, uses, or processes personally identifiable information (PII) for the Housing Forward HMIS and/or CAS. A provider that meets this definition is referred to as a covered homeless organization (CHO). All PII maintained by a CHO is subject to these standards.

    Any CHO that is covered under the Health Insurance Portability and Accountability Act (HIPAA) is not required to comply with this Policy if the CHO determines that a substantial portion of its PII about clients at-risk of or experiencing homelessness is protected health information as defined in the HIPAA rules. Exempting HIPAA-covered entities from this Policy avoids all possible conflicts between the two sets of rules.

    This Policy gives precedence to the HIPAA privacy and security rules because:

    1. The HIPAA rules are more finely attuned to the requirements of the health care system;
    2. The HIPAA rules provide important privacy and security protections for protected health information; and
    3. Requiring a homeless provider to comply with or reconcile two sets of rules would be an unreasonable burden.

    It is possible that part of a homeless organization’s operations may be covered by this Policy while another part is covered by the HIPAA standards. A CHO that, because of organizational structure, legal requirement, or other reason, maintains personal information about a client at-risk of or experiencing homelessness that does not fall under this Policy (e.g., the information is subject to the HIPAA health privacy rule) must describe that information in its privacy notice and explain the reason the information is not covered. The purpose of the disclosure requirement is to avoid giving the impression that all personal information will be protected under this Policy if other standards or if no standards apply.

  4. III. Allowable HMIS and CAS Uses and Disclosures of Personally Identifiable Information (PII)

    Client consent for any uses and disclosures defined in this section is assumed when organizations follow HUD HMIS Standards for notifying clients via the Housing Forward Privacy Notice.

    A CHO may use or disclose PII from the Housing Forward HMIS and/or CAS under the following circumstances:

    • To provide or coordinate services for an individual or household;
    • For functions related to payment or reimbursement for services;
    • To carry out administrative functions, including but not limited to legal, audit, personnel, oversight and management functions; or
    • For creating deidentified PII.

    CHOs, like other institutions that maintain personal information about individuals, have obligations that may transcend the privacy interests of clients. The following additional uses and disclosures recognize those obligations to use or share personal information by balancing competing interests in a responsible and limited way. Under this Policy, these additional uses and disclosures are permissive and not mandatory (except for first party access to information and any required disclosures for oversight of compliance with this Policy). However, nothing in this Policy modifies an obligation under applicable law to use or disclose personal information.

    Uses and disclosures required by law. A CHO may use or disclose PII when required by law to the extent that the use or disclosure complies with and is limited to the requirements of the law. HMIS Compliance Document

    • The CHO, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public; and
    • The use or disclosure is made to a person reasonably able to prevent or lessen the threat, including the target of the threat.

    Uses and disclosures about victims of abuse, neglect or domestic violence. A CHO may disclose PII about an individual whom the CHO reasonably believes to be a victim of abuse, neglect or domestic violence to a government authority (including a social service or protective services organization) authorized by law to receive reports of abuse, neglect or domestic violence under the following circumstances:

    • Where the disclosure is required by law and the disclosure complies with and is limited to the requirements of the law;
    • If the individual agrees to the disclosure; or
    • To the extent that the disclosure is expressly authorized by statute or regulation; and the CHO believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; or if the individual is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents that the PII for which disclosure is sought is not intended to be used against the individual and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.

    A CHO that makes a permitted disclosure about victims of abuse, neglect or domestic violence must promptly inform the individual that a disclosure has been or will be made, except if:

    • The CHO, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or
    • The CHO would be informing a personal representative (such as a family member or friend), and the CHO reasonably believes the personal representative is responsible for the abuse, neglect or other injury, and that informing the personal representative would not be in the best interests of the individual as determined by the CHO, in the exercise of professional judgment.

    Uses and disclosures for academic research or evaluation purposes. A CHO may use or disclose PII for academic

    • By an individual employed by or affiliated with the organization for use in a research/ evaluation project conducted under a written research/evaluation agreement approved in writing by a program administrator (other than the individual conducting the research/ evaluation) designated by theCHO; or
    • By an institution for use in a research/evaluation project conducted under a written research/evaluation agreement approved in writing by a program administrator designated by the CHO.

    A written research/evaluation agreement must:

    • Establish rules and limitations for the processing and security of PII in the course
      of the research/evaluation;
    • Provide for the return or proper disposal of all PII at the conclusion of theresearch/
      evaluation;
    • Restrict additional use or disclosure of PII, except where required by law; and
    • Require that the recipient of data formally agree to comply with all terms and conditions
      of the agreement.

    A written research/evaluation agreement is not a substitute for approval of a research project by an Institutional Review Board, Privacy Board, or other applicable human subject’s protection institution.

    Any research/evaluation on the nature and patterns of homelessness (at the CoC-wide level) that uses PII HMIS data will take place only on the basis of specific agreements between researchers and the entity that administers the HMIS. These agreements must be approved by the Executive Committee of the Housing Forward CoC and must reflect adequate standards for the protection of confidentiality of data.

    Disclosures for law enforcement purposes. A CHO may, consistent with applicable law and standards of ethical conduct, disclose PII for a law enforcement purpose to a law enforcement official under any of the following circumstances:

    • In response to a lawful court order, court-ordered warrant, subpoena or summons issued by a judicial officer, or a grand jury subpoena; HMIS Compliance Document
    • If the law enforcement official makes a written request for protected personal information that:
      • Is signed by a supervisory official of the law enforcement organization seeking the PII;
      • States that the information is relevant and material to a legitimate law enforcement investigation;
      • Identifies the PII sought;
      • Is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and
      • States that de-identified information could not be used to accomplish the purpose of the disclosure.
    • If the CHO believes in good faith that the PII constitutes evidence of criminal conduct that occurred on the premises of the CHO;
    • In response to a verbal request for the purpose of identifying or locating a suspect, fugitive, material witness or missing person and the PII disclosed consists only of name, address, date of birth, place of birth, Social Security Number, and distinguishing physical characteristics; or
    • If the official is an authorized federal official seeking PII for the provision of protective services to the President or other persons authorized by 18 U.S.C. 3056, or to foreign heads of state or other persons authorized by 22 U.S.C. 2709(a)(3), or for the conduct of investigations authorized by18 U.S.C. 871 and 879 (threats against the President and others); and the information requested is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought.

     

  5. IV. Privacy Requirements

    All CHOs involved with the Housing Forward HMIS and/or CAS must comply with the privacy requirements described in this Notice with respect to:

    1. Data collection limitations;
    2. Data quality;
    3. Purpose and use limitations;
    4. Openness;
    5. Access and correction; and
    6. Accountability.

    A CHO must comply with federal, state, and local laws that require additional confidentiality protections. All additional protections must be described in the CHO’s privacy notice. A CHO must comply with all privacy protections in this Notice and with all additional privacy protections included in its privacy notice, where applicable.

    A CHO may maintain a common data storage medium with another organization (including but not limited to another CHO) that includes the sharing of PII. When PII is shared between organizations, responsibilities for privacy may reasonably be allocated between the organizations. Organizations sharing a common data storage medium and PII may adopt differing privacy policies as they deem appropriate, administratively feasible, and consistent with this Policy, which allows for the de- duplication of clients at-risk of or experiencing homelessness at the CoC level.

  6. V. Collection Limitation

    A CHO may collect PII only when appropriate to the purposes for which the information is obtained or when required by law. A CHO must collect PII by lawful and fair means and, where appropriate, with the knowledge of the individual. A CHO must post a sign at each intake desk (or comparable location) that explains generally the reasons for collecting this information (Housing Forward HMIS Privacy Notice). Consent of the individual for data collection may be assumed when the Housing Forward Privacy Notice is properly displayed according to this Policy.

  7. VI. Data Quality

    PII collected by a CHO must be relevant to the purpose for which it is to be used. To the extent necessary for those purposes, PII should be accurate, complete, and timely, as defined by the CoC. A CHO must develop and implement a plan to dispose of, or remove identifiers from, PII that is not in current use seven years after the PII was created or last changed (unless a statutory, regulatory, contractual, or other requirement mandates longer retention).

  8. VII. Purpose Specification and Use Limitation

    A CHO may use or disclose PII only if the use or disclosure is allowed by this Policy. A CHO may assume consent for all uses and disclosures specified in this Policy and for uses and disclosures determined by the CHO to be compatible with those specified in this Policy. This Policy limits the disclosure of PII to the minimum necessary to accomplish the purpose of the disclosure. Uses and disclosures not specified in this Notice can be made only with the consent of the client or when required by law.

    A CHO processing PII for the purposes of the Housing Forward HMIS and/or CAS will agree to additional restrictions on the use or disclosure of the client’s PII at the request of the client, where it is reasonable to do so. This can include, but is not limited to, the following additional restrictions:

    1. Entering client PII into the Housing Forward HMIS so that it is not shared with any other CHO;or
    2. Using de-identified client information when coordinating services through the Housing ForwardCAS.

    A CHO, in the exercise of professional judgment, will communicate with a client who has requested additional restrictions, when it is reasonable to agree to these and alternatives in situations where it is not reasonable.

    A CHO must adhere to this Policy describing its practices for the processing of PII and must provide a copy of this Policy to any individual upon request. If a CHO maintains a public web page, the CHO must post the current version of this Policy on the web page. A CHO must post the Housing Forward Privacy Notice stating the availability of this Policy to any individual who requests a copy.

    This Policy may be amended at any time and amendments may affect PII obtained by a CHO before the date of the change. An amendment to this Policy regarding use or disclosure will be effective with respect to information processed before the amendment, unless otherwise stated.

    CHOs are obligated to provide reasonable accommodations for persons with disabilities throughout the data collection process. This may include but is not limited to, providing qualified sign language interpreters, readers or materials in accessible formats such as Braille, audio, or large type, as needed by the individual with a disability. See 24 CFR 8.6; 28 CFR 36.303. Note: This obligation does not apply to CHOs who do not receive federal financial assistance and who are also exempt from the requirements of Title III of the Americans with Disabilities Act because they qualify as ‘‘religious entities’’ under that Act.

    In addition, CHOs that are recipients of federal financial assistance shall provide required information in languages other than English that are common in the community, if speakers of these languages are found in significant numbers and come into frequent contact with the program. See HUD Limited English Proficiency Recipient Guidance published on December 18, 2003 (68 FR 70968).

  9. VIII. Access and Correction

    In general, a CHO must allow an individual to inspect and to have a copy of any PII about the individual. A CHO must offer to explain any information that the individual may not understand. A CHO must consider any request by an individual for correction of inaccurate or incomplete PII pertaining to the individual. A CHO is not required to remove any information but may, in the alternative, mark information as inaccurate or incomplete and may supplement it with additional information.

    A CHO may reserve the ability to rely on the following reasons for denying an individual inspection or copying of the individual’s PII:

    1. Information compiled in reasonable anticipation of litigation or comparableproceedings;
    2. Information about another individual (other than a health care or homelessprovider);
    3. Information obtained under a promise of confidentiality (other than a promise from a health care or homeless provider) if disclosure would reveal the source of the information;or
    4. Information, the disclosure of which would be reasonably likely to endanger the life or physical safety of any individual.

    A CHO can reject repeated or harassing requests for access or correction. A CHO that denies an individual’s request for access or correction must explain the reason for the denial to the individual and must include documentation of the request and the reason for the denial as part of the PII about the individual.

  10. IX. Accountability

    A CHO must establish a procedure for accepting and considering questions or complaints about this Policy. A CHO must require each member of its staff (including employees, volunteers, affiliates, contractors and associates) to sign a confidentiality agreement that acknowledges receipt of a copy of this Policy and that pledges to comply with this Policy.

  11. Appendix A

    This appendix addresses special considerations for Runaway and Homeless Youth (RHY) Program service providers, per the RHY Program HMIS Manual.

  12. III. Special Consideration for RHY-Funded Programs

    In consideration of the guidance laid out in the RHY Program HMIS Manual, RHY-funded grantees shall enter data into the Housing Forward HMIS and/or CAS for youth served and seeking services that will not be shared with any other CHO, unless the grantee receives written consent from the youth or parent / legal guardian of the youth served that allows the disclosure of the youth’s PII for the permissible purposes laid out in this Policy.

    are allowed to be based on individual youth data, but only if such data are de-identified in ways that preclude disclosing information on identifiable youth;

    1. Youth served by a Runaway and Homeless Youth grantee shall have the right to review their records; to correct a record or file a statement of disagreement; and to be apprised of the individuals who have reviewed their records;
    2. The Department of Health and Human Services (HHS) policies regarding confidential information and experimentation and treatment shall not apply if HHS finds that state law is more protective of the rights of youth;
    3. Procedures shall be established for the training of RHY program staff in the protection of these rights and for the secure storage of records. 45 CFR §1351.21.

  13. IV. Special Consideration for RHY-Funded Programs

    In consideration of the guidance laid out in the RHY Program HMIS Manual, RHY-funded grantees shall enter data into the Housing Forward HMIS and/or CAS for youth served and seeking services that will not be shared with any other CHO, unless the grantee receives written consent from the youth or parent / legal guardian of the youth served that allows the disclosure of the youth’s PII for the permissible purposes laid out in this Policy