Spill the Tea With the P&P
In this week’s review of the HMIS Policy and Procedure Manual, we will be discussing Privacy and Security. To ensure the confidentiality and safety of the clients we serve, HMIS must be administered and operated under high standards of data privacy and security.
The HMIS System Administrator and Partner Agencies are jointly responsible for ensuring that HMIS data processing capabilities, including the collection, maintenance, use, disclosure, transmission and destruction of data, comply with the HMIS privacy, security and confidentiality policies and procedures.
HMIS Operating Policies
HMIS Users and Partner Agencies must abide by all HMIS operational policies and procedures found in the HMIS Policies and Procedures Manual, the New Hampshire HMIS User Agreement, and the HMIS Agency Partner Agreement. Each user or Partner Agency violation will face successive consequences.
Examples of User and Partner agency Violations
Interactions with the HMIS Vendor
Emailing staff at the HMIS Vendor
Requesting and/or scheduling a meeting with the HMIS Vendor staff
Attending HMIS Vendor trainings
Participating in virtual platforms that are specific to the HMIS Vendor
Sharing username and password
Sharing consumer level data with agencies or persons that the consumer did not give permission to share with
Using consumer data to discriminate against a consumer or refuse services
Entering data in HMIS that makes a consumer pull as chronically homeless when they are not
There are repercussions to these violations including required privacy and security training, user license suspension, and notification to the HMIS Advisory Committee to determine further consequences.
Use and Disclosure of Personal Information
Personal information is collected and shared within the HMIS for many reasons. This data may be used to provide or coordinate services to individuals, to carry out administrative functions such as legal audits, personnel, and oversight, for research and statistical purposes, for academic research, or for law enforcement purposes.
Law Enforcement Purposes
If a requests made for a lawful court order, court-ordered warrant, subpoena or summons issued by a judicial officer or a grand jury subpoena, the request must be communicated to ICA. Data of this kind cannot be released until ICA gives permission to do so.
If you are unsure or have any questions regarding this policy, please reach out to your System Administrators at the Help Desk.
To learn more about the HMIS Policy and Procedure Manual, click this link: Vermont HMIS Governance - HMIS Knowledge Base
