Agencies are required to have this notice available for client's to review freely. The PDF of the privacy notice is here.
It is recommended to have a privacy policy on hand in case management/intake offices, and on boards where clients are open to review it (such as a lobby).
It is also required that agencies link to this policy or post a PDF of the policy on their agency website.
Homeless Management Information System (HMIS) Standard Agency Privacy Policy Notice (effective June 1, 2018)
THIS NOTICE DESCRIBES HOW INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED.
PLEASE REVIEW IT CAREFULLY.
-
Introduction and Applicability
This Notice describes the Privacy Policy of the City of Chicago Homeless Management Information System (“HMIS”). All Chicago, known as the HMIS Lead Agency (“HMIS Lead”), administers HMIS on behalf of Chicago Continuum of Care (“CoC”), and is governed by the CoC Board of Directors (“BoD”) through the “HMIS Committee”. The CoC is a local body comprised of various stakeholders invested in ending homelessness in Chicago, and may include but is not limited to: nonprofit homeless providers, victim service providers, faith based organizations, local government, businesses, advocates, public housing agencies, school district and city colleges, social service providers, mental health agencies, hospitals, universities, affordable housing developers, law enforcement, organizations that serve homeless and formerly homeless veterans including the Veterans Administration (VA), and homeless and formerly homeless persons and families.
Not all CoC stakeholders have direct access to HMIS. Throughout the CoC, there are certain agencies, usually the service provider agencies that are directly interacting with homeless clients, that actively use and contribute to the HMIS. Any agency with access to the HMIS is required to sign an Agency Partnership agreement and is known as a “participating agency”. All HMIS Lead personnel (including employees, volunteers, affiliates, contractors and associates), and all participating agencies and their personnel, are required to comply with this notice. Collectively, the HMIS Lead and all participating agencies make up the Chicago HMIS Collaborative (“Collaborative”, “we”, or “us”). All personnel in the Chicago HMIS Collaborative with access to HMIS must receive and acknowledge receipt of a copy of this Notice, agree in writing to comply with it, and receive training on this Privacy Policy before being given access to HMIS.
This Privacy Policy applies to all PII that is collected and maintained in the Chicago HMIS, including electronic and hard copies derived from the HMIS.
-
Purpose and Overview
To comply with federal, state, local, and funder requirements, information about you and your dependents that you provide, and the services that are provided, is required to be collected in the HMIS. When you seek assistance, it is assumed that you are consenting (“inferred consent”) to the use of the HMIS to store this information. You have the right to explicitly refuse the collection of this information, and participating agencies are not permitted to deny you services for this reason; however, this may severely impact the ability of any participating agency throughout the Collaborative to qualify you for certain types of assistance or to meet your needs.
Version 2.0 Effective 06.01.2018
Data collection should not be confused with data sharing (“disclosure”, as defined in section D). Participating agencies are required to provide you with an opportunity to consent to certain disclosure of your information, either in writing or electronically. If you consent to the disclosure of your information, you enhance the ability of the Collaborative to assess your specific needs and to coordinate delivery of services to you.
In general:
-
The privacy practices described in this Notice cover all your Personally Identifiable Information (“PII”) that is collected in the Chicago HMIS. “PII” is defined any information maintained by or for a Covered Homeless Organization about a living homeless client or homeless individual that: (1) identifies, either directly or indirectly, a specific individual;
(2) can be manipulated by a reasonably foreseeable method to identify a specific individual; or (3) can be linked with other available information to identify a specific individual.
-
Federal law may require participating agencies to have their own agency‐specific privacy policies. Information entered and accessed by the Collaborative may therefore also be covered by additional, agency‐specific privacy policies. Participating agencies may be more restrictive in their privacy policies, but may not be less restrictive than this Privacy Policy. In accordance with federal law, all participating agencies are required to post a sign at their intake desks, offices, or website, if applicable, explaining the reasons information is requested.
-
The CoC and the HMIS Lead reserve the right to amend this Privacy Policy at any time. It is possible that an amendment may affect PII that we obtained before the effective date of the amendment. We will maintain a record of the changes made in amendments and post new versions of this Privacy Policy on the website located at: https://hmis.allchicago.org/hc/en-us/categories/115000933426-Privacy-Policy-and- Client-Consent-Form. Any amendment will be posted as a draft at least 30 days prior to taking effect.
-
Every adult client and emancipated minor must provide his or her consent before his or her information can be shared within the Collaborative.
-
Adults may not provide consent on behalf of other adults.
-
In the case of dependents under the age of 18, parental or guardian (if you consider yourself responsible) consent must be obtained. Minors (persons less than 18 years old) may not consent to share information and their information will not be shared except with the consent of a responsible family member.
-
In the case of our telephone hotline, verbal consent to share your information is acceptable but only for purposes of referring you to a participating agency in the Collaborative.
-
-
The Collaborative strives to collect only information that is relevant to the purposes described in Part C. below. To the extent necessary for those purposes, we seek to maintain only information that is accurate, complete, and timely. We may implement a plan to dispose of information not in current use six years after the information was created or last changed. As an alternative to disposal, we may choose to remove identifiers from the information so that the data can be maintained for analysis purposes.
Services are provided to any person or family regardless of age, gender, religion, disability, nationality, sexual orientation and race, ethnic or cultural group.
-
-
How and Why the Chicago HMIS Collaborative collects your PII
In addition to obtaining information directly from persons seeking services from participating agencies, participating agencies may also obtain information about those seeking services from:
-
Other individuals who are accompanying a person seeking services, such as a guardian, caretaker, or advocate;
-
Referring organizations and/or service providers;
-
Law enforcement entities.
The Collaborative collects and maintains PII for the following purposes:
-
To provide or coordinate services for you;
-
To locate other programs that may be able to assist you;
-
For functions related to payment or reimbursement for services provided by or on behalf of the Chicago HMIS Collaborative;
-
To carry out administrative functions, including legal, audit, personnel, oversight, contract monitoring, program evaluation, and other management functions;
-
To comply with government and funder reporting obligations;
-
For data analysis, and community reporting purposes, including reporting to the Chicago CoC to inform policy decisions;
-
For academic research and
-
When required by law.
-
-
Use and disclosure of your PII
For purposes of this Notice, the terms “use” and “disclosure” are defined as follows:
-
Use” means, with respect to PII, the sharing, employment, application, utilization, examination, or analysis of such information internally within the HMIS participating agency that maintains such information or within the HMIS Lead.
-
“Disclosure” means, with respect to PII, the release, sharing, transfer, provision of access to, or divulging of information to an organization outside the HMIS participating agency holding the information or outside the HMIS Lead.
-
Your PII may be used or disclosed with your consent for the following reasons:
-
To provide or coordinate services for you and your family to help you end your homelessness. Participating agencies may use or disclose your information to locate suitable services or housing, to conduct referrals and assessments, to determine program eligibility, and to otherwise collaborate to address your specific needs and circumstances. Such uses and disclosures may include but not be limited to uses and dislcosures within the HMIS system among participating agencies that have access to the HMIS system and uses and disclosures at conference meetings for the purposes of finding and/or coordinating services for an individual.
-
-
Your PII may be used or disclosed without your consent for the following reasons:
-
For functions related to payment or reimbursement for services provided by or on behalf of the Collaborative;
-
To carry out administrative functions, such as legal, audit, personnel, oversight, contract monitoring, program evaluation, and other management functions;
-
To carry out maintenance and operation of the Chicago HMIS;
-
To create reports for the CoC that include your data but only in a manner in which your identity is not disclosed (this type of data is sometimes referred to as “anonymized” or “de-identified” data);
-
By the HMIS Lead; provided that the HMIS Lead enters into a Data Sharing Agreement with the party to which such information will be disclosed that provides reasonable confidentiality protections for the disclosed information;
-
When required by law to the extent that use or disclosure complies with and is limited to the requirements of the law;
-
To avert a serious threat to health or safety if:
-
It is believed in good faith that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public, and
-
The use or disclosure is made to a person reasonably able to prevent or lessen the threat, including the target of the threat.
-
-
To report about an individual who is believed to be a victim of abuse, neglect, or domestic violence to a governmental authority (including a social service or protective services agency) authorized by law to receive reports of abuse, neglect or domestic violence, under any of the following circumstances:
-
Where the disclosure is required by law and the disclosure complies with and is limited to the requirements of the law;
-
If the individual agrees to the disclosure; or
-
To the extent that the disclosure is expressly authorized by statute or regulation; and it is believed the disclosure is necessary to prevent serious harm to the individual or other potential victims; or if the individual is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents that the PPI for which disclosure is sought is not intended to be used against the individual and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.
A participating agency that makes a permitted disclosure about victims of abuse, neglect or domestic violence must promptly inform the individual that a disclosure has been or will be made, except if:
-
The participating agency, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or
-
The participating agency would be informing a personal representative (such as a family member or friend), and the participating agency reasonably believes the personal representative is responsible for the abuse, neglect or other injury, and that informing the personal representative would not be in the best interests of the individual as determined by the participating agency, in the exercise of professional judgment.
-
-
To a law enforcement official for a law enforcement purpose (if consistent with applicable law and standards of ethical conduct) under any of the following circumstances:
-
i. In response to a lawful court order, court‐ordered warrant, subpoena or summons
issued by a judicial officer, or a grand jury subpoena.
-
If the law enforcement official makes a written request that:
-
Is signed by a supervisory official of the law enforcement agency seeking the information; and
-
States that the information is relevant and material to a legitimate law enforcement investigation; and
-
Identifies the specific information sought; and
-
Is specific and limited in scope to the extent that is reasonably practical, considering the purpose for which the information is sought; and
-
States that de‐identified (anonymized) information could not be used to accomplish the purpose of the disclosure.
-
-
If it is necessary to report criminal conduct that occurred on the premises of the agency where the services are provided.
-
In response to an oral request for the purpose of identifying or locating a suspect, fugitive, material witness or missing person and the PPI disclosed consists only of name, address, date of birth, place of birth, Social Security Number, and distinguishing physical characteristics; or
-
If (1) the official is an authorized federal official seeking personally identifiable information for the provision of protective services to the President or other persons authorized by 18 U.S.C. 3056, or to foreign heads of state or other persons authorized by 22 U.S.C. 2709(a)(3), or for the conduct of investigations authorized by 18 U.S.C. 871 and 879 (threats against the President and others); and (2) the information requested is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought.
-
For academic research purposes, release of your personally identifiable information will be allowed, only if the research is:
-
Conducted by an individual or institution that has a formal relationship with a participating agency in the Chicago HMIS Collaborative if the research is to be conducted by either:
-
an individual employed by or affiliated with the organization for use in a research project conducted under a written research agreement approved in writing by an Agency Executive (other than the individual conducting the research); or
-
an institution for use in a research project conducted under a written research agreement approved in writing by the Agency’s Executive; and
-
-
The formal relationship is defined in a written research agreement that:
-
establishes rules and limitations for the processing and security of PII during the research;
-
provides for the return or proper disposal of all PII at the conclusion of the research;
-
restricts additional use or disclosure of PII, except where required by law; and
-
requires that each recipient of PII formally agrees to comply with all terms and conditions of the agreement; and
-
specifies that only aggregate data will appear in any publication or research report, and that no PII will be released by the researcher.
-
Please note that the Chicago HMIS Collaborative requires an academic researcher/ research organization to obtain approval from an Institutional Review Board, Privacy Board or other applicable human subjects protection institution, prior to any release of data. (A written research agreement that complies with all the requirements listed above does not constitute a substitute for approval from one of these institutions.)
-
-
Your Rights
Obtain an electronic version or paper copy of your information/Ask to correct or amend your information
-
You have the right to inspect and obtain a copy of your information for as long as it is kept in the HMIS, except for case notes and for information compiled in reasonable anticipation of, or for use in, a legal proceeding.
-
You have the right to request correction of your information in the HMIS if your information is inaccurate or incomplete. If agreed that the information is inaccurate or incomplete, it may be corrected or supplemented with additional information.
i. The participating agency that you are working with must respond to your request within a reasonable time frame (up to 5 business days).
-
Your request for inspection or to obtain a copy of PII may be denied if:
-
the information was compiled in reasonable anticipation of litigation or comparable proceedings;
-
the information is about another individual;
-
the information was obtained under a promise of confidentiality and the disclosure would reveal the source of the information; or
-
disclosure of the information would be reasonably likely to endanger the life or physical safety of any individual.
Requests method of communication
-
-
You can request us to contact you in a specific way. We will make every effort to honor your request and communicate with you in a familiar language and use communication technology to address any difficulties in hearing and sight.
Obtain a list
-
Obtain a copy of this Privacy Notice
-
You can request a paper copy of this Notice at any time. A copy of the Notice will always be made available on the Chicago CoC website and by the Collaborative and will never be denied.
Request to revoke your information from being shared
-
As described in this Notice, we need your written consent to disclose your information within the Collaborative. You have the right to revoke your consent and request that your information not be shared at any time. Please note that for the purposes mentioned in Section D(2) we are not required to agree to your request.
-
-
File a Complaint if you feel your rights are violated:
Protecting your information is important to us. If you feel we have violated your rights, we need to know. We will not retaliate against you for filing a complaint.
You may file a complaint with the Agency you are working with, following their procedures that are in place.
You may also file a complaint with the HMIS Lead at: All Chicago Making Homelessness History, 651 W. Washington, Ste 504, IL 60661, by sending an email to helpdesk@allchicago.org.