HMIS Personal Protected Information Policy
Confidentiality
A. The Agency will uphold relevant Federal and State confidentiality regulations and laws that protect client records, and the Agency will only release confidential client records with written consent by the client, or the client‘s guardian, unless otherwise provided for in the regulations or laws. A client is anyone who receives services from the Agency and a guardian is one legally in charge of the affairs of a minor or of a person deemed incompetent.
1. The Agency will abide specifically by Federal confidentiality regulations as contained in the Code of Federal Regulations, 42 CFR Part 2, regarding disclosure of alcohol and/or drug abuse records. In general terms, the Federal regulation prohibits the disclosure of alcohol and/or drug abuse records unless disclosure is expressly permitted by written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is not sufficient for this purpose. The Agency understands that Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patients.
2. The Agency will abide specifically with the Health Insurance Portability and Accountability Act of 1996 and corresponding regulations passed by the U.S. Department of Health and Human Services. In general, the regulations provide consumers with new rights to control the release of medical information, including advance consent for most disclosures of health information, the right to see a copy of health records, the right to request a correction to health records, the right to obtain documentation of disclosures of information may be used or disclosed. The current regulation provides protection for paper, oral, and electronic information.
3. The Agency will abide specifically by Georgia State law, which in general terms requires an individual to be informed that any and all medical records she/he authorizes to be released, whether related to physical or mental health, may include information indicating the presence of a communicable or venereal disease. The Agency is required to inform the individual that these records may include, but are not limited to the inclusion of information on diseases such as hepatitis, syphilis, gonorrhea, tuberculosis, and HIV/AIDS.
4. The Agency will provide a verbal explanation of the HMIS and arrange for a qualified interpreter or translator in the event that an individual is not literate in English or has difficulty understanding the consent form(s).
5. The Agency will not solicit or input information from clients into the HMIS unless it is essential to provide services or conduct evaluation or research.
6. The Agency will have signed authorization from the client to input client information into HMIS. The agency will not divulge any confidential information received from the HMIS to any organization or individual without proper written consent by the client unless otherwise permitted by relevant regulations or laws.
7. The Agency will ensure that all persons who are issued a User Identification and Password to the HMIS within that particular agency abide by this Partnership Agreement, including the confidentiality rules and regulations. The Agency will ensure that each person granted HMIS access at the Agency receives an HMIS manual. This manual will include information on how to use the HMIS as well as basic steps to ensure confidentiality. The Agency will be responsible for managing any of its own requirements that individual employees comply with HMIS confidentiality practices, such as having employees sign a consent confidentiality practices form and attend HMIS confidentiality training. It is understood that those granted Agency Administrator access within each HMIS agency must become a Certified HMIS Agency Administrator through training provided by HMIS.
B. The Agency agrees to maintain appropriate documentation of client consent or guardian-provided consent to participate in the HMIS.
1. The Agency understands that informed client consent is required before any basic identifying client information is entered into the HMIS. Informed client consent will be documented by completion of the standard HMIS client Authorization to Release and Exchange Basic Information for the HMIS form.
2. The Client Authorization form mentioned above, once completed, authorizes basic identifying client data to be entered into the HMIS, as well as non-confidential service transaction information. This authorization form permits basic client identifying information to be shared among all HMIS Member Agencies and non confidential service transactions with select HMIS Member Agencies based on relevance.
3. The Agency will incorporate an HMIS Clause into existing Agency Authorization for Release of Information form(s) if the Agency intends to input and share confidential client data with the HMIS. The Agency‘s modified Authorization for Release of Information form(s) will be used when offering a client the opportunity to input and share service information. The Agency will communicate to the client what information, beyond basic identifying data and non-confidential services will be shared if client consent is given. The Agency will communicate to the client that while the Agency can restrict information to be shared with select agencies, those other agencies will have access to the information and are expected to use the information professionally and to adhere to the terms of the HMIS Partnership Agreement. Agencies with whom information so shared are each responsible for obtaining appropriate consent before allowing further sharing of client records.
4. The Agency agrees to place all Client Authorization for Release of Information forms related to the HMIS in a file to be located at the Agency‘s business address and that such forms are made available to the Corporation for periodic audits. The Agency will retain these HMIS related Authorization for Release of Information forms for a period of 7 years, after which time the forms will be discarded in a manner that ensures client confidentiality is not compromised.
5. The Agency understands that in order to update, edit, or print a client‘s record, the Agency must have on file a current authorization from the client as evidenced by a completed standard HMIS Authorization to Release form pertaining to basic identifying data, and/or a modified Agency form with a HMIS clause pertaining to confidential information.
6. The Agency understands the Corporation does not require or imply that service be contingent upon a client‘s participation in the HMIS.
Participation in data collection, although optional, is a critical component of the community's ability to provide the most effective services and housing possible. Please understand that access to shelter and housing services is available without participation in data collection. The information gathered and prepared by the Agency will be included in a HMIS database of collaborating agencies (list available), and only to collaborating agencies, who have entered into an HMIS Agency Participation Agreement and shall be used to:
a) Produce a client profile at intake that will be shared by collaborating agencies
b) Produce anonymous, aggregate-level reports regarding use of services
c) Track individual program-level outcomes
d) Identify unfilled service needs and plan for the provision of new services
e) Allocate resources among agencies engaged in the provision of services
f) Provide individual case management
Information Collected
1. Identifying information (Name, birth date, social security number)
2. Demographic information (gender, race, residential information, family composition)
3. Medical records (except HIV/AIDS and alcohol and drug treatment), Psychological records and evaluations, vocational assessment, care coordinators recommendations and direct observations, employment status, etc.
4. Financial information (income verification, public assistance payments, food stamps)
5. HIV/AIDS diagnosis
6. Substance abuse diagnoses, treatment plan, progress in treatment, discharge.
This release can be revoked by the client at any time. The revocation must be signed and dated by the client. This consent is subject to revocation at any time, except to the extent that the Agency has already taken action in reliance on it. If not previously revoked, this consent terminates automatically 5 year after client‘s last treatment or discharge from the agency where the client was seeking services. These records are protected by federal, state, and local regulations governing confidentiality of client records and cannot be disclosed without client‘s written consent unless otherwise provided for in the regulations. Participation in data collection is optional, and clients are able to access shelter and housing services if they choose not to participate in data collection. Opting out does not delete information from the HMIS database, it hides the information from view. This information can still be disclosed in situations including court orders and academic research.
Jerusalem House reserves the right to change the terms of this notice and to make the new notice provision effective for all protected personal information that it maintains. If the terms of this notice are changed, the change will be noted in a dated addition to this policy and posted on the www.jerusalemhouse.org website.
Individuals may complain to Jerusalem House if they believe their privacy rights have been violated. Individuals will not be retaliated against for filing a complaint. Complaints may be sent to the address below:
Jerusalem House
Attn: HMIS Privacy
17 Executive Park Drive NE
Suite 290
Atlanta, GA 30329
For further information, contact the Jerusalem House administrative office at the address above or at (404) 350-1633.
Notice effective April 18, 2007