Skip to content

Privacy Policy

Comments
THIS NOTICE DESCRIBES HOW INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED. PLEASE REVIEW IT CAREFULLY.

A. Introduction and Applicability

This Notice describes the Privacy Policy of the City of Chicago Homeless Management Information System (“HMIS”). All Chicago, known as the HMIS Lead Agency (“HMIS Lead”), administers HMIS on behalf of Chicago Continuum of Care (“CoC”), and is governed by the CoC Board of Directors (“BoD”) through the “HMIS Committee”. The CoC is a local body comprised of various stakeholders invested in ending homelessness in Chicago, and may include but is not limited to: nonprofit homeless providers, victim service providers, faith based organizations, local government, businesses, advocates, public housing agencies, school district and city colleges, social service providers, mental health agencies, hospitals, universities, affordable housing developers, law enforcement, organizations that serve homeless and formerly homeless veterans including the Veterans Administration (VA), and homeless and formerly homeless persons and families.
Not all CoC stakeholders have direct access to HMIS. Throughout the CoC, there are certain agencies, usually the service provider agencies that are directly interacting with homeless clients, that actively use and contribute to the HMIS. Any agency with access to the HMIS is required to sign an Agency Partnership agreement and is known as a “participating agency”. All HMIS Lead personnel (including employees, volunteers, affiliates, contractors and associates), and all participating agencies and their personnel, are required to comply with this notice. Collectively, the HMIS Lead and all participating agencies make up the Chicago HMIS Collaborative (“Collaborative”, “we”, or “us”). All personnel in the Chicago HMIS Collaborative with access to HMIS must receive and acknowledge receipt of a copy of this Notice, agree in writing to comply with it, and receive training on this Privacy Policy before being given access to HMIS.
This Privacy Policy applies to all personal information that is collected and maintained in the Chicago HMIS, including electronic and hard copies derived from the HMIS.

B. Purpose and Overview

To comply with federal, state, local, and funder requirements, information about you and your dependents that you provide, and the services that are provided, is required to be collected in the HMIS. When you seek assistance, it is assumed that you are consenting (“inferred consent”) to the use of the HMIS to store this information. You have the right to explicitly refuse the collection of this information, and participating agencies are not permitted to deny you services for this reason; however, this may severely impact the ability of any participating agency throughout the Collaborative to qualify you for certain types of assistance or to meet your needs.
Data collection should not be confused with data sharing (“disclosure”, as defined in section D). Participating agencies are required to provide you with an opportunity to consent to certain disclosure of your information, either in writing or electronically. If you consent to the disclosure of your information, you enhance the ability of the Collaborative to assess your specific needs and to coordinate delivery of services to you.

In general:

    • The privacy practices described in this Notice cover all your Personally Identifiable Information (“PII”) that is collected in the Chicago HMIS. “PII ”is defined as: Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. Further, PII is defined as information:
      • that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.); or
      • by which a specific individual can be identified if the data relates to other data elements, i.e., indirect identification. (These data elements may include a combination of gender, race, birth date, gehic indicator, and other descriptors.)
    • Federal law may require participating agencies to have their own agency‐specific privacy policies. Information entered and accessed by the Collaborative may therefore also be covered by additional, agency‐specific privacy policies. Participating agencies may be more restrictive in their privacy policies, but may not be less restrictive than this Privacy Policy. In accordance with federal law, all participating agencies are required to post a sign at their intake desks, offices, or website, if applicable, explaining the reasons information is requested.
    • This Privacy Policy is intended to be consistent with requirements under the following Federal statutes and regulations:
      • the HMIS Data and Technical Standards and subsequent HMIS notices issued by the Department of Housing and Urban Development (HUD) and their federal partners through the U.S. Interagency Council on Homelessness (USICH);
      • 45 CFR, Part 160 and Subparts A and E of Part 164 ‐ the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 and subsequent amendments (HIPAA);
      • 42 CFR Part 2 (Confidentiality of Alcohol and Drug Abuse Patient Records);
      • Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110/)
      • Runaway and Homeless Youth Act (RHY Act);
      • Family Educational Rights and Privacy Act (FERPA).
    This Privacy Policy also is intended to be consistent with requirements outlined in applicable state and local laws.
    • The CoC and the HMIS Lead reserve the right to amend this Privacy Policy at any time. It is possible that an amendment may affect personal information that we obtained before the effective date of the amendment. We will maintain a record of the changes made in amendments and post new versions of this Privacy Policy on the website located at http://www.allchicago.org/ HMIS. Any amendment will be posted as a draft at least 30 days prior to taking effect.
    • Every adult client and emancipated minor (person at least 18 years old) must provide his or her consent before his or her information can be shared within the Collaborative.
      • Adults may not provide consent on behalf of other adults.
      • In the case of dependents under the age of 18, parental or guardian (if you consider yourself responsible) consent must be obtained. Minors (persons less than 18 years old) may not consent to share information and their information will not be shared except with the consent of a responsible family member.
      • In the case of our telephone hotline, verbal consent to share your information is acceptable but only for purposes of referring you to a participating agency in the Collaborative.
    • The Collaborative strives to collect only information that is relevant to the purposes described in Part C. below. To the extent necessary for those purposes, we seek to maintain only information that is accurate, complete, and timely. We may implement a plan to dispose of information not in current use six years after the information was created or last changed. As an alternative to disposal, we may choose to remove identifiers from the information so that the data can be maintained for analysis purposes.
    Services are provided to any person or family regardless of age, gender, religion, disability, nationality, sexual orientation and race, ethnic or cultural group.

    C. How and Why the Chicago HMIS Collaborative collects your Personal Information

    In addition to obtaining information directly from persons seeking services from participating agencies, participating agencies may also obtain information about those seeking services from:
    • Other individuals who are accompanying a person seeking services, such as a guardian, caretaker, or advocate;
    • Referring organizations and/or service providers;
    • Law enforcement entities.
    The Collaborative collects and maintains personal information for the following purposes:
    • To provide or coordinate services for you;
    • To locate other programs that may be able to assist you;
    • For functions related to payment or reimbursement for services provided by or on behalf of the Chicago HMIS Collaborative;
    • To carry out administrative functions, including legal, audit, personnel, oversight, contract monitoring, program evaluation, and other management functions;
    • To comply with government and funder reporting obligations;
    • For data analysis, and community reporting purposes, including reporting to the Chicago CoC to inform policy decisions;
    • For academic research and
    • When required by law.

    D. Use and disclosure of your Personal Information

For purposes of this Notice, the terms “use” and “disclosure” are defined as follows:
      1. Use” means, with respect to PII, the sharing, employment, application, utilization, examination, or analysis of such information internally within the HMIS participating agency that maintains such information or within the HMIS Lead.
      2. “Disclosure” means, with respect to PII, the release, sharing, transfer, provision of access to, or divulging of information to an organization outside the HMIS participating agency holding the information or outside the HMIS Lead.
  • Your personal information may be used or disclosed with your consent for the following reasons:
    • To provide or coordinate services for you and your family to help you end your homelessness. With your consent, participating agencies may disclose your information to locate suitable services or housing, to conduct referrals and assessments, to determine program eligibility, and to otherwise collaborate to address your specific needs and circumstances;
    • For purposes of data integration with other systems or data warehousing.
  • Your personal Information may be used or disclosed without your consent for the following reasons:
    • For functions related to payment or reimbursement for services provided by or on behalf of the Collaborative;
    • To carry out administrative functions, such as legal, audit, personnel, oversight, contract monitoring, program evaluation, and other management functions;
    • To carry out maintenance and operation of the Chicago HMIS;
    • To create reports for the CoC that include your data but only in a manner in which your identity is not disclosed (this type of data is sometimes referred to as “anonymized” or “de-identified” data);
    • When required by law to the extent that use or disclosure complies with and is limited to the requirements of the law;
    • To avert a serious threat to health or safety if:
      1. It is believed in good faith that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public, and
      2. The use or disclosure is made to a person reasonably able to prevent or lessen the threat, including the target of the threat.
    • To report about an individual who is believed to be a victim of abuse, neglect, or domestic violence to a governmental authority (including a social service or protective services agency) authorized by law to receive reports of abuse, neglect or domestic violence, under any of the following circumstances:
      1. Where the disclosure is required by law and the disclosure complies with and is limited to the requirements of the law;
      2. If the individual agrees to the disclosure;
      3. To the extent that the disclosure is expressly authorized by statute or regulation; and
        1. It is believed the disclosure is necessary to prevent serious harm to the individual or other potential victims; or
        2. If the individual is unable to agree because of incapacity, then a law enforcement or other public official authorized to receive the information for which disclosure is sought must agree that the information is not intended to be used against the individual, and must represent that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual can agree to the disclosure; and

        the participating agency making the report promptly informs the individual who is believed to be the victim, or a personal representative, that a disclosure has been or will be made, except if:

        1. In the exercise of professional judgment, it is believed that informing the individual would place the individual at risk of serious harm, or
        2. It would be informing a personal representative (such as a family member or friend) and reasonably believes that the personal representative is responsible for the abuse, neglect or other injury; such that informing the personal representative would not be in the best interests of the individual.
    • To a law enforcement official for a law enforcement purpose (if consistent with applicable law and standards of ethical conduct) under any of the following circumstances:
      1. In response to a lawful court order, court‐ordered warrant, subpoena or summons issued by a judicial officer, or a grand jury subpoena.
      2. If the law enforcement official makes a written request that:
        1.  Is signed by a supervisory official of the law enforcement agency seeking the information; and
        2. States that the information is relevant and material to a legitimate law enforcement investigation; and
        3. Identifies the specific information sought; and
        4. Is specific and limited in scope to the extent that is reasonably practical, considering the purpose for which the information is sought; and
        5. States that de‐identified (anonymized) information could not be used to accomplish the purpose of the disclosure.
          If the law enforcement official will not submit a written request which satisfies the above conditions, the agency from which information was requested, will resist, in judicial proceedings if necessary, any efforts to obtain access to information pertaining to its clients.
      3. If it is necessary to report criminal conduct that occurred on the premises of the agency where the services are provided.
    • To a law enforcement official for a law enforcement purpose:
      1. for the provision of protective services to the President or other persons authorized by 18 U.S.C. 3056, or to foreign heads of state or other persons authorized by 22 U.S.C. 2709(a)(3); or
      2. for the conduct of investigations authorized by 18 U.S.C. 871 and 879 (threats against the President and others); or
      3. to conduct intelligence, counterintelligence, and other national security activities under the National Security Act (45 CFR 164.512(k)(2)); and
        if the information requested is specific and limited in scope to the extent reasonably practicable considering the purpose for which it is sought.
    • For academic research purposes, release of your PII (personally identifiable information) will be allowed, only if the research is:
        1. an individual employed by or affiliated with the organization for use in a research project conducted under a written research agreement approved in writing by an Agency Executive (other than the individual conducting the research); or
        2. an institution for use in a research project conducted under a written research agreement approved in writing by the Agency’s Executive;Conducted by an individual or institution that has a formal relationship with a participating agency in the Chicago HMIS Collaborative if the research is to be conducted by either:
          and
      2. The formal relationship is defined in a written research agreement that:
        1.  establishes rules and limitations for the processing and security of PII during the research;
        2. provides for the return or proper disposal of all PII at the conclusion of the research;
        3. restricts additional use or disclosure of PII, except where required by law; and
        4. requires that each recipient of PII formally agrees to comply with all terms and conditions of the agreement; and
        5. specifies that only aggregate data will appear in any publication or research report, and that no PII will be released by the researcher.
        1. Please note that the Chicago HMIS Collaborative requires an academic researcher/research organization to obtain approval from an Institutional Review Board, Privacy Board or other applicable human subjects protection institution, prior to any release of data. (A written research agreement that complies with all the requirements listed above does not constitute a substitute for approval from one of these institutions.)

E. Your Rights

Obtain an electronic version or paper copy of your information/Ask to correct or amend your information
    • You have the right to inspect and obtain a copy of your information for as long as it is kept in the HMIS, except for case notes and for information compiled in reasonable anticipation of, or for use in, a legal proceeding.
    • You have the right to request correction of your information in the HMIS if your information is inaccurate or incomplete. If agreed that the information is inaccurate or incomplete, it maybe corrected or supplemented with additional information.
      1. The participating agency that you are working with must respond to your request within a reasonable time frame (up to 5 business days).
    • Your request for inspection or to obtain a copy of personal information may be denied if:
      1.  the information was compiled in reasonable anticipation of litigation or comparable proceedings;
      2. the information is about another individual;
      3. the information was obtained under a promise of confidentiality and the disclosure would reveal the source of the information; or
      4. disclosure of the information would be reasonably likely to endanger the life or physical safety of any individual.
Requests method of communication
    • You can request us to contact you in a specific way. We will make every effort to honor your request and communicate with you in a familiar language and use communication technology to address any difficulties in hearing and sight.
Obtain a list
    • You can request a list of participating agencies in the Chicago HMIS Collaborative. This list will also be posted on the Chicago CoC website, www.allchicago.org.
Obtain a copy of this Privacy Notice
    • You can request a paper copy of this Notice at any time. A copy of the Notice will always be made available on the Chicago CoC website and by the Collaborative and will never be denied.
Request to revoke your information from being shared
    • As described in this Notice, we need your written consent to disclose your information within the Collaborative. You have the right to revoke your consent and request that your information not be shared at any time. Please note that for the purposes mentioned in Section D(2) we are not required to agree to your request.

F. File a Complaint if you feel your rights are violated:

Protecting your information is important to us. If you feel we have violated your rights, we need to know. We will not retaliate against you for filing a complaint.
    • You may file a complaint with the Agency you are working with, following their procedures that are in place.
    • You may also file a complaint with the HMIS Lead at: All Chicago Making Homelessness History, 651 W. Washington, Ste 504, IL 60661, by sending an email to hmis@allchicago.org, or by calling (773)599‐3822.