|
The HMIS Team held virtual training session this month. If you missed it, a recorded session is available! This policy will help participating agencies respond consistently when they receive requests for HMIS client records or client-related information.
The policy explains how to handle requests from clients, authorized third parties, agencies, attorneys, courts, government entities, Homelink/Coordinated Entry partners, and other requesters. It provides a clear process for verifying identity and authority, determining whether the request can be handled by the agency or must be routed to HMIS, CTH/CoC, Legal, or Security/Compliance, and documenting the final response.
The policy covers key request types, including:
- client record requests;
- client-authorized third-party disclosures;
- agency-owned and cross-agency records;
- Homelink / Coordinated Entry records;
- legal requests, subpoenas, affidavits, and certifications;
- privacy or security concerns involving PHI/PII, audit logs, metadata, or unsecured communication.
Before records are released, agencies must confirm requester identity, verify authority, review data ownership, apply minimum necessary standards, check for redaction or withholding needs, and use an approved secure delivery method.
The standard timeline is 5 business days for initial acknowledgment and 30 business days for a final outcome once the request is complete. Additional time may be needed for large requests, older records, cross-agency review, Homelink/CE approval, legal review, or security concerns.
This policy will help protect client privacy, reduce unauthorized disclosure risk, improve documentation, and give providers a practical tool for handling real client record request scenarios.
HMIS will provide a training session to walk agencies through the policy, request routing, common examples, secure delivery, and documentation steps.
| 
