HMIS Privacy Statement

Jun 4, 2024

Privacy Notice for HMIS Reporting Programs

Effective 04/13/2022

A. What This Notice Covers

• This notice describes the privacy policy and practices of Community Access’s HMIS Reporting Programs. Our main office is located at 17 Battery Place, Suite 1326 New York, NY 10004.
• All personal and private information that is maintained in our HMIS Reporting programs is covered by the policy and practices described in this privacy notice. This policy does not cover personal or private information about participants that are covered by the HIPAA Privacy Rule.
• Personal or private information is any information that we maintain about a participant that allows identification of an individual directly or indirectly, can be manipulated by a reasonably foreseeable method to identify a specific individual, or can be linked to identify a specific participant.
• We adopted this policy because of the standards for Homeless Management Information Systems issued by the Department of Housing and Urban Development. We intend our policies and practices to be consistent with those standards. See 69 Federal Register 45888 (July 30, 2004).
• This notice tells our participants, our staff, and others how we process personal or private information. We follow the policy and practices described in this notice.
• We may amend this notice and change our policy or practices at any time. Amendments may affect private or personal information that we obtained before the effective date of the amendment.
•  We give a written copy of this privacy practice to any individual or participant who asks.
•  We maintain a copy of this policy on our website at https://www.communityaccess.org/hmis-privacy-notice

B. How and Why We Collect Personal or Private Information

• We collect personal or private information only when appropriate to provide services or for another specific purpose of our organization or when required by law. We may collect information for these purposes:
  • To provide or coordinate services to participants
  • To locate other programs that may be able to assist participants
  • For functions related to payment or reimbursement from others for services that we provide
  • To operate our organization, including administrative functions such as legal, audits, personnel, oversight and management functions
  • To comply with government reporting obligations
  • When required by law
  • We only use lawful and fair means to collect private or personal information
  • We normally collect private or personal information with the knowledge or consent of our participants. If you seek our assistance and provide us with private or personal information, we assume that you consent to the collection of information as described in this notice.
  • We post a sign at our intake desk or other location explaining the reasons we ask for personal information. The sign says:

“We collect private or personal information directly from you for reasons that are discussed in our privacy statement. We may be required to collect some private or personal information by law or by organizations that give us money to operate this program. Other private or personal information that we collect is important to run our programs, to improve services for homeless individuals, and to better understand the needs of homeless individuals. We only collect information that we consider to be appropriate.”

C. How We Use and Disclose Private or Personal Information

We may use or disclose private or personal information for activities described in this part of this notice.  Before we make any use or disclosure of your private or personal information that is not described here, we seek your consent first. We may or may not make any of these disclosures with your information. We assume that you consent to the use or disclosure of your private or personal information for the purposes described here and for other uses and disclosures that we determine to be compatible with these uses or disclosures:

• To provide or coordinate services to participants. 
• For functions related to payment or reimbursement for services.
• To carry our administrative functions such as legal, audits, personnel, oversight and management functions.
• To create de-identified (anonymous) information that can be used for research and statistical purposes without identifying participants.
• When required by law to the extent that use or disclosure complies with and is limited to the requirements of the law.
• To advert a serious threat to health or safety if;
  • we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a participant or the public, and
  • the use or disclosure is made to a person reasonably able to prevent or lessen the threat, including target of the threat, or
  • the participant’s treating psychiatrist or psychologist has determined that a participant presents a serious and imminent danger to an individual. The reasons for any such disclosures shall be fully documented in the record.
• To report about a participant we reasonably believe to be a victim of abuse, neglect or domestic violence to a governmental authority (including social service or protective services agency) authorized by law to receive reports of abuse, neglect or domestic violence
  • Under any of these circumstances
    • Where the disclosure is required by law and the disclosure complies with and is limited to the requirements of the law.
    • If the participant agrees to the disclosure, or
    • To the extent that the disclosure is expressly authorized by statute and regulation, and
      • If the participant is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents the private or personal information for which the disclosure is sought is not intended to be used against the participant and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the participant is able to agree on the disclosure.
    • When we make a permitted disclosure about a victim of abuse, neglect or domestic violence, we will promptly inform the participant who is the victim that a disclosure has been or will be made, except if:
      • We, in the exercise of professional judgement, believe informing the participant would place the participant at risk of serious harm, or
      • We would be informing a personal representative (such as a family member or friend) and we reasonably believe the personal representative is responsible for the abuse, neglect or other injury, and that informing the personal representative would not be in the best interests of the participant as we determine in the exercise of professional judgement.
    • For academic research purposesConducted by an individual or institution that has a formal relationship with Community Access if the research is conducted either:
      • By an individual employed by or affiliated with Community Access for use in a research project conducted under a written research agreement approved in writing by a designated Community Access program administrator (other than the individual conducting the research), or
      • By an institution for use in a research project conducted under a written research agreement approved in writing by a designated Community Access administrator, and
    • Any written research agreement:
      • Must establish rules and limitations for the processing and security of protected personal information in the course of the research.
      • Must provide for the return or proper disposal of all private or personal information at the conclusion of the research.
      • Must restrict additional use or disclosure of private or personal informational, except where required by law.
      • Must require that the recipient of the data formally agrees to comply with all terms and conditions of the agreement, and
      • Is not a substitute for approval (if appropriate) of a research project by an Institutional Review Board, Privacy Board or other applicable human subjects protection institution.
• To comply with government reporting obligations for homeless management information systems and for the oversight of compliance with homeless management information system requirements.
• To the mental hygiene legal service.
• To the Medical Review Board of the State Commission of Correction when such board has requested such information with respect to the death of a named person, or, with the consent of a participant when such board has requested information with respect to the death of a named person, or, with the consent of a participant when such board is has requested information about the participant providing that such board requests such information in the exercise of its statutory functions, powers and duties. Information, books, records or data which are confidential as provided by law shall be kept confidential by the state commission and any limitation on the release thereof imposed by law upon the party furnishing the information, books, records or data shall apply to the medical review board.
• To the State Board for Professional Medical Conduct or the Office of Professional Discipline or their respective representatives when such person or entities request such information in the exercises of their statutory function, power and duties provided, however that no such information shall be released when it concerns the subject of an inquiry who is also a participant, except pursuant to the paragraph above.
• With the consent of the appropriate commissioner,
  • To a coroner, a county medical examiner, or the chief medical examiner for New York City.
  • Appropriate persons and entities when necessary to protect the public concerning a specific sex offender requiring civil management.
• To a correctional facility, when the chief administrative officer has requested such information with respect to a named incarcerated individual of such correctional facility or to the Department of Corrections and Community Supervision, when the department has requested such information with respect to a person under its jurisdiction or an incarcerated individual of a state correctional facility, when such incarcerated individual is within four weeks of release from such institution to community supervision. Information released pursuant to this paragraph may be limited to a summary of the record, including but not limited to: the basis for referral to the facility; the diagnosis upon admission and discharge; a diagnosis and description of the participant’s current mental condition; the current course of treatment, medication and therapies; and Community Access’ recommendation for future mental hygiene services, if any. Such information may be forwarded to the department of corrections and community supervision staff in need of such information for the purpose of making a determination regarding an incarcerated individual’s health care, security, safety or ability to participate in programs. In the event an incarcerated individual is transferred, the sending correctional facility shall forward, upon request, such summaries to the chief administrative officer of any correctional facility to which the incarcerated individual is subsequently incarcerated.
• To a qualified court surrogate, parent or guardian as described in 33.16 of the Mental Hygiene Law.
• To a director of community services or his or her designee, provided that such director or his or her designee requests such information in the exercise of his or her statutory functions powers and duties.
• To the state division of criminal justice services for the sole purposes of:
  • Providing, facilitating, evaluating or auditing access by the commissioner of mental health to criminal history information; or
  • Providing information to the criminal justice information services division of the federal bureau of investigation by the commissioner of mental health for the purposes of responding to queries to the national instant criminal background check system regarding attempts to purchase or otherwise take possession of firearms, in accordance with applicable federal laws or regulations.
• To the division of criminal justice services, names and other non-clinical identifying information for the sole purpose of implementing the divisions responsibilities and duties under section 400.00 and 400.02 of the penal law.
• To the agency designated by the governor pursuant to provide protection and advocacy services and to administer the protection and advocacy system as provided by federal law. Such agency shall not be charged any fee for copies of records obtained from a facility under this article.
• To the board of correction of the City of New York when such board has requested such information with respect to the death of a named person, or, with the consent of a participant when such board has requested information about the patient or client providing that such board requires such information in the exercise of its functions, powers and duties. Information, books, records or data which are confidential as provided by law shall be kept confidential by the board of correction of the City of New York and any limitation on the release thereof imposed by law upon the party furnishing the information, books, records or data shall apply to the board of correction of the City of New York.

Nothing in this section shall prevent the electronic or other exchange of information concerning participants, including identification, between and among 1) facilities or others providing services for such participants pursuant to an approved local services plan and 2) the Department of Health, Office of Mental Health, or Department of Health and Mental Hygiene or any of its licensed or operated facilities. Neither shall anything in this section prevent the exchange of information concerning participants, including identification, between Community Access and managed care organizations, behavioral health organizations, health homes or other entities authorized by the Department of Health, Offices of Mental Health, or Department of Health and Mental Hygiene to provide, arrange for or coordinate health care services for such participants who are enrolled in or receiving services from such organizations or entities. Provided however, written patient or client consent shall be obtained prior to the exchange of information concerning substance use treatment.

D. How to Inspect and Correct Private or Personal Information

• You may inspect and have a copy of your private or personal information that we maintain. We will offer to explain any information that you may not understand.
• We will consider a request from you for correction of inaccurate or incomplete private or personal information that we maintain about you. If we agree that the information is inaccurate or incomplete, we may delete it or we may choose to mark it as inaccurate or incomplete and to supplement it with additional information.
• To inspect, get a copy of, or ask for correction of your information, please contact Community Access’ Compliance Officer, Brittany Griffin at (212) 780-1400 x7911 or Bradley Moore, Director of Quality Improvement Compliance and Data Analytics/ Chief Compliance Officer at (212) 780-1400 x7785.
• We may deny your request for inspection or copying of private or personal information if:
  • The information was compiled in reasonable anticipation of litigation or comparable proceedings.
  • The information is not part of the relevant participant’s designated record set.
  • The information is about another participant (other than a health care provider or homeless provider).
  • The information was obtained under a promise of confidentiality (other than a promise from a health care provider or homeless provider) and if the disclosure would reveal the source of the information, or
  • Disclosure of the information would be reasonably likely to endanger the life or physical safety of any individual.
• If we deny a request for access or correction, we will explain the reason for denial. We will also include, as part of the private or personal information that we maintain, documentation of the request and the reason for the denial.
• We may reject repeated or harassing requests for access or correction.

E. Data Quality

1. We only collect private or personal information that is relevant to the purposes for which we plan to use it. To the extent necessary for those purposes, we seek to maintain only private or personal information that is accurate, complete and timely.
2. We are developing and implementing a plan to dispose of all private or personal information not in current use ten years after the information was created or last changed. As an alternative to disposal, we may choose to remove identifiers from the information.
3. We may keep information for a longer period of time if required to do so by statute, regulation, contract or other requirement.

F. Complaint

1. We accept and consider questions or complaints about our privacy and security policies and practices. A participant who believes his or her privacy rights have been violated may file a complaint regarding the alleged privacy violation with, Brittany Griffin, Compliance Officer, 17 Battery Place Suite 1326, New York, N.Y. 10004, bgriffin@communityaccess.org, 212-780-1400 x7911 or the New York State Attorney General. Complaints submitted to Community Access’s Privacy Officer(s) will follow the Community Access Grievance process and be documented, reviewed and acted upon, if necessary. Please contact CA’s Compliance Officer if a participant needs assistance locating current contact information.
2. Participants will not be penalized or retaliated against for filing a complaint.
3. All members of our staff in HMIS reporting programs (including employees, volunteers, affiliates, contractors and associates) are required to comply with this privacy notice.