Background

Clients in OC HMIS have the right to review a copy of their data as entered in HMIS. This includes the data on the client’s Profile screen, the client’s Release of Information, the client’s enrollment history in any projects that participate in OC HMIS, and a list of all client documents uploaded into HMIS. ​​​​No client shall have access to another client’s data for any reason, except for parents or guardians of a minor requesting their minor child’s records. No data that can be used to identify a client, like name, date of birth, SSN, etc., will be released to any person, agency, or organization not participating in HMIS for any purpose without written permission from the client, with the exception of subpoenas, academic research purposes or other circumstances as required by law. A sample dashboard is included below.

Client Record Request Process

• Clients can request their record from agency participating in OC HMIS that they have been served by in the past. This is so the agency can verify the client's identity. Clients should not contact 211OC directly unless they have requested their record from an agency and were denied. In this case, the client should submit a grievance to 211OC.
• An Agency Administrator at the agency is responsible for submitting a ticket to the HMIS Help Desk to request the Client Record Request Dashboard for the client within five (5) business days of the request except where exempted by state and federal law. The ticket should state that a client is requesting their Client Record Request Dashboard, and should include the client's HMIS ID only (no names or other identifying data). If the Agency Administrator cannot find the client's record in HMIS, it's possible that the client's record has been marked private and is not visible by other agencies. In this case, the Agency Administrator must call 211OC and provide the client's name, and the HMIS Help Desk team will search for the client's record.
• At the time of the client's request, the Agency Administrator must decide with the client an appropriate method for the client to receive their dashboard that does not violate the privacy of the client’s data. Acceptable methods of sharing the dashboard with the client include:
  • Scheduling a time for the client to return to the office to pick-up their dashboard in person
  • Emailing the client's dashboard to the client or another trusted contact like a case manager, advocate, friend, etc. that the client has approved to receive their dashboard. This method is only acceptable if the dashboard is password protected, or otherwise sent over encrypted email, and if the recipient of the email understands how to access a document that has been sent over encrypted email.
• The HMIS Help Desk will send the client's dashboard to the agency that made the request, and the Agency Administrator will give the dashboard to the client in the method that was previously agreed upon. An Agency Administrator at the agency is required to review the dashboard with the client upon request.

Dashboard Review Procedures

• If the dashboard review occurs in person with the client, the following practices should be followed:
  • The Agency Administrator should meet with the client in a private location where the client's information cannot be overheard by other clients or members of the public.
  • The Agency Administrator should explain each section of the dashboard and what information is collected. Review the HMIS Client Record Requests page for details.
  • If the client requests a revision to their dashboard, review the Client Data Revisions section below.
  • If a copy of the dashboard is printed for the client's review, the Agency Administrator must shred the dashboard on the client's behalf once the client reviews the dashboard and discusses any data with the Agency Administrator. The only exception to this is if the client wants to take the dashboard with them. This is not recommended, as the dashboard contains sensitive client information.
• If the dashboard is sent over encrypted email, the email should include a link to the HMIS Client Record Requests page, which contains an overview of the dashboard and tips for protecting the client's information. The agency should also inform the client that if they need a revision to their dashboard they should call the Agency Administrator or meet with them in person to discuss these changes.

Client Data Revisions

• Client Profile
  • All data in the Client Profile section is available on the Profile screen in HMIS. Clients may request an update to any data on this screen. If the Agency Administrator has access to the client's Profile, they can make the revision in HMIS. If the client record is not visible to the Agency Administrator, it is because the client's record is marked as private. In this case, the Agency Administrator will need to submit a ticket to the HMIS Help Desk to update this record. Remember that no identifying data can be sent over email, so if the revision includes identifying data the Agency Administrator will need to call the HMIS Help Desk.
• Enrollment History
  • This is a list of all of the enrollments associated with the client in HMIS. This section is informational only, and cannot be edited.
• Release of Information
  • This section provides information on the Release of Information (ROI) that has been collected from the client. Review the Accessing and Completing Release of Information (ROI) Page article for instructions on accessing this data in HMIS.
  • This section includes the agency that collected the ROI, the date it was collected, the date it expires, and the type of documentation collected for the ROI.
  • If the Permission field is Yes, the client record is being shared with agencies with access to HMIS. If the client does not want to share their record in HMIS they can complete the Client Revocation of Consent Form. Review the Refusing/Revoking Consent to Share Personal Information article for instructions on how to update the client's record in HMIS.
  • If the Permission field is No, the client's record is not being shared with agencies that have access to HMIS. Only agencies where the client has been served can see their HMIS record. If the client agrees to share their record with agencies participating in HMIS they can complete the Consent to Share Protected Personal Information form. Review the Accessing and Completing Release of Information (ROI) Page article for instructions on how to update the client's ROI.
• Client Documentation
  • This is a list of the documents that have been uploaded into HMIS on the client's behalf. To add additional documents to the client's record, review the Adding Documents to a Client Profile article. If the client would like documents to be deleted from HMIS, please enter a ticket with the HMIS Help Desk including the client's ID and the names of the documents that they would like deleted. Some documents cannot be deleted because they are required to confirm program eligibility.