Date Published: October 2017
In general, HMIS standards do not stipulate what form of consent must be obtained to share data within HMIS. Decisions regarding permitted types of consent (inferred, written, verbal, etc.) may be made locally by the CoC, working in conjunction with the HMIS Lead, and should also consider possible state or other local requirements. In general, client consents requiring amendments would necessitate obtaining client consent (again) for the amended sections.
For a privacy notice, an agency must post a sign at each intake desk (or comparable location) that explains generally the reasons for collecting HMIS information, and the uses and disclosures allowable. Section 4.2.4 of the 2004 HUD Data and Technical Standards Notice allows for retroactive application of amendments to the privacy notice, stating, “A CHO must state in its privacy notice that the policy may be amended at any time and that amendments may affect information obtained by the CHO before the date of the change. An amendment to the privacy notice regarding use or disclosure will be effective with respect to information processed before the amendment, unless otherwise stated.” In instances where past privacy notices did not include a statement about amendments and retroactive impact, client data obtained under those privacy notices would not be permitted to be used for any purposes other than the original uses and disclosures outlined in the privacy notice.