04-17097. Homeless Management Information Systems (HMIS); Data and Technical Standards Final Notice

AGENCY:

Office of the Assistant Secretary for Community Planning and Development, U.S. Department of Housing and Urban Development (HUD).

ACTION:

Final notice.

SUMMARY:

This notice implements data and technical standards for Homeless Management Information Systems (HMIS). The final Notice follows publication of a draft Notice on July 22, 2003.

DATES:

Effective Date: August 30, 2004.

FOR FURTHER INFORMATION CONTACT:

Michael Roanhouse, Office of Special Needs Assistance Programs, Office of the Assistant Secretary for Community Planning and Development, Room 7262, Department of Housing and Urban Development, 451 Seventh Street, SW, Washington, DC 20410-7000; telephone [phone], ext. 4482 (this is not a toll-free number). Hearing-or speech-impaired individuals may access this number by calling the toll-free Federal Information Relay Service at 1-800-877-8339.

SUPPLEMENTARY INFORMATION:

I. Background—The July 22, 2003 Draft Notice

On July 22, 2003 (68 FR 43430), HUD published a draft Notice that described the data and technical standards for implementing HMIS. An HMIS is a computerized data collection application that facilitates the collection of information on homeless individuals and families using residential or other homeless assistance services and stores that data in an electronic format. Because an HMIS has the capacity to integrate data from all homeless service providers in the community and to capture basic descriptive information on every person served, it is a valuable resource for communities. HMIS can be employed to: better understand the characteristics of homeless persons in the community, including their demographic characteristics, patterns of homelessness, and use of services; improve the delivery of housing and services to specific sub-populations such as veterans or persons experiencing chronic homelessness; and assess and document the community's progress in reducing homelessness.

Over the past several years, Congress has directed HUD to assist local jurisdictions in implementing HMIS and in using data from these systems to understand the size and characteristics of the homeless population, analyze local patterns of services usage, and assess local service needs. HUD's goals for the development of local HMIS are threefold:

1. Bringing the power of technology to the day-to-day operations of individual housing and service providers;

2. Knitting together housing and service providers within a local community into more coordinated and effective delivery systems for the benefit of homeless clients; and

3. Obtaining and reporting critical aggregate information about the characteristics and service needs of homeless persons.

To achieve these goals, HUD has initiated a yearlong process to develop national data and technical standards for HMIS. The standards have been developed with extensive input from an expert panel composed of practitioners, advocates, government representatives and researchers. The composition of the expert panel was designed to make sure that the need for addressing key policy questions would be balanced against practical considerations about the data collection environment.

A draft Notice that outlined the data and technical standards was published in July 2003, to permit Continuums of Care (CoC) (local bodies that plan for and coordinate homeless services), homeless service providers, local and State governments, advocates and homeless clients an opportunity to review and comment on the proposed standards. The draft Notice was divided into five sections.

Section 1, the Introduction, presented background information on the Congressional direction on improving homeless data collection and analysis at the local and national levels, and specific statutorily based programmatic and planning requirements for addressing homeless needs. This section also described HUD's major policy decisions regarding HMIS and the benefits of developing an HMIS for homeless persons, local homeless assistance providers, CoCs and national policy makers.

Section 2, the Universal Data Elements, described the data elements that are to be collected from all clients served by all homeless assistance programs reporting to the HMIS. Universal data elements (including date of birth, gender, race, ethnicity, and veteran's status) are needed for CoCs to understand the basic dynamics of homelessness in their communities and for HUD to meet Congressional direction to: develop unduplicated counts of homeless service users at the local level; describe their characteristics; and identify their use of homeless assistance and mainstream resources.

Section 3, the Program Level Data Elements (called Program-Specific Data Elements in the final Notice), described data elements that are required for programs receiving certain types of funding, but are optional for other programs. Most program-specific data elements are required for programs that receive funding under the McKinney-Vento Homeless Assistance Act (McKinney-Vento Act) (42 U.S.C. 11301 et seq.) and complete Annual Progress Reports (APRs). In the future HUD intends to use HMIS data as a basis for grantees to complete APRs.

Finally, Section 4, Standards for Data Confidentiality and Security, and Section 5, Technical Standards, described how data are to be safeguarded and the technical requirements for HMIS applications and for the CoCs or other entities responsible for storing HMIS data.

II. Significant Differences Between the July 22, 2003, Draft Notice and This Final Notice

The final Notice takes into consideration the public comments received on the July 22, 2003 draft Notice. After reviewing the public comments, the significant changes described below have been made to the Notice.

1. The methodology for obtaining data has been made less prescriptive. The final Notice no longer prescribes a methodology for obtaining the data, as long as the definitions of the data elements are used to collect client information. This allows housing and service providers the flexibility to collect the required information in ways that are suitable for the operation of their programs and their local circumstances. For many providers, there may be very few changes in the way they already obtain information from clients.

Specifically, the data standards have been changed from a survey format that presented both recommended questions and required response categories for each data element to a format that specifies only the required response categories. The draft Notice included questions for obtaining each data element to ensure collection of consistent information across communities. To meet the same objective, the final Notice includes a definition of each data element and the required response categories, but does not mandate the procedures for collecting the information. Data collection procedures can be tailored to meet the circumstances of providers as long as the collected information is consistent with the definition of the data element. Also, follow-up questions and corresponding data fields for use when a client provides only partial answers have been removed. For providers that want to use the questions, they are presented in Exhibits 2 and 4 of the final Notice.

The timing of the data collection has also been made more flexible so that providers can choose the time most appropriate to collect the information. One important exception involves Disabling Condition, a data element that was added to the universal data standards in the final Notice. As discussed in the final Notice, providers are required to collect a client's disability status only after the client has been accepted into the program, unless disability is an eligibility criterion for the program (such as disability status for the Shelter Plus Care program or HIV status for the Housing Opportunities for Persons with AIDS Program). Instructions for the program-specific data standards allow providers to collect the information at the time when it makes most sense, for example, during a client needs assessment, or provision and monitoring of services, or from case management records.

Finally, the final Notice acknowledges that providers or communities can collect additional data elements to meet other information needs in the community. Also, required response categories can be disaggregated to meet local information needs, as long as the locally-developed response categories can be aggregated to the response categories for each data element in the final Notice. For example, programs may choose to collect more detailed information regarding a client's residence prior to program entry by disaggregating the emergency shelter response category into several categories (hotel, motel, campground paid for with emergency shelter voucher, particular type of crisis shelter or runaway youth shelter). For reporting purposes, the more detailed categories must be combined into the emergency shelter response category.

2. Privacy and security standards are more flexible than in the draft Notice. This final Notice has been revised to provide housing and service providers more flexibility in implementing privacy and security standards, while establishing minimum requirements for protecting HMIS data. The revised standards establish policies and procedures for addressing the privacy and confidentiality of information collected by HMIS, while allowing for reasonable and responsible uses and disclosures of data.

The privacy and security section provides baseline standards required of all programs that record, use or process HMIS data. The baseline standards are based on principles of fair information practices and security standards recognized by the information privacy and technology communities as appropriate for securing and protecting personal information. The section also identifies additional protocols or policies that communities may choose to adopt to further ensure the privacy and confidentiality of information collected through HMIS. Programs are encouraged to apply these additional protections as needed to protect client confidentiality. Programs may also implement other forms of protections not specified in the Notice as long as these protections do not conflict with the standards in this Notice.

The revision has been made in recognition of the broad diversity of programs involved in HMIS and the various programmatic and organizational realities that may prompt some programs to implement higher standards. While some programs (e.g., programs that serve particularly vulnerable populations) strive to implement the highest level of privacy and security standards possible because of the nature of their homeless population and/or service provision, other programs (e.g., programs that serve large numbers of clients daily) may find higher standards excessively prescriptive and overly burdensome. At a minimum, however, all programs must meet the baseline requirements described in the Notice.

III. Discussion of the Public Comments Received on the July 22, 2003, Draft Notice

The public comment period for the proposed Notice closed on September 22, 2003. HUD received comments on the draft Notice from 167 commenters, representing a variety of organizations and entities. Comments were received from: members of CoCs and homeless service providers; disability and domestic violence advocacy groups; homeless and low-income housing advocacy organizations; HMIS software vendors; legal and privacy organizations; Federal, State, county and city government agencies; a public housing authority; consulting firms and research organizations; academia; and the general public. Overall, more than 1,600 distinct comments were made.

The comments expressed a wide range of viewpoints. Very few commenters expressed unqualified support for, or opposition to, the draft Notice. Instead, many commenters mixed broad statements of support with criticisms of specific provisions in the Notice. The statements of support frequently commended HUD for issuing the draft Notice, stating that uniform data collection and technical standards will benefit homeless persons, the programs that serve them, and the policies designed to address homelessness. Some commenters wrote that accurate HMIS data will “improve services provided to homeless families and individuals,” help agency staff to “streamline referrals and coordinated case management” and comprise “one of the cornerstones of a comprehensive program to prevent and end homelessness.” A few commenters urged HUD to expand the scope of the draft Notice by requiring all programs affected by the Notice to share HMIS data, and some commenters recommended adding data elements or questions. However, a few commenters condemned the entire HMIS initiative as invasive of client privacy, burdensome to programs and beyond Congressional intent.

The criticisms raised by the commenters generally focused on the data collection requirements and the privacy and security standards of the draft Notice. A number of commenters expressed concerns that the data collection requirements would be burdensome to program staff or invasive of client privacy. Some commenters believed the proposed requirements would take time away from service provision and potentially discourage clients from seeking services. Other commenters expressed concerns about the implication of the draft Notice for particular subpopulations. Some commenters took the position that the collection of disability-related information and other medical information violates fair housing or privacy laws and could lead to discriminatory housing practices. Several domestic violence groups were particularly concerned with the collection of personal identifying information, and stated that the privacy standards in the Notice were inadequate to protect the safety of domestic violence victims. On the other hand, a number of commenters indicated that the security standards were overly prescriptive and costly to implement.

The following sections of this preamble present a more detailed review of the most significant concerns raised by the public in response to the July 22, 2003, draft Notice and HUD's response to each concern. The sections proceed as follows:

Section IV of this preamble discusses general comments on the draft Notice.

Section V of this preamble discusses the comments regarding the Universal Data Elements.

Section VI of this preamble discusses the comments regarding the Program-Specific Data Elements.

Section VII of this preamble discusses the comments regarding the Privacy and Security Standards and Technical Standards.

IV. General Comments About the Draft Notice

Several commenters expressed general concerns with the draft Notice that were not associated with specific data elements or technical provisions.

Comment: HUD should not require CoCs to develop HMIS systems. Some commenters wrote that HUD should not require communities to develop HMIS, noting that HMIS could be used to track homeless people and could put some people, particularly vulnerable populations, at risk. Other commenters supported the development of local HMIS. One commenter applauded the Department's efforts to collect better data to further improve services to homeless families and individuals. Another commenter stated that implementation of HMIS had enabled his community to better serve their consumers. Another noted the benefits of HMIS, both in terms of its ability to better inform a community's understanding of the problem of homelessness and as a case management tool for individual providers.

HUD Response: The development of local HMIS began as a grassroots effort over 20 years ago, led by homeless program administrators in a small number of communities across the country. The positive experiences with HMIS in shaping local homeless policies and improving services to homeless clients led the Congress to authorize federal agencies to begin providing support for the local development of HMIS starting in the 1990s.

HUD recognizes that: (1) Development of HMIS can pose a burden on clients and the providers that assist them; and (2) without adequate safeguards, providing data to an HMIS could put a homeless person at risk. However, the burden of data collection must be balanced against the benefits of HMIS, including better coordination and delivery of services to homeless persons and obtaining information that can help providers and policymakers to understand the magnitude of homelessness and the needs of homeless individuals and families. Also, HUD has consulted with information privacy experts to develop privacy and confidentiality standards that are regarded as best practices and providing optional privacy protections for programs that require additional safeguards. HUD is committed to working with CoCs to ensure that adequate safeguards are in place so that information collected through HMIS is protected.

Comment: Clarify HUD's position on the creation of a national database. A few commenters were concerned that the draft Notice contained the necessary elements to create a centralized, nationwide database. These commenters were particularly troubled by the requirement to collect personal identifying information since this information could be used to track homeless persons at the national level.

HUD Response: HUD believes that its position in the draft Notice is clear: “The HMIS initiative will include no Federal effort to track homeless people and their identifying information beyond the local level.” As stated in the final Notice, HUD will only require CoCs to report HMIS data in the aggregate and not by individual.

Comment: Funding for HMIS is not adequate. Some commenters noted that there are significant costs associated with implementing an HMIS at the local level (e.g., purchasing software and hardware, training staff, and collecting data on an on-going basis). Several commenters who represented communities with existing HMIS systems noted that significant costs would be associated with changing their system to conform with the proposed data standards. In addition, some commenters expressed concern that HUD funding for HMIS would reduce the resources available for direct services and stated that a separate funding source should be made available for HMIS.

HUD Response: Congress has authorized HUD to provide Federal funding to support the development of HMIS at the local level. Starting in 2001, Congress directed HUD to make HMIS an eligible cost under the Supportive Housing Program (SHP). Subsequently, HUD's 2001, 2002 and 2003 CoC Notice of Funding Announcements allowed CoCs to apply for SHP funding in order to pay for the costs associated with HMIS equipment, software, computer services, managing and operating the system, analyzing HMIS data and producing reports, and training. While planning costs are not an eligible activity under SHP, some communities have used Community Development Block Grant funds to cover HMIS planning costs. (For more information on using SHP and other sources to pay for HMIS implementation, see HUD's Homeless Management Information System: Implementation Guide, p. 56.)

Congress has also provided funding for technical assistance on the HMIS initiative. HUD has used these funds to engage experienced technical assistance providers to work with communities across the country to plan for, implement and update HMIS.

Comment: HMIS is not a good way to count homeless people. There are other ways to obtain an estimate of the number of homeless persons and their needs. Some commenters stated that HMIS is not a good way to obtain a count of the number of homeless people in a community because: (1) It only counts persons who are receiving services; and (2) it is invasive and, therefore, will discourage homeless persons from seeking services. Several commenters indicated that a number of organizations in their communities that serve homeless persons do not participate in HMIS, and as a result, their clients would not be included in the HMIS count of homeless persons. These commenters were concerned that using HMIS would lead to undercounts of homelessness and result in cuts in homeless programs. Several commenters stated that HUD could obtain an unduplicated count by conducting annual point-in-time counts of homeless persons. Other commenters stated that HUD could conduct intensive research in a small number of communities to obtain information about the number and characteristics of homeless persons.

HUD Response: HUD agrees that HMIS will not produce an unduplicated count of all homeless persons, but rather an unduplicated count of all homeless persons who use homeless assistance services and participate in HMIS. However, research has shown that, over the course of a year, a very high proportion of homeless persons will use some kind of homeless service; therefore, HMIS will capture information on most homeless persons in a community.

It was also noted that not all housing and service providers in a community participate in HMIS. Obtaining participation of all providers is critical to a comprehensive HMIS system but it will take time. In the near term, HUD will provide guidance to CoCs on how they can use existing HMIS information to estimate the number of persons who are not included in an HMIS because they use services of a non-participating provider. Technical assistance will also be provided on building broad-based provider participation in local HMIS.

HUD disagrees that small research studies or point-in-time counts will provide information of equal or better quality to HMIS on the characteristics and needs of homeless persons. Point-in-time counts provide information on the number of people experiencing homelessness on a particular day. One of the key benefits of HMIS is that it can produce an accurate count of the number of people in a community who experience homelessness over the course of a year (or some other period of time) and their patterns of homelessness and service use. Generally, HMIS counts reveal a much higher number of persons experiencing homelessness than point-in-time estimates, which tend to under-represent people who are homeless only for short periods.

In-depth research studies are useful for probing into a particular issue, but cannot be used to understand the magnitude of homelessness across a community or beyond particular communities. HMIS can be used for this purpose and, in combination with other data sources (such as in-depth interviews), can be used to explore specific policy-relevant topics in a cost-efficient manner.

Comment: Proposed data collection requirements go beyond Congressional intent. Several commenters stated that the draft data standards go beyond Congressional intent to produce an unduplicated count of homelessness. For example, some commenters stated that questions about physical and behavioral health are irrelevant to Congressional intent and others questioned the need to collect personal identifiers to meet the directive.

HUD Response: HUD disagrees that the data standards go beyond Congressional intent. The draft and final Notice present the Congressional authority for data collection. These include two requirements: First, that HUD grantees assess client needs; and second, that the Interagency Council on Homelessness submit reports to Congress regarding how federal funds are used to meet the needs of homeless persons. Further, as described in the draft and final Notice, Congress has directed HUD (see Consolidated Appropriations Act of 2004 [Pub. L. 108-199, approved January 23, 2004], Fiscal Year (FY) 2001 H.R. Report 106-988; Pub. L. 106-377; FY 2001 Senate Report 106-410; and FY 1999 House Report 105-610) to use HMIS data to develop an unduplicated count of homeless persons and to analyze patterns of use of assistance, including how people enter and exit the homeless assistance system, and the effectiveness of such assistance. In the FY 2001 Senate Report 106-410, Congress also expressed concern about the role of mainstream income support and social services programs in addressing the problems of homelessness and has charged HUD and other agencies to identify ways in which mainstream programs can prevent homelessness among those they serve.

Moreover, it would not be possible for HUD to respond to Congressional concerns without obtaining information on the characteristics and needs of homeless persons, including the types of disabilities that may contribute to homelessness. It is also not possible for local providers to determine whether homeless clients are accessing mainstream resources without collecting Social Security Numbers (SSNs) and other personal identifying information. Section V of this preamble discusses the standards regarding the collection of SSNs in more detail.

Comment: The data required for HMIS poses a significant burden on homeless clients and service providers. A number of commenters were concerned about the amount of information to be collected from homeless clients and the personal nature of some of this information. Commenters stated that collecting the information would have numerous negative effects, including: Discouraging homeless persons from seeking services; reducing the amount of time the provider has to provide services; undermining the client/provider relationship; and discouraging non-HUD funded providers from participating in HMIS.

HUD Response: HUD acknowledges that data collection can be burdensome, especially for programs that register large numbers of people each night. In developing the data standards, every effort was made to balance the need for obtaining basic information about users of homeless assistance services against the need to avoid disrupting the provision of services. In revising the Notice, HUD reviewed all of the universal data elements and made some adjustments in order to limit data collection as much as possible. It is important to emphasize that only the universal data elements are required for all providers reporting to the HMIS. Many homeless assistance providers are already collecting much of this information as part of their intake process and for program administration purposes, including reporting to HUD and other funding sources. Further, some of this data (name, date of birth, race, and ethnicity) does not need to be re-collected every time a client re-enters a program because this information does not change between service encounters.

A subset of the program-specific data elements is required for: (1) Programs that receive HUD McKinney-Vento Act funds and complete Annual Progress Reports (APRs); and (2) Housing Opportunities for People with AIDS (HOPWA) projects that target homeless persons and complete APRs. These data elements are consistent with the information that communities already collect and aggregate for the APRs. There will be some additional effort required as programs adjust to the HMIS-based APR that HUD will adopt in the future.

HUD has attempted to address the burden issue by providing flexibility with respect to when and how client information is obtained. As the final Notice indicates, there is no longer a requirement that program-specific data elements be collected from clients at or shortly after intake. The information can be collected during the client assessment process, taken from client records, or recorded based upon the observations of case managers.

Comment: Clarify the special provision for domestic violence programs. Some commenters stated that HUD's special provisions for domestic violence programs are inadequate because many victims seek services at mainstream homeless programs. Several commenters suggested an exemption from HMIS for any individual accessing homeless services who reports that he/she is, or has been, a victim of domestic violence.

However, some commenters disagreed with the special provision for domestic violence programs. These commenters stated that domestic violence providers may constitute a significant part of a CoC and, if they do not participate, the CoC will not be able to produce an accurate count of the homeless. The commenters were concerned that, if domestic violence victims are not included in a description of the local homeless population, it will not be possible to identify the level of resources needed to provide for their special needs.

HUD Response: HUD has carefully considered the special circumstances associated with victims of domestic violence and domestic violence programs with respect to participation in the HMIS. It is understood that unlike other special populations, victims of domestic violence could be physically at risk if individuals who intend to cause them harm are able to obtain personal information from an HMIS with inadequate security and confidentiality protections. At the same time, domestic violence programs play an important role in many CoCs. As a number of commenters noted, their lack of participation in an HMIS means that it will not be possible to obtain an accurate unduplicated count of homeless persons in a community or adequately understand the needs of the homeless population. HUD is also aware that in some communities around the country domestic violence programs are participating in the HMIS after reaching agreement with the CoC about ways that HMIS information can be protected to ensure the safety of domestic violence clients.

After careful consideration, HUD has determined that it is essential for domestic violence providers to participate in HMIS and that technological and administrative solutions are available that will adequately protect data on victims of domestic violence. Therefore, domestic violence programs that receive HUD McKinney-Vento funding are required to participate in local HMIS and must submit client-level information to obtain an unduplicated count of homeless persons at the CoC level. CoC representatives are instructed to meet with domestic violence program staff in their communities with the goal of developing a plan for participation that includes protocols that address the concerns of domestic violence programs and ensures adequate protection of data.

Participation in HMIS can occur through a variety of arrangements, and communities are encouraged to think creatively about solutions that allow domestic violence programs to fulfill this HUD requirement. HUD will provide technical assistance to local CoCs to help them develop solutions that meet the needs of victims of domestic violence and the programs that serve this population. Given that it may take some time to negotiate protocols and agreements, HUD will permit CoCs to stage the entry of domestic violence programs last, including after the October 2004 goal for HMIS implementation. The later permissible staging of domestic violence programs into the HMIS will be taken into account in HUD's assessment of CoC progress in HMIS implementation in the national CoC competitive ranking process.

All domestic violence programs, regardless of funding, are encouraged to participate in HMIS, to ensure that critical information about domestic violence clients is available for public policy purposes.

V. Comments Regarding Universal Data Elements

Comments about the universal data standards ranged from overall statements about reducing the number of elements to detailed suggestions for revising response categories and recommendations for adding elements.

Comment: Remove some of the universal data elements to reduce the burden on providers, particularly large overnight shelters and family shelters. Several commenters indicated that the number of universal data elements should be reduced to limit the burden on shelters that serve a large number of clients every night. Some commenters stated that only the elements needed for an unduplicated count of homeless service users should be part of the required universal data elements. A few commenters suggested having two tiers of universal data elements, with a smaller number of elements for emergency shelters and the full list for other providers. Several commenters also stated that collecting all the universal data elements for each child in the family is too burdensome for providers serving large families.

On the other hand, some commenters suggested adding more detailed response categories, moving some of the program-specific data elements to universal data elements or adding new data elements.

HUD Response: In developing and reviewing the universal data standards, HUD made every effort to balance the need for requiring basic information about users of homeless services against the data collection burden for service providers and clients. All of the data elements are necessary for meeting Congress's desire for an unduplicated count of people using homeless assistance services and an analysis of the characteristics and patterns of service use of people who are homeless.

In reviewing the universal data elements, HUD identified several areas in which the Notice could be and was revised to reduce the burden of data collection for the universal data elements while still fulfilling Congressional instructions. The “Month/Year of Last Permanent Address” and “Program Event Number” data elements were dropped from the data standards due to data quality concerns and burden issues. Requirements for obtaining follow-up information when clients could only provide partial or incomplete information were eliminated for many elements. The number of required response categories was also reduced for several data elements to facilitate the intake for each client. In addition, “Don't Know” and “Refused” response categories were removed from almost every data element.

Finally, many of the comments on the burden of universal standards assumed that every universal data element would need to be collected each time a person uses a provider's services or uses any service in a community that shares data across providers. This is not required. Many of the universal data elements do not change over time (e.g., SSN and birth date), so these elements only have to be collected the first time the person is served. To clarify this, we have added a column to Exhibit 1 of the final Notice, Summary of Universal Data Elements, which specifies whether the element needs to be collected the first time only or every time the person uses a service.

Comment: Universal data elements should include all information needed to determine whether a client is chronically homeless. Several commenters said that HUD's initiative to end chronic homelessness defines a chronically homeless person as someone who has a pattern of homelessness over the past year or years and is disabled. Therefore the universal data elements need to include an indicator of whether or not the client is disabled in order to measure chronic homelessness.

HUD Response: HUD agrees that the elements needed to identify chronic homeless individuals should be part of the universal data standards. A Disabling Condition data element has been added as a universal data element for this purpose. For programs that do not require this information to determine program eligibility, this data element can be obtained from assessment of a client's needs, by asking the client about their disability status, through observation, or through reviewing case management records kept by the provider. Where disability information is not required for program eligibility, homeless service providers must separate the client intake process for program admission from the collection of disability information in order to comply with Fair Housing laws and practices. Thus, unless the information is needed for eligibility determination, Disabling Condition should be collected only after the client has been admitted into the program.

Comment: Collection of full SSNs is unnecessary for obtaining unduplicated count of the homeless and may discourage clients from obtaining services. A number of commenters stated that collection of SSNs was unnecessary for obtaining an unduplicated count of homeless service users. Some commenters suggested that a partial SSN (e.g., last 5 digits) should be collected and used along with other information such as name, birth date, and gender to obtain an unduplicated count. Several of the commenters also wrote that collection of SSNs infringed on a client's privacy and would discourage clients from seeking services.

HUD Response: HUD has carefully considered comments expressing concerns about collection of SSNs, but has concluded that the benefits of collecting SSNs outweigh the burden. Some CoCs and many individual providers already collect SSNs as part of their program operations without reporting any problems. On the contrary, many programs report that collecting SSN greatly facilitates the process of identifying clients who have been previously served. Further, the Notice explicitly states that a client who does not have or refuses to provide his/her SSN cannot be denied service for this reason unless it is a statutory requirement of the program under which the service is provided.

While name and date of birth are useful identifiers, these identifiers by themselves do not produce as accurate a method for distinguishing individual homeless persons as using SSN, since names change and people share the same date of birth. Overall, the collection of SSNs greatly improves the accuracy of deduplication.

Also, an important Congressional goal is to increase the use of mainstream programs to prevent homelessness. To achieve this goal, providers need the SSN along with the other personal identifiers in order to access mainstream services for their clients.

Comment: Transgender categories should be added to the Gender data element. Several commenters recommended adding “transgender male to female” and transgender “female to male” categories to the Gender element to provide transgender clients these options for self-identification. Some commenters also wrote that it was inappropriate to specify that providers who use transgender categories should aggregate them to “Don't Know” for reporting purposes.

HUD Response: The final Notice allows local communities to add transgender response categories to meet their local needs, but has not made transgender response categories mandatory for the HMIS. The HMIS will be implemented by a wide variety of providers in a variety of circumstances. HUD has tried to keep mandatory reporting elements and response categories to a minimum, while allowing local communities and individual providers the flexibility to include additional response categories as appropriate for their community. However, the response categories used by local communities or individual providers must be aggregated to the required response categories for reporting purposes. For providers who add transgender categories, the responses should be aggregated to the self-identified gender of the client, for example a client who reports “transgender male to female” should be aggregated to the female category.

Comment: Drop the Zip Code of Last Permanent Address element because it is too difficult to collect. Some commenters stated that Zip Code of Last Permanent Address would not be a reliable element, because clients may not remember it because of their unstable living arrangements, cognitive problems, or simply because they have forgotten it. Commenters also raised concern about the burden of collecting last permanent street address for clients who could not recall their zip code. A few commenters suggested adding a response category for clients who report never having had a permanent address.

HUD Response: HUD does not agree that the zip code should be dropped. HUD recognizes that Zip Code of Last Permanent Address may be difficult for some clients to report accurately, but believes the information that is reported will be valuable for local communities to understand the geographic mobility of the homeless population and the effective catchment areas for service providers. For example, CoCs that currently collect this data element have used this information to raise awareness of homeless issues in communities that were disengaged previously from the CoC planning process.

In order to reduce data collection burden, one modification has been made to the data element. In the final Notice, programs are not required to collect the street address of clients who cannot recall their last permanent zip code.

Comment: Inserting an “X” for unknown digits in SSN and birth date fields is burdensome for software developers and adds extra key strokes for persons entering information. Some commenters stated that placing an “X” for each unknown date in the date field conflicts with many software applications, because they allow only numeric digits in the date fields. They suggested using an approximate date, such as January (i.e., 01) for missing month and 01 for missing day. Some commenters also wrote that placing an “X” for missing digits in the SSN field adds unnecessary key strokes and will require software developers to create nine data fields instead of one for SSN.

HUD Response: HUD agrees with these suggestions. The final Notice does not require entering an “X” for missing SSN digits and allows for approximate dates for missing month and day where appropriate.

Comment: Do not mandate “Don't Know” and “Refused” response categories for each question. A number of commenters suggested eliminating the requirement for “Don't Know” and “Refused” response categories for each data field in the universal and program-specific standards or making them optional fields. Some commenters pointed out that, for elements with specific data formats (e.g., birth date) or text fields (e.g., name), a second data field would be required to capture this information. Other commenters noted that these response categories would take up excess computer screen or paper form space and require the creation of additional fields. Finally, some commenters were concerned that these categories would diminish the value of some key data elements because staff and clients would check these responses for expediency, neglecting the opportunity to collect valuable information. A few commenters expressed support for having these response options for each data element.

HUD Response: HUD agrees that requiring “Don't Know” and “Refused” response categories for every data field is an unnecessary burden. While individual providers and local communities still have the option of including these data fields, they are only required for the following elements: SSN; Veterans Status; Disabling Condition; Residency Prior to Program Entry; and Zip Code of Last Permanent Address.

VI. Comments Regarding Program-Specific Data Elements

Comment: Program-specific data elements are too burdensome. Several commenters stated that too many program-specific data elements are required. Some commenters estimated that collecting the program-specific data elements would require a significant amount of time and resources, exceeding the current capacity of most programs.

HUD Response: As discussed in the general comments section, HUD is sensitive to the burden that data collection represents to homeless assistance providers. However, a misunderstanding as to which programs are required to collect program-specific data elements contributed to concerns about burden. Many commenters thought that all providers were required to collect the program-specific data elements in addition to the universal data elements. This is not HUD's intent. Programs that do not complete APRs are not required to collect any of the program-specific data elements.

HUD will require providers that receive HUD McKinney-Vento or HOPWA funding for homeless services and complete APRs to collect a select number of program-specific data elements. Since these data elements are necessary for APR reporting purposes, providers should be collecting much of this information already.

The standards also include optional program-specific data elements (that is, elements that are not needed to complete APRs). These optional elements were included based on discussions with other Federal agencies that administer programs for homeless persons. HUD is working with these agencies to standardize, to the maximum extent possible, the data elements and definitions used by various agencies in their reporting requests of homeless providers. The long-term goal is to make reporting easier and more consistent for homeless providers who use multiple Federal programs.

HUD recognizes that the mixing of APR-required and optional program-specific data elements contributed to concerns about burden. The final Notice discusses the two types of data elements separately. Data elements 3.1 through 3.11 are needed to complete APRs. Data elements 3.12 through 3.17 are recommended for inclusion in an HMIS because they provide important additional information about homeless persons and are needed for non-HUD funded reporting purposes.

Finally, HUD is aware that the question and answer format presented in the draft Notice contributed to concerns about burden. For each data element, the draft Notice provided a series of questions that providers would use to collect and record client information. For some APR-required data elements (e.g., Income and Sources), the questions were intended to provide a step-by-step process for making (sometimes difficult) determinations about the status of a person. The final Notice does not specify the questions to be asked.

Comment: Health-related or other sensitive client information should not be collected at intake. Commenters expressed two main concerns with the collection of health-related or other sensitive data at intake. First, several commenters stated that intake staff could not be expected to properly collect some of the program-specific data elements—in particular physical or developmental disability, behavioral health status, and experience with domestic violence—since many front-line staff are not trained to make assessments about these conditions. Commenters also wrote that program staff should not collect health-related or other sensitive information at program entry, because clients often resist such inquiries when asked by people they do not know or trust. Commenters emphasized the need to build a rapport with clients throughout the assessment process to gain their trust, correctly identify their needs, and provide the appropriate service or referral.

Second, some commenters suggested that collecting health-related and other sensitive client information at intake could lead to unfair and discriminatory treatment of persons with disabilities. Some of these commenters were concerned that clients would be stigmatized or possibly denied shelter or services solely on the basis of their disability status or other health condition.

HUD Response: HUD agrees with these comments. The Notice no longer allows program staff to collect health-related information (including Physical Disability, Developmental Disability, HIV/AIDS, Mental Health, and Substance Abuse) at intake, unless this information is a statutory or regulatory eligibility requirement (e.g., such as disability status for the Shelter Plus Care program or HIV status for the Housing Opportunities for Persons with AIDS program). Where disability status is not an eligibility requirement, the collection of health-related information may occur throughout the client assessment process to ensure that a client's disability status is properly recorded. The change in the timing of data collection also creates more time for providers to build a rapport with clients.

Furthermore, HUD has made it clear throughout the final Notice that homeless service providers cannot deny services to an otherwise eligible person on the basis of his/her disability or health status. In addition, the final Notice requires programs for which disability is not an eligibility criterion to collect disability-related information only after the client has been admitted into the program.

The final Notice also contains specific language in Section 4 that requires providers to post a sign at each intake desk (or comparable location) stating the reasons for collecting this information. Providers are obligated to provide reasonable accommodations for persons with disabilities throughout the data collection process. This may include, but is not limited to, providing qualified sign language interpreters, readers or materials in accessible formats such as Braille, audio, or large type, as needed by the individual with a disability.

In addition, providers that are recipients of federal financial assistance shall provide required information in languages other than English that are common in the community, if speakers of these languages are found in significant numbers and come into frequent contact with the program.

Comment: Unclear how the program-specific data elements relate to the APR. Some of the commenters suggested that HUD clarify the relationship between the APR and the HMIS data collection requirements. Many of these commenters indicated that the proposed data elements and required response categories were not consistent with APR reporting requirements, despite HUD's stated intention to use HMIS data for APR reporting in the future.

HUD Response: As discussed in the general comments section, HUD anticipates moving toward an APR based on HMIS data, and therefore has made the final Notice consistent with the current APR. The response categories for several program-specific data elements (e.g., Destination and Services Received) were modified to be consistent with the APR. For example, the Destination data element contains the same places listed as response categories in the APR and asks service providers to report whether the destination is permanent or temporary and if the move involves one of HUD's housing programs. Also, a Reasons for Leaving data element was added to the program-specific data elements with response categories identical to the APR categories. Grantees that implement an HMIS in accordance with the final Notice will be able to satisfy HUD APR reporting requirements.

In addition, a cross-walk of HMIS and APR response categories is provided for both the Services Received and Destination program-specific data elements in Section 3 of this notice. The cross-walk provides guidance on how to meet APR reporting requirements using the HMIS response categories for these data elements.

As previously noted, HUD anticipates changes to the APR in the future, but not before most HUD grantees have implemented an HMIS that is compliant with this Notice. HUD will begin working with interested parties and its research and technical assistance experts to review the current competitive SHP, Shelter Plus Care (S+C), Section 8 Moderate Rehabilitation Single Room Occupancy Program (SRO) and formula Emergency Shelter (ESG) reports in order to standardize reporting across HUD homeless programs. The changes may include provisions allowing for the electronic submission of reports.

VII. Comments Regarding Privacy/Security and Technical Standards

Comment: Some commenters stated that the privacy standards were too demanding and impractical. Others viewed the standards as too lenient. Public comments on the privacy standards were mixed. Several commenters suggested that programs will not be able to implement many of the proposed privacy standards absent significant increases in staffing and funding. In particular, commenters said that it is unrealistic to expect front-line program staff to explain to each and every client how the information will be used and protected, and the advantages of providing accurate information.

Other commenters viewed the privacy standards as too lenient and were concerned about: Misuse of data by staff with access to the data; the lack of grievance procedures for investigating programs that violate privacy standards; the use of oral consent rather than written consent; and the impact of the standards on vulnerable populations, such as victims of domestic violence and persons with mental illness.

HUD Response: The wide range of public comments to the privacy standards underscores the diversity of providers and organizations involved in developing HMIS and the unique circumstances within programs that shape the various levels of privacy standards needed to protect clients. Providers that serve particularly vulnerable populations or those that conduct client assessments press for the highest possible privacy standards. Providers that serve large numbers of clients nightly and collect a limited amount of information or that have limited time to engage clients call for minimum standards that are less burdensome to implement. HUD clearly must be sensitive to all types of providers and design privacy standards that are sufficiently flexible to meet these dissimilar needs.

The final Notice addresses these differing needs by presenting the two-tiered privacy approach that is described in Section II of this preamble. Baseline privacy standards are required of all programs and balance the need to protect the confidentiality of client data with the practical realities of homeless service providers. Additional optional privacy protections are also presented for programs that choose to implement higher privacy standards because of the nature of their programs or service population. Although these additional privacy protections are optional, they are based on principles of fair information practices recognized by the information privacy community as appropriate for protecting personal information. Programs are encouraged to apply these additional protections as needed to provide a higher level of privacy when appropriate to meet local circumstances.

Comment: Security standards were too prescriptive. Some commenters objected to the security standards as overly prescriptive, particularly the proposed standards for passwords, workstation firewalls, and physical access. Some commenters stated that the password requirements were too complex for staff to remember, thus the requirement could prompt program staff to post their passwords in publicly accessible places, negating the security provided by the password. The requirement to install workstation firewalls was criticized by several commenters as cost prohibitive for agencies that are understaffed, especially in terms of information technology IT support, and underfunded. Some commenters indicated that the physical access provision requiring program staff to shut down a workstation when not in use was burdensome and unrealistic.

HUD Response: HUD agrees with these comments and has modified the security standards accordingly. The security standards in the final Notice follow the format of the privacy standards by presenting baseline requirements for all programs and additional security protections that communities may choose to implement to further ensure the security of their HMIS data. The baseline requirements are based on current information technology practices and rely on software applications that typically come with hardware purchased within recent years. For example: The password requirements have been simplified to meet minimum industry standards with the aim of reducing breaches in security from staff writing the passwords in publicly accessible areas; firewalls are not required on each individual workstation, so long as there is a firewall between that workstation and the outside world; and password-protected screen savers that automatically turn on are required to mitigate the burden of shutting down workstations.

Comment: Clarify how the privacy and security standards relate to the Health Insurance Portability and Accountability Act (HIPAA). Several commenters wanted HUD to clarify how the privacy and security standards for HMIS relate to the privacy and security rules for health information issued by the Department of Health and Human Services (HHS) under the authority of HIPAA. The commenters especially wanted clarification on how these standards would apply to homeless service providers that are not “covered entities” under HIPAA and therefore not obligated to abide by HIPAA regulations.

HUD Response: Based on input from a panel of experts (composed of homeless service providers, representatives from various federal agencies and national advocacy groups, and leading homeless researchers) and legal consultants, it is HUD's understanding that very few homeless service providers are “covered entities” under HIPAA. When a homeless service provider is a covered entity, the provider is required to operate in accordance with HIPAA regulations. The final Notice states that such a provider is not required to comply with the HMIS privacy or security standards. Exempting HIPAA covered entities from the HMIS privacy and security rules avoids all possible conflicts between the two sets of rules. Where a homeless service provider is not a covered entity under HIPAA, it is subject to the HMIS privacy and security standards. A provider is also subject to applicable state and local privacy laws.

Although most homeless programs are not subject to HIPAA, HUD recognizes that the HIPAA privacy rule establishes a national baseline of privacy standards for most health information. Accordingly, the HIPAA privacy rule was used as a guide for developing the HMIS privacy standards. For example, both the final Notice and HIPAA seek to assure that clients' personal information is properly protected while allowing for the flow of client information needed to provide and promote high quality services to clients. Like HIPAA, the HMIS final Notice strikes a balance between important and responsible uses of information and protecting the privacy of homeless persons who seek services. Further, both the HMIS final Notice and HIPAA are designed to recognize the unique programmatic and operational realities of a range of entities.

In several instances the HMIS baseline requirements exceed the requirements in the HIPAA privacy rule. Where programmatic and organizational realities of certain programs (e.g., programs that register a large numbers of clients daily) would make the use of HIPAA standards impractical, the privacy standards in this Notice diverge from HIPAA. Yet, in all instances, additional protocols or policies are presented that communities may choose to adopt to further ensure the privacy and confidentiality of information collected through HMIS.

Comment: Clarify disclosure provision for law enforcement purposes. Several commenters criticized the disclosure provision for law enforcement purposes as too lax and particularly inadequate in domestic violence situations. Commenters indicated a concern that some law enforcement personnel may have abused their access to databases containing sensitive personal information in the past. Furthermore, in situations involving domestic violence, commenters said that they are aware of instances where law enforcement personnel are the abusers; thus, the provision would place victims of domestic violence at risk. Most of these commenters suggested that the uses and disclosures provision for law enforcement purposes should require a court order, court ordered warrant, or a subpoena.

HUD Response: The standards pertaining to the uses and disclosures of information were based on the standards set forth in HIPAA. The general principle in HIPAA is that a covered entity is permitted, but not required, to disclose protected health information for law enforcement purposes, without an individual's authorization, for six specified purposes or situations. HIPAA allows covered entities to disclose protected health information to a law enforcement official: (1) As required by law or in compliance with court orders, subpoenas, and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official's request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person's death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; or (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime 45 CFR 164.512(f). HIPAA clearly allows disclosure of protected health information to law enforcement officials under several circumstances that do not involve court orders, warrants, or subpoenas.

In accordance with HIPAA standards, the final Notice adopts the general principle that all uses and disclosures are permissive and not mandatory, except for first party access to records and any required disclosures for oversight of compliance with HMIS privacy and security standards. However, HUD recognizes the particularly sensitive circumstances within certain programs and has made the following modifications to the final Notice. Among the permitted disclosures to law enforcement, this final Notice specifies that service providers may (but are not required to) disclose protected information in response to a law enforcement official's oral request for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person. In this case, the protected information is limited to name, address, date of birth, place of birth, SSN, and distinguishing physical characteristics. This provision is comparable to HIPAA. Furthermore, service providers may (but are not required to) disclose protected information for other law enforcement purposes to a law enforcement official if the law enforcement official: Makes a written request that is signed by a supervisory official of the law enforcement agency seeking the protected information; states that the information is relevant and material to a legitimate law enforcement investigation; identifies the protected information sought; is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and states that de-identified information could not be used to accomplish the purpose of the disclosure. This requirement is more restrictive than HIPAA.

Comment: Clarify HUD's intention that clients not be denied service if they refuse to supply identifying information, and how data collection may prompt some clients to feel coerced into participating in the HMIS. A few commenters were concerned that the proposed standards do not require providers to explicitly inform each client that some information requests are optional and that services cannot be denied if a client refuses to provide information. The commenters indicated that clients frequently perceive a power imbalance between themselves and housing and service providers and will consequently feel compelled to provide the requested information or risk being denied services.

HUD Response: The draft Notice stated that it is not HUD's intention that clients be denied service if they refuse to supply identifying information. HUD expects homeless service providers to attempt to collect the information specified in the final Notice for each client, but acknowledges that clients may choose not to provide information when Federal, State or local laws grant persons the right not to provide certain types of information.

HUD, other Federal agencies, State and local governments, and private funders of homeless services often require certain information to determine eligibility for housing or services or to assess needed services. This eligibility-related information is often statutory and/or regulation-based and is contained in provider agreements. Therefore, some providers are required to obtain certain information from homeless persons as a condition for receiving services. (See HUD's McKinney-Vento Act client-eligibility and assessment program requirements above). Exceptions to this requirement may occur in outreach programs to the street homeless or other nonresidential-based services such as soup kitchens. In such cases, an intake is often not taken, or even possible, and no information is required to access the service.

In addition, in some situations the potential dynamics within programs may prompt clients to feel coerced into supplying information. The final Notice has been modified to mitigate these circumstances. As discussed in previous sections, the methodology for collecting data was modified and programs are no longer required to collect sensitive data, particularly medical and health-related information, at program intake. The final Notice permits programs to collect much of this information during the client assessment process. By separating the data collection process from program entry, programs can build a relationship with clients and work to diminish any perceived power imbalances between provider and client.

In accordance with the baseline privacy standards specified in Section 4 of the Notice, providers are required to include a statement in their privacy notice that explains generally the reasons for collecting this information. Providers may use the following language to meet this standard: “We collect personal information directly from you for reasons that are discussed in our privacy statement. We may be required to collect some personal information by law, or by organizations that give us money to operate this program. Other personal information that we collect is important to run our programs, to improve services for homeless persons, and to better understand the needs of homeless persons. We only collect information that we consider to be appropriate.”

VIII. Paperwork Reduction Act

The information collection requirements in this Notice have been approved by the OMB and assigned OMB control numbers 2506-0145, 2106-0112, 2506-0133 and 2506-0117, respectively. In accordance with the Paperwork Reduction Act of 1995 U.S.C. (44 U.S.C. 3501-3520), an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the collection displays a valid control number.

1. Introduction to the Notice

This Notice sets forth the results of the Department's deliberative process to develop national data and technical standards for locally administered Homeless Management Information Systems (HMIS). An HMIS is a computerized data collection application designed to capture client-level information over time on the characteristics and service needs of homeless persons. HMIS is being used increasingly by communities across the country to improve the delivery of service to homeless persons and to obtain better information about their needs. Today's advanced HMIS applications offer homeless assistance providers the opportunity to collect information about client needs, service usage, and service outcomes. They also permit provider staff to access timely resource and referral information and to manage operations.

This Notice is divided into five parts. This Introduction describes the benefits of an HMIS for homeless persons, local homeless assistance providers, local bodies that plan for and coordinate homeless services (most frequently known as Continuums of Care [CoC] ^[1] ), and policy makers at the local and national levels. It also describes the statutory authority that allows HUD to prescribe HMIS data and technical standards and provides an overview of the standards and related requirements.

The next two parts of the Notice set forth the HMIS data standards. Section 2 presents the Universal data elements that HUD has determined must be collected from all clients receiving homeless assistance services. Section 3 presents Program-specific data elements that are to be collected from clients served by certain types of programs. Recommended data collection steps, required response categories, and suggested question wording are provided for each universal and program-specific data element, and, when appropriate, there is a discussion of special issues. Section 4 of the Notice describes the HMIS privacy and security standards for data confidentiality and security that apply to an HMIS and programs that collect, use, or process HMIS data. Finally, Section 5 addresses Technical standards for the creation of HMIS data systems.

This Notice is being published following a public comment period (July 22, 2003, to September 22, 2003) during which CoC planning bodies, homeless service providers, local and State governments, advocates, professional associations, homeless clients, and the general public had an opportunity to review and comment on the proposed standards.

1.1. The Benefits of a Local HMIS

The development of a local HMIS is about: (1) Bringing the power of computer technology to the day-to-day operations of individual homeless assistance providers; (2) knitting together providers within a local community in a more coordinated and effective housing and service delivery system for the benefit of homeless clients; and (3) obtaining and reporting critical aggregate information about the characteristics and needs of homeless persons.

An HMIS provides significant opportunities to improve access to, and delivery of, housing and services for people experiencing homelessness. An HMIS can accurately describe the scope of homelessness and the effectiveness of efforts to ameliorate it. An HMIS can strengthen community planning and resource allocation.

1.1.1. Benefits to Homeless Clients and Homeless Assistance Providers

An HMIS offers many specific benefits to homeless persons seeking assistance and the organizations that provide assistance. An HMIS offers front-line program staff tools for providing more effective client services through improved referrals, case management, and service coordination. If programs choose to share data about clients and services, program staff will be able to retrieve records of clients previously served, thereby streamlining the intake process. An HMIS reduces the frequency with which clients are required to complete intake forms and assessments. Homeless clients benefit directly from these service improvements as well as from the providers' improved ability to understand the needs of homeless persons and their use of homeless assistance resources.

1.1.2. Policy Makers and Planners

Local policy makers, planners and advocates can use aggregated HMIS data to demonstrate the size and characteristics of the homeless population in their communities and improve their understanding of service usage patterns by that population. HMIS data can also be used to identify and address service delivery gaps within the CoC and improve planners ability to link clients to mainstream programs that are essential to the prevention of homelessness and to sustaining formerly homeless people in permanent housing. Compared to other commonly used methods for gathering information on homeless persons, notably point-in-time census counts, HMIS allows local CoCs to obtain significantly better point-in-time and longitudinal data about homeless persons in their communities.

In addition, HMIS helps national policy makers and advocates to more effectively address homelessness. Congress has charged HUD with producing an Annual Homeless Assessment Report (AHAR) based on HMIS data. To carry out that responsibility, HUD has developed a representative sample of 80 jurisdictions and is helping those jurisdictions develop their HMIS, collect good quality data, and conduct analysis to support unduplicated counts of homeless service users and their characteristics at the local level. Analysis of HMIS data from the 80-jurisdiction sample will form the core of the AHAR and will enable Congress and HUD to better understand the needs of homeless persons and target Federal resources accordingly.

HUD also has responsibility for funding and monitoring several McKinney-Vento Act programs (42 U.S.C. 11301 et seq.). Individual programs authorized under the McKinney-Vento Act require the assessment of homeless needs, the provision of services to address those needs, and the reporting of outcomes of Federal assistance in helping homeless people to become more independent. HMIS will make it possible for HUD to request—and grantees to more quickly generate—information for Annual Progress Reports (APRs) that will enable HUD to report program results to Congress and the American public as required by the Government Performance Results Act and to meet its administrative and program responsibilities.

1.2. Statutory Authority

1.2.1. Direction to HUD on Homeless Management Information Systems

Over the past several years, Congress has expressed its concern for better local and national information about homeless persons through numerous conference and committee reports. Most recently, the Consolidated Appropriations Act of 2004 (Pub. L. 108-199, approved January 23, 2004) Conference Report (H.R. 108-401) stated: “The conferees reiterate the direction and reporting requirement included in the Senate Report regarding the collection and analysis of data to assess the effectiveness of the homeless system.”

Senate Report 108-143 stated:

The Committee remains supportive of the Department's ongoing work on data collection and analysis within the homeless program. HUD should continue its collaborative efforts with local jurisdictions to collect an array of data on homelessness in order to analyze patterns of use of assistance, including how people enter and exit the homeless assistance system, and to assess the effectiveness of the homeless assistance system. The Committee directs HUD to take the lead in working with communities toward this end, and to analyze jurisdictional data. The Committee directs HUD to report on the progress of this data collection and analysis effort by no later than March 12, 2004.

The Consolidated Appropriations Resolution of 2003 (Pub. L. 108-7, approved February 20, 2003) Conference Report (H.R. Report 108-10) provided guidance on obtaining data on the chronically homeless and support for HMIS data collection:

The conferees are concerned that the Department is not taking the proper steps to determine the extent to which HUD's homeless assistance programs are meeting the needs of chronically homeless people. Therefore, HUD is directed to begin collecting data on the percentage and number of beds and supportive services programs that are serving people who are chronically disabled and/or chronically homeless.

The conferees reiterate the direction and reporting requirement included in the Senate report regarding the collection and analysis of data to assess the effectiveness of the homeless system, and direct that such report also include HUD's timeline for finalizing data requirements for the Homeless Management Information Systems.

Senate Report 107-222 stated:

The Committee remains supportive of the Department's ongoing work on data collection and analysis within the homeless program. HUD should continue its collaborative efforts with local jurisdictions to collect an array of data on homelessness in order to analyze patterns of use of assistance, including how people enter and exit the homeless assistance system, and to assess the effectiveness of the homeless assistance system. The Committee directs HUD to take the lead in working with communities toward this end, and to analyze jurisdictional data within one year. The Committee directs HUD to report on the progress of this data collection and analysis effort by no later than May 13, 2003.

The Congress previously discussed the need for better data on homelessness in the Conference Report (H.R. Report 106-988) for Fiscal Year (FY) 2001 HUD Appropriations Act (Pub. L. 106-377, approved October 27, 2000). It stated:

The conferees reiterate and endorse language included in the Senate report regarding the need for data and analysis on the extent of homelessness and the effectiveness of McKinney Act programs * * * The conferees concur with the importance of developing unduplicated counts of the homeless at the local level, as well as taking whatever steps are possible to draw inferences from this data about the extent and nature of homelessness in the nation as a whole.

Likewise, the conferees agree that local jurisdictions should be collecting an array of data on homelessness in order to prevent duplicate counting of homeless persons, and to analyze their patterns of use of assistance, including how they enter and exit the homeless assistance system and the effectiveness of the systems. HUD is directed to take the lead in working with communities toward this end, and to analyze jurisdictional data within three years. Implementation and operation of Management Information Systems (MIS), and collection and analysis of MIS data, have been made eligible uses of Supportive Housing Program funds. The conferees direct HUD to report to the Committees within six months after the date of enactment of this Act on its strategy for achieving this goal, including details on financing, implementation, and maintaining the effort.

Congress directed HUD to take the lead in requiring every jurisdiction to have unduplicated client-level data within three years. The reasons for the emphasis and the specific directives on encouraging these systems were articulated in FY 2001 Senate Report 106-410:

The Committee believes that HUD must collect data on the extent of homelessness in America as well as the effectiveness of the McKinney homeless assistance programs in addressing this condition. These programs have been in existence for some 15 years and there has never been an overall review or comprehensive analysis on the extent of homelessness or how to address it. The Committee believes that it is essential to develop an unduplicated count of homeless people, and an analysis of their patterns of use of assistance (HUD McKinney homeless assistance as well as other assistance both targeted and not targeted to homeless people), including how they enter and exit the homeless assistance system and the effectiveness of assistance.

In the FY 1999 HUD Appropriations Act, Congress directed HUD to collect data from a representative sample of existing local HMIS. Specifically, House Report 105-610 stated that HUD should:

Collect, at a minimum, the following data: the unduplicated count of clients served; client characteristics such as age, race, disability status, units [days] and type of housing received (shelter, transitional, permanent); and services rendered. Outcome information such as housing stability, income, and health status should be collected as well.

In the FY 2001 HUD appropriations process, Senate Report 106-410 directed HUD to build on its earlier preliminary work with communities with an advanced HMIS and continue assessing data from these communities:

To continue on an annual basis to provide a report on a nationally representative sample of jurisdictions whose local MIS data can be aggregated yearly to document the change in demographics of homelessness, demand for homeless assistance, to identify patterns in utilization of assistance, and to demonstrate the effectiveness of assistance.

The Committee instructs HUD to use these funds to contract with experienced academic institutions to analyze data and report to the agency, jurisdictions, providers, and the Committee on findings.

1.2.2. Direction to HUD and Other Federal Agencies on Homeless Data Collection

In addition to Congressional direction relating to HMIS, HUD, other Federal agencies and the Interagency Council on the Homeless are required under various statutory authorities and Congressional direction to collect information about the nature and extent of homelessness. Individual programs authorized under the McKinney-Vento Act require the assessment of homeless needs, the provision of services to address those needs, and reporting on the outcomes of federal assistance in helping homeless people to become more independent. The major Congressional imperatives in HUD's McKinney-Vento Act programs are:

• Assessing the service needs of homeless persons;
• Ensuring that services are directed to meeting those needs;
• Assessing the outcomes of the services in nurturing efforts by homeless persons to become more self-sufficient; and
• Reporting to Congress on the characteristics and effectiveness of Federal efforts to address homelessness.

Both individually and as a whole, these provisions provide statutory imperatives for collecting comprehensive data on homeless individuals and their needs. This section progresses from the most general of the statutory authorities to the most specific programmatic authorities.

Interagency Council on the Homeless. The McKinney-Vento Homeless Assistance Act directs the Interagency Council on the Homeless (ICH) to undertake a number of tasks on interagency coordination, evaluation, and reporting that mandate the collection and dissemination of information on homeless individuals and their needs:

(a) Duties.

The Council shall—

(1) Review all Federal activities and programs to assist homeless individuals;

(2) Take such actions as may be necessary to reduce duplication among programs and activities by Federal agencies to assist homeless individuals;

(3) Monitor, evaluate, and recommend improvements in programs and activities to assist homeless individuals conducted by Federal agencies, State and local governments, and private voluntary organizations;

* * * * *

(5) Collect and disseminate information relating to homeless individuals;

(6) Prepare the annual reports required in subsection (c)(2) of this section;

(Section 203(a), McKinney-Vento Homeless Assistance Act).

Each Federal agency is required to report to the ICH: A description of each program to assist homeless individuals and the number of homeless individuals served by the program; impediments to use of the program by homeless individuals; and efforts by the agency to increase homeless assistance services. The ICH, in turn, is required to submit an annual report to the President and Congress that:

(A) Assesses the nature and extent of the problems relating to homelessness and the needs of homeless individuals;

(B) Provides a comprehensive and detailed description of the activities and accomplishments of the Federal Government in resolving the problems and meeting the needs assessed pursuant to subparagraph (A);

(Section 203(a), McKinney-Vento Homeless Assistance Act)

In the following excerpt from the 2001 Senate Report on the HUD Appropriations Act, at page 53, Congress further directed the revitalized ICH to assess how mainstream programs can prevent homelessness.

The committee also recognizes that homelessness cannot be ended by homeless assistance providers alone—it requires the involvement of a range of Federal programs. Accordingly it has included $500,000 for the staffing of the Interagency Council on the Homeless. It instructs the Council specifically to require HUD, HHS, Labor, and VA to quantify the number of their program participants who become homeless, to address ways in which mainstream programs can prevent homelessness among those they serve, and to describe specifically how they provide assistance to people who are homeless* * *

Comprehensive Housing Affordability Strategy/Consolidated Plan. Every jurisdiction that receives funding from certain HUD programs (HOME, Community Development Block Grant, Housing Opportunities for Persons with AIDS, Emergency Shelter Grants) must submit a comprehensive housing strategy that includes a Consolidated Plan section dealing with homeless needs and an analysis of impediments to fair housing choice. Every jurisdiction is required to:

Describe the nature and extent of homelessness, including rural homelessness, within the jurisdiction, providing an estimate of the special needs of various categories of persons who are homeless or threatened with homelessness, including tabular presentation of such information; and a description of the jurisdiction's strategy for (A) helping low-income families avoid becoming homeless; (B) addressing the emergency shelter and transitional housing needs of homeless persons (including a brief inventory of facilities and services that meet such needs within that jurisdiction); and (C) helping homeless persons make the transition to permanent housing and independent living. (Section 105(a)(2), Cranston-Gonzalez National Affordable Housing Act (42 U.S.C. 12701 et seq.)

The implementing regulations and administrative directions detail how the 50 states, Puerto Rico, the U.S. territories and over 1000 metropolitan cities and urban counties present narratives and data tables on homeless needs, current services, and the plans to address and prevent homelessness.

HUD'S McKinney-Vento Act Program Requirements. The McKinney-Vento Act contains a consistent philosophy and an accompanying set of statutory mandates concerning the framework for assessing homeless needs and addressing them with appropriate services. The McKinney-Vento Act also recognizes the importance of ensuring confidentiality in recordkeeping and public disclosure of information concerning homeless persons seeking domestic violence shelter and services. In addition, all of HUD's McKinney-Vento Act assistance must be consistent with the local jurisdiction's Consolidated Plan.

Emergency Shelter Grant (ESG) Program. Each governmental and nonprofit recipient of ESG funds is required to certify to HUD that it will undertake certain responsibilities regarding the provision of services, including that:

* * * * *

(3) It will assist homeless individuals in obtaining—

(A) Appropriate supportive services, including permanent housing, medical and mental health treatment, counseling, supervision, and other services essential for achieving independent living; and

(B) Other Federal, State, local, and private assistance available for such individuals;

* * * * *

(5) It will develop and implement procedures to ensure the confidentiality of records pertaining to any individual provided family violence prevention or treatment services under any project assisted under this subtitle and that the address or location of any family violence shelter project assisted under this subtitle will, except with written authorization of the person or persons responsible for the operation of such shelter, not be made public;

(6) Activities undertaken by the recipient with assistance under this subtitle are consistent with any housing strategy submitted by the grantee in accordance with Section 105 of the Cranston-Gonzalez National Affordable Housing Act (Sections 415(c)(3), (5) and (6), McKinney-Vento Homeless Assistance Act).

Supportive Housing Program. The Supportive Housing Program (SHP) funds transitional and permanent supportive housing and supportive services only projects that require grant recipients to collect specific information from clients concerning their qualification for services, their service needs, and progress toward assisting clients to independent living. HUD requires projects to report on the number and characteristics of clients served and their outcomes.

The statute provides that:

(a) IN GENERAL—To the extent practicable, each project shall provide supportive services for residents of the project and homeless persons using the project, which may be designed by the recipient or participants.

(b) REQUIREMENTS—Supportive services provided in connection with a project shall address the special needs of individuals (such as homeless persons with disabilities and homeless families with children) intended to be served by a project (Section 425(a) and (b), McKinney-Vento Homeless Assistance Act).

The McKinney-Vento Act requires every project in the Supportive Housing Program to conduct an on-going assessment of client needs for services and their availability for the client. This information is necessary to assess the progress of the project in moving clients to independent living and to report to HUD. In addition, special protections on confidentiality of recordkeeping involving persons provided domestic violence services are specified.

Section 426 of the McKinney-Vento Homeless Assistance Act provides that—

(c) REQUIRED AGREEMENTS—The Secretary may not provide assistance for any project under this subtitle unless the applicant agrees—

(1) To operate the proposed project in accordance with the provisions of this subtitle;

(2) To conduct an ongoing assessment of the supportive services required by homeless individuals served by the project and the availability of such services to such individuals;

(3) To provide such residential supervision as the Secretary determines is necessary to facilitate the adequate provision of supportive services to the residents and users of the project;

(4) To monitor and report to the Secretary on the progress of the project;

(5) To develop and implement procedures to ensure (A) the confidentiality of records pertaining to any individual provided family violence prevention or treatment services through any project assisted through this subtitle, and (B) that the address or location of any family violence shelter project assisted under this subtitle will not be made public, except with written authorization of the person or persons responsible for the operation of such project;

* * * * *

(7) To comply with such other terms and conditions as the Secretary may establish to carry out this subtitle in an effective and efficient manner.

Shelter Plus Care (S+C) Program. The Shelter Plus Care (S+C) Program funds tenant-, sponsor-, and project-based rental assistance and rental assistance in connection with moderate rehabilitation for single-room occupancy units in conjunction with supportive services funded from other sources for homeless persons with disabilities. Specific information is required to establish both the initial disability status of the client to enter the program and to ensure that appropriate supportive services are provided during the full term of the program to address the needs of the client and to meet the match requirement of the program.

* * * * *

Section 454(b) of the McKinney-Vento Homeless Assistance Act provides in part that:

(b) MINIMUM CONTENTS—The Secretary shall require that an application identify the need for the assistance in the community to be served and shall contain at a minimum—

* * * * *

(2) A description of the size and characteristics of the population of eligible persons;

* * * * *

(4) The identity of the proposed service provider or providers;

(5) A description of the supportive services that the applicant proposes to assure will be available for eligible persons;

(6) A description of the resources that are expected to be made available to provide the supportive services required by section 453;

(7) A description of the mechanisms for developing a housing and supportive services plan for each person and for monitoring each person's progress in meeting that plan * * *

The McKinney-Vento Act also requires recipients to provide for ongoing client assessments and provision of needed services. Section 456 states that the Secretary may not approve assistance under this subtitle unless the applicant agrees

(1) To operate the proposed program in accordance with the provisions of this subtitle;

(2) To conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program;

(3) To assure the adequate provision of supportive services to the participants in the program.

1.3. Development of Systems and Software

With Congressional support, HUD has been encouraging local CoCs to implement HMIS. Since 2001, the implementation of HMIS has been a fundable activity for CoCs under the Supportive Housing program, and since 2002, making progress towards implementing an HMIS has been part of HUD's review of the CoC applications.

Before implementation of an HMIS became a federal initiative, some communities had already developed sophisticated client-level information systems based on the technology of the time. Some of these were management systems for large local government programs (e.g., New York, Philadelphia). Others linked decentralized service providers around a centralized bed-registry (e.g., St. Louis) or an information and referral system. The success of these pioneering data management systems has prompted an increasing number of CoCs to develop similar systems to meet the needs of their clients and participating service providers. Software companies are developing specialized systems capable of documenting client demographic data, storing information on clients needs and on case management or treatment plans, identifying available services and tracking referrals, and monitoring service provision, progress, outcomes, and follow-up.

Reflecting experiences at both local and national levels to develop and test first-generation HMIS software, today's most advanced HMIS software combines a number of functions to enhance individual service provider operations and to link providers together into a broader CoC data system. These functions include:

Client Profile: Client demographic data obtained at intake and exit.

Client Assessment: Information on clients' needs and goals, as well as case management or treatment plans.

Service Outcomes: Client-level data on services provided, progress, outcomes, and follow-up.

Information and Referral/Resource Directories: Timely data on the network of available services within the Continuum to determine eligibility and provide referrals. Some systems provide documentation and tracking of a referral from one provider to the next and messaging capability.

Operations: Operational functionality that permits staff to manage day-to-day activities, including bed availability, and incident reporting.

Accounting: Traditional accounting tools and special components to record service activity/expenditures against specific grants. Some systems have donor and fundraising elements.

Thus, HMIS software provides local providers and agencies not only with comprehensive information on the nature of homelessness in their communities, but also with the ability to generate reports on their internal operations and for various funders. Because each participating provider agrees to share certain information with the HMIS central server, it also offers the capacity to generate reports on the operations of the CoC system as a whole.

One of HUD's major goals in this HMIS initiative is to help individual homeless service providers access the very best computer technology to assist them in their day-to-day operations and to help increase the effective coordination of services in the CoC. To this end, HUD has developed several publications to assist local jurisdictions including: Homeless Management Information System Consumer Guide: A Review of Available HMIS Solutions, January 2003; and Homeless Management Information Systems: Implementation Guide, September 2002. These guides can be found at: http://www.hud.gov/​offices/​cpd/​homeless/​hmis/​guide. HUD is also preparing a guide on local uses of HMIS data that will be available on HUD's Web site following the publication of this Notice in 2004.

1.4. Overview of Data Standards, Definitions, and Collection Requirements

1.4.1. Universal Data Elements

Data to be collected by all HMIS are those essential to the administration of local homeless assistance programs and to obtaining an accurate picture of the extent, characteristics and the patterns of service use of the local homeless population. These data elements are critical to meeting the Congressional requirement for HMIS. Therefore, all providers participating in a local HMIS will be required to collect the universal data elements from all homeless clients seeking housing or services, including date of birth, race, ethnicity, gender, veteran's status and Social Security Number (SSN). Standards for notification about the purposes of data collection, non-disclosure, and protection of this and other data elements are discussed in Section 4 of this Notice.

In addition to personal identifying information, the universal data elements include information on a client's demographic characteristics and recent residential history in order to enable local providers and communities to analyze patterns of homelessness and service use. Among other important uses, these data will enable CoCs to identify the chronically homeless. Section 2 of this Notice provides more detail on the data standards for the universal data elements.

1.4.2. Program-Specific Data Elements

Program-specific data elements are needed to assess the operations and outcomes of programs that provide services to homeless clients. HUD, other Federal agencies, State and local governments, and private funders of homeless services often require certain information to assess services, to determine eligibility for housing or services provided by particular programs, and to monitor service provision and outcomes for clients. This eligibility-related information is often statutory and/or regulation-based and is contained in provider agreements. Therefore, some providers are required to obtain certain information from homeless persons as a condition for receiving services. (See HUD's McKinney-Vento Act client-eligibility and assessment program requirements above).

Program-specific data elements should be collected from all clients served by programs that are required to report this information to HUD or other organizations. For programs with no such reporting requirement, these standards are recommended to allow data across all local programs to be easily analyzed. For programs that receive funding through HUD's SHP, S+C Program, and Section 8 Moderate Rehabilitation for Single Room Occupancy Dwellings (SRO) Program, as well as HOPWA-funded homeless programs, most program-specific data elements are required to complete APRs. Exceptions to this requirement may occur in outreach programs to the street homeless or other nonresidential-based services such as soup kitchens. In such cases, an intake is often not taken, or even possible, and no information is required to access the service.

Data elements required to assess operations and outcomes of programs include private or sensitive information on topics such as income, physical disabilities, behavioral health status, and whether the client is currently at risk of domestic violence. As described in Section 4, CoCs will have to establish firm policies and procedures to protect against unauthorized disclosure of personal information. Section 3 of this Notice provides more detail on the standards for program-specific data elements.

1.4.3. Data Collection and Reporting

As will be discussed further in Sections 2 and 3, the data standards establish uniform definitions for the types of information to be collected but not uniform protocols for how the data are to be collected. With some exceptions, the data need not be collected at a standard point in time during intake, assessment, or provision of services, as programs differ in the ways in which these functions are performed. The intent is not to add the administration of a survey questionnaire to other program activities, but rather to ensure that information with standardized meaning is entered into the HMIS.

Providers will be required to report the client-level data specified in this Notice on a regular basis to a central data storage facility in order to make it possible for the CoC to eliminate duplicate records and analyze the data for local planning purposes. The CoC will be responsible for aggregating the data and preparing an unduplicated local count of homeless persons and a description of their characteristics and patterns of service use. The CoC must retain the data for a period of seven years, adhering to the security provisions set forth in Section 4 of this Notice. An HMIS should have the ability to record client data from a limitless number of service transactions for longitudinal data analysis and assessment of client outcomes (often referred to as a “transactional” or “relational” database structure). The maintanence of historical data is discussed in Section 5 of this Notice.

1.4.4. Additional HMIS Data Elements

Particular programs (or the entire local CoC) may wish to collect assessment, service tracking, and outcome information in more detail than required by the uniform HMIS standards. For example, with regard to behavioral health, a program may wish to capture significantly more information about a client's psychiatric history or current status than is specified under the program-specific data elements. Such elective data elements are developed at the discretion of each CoC.

Just as is the case for the universal data elements and program-specific data elements, the collection of additional data within the HMIS is subject to privacy and fair housing laws and practices.

1.5. Other HMIS Provisions

1.5.1. Participation Requirements for Providers Receiving HUD McKinney-Vento Act Funding

Given the benefits of an HMIS for providing accurate estimates of the homeless population and its needs and improving housing and service provision at the local level, all recipients of HUD McKinney-Vento Act program funds are expected to participate in an HMIS. The HUD McKinney-Vento Act programs include ESG, SHP, S+C, and Section 8 Moderate Rehabilitation for SRO. In the FY 2003 funding notices for the SHP, S+C, and Section 8 Moderate Rehabilitation for SRO programs, HUD announced that providing data to an HMIS is a condition of funding for grantees.

The annual CoC application requires information about a CoC's progress in developing and implementing its HMIS. This information is used to rank CoCs in order to determine annual program funding. The application questions will be more detailed in the future to make possible an accurate determination of the extent of coverage and stage of implementation of each HMIS.

1.5.2. Participation Requirements for HOPWA-Funded Homeless Projects

Projects that receive HOPWA funding and target homeless persons are required to participate in HMIS. Such projects involve efforts to: provide outreach and assess the needs of persons with HIV/AIDS who are homeless; provide housing and related supportive services; and conduct project evaluation activities for this sub-population. HOPWA projects that assist persons who are homeless but do not target this sub-population are not required to participate in HMIS. However, such projects are encouraged to consider the benefits of an HMIS in coordinating assistance for clients and in reporting to funders. HOPWA projects that target homeless persons are required to integrate efforts within their Continuum of Care, including the use of the HMIS.

As noted in Section 3 (data element 3.5: HIV/AIDS), the HMIS standards will require the collection of information on a client's HIV/AIDS status. Such information is covered by confidentiality requirements. As in other areas involving sensitive or protected client information, information should be recorded only when a program or project has adequate data confidentiality protections. These protections include agency policies and procedures and staff training to ensure that HIV-related information cannot be learned by anyone without the proper authorization.

1.5.3. Annual Progress Reports

Recipients of funds under the SHP, S+C, Section 8 SRO and HOPWA Programs are required to submit APRs to HUD. The Notice provides guidance for how to use HMIS data in submitting the current version of the APR. Homeless shelter and service providers receiving funds under the Emergency Shelter Grant (ESG) program are required to participate in an HMIS if the provider is located in a jurisdiction covered by a CoC with an HMIS. Entitlement communities and states are not required to set up an HMIS for homeless providers receiving ESG funds in jurisdictions not covered by a CoC HMIS.

HUD intends at some point to use an APR driven by HMIS data to measure the performance of both McKinney-Vento Act program grantees and CoCs more generally. Prior to implementation of performance-based measures, performance indicators would be developed through a process of consultation with homeless service providers. Performance indicators would need to be carefully designed to include appropriate adjustments for the characteristics of the population served by a CoC and individual providers and the nature of the services provided. CoCs and software developers would be given sufficient time to adopt enhancements to their systems to accommodate new outcome indicators.

1.5.4. Sharing HMIS Data Among Providers Within a CoC

While local providers will be required to report client-level data to a CoC's central data storage facility on a regular basis, sharing of HMIS data among providers within the CoC is not required by HUD and is at the discretion of each CoC and its providers. In communities where data are shared, providers may choose to share all of the information that is collected about clients or limit that information to a small number of data elements. Where there is limited data sharing, providers should allow access to at least the clients' names, SSNs, and birthdates in order to prevent the creation of duplicate client records within the CoC. HUD encourages data sharing among providers within a Continuum of Care as sharing of HMIS information allows maximum benefits from such systems. From an operational perspective, it improves the ability of service provider staff to coordinate and deliver services to homeless clients. (Section 2 discusses how communities can obtain an unduplicated count of homeless persons when data are not shared.)

1.5.5. Access To HMIS Data Outside the Local Continuum of Care

The HMIS initiative is not a federal effort to track homeless people and their identifying information beyond the local level. HUD has no plans to develop a national client-level database with personal identifiers of homeless service users, having concluded that such an endeavor would create serious impediments to provider participation in local HMIS.

To produce the AHAR, HUD will request aggregated data produced by local HMIS analysts responsible for the 80 jurisdictions in the AHAR sample as well as self-selected non-sample jurisdictions that have a high proportion of homeless assistance providers contributing data to their local HMIS. The aggregated data will represent an unduplicated count of client records at the CoC level. There will be no use of protected personal identifiers to de-duplicate records across CoCs.

Any research on the nature and patterns of homelessness that uses client-level HMIS data will take place only on the basis of specific agreements between researchers and the entity that administers the HMIS. These agreements must reflect adequate standards for the protection of confidentiality of data and must comply with the disclosure provisions in Section 4 of this final Notice. For example, such agreements will be necessary if any of the jurisdictions included in the AHAR sample choose to report client-level data to the organizations conducting the AHAR analysis for HUD rather than reporting aggregated data. Under no circumstances will any identifiers be shared with the Federal Government under these special arrangements. For more information on the AHAR research project, see HUD's Web site at http://www.hud.gov/​offices/​cpd/​homeless/​hmis/​standards/​hmisfaq.pdf.

1.5.6. Special Provisions for Domestic Violence Shelters

Domestic violence shelters and other programs that assist victims of domestic violence play an important role in many CoCs and have received significant funding through local Continuums. Victims of domestic violence are also served in many general purpose programs funded by HUD. HUD is aware of, and is sensitive to, the data confidentiality and security concerns that many domestic violence programs have with respect to their participation in a local HMIS.

At the same time, HUD recognizes that HMIS can provide valuable data concerning domestic violence victims' needs, and localities have been able to greatly improve their service delivery to this vulnerable population. In communities across the country, domestic violence programs are already providing data to local HMIS. The key to participation hinges on the availability of sophisticated HMIS software that addresses data security issues and the development of protocols within programs for data security, confidentiality, and sharing that satisfy the concerns of domestic violence programs.

After careful review, HUD has determined that it will require domestic violence programs that receive HUD McKinney-Vento funds to participate in local HMIS. HUD expects domestic violence programs that receive HUD McKinney-Vento funds to implement the universal and, where applicable, program-specific data elements described in this final Notice. Adopting these standards is essential if domestic violence programs are to comply with HUD reporting requirements. CoC representatives are instructed to meet with domestic violence program staff in their communities with the goal of developing procedures and protocols that will provide the necessary safeguards for victims of domestic violence and address the concerns of domestic violence programs. All HMIS data is subject to the privacy and security standards set forth in Section 4 of this Notice.

HUD is prepared to provide extensive technical assistance to communities to develop the best possible solutions for domestic violence victims and providers. Given that it may take additional time to reach agreement in communities where domestic violence programs do not presently provide data, HUD will permit CoCs to stage the entry of domestic violence programs last, including after the October 2004 goal for HMIS implementation. The later staging of entry into the HMIS by domestic violence programs will be taken into account in HUD's assessment of CoC progress in HMIS implementation in the national CoC competitive ranking process.

1.6. Staging of Local HMIS Implementation

HUD recognizes that developing and implementing an HMIS is a difficult and time-consuming process and must necessarily be done in stages. It is expected that all CoCs will make progress toward meeting the Congressional direction for implementation of HMIS by October 2004. As shown in the chart, a CoC's first priority is to bring on board emergency shelters, transitional housing programs, and outreach programs. Providers of emergency shelter, transitional housing, and homeless outreach services should be included in the HMIS as early as possible, regardless of whether they receive funding through the McKinney-Vento Act or from other sources.

As a second priority, HUD encourages CoCs to actively recruit providers of permanent supportive housing funded by HUD McKinney-Vento Act programs and other HUD programs. As a third priority, CoCs should recruit homelessness prevention programs, Supportive Services Only programs funded through HUD's Supportive Housing Program, and non-federally funded permanent housing programs.

Other Federal agencies that fund McKinney-Vento Act programs have their own data collection and reporting requirements. Key Federal agency representatives were invited and participated in consideration of the proposed HMIS data elements for this Notice. HUD continues to work with those agencies to maximize standardization of McKinney-Vento Act reporting requirements and to broaden adoption of HMIS-based data.

Efforts to recruit providers into the HMIS will require local HMIS designers to make trade-offs between the desirability of including as many homeless service providers as early as possible and the feasibility of obtaining high quality data. At the same time, given the benefits of HMIS to clients, service providers, and the larger CoC system, a high degree of coverage is both desirable and advantageous.

2. Data Standards For Universal Data Elements

The universal data elements should be collected by all agencies serving homeless persons. HUD carefully weighed the reporting burden of the universal data elements against the importance of the information for producing meaningful local and Federal reports. Of special concern to HUD was the reporting burden for programs that register large numbers of applicants on a daily basis, with little time to collect information from each applicant. As a result, the number of universal data elements was kept to a minimum, and the ease of providing the information requested and whether or not many homeless service providers were already collecting such information was considered for each element.

The universal data standards will make possible unduplicated estimates of the number of homeless people accessing services from homeless providers, basic demographic characteristics of people who are homeless, and their patterns of service use. The universal data standards will also allow measurement of the number and share of chronically homeless people who use homeless services. The standards will enable generation of information on shelter stays and homelessness episodes over time. The universal data elements are:

2.1: Name

2.2: Social Security Number

2.3: Date of Birth

2.4: Ethnicity and Race

2.5: Gender

2.6: Veteran Status

2.7: Disabling Condition

2.8: Residence Prior to Program Entry

2.9: Zip Code of Last Permanent Address

2.10: Program Entry Date

2.11: Program Exit Date

2.12: Unique Person Identification Number

2.13: Program Identification Number

2.14: Household Identification Number

Data elements 2.1 through 2.9 require that staff from a homeless assistance agency enter information provided by a client into the HMIS database. Data elements 2.1 to 2.5 only need to be collected the first time a client uses a program offered by a provider or, within a CoC that shares local HMIS data, uses a program offered by any provider in that community. If some of this information is not collected the first time a client accesses services or is inaccurate, it may be added or corrected on subsequent visits. Data elements 2.6 to 2.9 may need to be collected in subsequent visits as this information can change over time. However, the new information that changes over time should be captured without overwriting the information collected previously.

The next two elements, 2.10 and 2.11, are entered by staff (or computer-generated) every time a client enters or leaves a program. Elements 2.12 to 2.14 are automatically generated by the data collection software, although staff inquiries are essential for the proper generation of these elements. Data elements 2.13 and 2.14 need to be generated for each program entry. Exhibit 1 at the end of this section summarizes the above information for each universal data element.

There are no mandated questions for obtaining the required information, although recommended questions are provided in Exhibit 2 at the end of this section. Providers have the flexibility to tailor data collection questions and procedures to their circumstances as long as the information is accurately and consistently collected given the response categories and definitions provided. As discussed in Section 4, HUD requires that clients be notified of the purpose for which the information is being collected and the ways in which the client may benefit from providing the information.

The response categories are required and the HMIS application must include the exact response categories that are presented in this section. For each data element, a definition indicating the type of information to be collected and the response categories are shown separately. Exhibit 3, at the end of this section, summarizes the required response categories for all the universal data elements. Section 5 of this Notice, Technical Standards, discusses approaches for handling missing response categories throughout the HMIS application.

All universal data elements must be obtained from each adult and unaccompanied youth who applies for a homeless assistance service. Most universal data elements are also required of children under age 18 in a household. Where a group of persons apply for services together (as a household or family), information about any children under the age of 18 in the household can be provided by the household head who is applying for services. The children do not need to be present at the time the household head applies for services. However, information should not be recorded for children under age 18 if it is indicated that these children will not be entering the program on the same day as the household head. Information for these children should be recorded when the children join the program. Information on any other adults (18 years of age or older) who are applying for services as part of the household will be obtained directly from that adult. Generally, one adult should not provide information for another adult.

All identifying information, including data elements 2.1 (Name), 2.2 (SSN), 2.3 (Date of Birth), 2.9 (Zip Code of Last Permanent Address), 2.10 Program Entry Date, 2.11 (Program Exit Date), 2.12 (Unique Person Identification Number), and 2.13 (Program Identification Number) need to have special protections to ensure the data are unusable by casual viewers. HMIS user access to this information will be highly restricted in accordance with Section 4 of this Notice.

2.1. Name

Rationale: The first, middle, last names, and suffix should be collected to support the unique identification of each person served.

Data Source: Client interview or self-administered form.

When Data Are Collected: Upon initial program entry or as soon as possible thereafter.

Subjects: All clients.

Definition and Instructions: Four fields should be created in the HMIS database to capture the client's full first, middle, and last names and any suffixes (e.g., John David Doe, Jr.). Try to obtain legal names only and avoid aliases or nicknames. Section 5 of this Notice discusses how to treat missing information for open-ended questions.

Required Response Categories:

Universal Data Element

2.1. Name	Response categories
Current name	First name	Middle name	Last name	Suffix.
Other Name Used to Receive Services previously	First name	Middle name	Last name	Suffix.
Example	John	David	Doe	Jr.

Special Issues: This data element should be treated as a protected personal identifier and is subject to the security standards for personal identifiers set forth in Part 4 of this Notice.

2.2. Social Security Number

Rationale: The collection of a client's Social Security Number (SSN) and other personal identifying information is required for two important reasons. First, unique identifiers are key to producing an accurate, unduplicated local count of homeless persons accessing services covered by HMIS. This is particularly critical in jurisdictions where homeless assistance providers do not share data at the local level and are, therefore, unable to use a Personal Identification Number to de-duplicate (at intake) across all the programs participating in the CoC's HMIS (see data element 2.12 for more information). Where data are not shared, CoCs must rely on a set of unique identifiers to produce an unduplicated count once the data are sent to the CoC or central server. Name and date of birth are useful unique identifiers, but these identifiers by themselves do not facilitate as accurate an unduplicated count of homeless persons as using SSN since names change and people share the same date of birth. Where data are shared across programs, SSN greatly improves the process of identifying clients who have been previously served and allows programs to de-duplicate upon program entry.

Second, an important Congressional goal is to increase the use of mainstream programs by homeless persons. To achieve this goal, homeless service providers need the SSN along with the other personal identifiers in order to access mainstream services for their clients.

Data Source: Interview or self-administered form.

When Data Are Collected: Upon initial program entry or as soon as possible thereafter.

Subjects: All clients.

Definitions and Instructions: In one field, record the nine-digit Social Security Number. In another field, record the appropriate SSN data quality code.

Required Response Categories:

Universal Data Element

2.2 Social security number	Response categories
Social Security number	___/__/____ (example: 123 45 6789)
SSN data quality code	1 = Full SSN reported. 2 = Partial SSN reported. 8 = Don't know or don't have SSN. 9 = Refused.

Special Issues: Although the HMIS application's data entry form may include hyphens or back slashes within the SSN to improve readability, one alphanumeric field without hyphens should be created within the HMIS database. Ideally, if only a partial SSN is recorded, the database should fill in the missing numbers with blanks so that the provided numbers are saved in the correct place of the Social Security Number. (For example, if only the last four digits of the SSN, “123456789” are given, it should be stored as “  6789” and if only the first three digits are provided, it should be stored as “123  ”.) This will allow maximum matching ability for partial SSNs.

Under Federal law (5 U.S.C. 552a), a government agency cannot deny shelter or services to clients who refuse to provide their SSN, unless the requirement was in effect before 1975 or SSN is a statutory requirement for receiving services from the program. This data element should be treated as a protected personal identifier and is subject to the security standards for personal identifiers set forth in Section 4 of this Notice.

2.3. Date of Birth

Rationale: The date of birth can be used to calculate the age of persons served at time of program entry or at any point in receiving services. It will also support the unique identification of each person served.

Data Source: Client interview or self-administered form.

When Data Are Collected: Upon initial program entry or as soon as possible thereafter.

Subjects: All clients.

Definitions and Instructions: Collect the month, day, and year of birth for every person served. If a client cannot remember the year of birth, ask the person's age and calculate the approximate year of birth. If a client cannot remember the month or day of birth, communities may record an approximate date of “01” for month and “01” for day since this approximation is a best practice among data users. Communities that already have a policy of entering another approximate date may continue this policy. Approximate dates for month and day will allow calculation of a person's age within one year of their actual age.

Required Response Categories:

Universal Data Element

2.3 Date of birth	Response categories
__/__/____ (e.g., 08/31/1965). (Month) (Day) (Year)

Special Issues: One date-format field for birth dates should be created in the HMIS database. This data element should be treated as a protected personal identifier and is subject to the security standards for personal identifiers set forth in Section 4 of this Notice.

2.4. Ethnicity/Race

Rationale: Ethnicity and race are used to count the number of homeless persons who identify themselves as Hispanic or Latino and to count the number of homeless persons who identify themselves within five different racial categories. In the October 30, 1997 issue of the Federal Register (62 FR 58782), the Office of Management and Budget (OMB) published “Standards for Maintaining, Collecting, and Presenting Federal Data on Race and Ethnicity.” All existing Federal recordkeeping and report requirements must be in compliance with these Standards as of January 1, 2003. The data standards in this Notice follow the OMB guidelines and can be used to complete HUD form 27061.

Data Source: Interview or self-administered form.

When Data Are Collected: Upon initial program entry or as soon as possible thereafter.

Subjects: All clients.

Definitions and Instructions: In separate data fields, collect both the self-identified Hispanic or Latino ethnicity and the self-identified race of each client served. Allow clients to identify multiple racial categories. Staff observations should not be used to collect information on ethnicity and race.

2.4.1. Ethnicity

The definition of Hispanic or Latino ethnicity is a person of Cuban, Mexican, Puerto Rican, South or Central American or other Spanish culture of origin, regardless of race.

2.4.2. Race

Definitions of each of the race categories are as follows:

1.—American Indian or Alaska Native is a person having origins in any of the original peoples of North and South America, including Central America, and who maintains tribal affiliation or community attachment.

2.—Asian is a person having origins in any of the original peoples of the Far East, Southeast Asia or the Indian subcontinent including, for example, Cambodia, China, India, Japan, Korea, Malaysia, Pakistan, the Philippine Islands, Thailand and Vietnam.

3.—Black or African American is a person having origins in any of the black racial groups of Africa. Terms such as “Haitian” or “Negro” can be used in addition to “Black or African American.”

4—Native Hawaiian or Other Pacific Islander is a person having origins in any of the original peoples of Hawaii, Guam, Samoa or other Pacific Islands.

5—White is a person having origins in any of the original peoples of Europe, the Middle East or North Africa.

Required Response Categories:

Universal Data Element

2.4—Ethnicity and race	Response categories
Ethnicity	0 = Non-Hispanic/Latino. 1 = Hispanic/Latino.
Race	1 = American Indian or Alaska Native. 2 = Asian. 3 = Black or African-American. 4 = Native Hawaiian or Other Pacific Islander 5 = White

2.5. Gender

Rationale: To create separate counts of homeless men and homeless women served.

Data Source: Interview, observation, or self-administered form.

When Data Are Collected: Upon initial program entry or as soon as possible thereafter.

Subjects: All clients.

Data definitions and instructions: Record the gender of each client served.

Required Response Categories:

Universal Data Element

2.5 Gender	Response categories
	0 = Female. 1 = Male.

Special Issues: Programs may add “transgender male to female” and “transgender female to male” categories as needed. However, for reporting purposes these categories are to be aggregated to the “male” or “female” categories based on the client's self-perceived sexual identity.

2.6. Veteran Status

Rationale: To determine the number of homeless veterans.

Data Source: Interview or self-administered form.

When Data Are Collected: Upon initial program entry or as soon as possible thereafter.

Subjects: All adults served.

Definition and Instructions: A veteran is someone who has served on active duty in the Armed Forces of the United States. This does not include inactive military reserves or the National Guard unless the person was called up to active duty.

Required Response Categories:

Universal Data Element

2.6 Veteran status	Response categories
	0 = No. 1 = Yes. 8 = Don't Know. 9 = Refused.

2.7. Disabling Condition

Rationale: Disability condition is needed to help identify clients meeting HUD's definition of chronically homeless and, depending on the source of program funds, may be required to establish client eligibility to be served by the program.

Data Source: Client interview, self-administered form, observation, or assessment. Where disability is a statutory or regulatory eligibility criteria, the data source is the evidence required by the funding source.

When Data are Collected: At any time after the client has been admitted into the program.

Subjects: All adults served.

Definition and Instructions: For this data element, a disabling condition means: (1) A disability as defined in Section 223 of the Social Security Act; (2) a physical, mental, or emotional impairment which is (a) expected to be of long-continued and indefinite duration, (b) substantially impedes an individual's ability to live independently, and (c) of such a nature that such ability could be improved by more suitable housing conditions; (3) a developmental disability as defined in section 102 of the Developmental Disabilities Assistance and Bill of Rights Act; (4) the disease of acquired immunodeficiency syndrome or any conditions arising from the etiological agency for acquired immunodeficiency syndrome; or (5) a diagnosable substance abuse disorder.

Required Response Categories:

Universal Data Element

2.7 Disabling condition	Response categories
	0 = No. 1 = Yes. 8 = Don't Know. 9 = Refused.

Special Issues: Homeless service providers must separate the client intake process for program admission from the collection of disability information in order to comply with Fair Housing laws and practices, unless this information is required to determine program eligibility.

For the purposes of defining an adult that meets HUD's definition of chronically homeless, programs should use the Disabling Condition data element along with: Date of Birth (to determine that the person is 18 years of age or older); Household Identification Number (to identify unaccompanied individuals); and Residence Prior to Program Entry or prior information on Program Entry and Program Exit dates (to determine the number of episodes of homelessness and length of time a person is homeless).

2.8 Residence Prior to Program Entry

Rationale: To identify the type of residence and length of stay at that residence just prior to program admission.

Data Source: Interview or self-administered form.

When Data Are Collected: At any time after the client has been admitted into the program.

Subjects: All adults and unaccompanied youth served.

Definition and Instructions: In separate fields, determine the type of living arrangement the night before entry into the program and the length of time the client spent in that living arrangement.

Required Response Categories:

Universal Data Element

2.8 Residence prior to program entry	Response category
Type of Residence	1 = Emergency shelter (including a youth shelter, or hotel, motel, or campground paid for with emergency shelter voucher). 2 = Transitional housing for homeless persons (including homeless youth). 3 = Permanent housing for formerly homeless persons (such as SHP, S+C, or SRO Mod Rehab). 4 = Psychiatric hospital or other psychiatric facility. 5 = Substance abuse treatment facility or detox center. 6 = Hospital (non-psychiatric). 7 = Jail, prison or juvenile detention facility. 10 = Room, apartment, or house that you rent. 11 = Apartment or house that you own. 12 = Staying or living in a family member's room, apartment, or house. 13 = Staying or living in a friend's room, apartment, or house. 14 = Hotel or motel paid for without emergency shelter voucher. 15 = Foster care home or foster care group home. 16 = Place not meant for habitation (e.g., a vehicle, an abandoned building, bus/train/subway station/airport or anywhere outside). 17 = Other. 8 = Don't Know. 9 = Refused.
Length of Stay in Previous Place	1 = One week or less. 2 = More than one week, but less than one month. 3 = One to three months. 4 = More than three months, but less than one year. 5 = One year or longer.

Special Issues: For APR reporting purposes, programs should use the following coding approach to conform with the response categories in the current APR:

Cross-Walk of HMIS and APR Response Categories for Residence Prior to Program Entry

Response categories in the final notice	Corresponding response categories in the current APR
1 = Emergency shelter	b = Emergency Shelter.
2 = Transitional housing for homeless persons	c = Transitional housing for homeless persons.
3 = Permanent housing for formerly homeless persons	k = Other.
4 = Psychiatric hospital or other psychiatric facility*	d = Psychiatric facility.
5 = Substance abuse treatment facility or detox center*	e = Substance abuse treatment facility.
6 = Hospital (non-psychiatric)*	f = Hospital.
7 = Jail, prison or juvenile detention facility*	g = Jail/prison.
8 = Don't Know	k = Other.
9 = Refused	k = Other.
10 = Room, apartment, or house that you rent	j = Rental housing.
11 = Apartment or house that you own	k = Other.
12 = Staying or living in a family member's room, apartment, or house	i = Living with relatives/friends.
13 = Staying or living in a friend's room, apartment, or house	i = Living with relatives/friends.
14 = Hotel or motel paid for without emergency shelter voucher	k = Other.
15 = Foster care home or foster care group home	k = Other.
16= Place not meant for habitation	a = Non-housing.
17 = Other	k = Other.

In addition, for response categories marked with an asterisk (*), if the client came from one of these institutions but was there for less than 30 days and was living in an emergency shelter or in a place not meant for habitation prior to entry, the client should be counted for APR reporting purposes in either the “emergency shelter” or “place not meant for habitation” categories, as appropriate.

This standard does not preclude the collection of residential history information beyond the residence experienced the night prior to program admission.

2.9 Zip Code of Last Permanent Address

Rationale: To identify the former geographic location of persons experiencing homelessness.

Data Source: Interview or self-administered form.

When Data Are Collected: Upon initial program entry or as soon as possible thereafter.

Subjects: All adults and unaccompanied youth.

Definition and Instructions: In one field, record the five-digit zip code of the apartment, room, or house where the client last lived for 90 days or more. In another field, record the appropriate Zip data quality code.

Required Response Categories:

Universal Data Element

2.9 Zip code of last permanent residence	Response categories
Zip Code	_ _ _ _ _ (e.g., 12345)
Zip Data Quality Code	1 = Full Zip Code Recorded. 8 = Don't Know. 9 = Refused.

Special Issues: This data element should be treated as a protected personal identifier and is subject to the security standards for personal identifiers set forth in Section 4 of this Notice.

2.10 Program Entry Date

Rationale: To determine the length of stay in a homeless residential program or the amount of time spent participating in a services-only program.

Data Source: Recorded by the staff responsible for registering program entrants.

When Data Are Collected: Upon any program entry (whether or not it is an initial program entry).

Subjects: All clients.

Definition and Instructions: Record the month, day, and year of first day of service of program entry. For a shelter visit, this date would represent the first day of residence in a shelter program following residence outside of the shelter or in another program. For services, this date may represent the day of program enrollment, the day a service was provided, or the first date of a period of continuous participation in a service (e.g., daily, weekly or monthly).

There should be a new program entry date (and corresponding program exit date) for each period/episode of service. Therefore, any return to a program after a break in treatment, completion of the program, or termination of the program by the user or provider must be recorded as a new program entry date. A definition of what constitutes a break in the treatment depends on the program and needs to be defined by program staff. For example, programs that expect to see the same client on a daily (or almost daily) basis may define a break in treatment as one missed day that was not arranged in advance or three consecutive missed days for any reason. Treatment programs that are scheduled less frequently than a daily basis may define a break in treatment as one or more missed weekly sessions.

Required Response Categories:

Universal Data Element

2.10 Program entry date	Response categories
	_ _ /_ _ /_ _ _ _ (example: 01/30/2004. (Month) (Day) (Year).

Special Issues: This data element should be treated as a protected personal identifier and is subject to the security standards for personal identifiers set forth in Section 4 of this Notice.

2.11 Program Exit Date

Rationale: To determine the length of stay in a homeless residential program or the amount of time spent participating in a services-only program.

Data Source: Recorded by the staff responsible for monitoring program utilization or conducting exit interviews.

When Data Are Collected: Upon any program exit.

Subjects: All clients.

Definition and Instructions: Record the month, day and year of last day of service. For a program providing housing or shelter to a client, this date would represent the last day of residence in the program's housing before the client transfers to another residential program or leaves the shelter. For example, if a person checked into an overnight shelter on January 30, 2004, stayed over night and left in the morning, the last date of service for that shelter stay would be January 31, 2004. To minimize staff and client burden at shelters that require most (or all) clients to reapply for service on a nightly basis, the provider can enter the entry and exit date at the same time or can specify software that automatically enters the exit date as the day after the entry date for clients of the overnight program.

For services, the exit date may represent the last day a service was provided or the last date of a period of continuous service. For example, if a person has been receiving weekly counseling as part of an ongoing treatment program and either formally terminates his or her involvement or fails to return for counseling, the last date of service is the date of the last counseling session. If a client uses a service for just one day (i.e., starts and stops before midnight of same day, such as an outreach encounter), the entry and exit date would be the same date.

Required Response Categories:

Universal Data Element

2.11 Program exit date	Response categories
	_ _ /_ _ /_ _ _ _ (example: 01/30/2004. (Month) (Day) (Year).

Special Issues: This data element should be treated as a protected personal identifier and is subject to the security standards for personal identifiers set forth in Section 4 of this Notice.

2.12 Unique Person Identification Number

Rationale: Every client receiving homeless assistance services within a CoC is assigned a Personal Identification Number (PIN), which is a permanent and unique number generated by the HMIS application. The PIN is used to obtain an unduplicated count of persons served within a CoC. The PIN is the only identifier that is guaranteed to be present and unique for each client served. A client may not have or may not know their SSN, while other identifying information such as name may be the same as another client's.

Data Source: Where data are shared across programs in a CoC, staff will determine at intake whether a client has been assigned a PIN previously by any of the participating programs. To make this determination, the staff enters personal identifying information (Name, SSN, Date of Birth, and Gender) into the HMIS application. The application then searches a CoC's centralized database for matching records. If a match is found and a PIN is retrieved, the same PIN will be assigned to the client. If no matches are found, a new randomly generated PIN is assigned to the client.

Where data are not shared across programs, staff will similarly determine at intake whether a client has been assigned a PIN previously by their agency or program. If the client is found within their program records, the same PIN will be assigned to the client. If the client has not been served by their program previously, a PIN is randomly generated and assigned to the client. The PIN will allow programs to produce an unduplicated count of clients served by their program. Programs will provide client-level information on a regular basis to the CoC system administrators who are responsible for producing a CoC-wide unduplicated count.

When Data Are Collected: Upon program entry.

Subjects: All clients.

Definition and Instructions: Assign a unique ID number to each client served. The PIN is a number automatically generated by the HMIS application (see Section 5 of this Notice). The PIN will not be based on any client-specific information, but instead should be a randomly, computer-generated number.

Required Response Categories:

Universal Data Element

2.12 Personal Identification Number	Response categories
	A PIN must be created, but there is no required format as long as there is a single unique PIN for every client served in the CoC and it contains no personally identifying information.

Special Issues: This data standard should be treated as a protected personal identifier and is subject to the security standards for personal identifiers set forth in Section 4 of this Notice.

2.13 Program Identification Information

Rationale: Program identification information will indicate the geographic location of a program, its facility and CoC affiliation, and whether the program is a street outreach, emergency shelter, transitional housing, permanent supportive housing, homeless prevention, services-only or other type of program.

Data Source: Selected by staff from a list of programs available within a particular agency or the CoC. Upon selection of a program from the list, the HMIS application will assign the program identification information to every program event for each client.

When Data Are Collected: Upon any program entry (whether or not it is an initial program entry).

Subjects: All clients.

Definition and Instructions: The program identification information consists of four components that identifies the geographic location of a program Federal Information Processing Standards (FIPS code), its facility and CoC affiliation, and whether it is a street outreach, emergency shelter, transitional housing, permanent supportive housing, homeless prevention, services-only or other type of program. For each client, staff will only need to select the name of the program servicing the client. Staff will not need to view or have access to the actual program identification number. For some providers with only one program for all clients, the HMIS application can be specified to automatically generate the Program Identification Information. For more information on the components of this data element, see Section 5 of this Notice.

Required Response Categories:

Universal Data Element

	Response categories
2.13 Program Identification Information
Federal Information Processing Standards (FIPS Code)	10-digit FIPS code identifying geographic location of provider (see Part 5 of Notice for instructions on how to obtain FIPS code).
Facility Code	Identification code for facility where services provided (Locally Determined).
Continuum of Care Code	HUD-Assigned.
Program Type Code	1 = Emergency shelter (e.g., facility or vouchers) 2 = Transitional housing 3=Permanent supportive housing 3 = Permanent supportive housing 4 = Street outreach 5 = Homeless prevention (e.g., security deposit or one month's rent) 6 = Services only type of program 7 = Other

Special Issues: The FIPS code, facility code, CoC code, and program type code should be stored as separate fields in the database. This data element should be treated as a protected personal identifier and is subject to the security standards for personal identifiers set forth in Section 4 of this Notice.

2.14 Household Identification Number

Rationale: To count the number of households served.

Data Source: Interview or staff observation that a client is participating in a program with other members of a household.

When Data Are Collected: Upon any program entry (whether or not it is an initial program entry) or as soon as possible thereafter.

Subjects: All clients.

Required Response Categories:

Universal Data Element

2.14 Household identification number	Response categories
	A Household ID number must be created, but there is no required format as long as the number allows identification of clients that receive services as a household.

Special Issues: A household is a group of persons who together apply for homeless assistance services. If it is not evident to program staff whether or not the others are applying for assistance with the client, then program staff should ask if anyone else is applying for assistance with the client.

Persons can join a household with members who have already begun a program or leave a program although other members of the household remain in the program. A common household identification number should be assigned to each member of the same household. Individuals in a household (adults and/or children) who are not present when the household initially applies for assistance and later join the household should be assigned the same household identification number that links them to the rest of the persons in the household. For example, a child may be in school when the adult applies for assistance, but will be part of the household receiving assistance from the program right from the start. Or, a child may be in foster care at the time service is initiated, but may rejoin the household to receive services several weeks later. See Section 5 of this Notice for more information on this data element.

Exhibit 1: Summary of Universal Data Elements

Data standards	Subjects	Protected personal information	Data entry or computer generated	Collect at initial or every service event
2.1 Name	All Clients	Protected	Data Entry	Initial Only.1
2.2 Social Security Number	All Clients	Protected	Data Entry	Initial Only.1
2.3 Date of Birth	All Clients	Protected	Data Entry	Initial Only.1
2.4 Ethnicity and Race	All Clients		Data Entry	Initial Only.
2.5 Gender	All Clients		Data Entry	Initial Only.
2.6 Veteran Status	Adults		Data Entry	Every Time.
2.7 Disabling Condition	Adults		Data Entry	Every Time.
2.8 Residence Prior to Program Entry	Adults and Unaccompanied Youth		Data Entry	Every Time.
2.9 Zip Code of Last Permanent Address	Adults and Unaccompanied Youth	Protected	Data Entry	Every Time.
2.10 Program Entry Date	All Clients	Protected	Data Entry	Every Time.
2.11 Program Exit Date	All Clients	Protected	Data Entry	Every Time.
2.12 Unique Personal Identification Number	All Clients	Protected	Computer-Generated	Initial Only.
2.13 Program Identification Number	All Clients	Protected	Computer-Generated	Every Time.
2.14 Household Identifier Number	All Clients		Computer-Generated	Every Time.
1 Note that one or more of these personal identifiers may need to be asked on subsequent visits to find and retrieve the client's record. However, this information only needs to be recorded on the initial visit.

2.1 Name

Q: “What is your first, middle, and last name, and suffix?” (legal names only; avoid aliases or nicknames)

2.2 Social Security Number (SSN)

Q: “What is your Social Security Number?”

2.3 Date of Birth

Q: “What is your birth date?”

If complete birth date is not known:

Q: “What is your age?”

2.4 Ethnicity and Race

Q: “Are you Hispanic or Latino?”

Q: “What is your race (you may name more than one race)?”

2.5 Gender

Q: “Are you male or female?

2.6 Veteran Status

Q: “Have you ever served on active duty in the Armed Forces of the United States?”

2.7 Disabling Condition

Q: “Do you have a physical, mental, emotional or developmental disability, HIV/AIDS, or a diagnosable substance abuse problem that is expected to be of long duration and substantially limits your ability to live on your own?”

2.8 Residence Prior to Program Entrance

Q: “Where did you stay last night?”

Q: “How long did you stay at that place?”

2.9 Zip Code of Last Permanent Residence

Q: “What is the zip code of the apartment, room, or house where you last lived for 90 days or more?”

2.10 Program Entry Date

No question needed.

2.11 Program Exit Date

No question needed.

2.12 Personal Identification Number (PIN)

To facilitate the search for an existing PIN, may want to ask:

Q: “Have your ever been served by this [name of facility or program] before?”

2.13 Program Identification Number

No question needed.

2.14 Household Identification Number

If it is not evident that others are applying for or receiving assistance with the client, then may want to ask:

Q: “Is there someone else who is applying for (or receiving) assistance with you?” If yes,

Q: “What is their first, middle, and last name?” (legal names only; avoid aliases and nicknames)

Q: “Do you have any children under 18 years of age with you?” If yes,

Q: “What is (are) the first, middle, and last name(s) of the child(ren) with you?”

Exhibit 3: Required Response Categories for Universal Data Elements

2.1 Name	Response Categories
Current Name	First Name	Middle Name	Last Name	Suffix
Other Name Used to Receive Services Previously	First Name	Middle Name	Last Name	Suffix
Example	John	David	Doe	Jr.

2.2 Social security number	Response categories
Social security number	__,_,__ (example: 123 45 6789)
SSN data quality code	1 = Full SSN Reported
	2 = Partial SSN Reported
	8 = Don't Know or Don't Have SSN
	9 = Refused
2.3 Date of birth	Response categories
	___/__/__ (e.g., 08/31/1965) (Month) (Day) (Year)
2.4 Ethnicity and race	Response categories
Ethnicity	0 = non-Hispanic/Latino
	1 = Hispanic/Latino
Race	1 = American Indian or Alaska Native
	2 = Asian
	3 = Black or African-American
	4 = Native Hawaiian or Other Pacific Islander
	5 = White
2.5 Gender	Response categories
	0 = Female 1 = Male
2.6 Veteran status	Response categories
	0 = No
	1 = Yes
	8 = Don't Know
	9 = Refused
2.7 Disabling condition	Response categories
	0 = No
	1 = Yes
	8 = Don't Know
	9 = Refused
2.8 Residence prior to program entry	Response category
Type of residence	1 = Emergency shelter (including a youth shelter, or hotel, motel, or campground paid for with emergency shelter voucher)
	2 = Transitional housing for homeless persons (including homeless youth)
	3 = Permanent housing for formerly homeless persons (such as SHP, S+C, or SRO Mod Rehab)
	4 = Psychiatric hospital or other psychiatric facility
	5 = Substance abuse treatment facility or detox center
	6 = Hospital (non-psychiatric)
	7 = Jail, prison or juvenile detention facility
	10 = Room, apartment, or house that you rent
	11 = Apartment or house that you own
	12 = Staying or living in a family member's room, apartment, or house
	13 = Staying or living in a friend's room, apartment, or house
	14 = Hotel or motel paid for without emergency shelter voucher
	15 = Foster care home or foster care group home
	16 = Place not meant for habitation (e.g., a vehicle, an abandoned building, bus/train/subway station/airport or anywhere outside)
	17 = Other
	8 = Don't Know
	9 = Refused
Length of stay in previous place	1 = One week or less
	2 = More than one week, but less than one month
	3 = One to three months
	4 = More than three months, but less than one year
	5 = One year or longer
2.9 Zip code of last permanent residence	Response categories
Zip code	_ _ _ _ _ (e.g., 12345)
Zip data quality code	1 = Full Zip Code Recorded
	8 = Don't Know
	9 = Refused
2.10 Program entry date	Response categories
	_/_/_ (example: 01/30/2004) (Month) (Day) (Year)
2.11 Program exit date	Response categories
	_/_/_ (example: 01/31/2004) (Month) (Day) (Year)
2.12 Personal identification number	Response categories
	A PIN must be created, but there is no required format as long as there is a single unique PIN for every client served in the CoC and it contains no personally identifying information.
2.13 Program identification information	Response categories
Federal information processing standards (FIPS code)	10-digit FIPS code identifying geographic location of provider (see Part 5 of Notice for instructions on how to obtain FIPS code).
Facility code	Identification code for facility where services provided (Locally Determined)
Continuum of care code	HUD-Assigned
Program type code	1 = Emergency shelter (e.g., facility or vouchers)
	2 = Transitional housing
	3 = Permanent supportive housing
	4 = Street outreach
	5 = Homeless prevention (e.g., security deposit or one month's rent)
	6 = Services only type of program
	7 = Other
2.14 Household identification number	Response categories
	A Household ID number must be created, but there is no required format as long as the number allows identification of clients that receive services as a household.

3. Program-Specific Data Elements

Program-specific data elements must be collected from all clients served by programs that are required to report this information to HUD and other organizations. For programs with no such reporting requirements, these standards are optional but recommended since they allow local CoCs to obtain consistent information across a range of providers that can be used to plan service delivery, monitor the provision of services, and identify client outcomes. These data elements, however, do not constitute a client assessment tool, and providers will need to develop their own data collection protocols in order to properly assess a client's need for services. For programs that receive funding through HUD's Supportive Housing Program, Shelter Plus Care, Section 8 Moderate Rehabilitation for Single Room Occupancy Dwellings (SRO) Program, and the homeless programs funded through Housing Opportunities for Persons with AIDS (HOPWA), most program-specific data elements are required to complete Annual Progress Reports (APRs).

The program-specific data elements that are required for HUD's current APR reporting include:

3.1: Income and Sources

3.2: Non-Cash Benefits

3.3: Physical Disability

3.4: Developmental Disability

3.5: HIV/AIDS

3.6: Mental Health

3.7: Substance Abuse

3.8: Domestic Violence

3.9: Services Received

3.10: Destination

3.11: Reasons for Leaving

In addition to these data elements that are required for APR reporting, additional program-specific data elements are recommended by a team of HMIS practitioners, federal agency representatives, and researchers. These data elements are based on best practices that are currently being implemented at the local level. In addition, HUD is working to bring together federal agencies that fund McKinney-Vento programs in an effort to standardize the data elements and definitions used by these agencies in their reporting requirements. This effort to standardize data definitions and standards across federal agencies will make reporting easier and more consistent for homeless providers who use multiple federal funding sources. Some of these data elements may be added to HUD APRs in the future. They include:

3.12: Employment

3.13: Education

3.14: General Health Status

3.15: Pregnancy Status

3.16: Veteran's Information

3.17: Children's Education

A summary of the program-specific data elements is provided at the end of this section (see Exhibit 4).

All of the program-specific data elements require that staff from a homeless assistance agency enter information into the HMIS database. This information may be:

• Provided by the client (in the course of client assessment and, for some data elements, at program exit);
• Taken from case manager interviews or records; and/or
• Observed by program staff.

Information should be collected separately from each adult and unaccompanied youth. In the case of a household or family that is receiving services together, information should be obtained and recorded for each adult and child in the household. However, for current APR reporting purposes, programs should continue to report only on participants defined by HUD as single persons and adults in families, excluding children or caregivers who live with the adults, who receive assistance during the operating year.

If the source of information is a client interview, staff are encouraged to use the questions that are provided in Exhibit 5 “Recommended Questions for Program-Specific Data Elements” at the end of this section. HUD requires that clients be notified as to why the information is being collected and the ways in which clients may benefit from providing the information. Programs that collect this information should be prepared to help the person, to the extent practicable, either by directly providing services or providing a referral, and programs should provide adequate data confidentiality protections, including adequate training of staff, to ensure that this information remains confidential. As discussed in Section 4 of this Notice, local CoCs must establish firm policies and procedures to protect against unauthorized disclosure of, or misuse of, personal information.

For each program-specific data element, multiple response categories are provided. For APR-required data elements, the response categories and associated codes are required and the HMIS application must include these responses and codes exactly as they are presented in this section. The response categories and corresponding codes for each data element are summarized at the end of this section (see Exhibit 6). Section 5 of this Notice discusses the technical standards for handling specific types of response categories and codes (e.g., missing values and “other” response categories) throughout the HMIS application.

Finally, many of these data elements represent transactions or information that may change over time. The CoC should decide which program-specific data elements to update in cases where clients already have records in the HMIS and return to the program following a previous service episode.

3.1 Income and Sources

Rationale: Income and sources of income are important for determining service needs of people at the time of program entry, determining whether they are accessing all income sources for which they are eligible, and describing the characteristics of the homeless population. Capturing the amount of cash income from various sources will help to: assure all income sources are counted in the calculation of total income; enable program staff to take into account the composition of income in determining needs; determine if people are receiving the mainstream program benefits to which they may be entitled; help clients apply for benefits assistance; and allow analysis of changes in the composition of income between entry and exit from the program.

Data Source: Client interview, self-administered form, and/or case manager records.

When Data Are Collected: In the course of client assessment and at program exit. Needed to complete Annual Progress Reports for certain HUD McKinney-Vento Act programs.

Subjects: All clients served.

Definition and Instructions: In separate fields, determine (a) whether the client received income from each source listed below in the past 30 days, (b) the amount of income received from each source identified by the client, and (c) the client's total monthly income (rounded to the nearest U.S. dollar). Allow clients to identify multiple sources of income.

Required Response Categories:

Program—Specific Data Element

3.1 Income and source	Response category
Source and amount of income	Source of income	Amount from source $
	1 = Earned Income	_ _ _ _.00
	2 = Unemployment Insurance	_ _ _ _.00
	3 = Supplemental Security Income or SSI	_ _ _ _.00
	4 = Social Security Disability Income (SSDI)	_ _ _ _.00
	5 = A veteran's disability payment	_ _ _ _.00
	6 = Private disability insurance	_ _ _ _.00
	7 = Worker's compensation	_ _ _ _.00
	8 = Temporary Assistance for Needy Families (TANF) (or use local program name)	_ _ _ _.00
	9 = General Assistance (GA) (or use local program name)	_ _ _ _.00
	10 = Retirement income from Social Security	_ _ _ _.00
	11 = Veteran's pension	_ _ _ _.00
	12 = Pension from a former job	_ _ _ _.00
	13 = Child support	_ _ _ _.00
	14 = Alimony or other spousal support	_ _ _ _.00
	15 = Other source	_ _ _ _.00
	16 = No financial resources
Total monthly income		$_ _ _ _.00

Special Issues: For APR reporting purposes, the total monthly income should include only the income for participants as defined by HUD and should not include income associated with children or caregivers who live with the adults assisted. The income associated with children or caregivers who live with the adults assisted should be recorded separately as part of their individual client record.

Programs may choose to disaggregate the sources of income into more detailed categories as long as these categories can be aggregated into the above stated sources of income.

3.2 Non-Cash Benefits

Rationale: Non-cash benefits are important to determine whether people are accessing all mainstream program benefits for which they may be eligible and to ascertain a more complete picture of their situation.

Data Source: Client interview, self-administered form, and/or case manager records.

When Data Are Collected: In the course of client assessment and at program exit. Needed to complete Annual Progress Reports for certain HUD McKinney-Vento Act programs.

Subjects: All adults and unaccompanied youth served by the program.

Definition and Instructions: For each source listed below, determine if the client received any of the non-cash benefits in the past month (30 days). Allow clients to identify multiple sources of non-cash benefits.

Required Response Categories:

Program-Specific Data Element

3.2 Source of non-cash benefit	Response category
	1 = Food stamps or money for food on a benefits card
	2 = MEDICAID health insurance program (or use local name)
	3 = MEDICARE health insurance program (or use local name)
	4 = State Children's Health Insurance Program (or use local name)
	5 = Special Supplemental Nutrition Program for Women, Infants, and Children (WIC)
	6 = Veteran's Administration (VA) Medical Services
	7 = TANF Child Care services (or use local name)
	8 = TANF transportation services (or use local name)
	9 = Other TANF-funded services (or use local name)
	10 = Section 8, public housing, or other rental assistance
	11 = Other source

Special Issues: Programs may choose to disaggregate the non-cash sources of income into more detailed categories as long as these categories can be aggregated into the above-stated non-cash sources of income. Programs may also choose to record additional information about non-cash sources of income, including: information related to benefit eligibility (e.g., if a person is not receiving a service, is it because they are not eligible or eligibility has not yet been determined); amount of benefits; and start and stop dates for receipt of benefits.

3.3 Physical Disability

Rationale: To count the number of physically disabled persons served by homeless programs, determine eligibility for disability benefits, and assess their need for services.

Data Source: Client interview, self-administered form, and/or case manager records.

When Data Are Collected: In the course of client assessment once the individual is admitted, unless this information is needed prior to admission to determine program eligibility. Needed to complete Annual Progress Reports for certain HUD McKinney-Vento Act programs.

Subjects: All clients served.

Definition and Instructions: Determine if the client has a physical disability, meaning a physical impairment which is (a) expected to be of long-continued and indefinite duration, (b) substantially impedes an individual's ability to live independently, and (c) of such a nature that such ability could be improved by more suitable housing conditions.

Required Response Categories:

Program-Specific Data Element

3.3 Physical disability	Response category
	0=No 1=Yes

3.4 Developmental Disability

Rationale: To count the number of developmentally disabled persons served by homeless programs, determine eligibility for disability benefits, and assess their need for services.

Data Source: Client interview, self-administered form and/or case manager records.

When Data Are Collected: In the course of client assessment once the individual is admitted, unless this information is needed prior to admission to determine program eligibility. Needed to complete Annual Progress Reports for certain HUD McKinney-Vento Act programs.

Subjects: All clients served.

Definition and Instructions: Determine if the client has a developmental disability, meaning a severe, chronic disability that is attributed to a mental or physical impairment (or combination of physical and mental impairments) that occurs before 22 years of age and limits the capacity for independent living and economic self-sufficiency.

Required Response Categories:

Program-Specific Data Element

3.4 Developmental disability	Response category
	0=No 1=Yes

3.5 HIV/AIDS

Rationale: To identify persons who have been diagnosed with AIDS or have tested positive for HIV and assess their need for services.

Data Source: Client interview, self-administered form and/or case manager records.

When Data are Collected: In the course of client assessment once the individual is admitted, unless this information is needed prior to admission to determine program eligibility. Needed to complete APRs for certain HUD McKinney-Vento Act programs and is an eligibility requirement for HOPWA.

Subjects: All adults and unaccompanied youth served.

Definition and Instructions: Determine if the client has been diagnosed with AIDS or has tested positive for HIV. If the client does not provide the information and it is not contained in case manager records, leave the response field blank.

Required Response Categories:

Program-Specific Data Element

3.5 HIV/AIDS	Response category
	0=No 1=Yes

Special Issues: This information is required for determining eligibility for the HOPWA program. Such information is covered by confidentiality requirements. As in other areas involving sensitive or protected client information, information should be recorded only when a program or project has adequate data confidentiality protections. These protections include agency policies and procedures and staff training to ensure that HIV-related information cannot be learned by anyone without the proper authorization.

3.6 Mental Health

Rationale: To count the number of persons served with mental health problems, and to assess the need for treatment.

Data Source: Client interview, self-administered form and/or case manager records.

When Data are Collected: In the course of client assessment once the individual is admitted, unless this information is needed prior to admission to determine program eligibility. Needed to complete APRs for certain HUD McKinney-Vento Act programs.

Subjects: All adults and unaccompanied youth served.

Definition and Instructions: In separate data fields, determine: (a) If the client has a mental health problem; and (b) whether it is expected to be of long-continued and indefinite duration and substantially impedes a client's ability to live independently. A mental health problem may include serious depression, serious anxiety, hallucinations, violent behavior or thoughts of suicide.

Required Response Categories:

Program-Specific Data Element

3.6 Mental Health	Response Category
Mental health problem	0=No 1=Yes
Expected to be of long-continued and indefinite duration and substantially impairs ability to live independently	0=No 1=Yes

3.7 Substance Abuse

Rationale: To count the number of persons served with substance abuse problems, and to assess the need for treatment.

Data Source: Client interview, self-administered form and/or case manager records.

When Data are Collected: In the course of client assessment once the individual is admitted, unless this information is needed prior to admission to determine program eligibility. Needed to complete APRs for certain HUD McKinney-Vento Act programs.

Subjects: All adults and unaccompanied youth served.

Definition and Instructions: In separate data fields, determine (a) if the client has an alcohol or drug abuse problem, or is dully diagnosed and (b) whether it is expected to be of long-continued and indefinite duration and substantially impedes a client's ability to live independently.

Required Response Categories:

Program-Specific Data Element

3.7 Substance abuse	Response category
Substance abuse problem	1 = Alcohol abuse
	2 = Drug abuse
	3 = Dully diagnosed
Expected to be of long-continued and indefinite duration and substantially impairs ability to live independently	0=No 1=Yes

3.8 Domestic Violence

Rationale: Ascertaining whether a person is a victim of domestic violence is necessary to provide the person with the appropriate services to prevent further abuse and to treat the physical and psychological injuries from prior abuse. Also, ascertaining that a person may be experiencing domestic violence may be important for the safety of program staff and other clients. At the aggregate level, knowing the size of the homeless population that has experienced domestic violence is critical for determining the resources needed to address the problem in this population.

Data Source: Client interview, self-administered form and/or case manager records.

When Data are Collected: In the course of client assessment. Needed to complete APRs for certain HUD McKinney-Vento Act programs.

Subjects: All adults and unaccompanied youth.

Definition and Instructions: In separate fields, determine (a) if the client has ever been a victim of domestic violence and (b), if so, how long ago did the client have the most recent experience.

Required Response Categories:

Program-Specific Data Element

3.8 Domestic violence	Response category
Domestic violence experience	0 = No 1 = Yes
(If yes) When experience occurred	1 = Within the past three months 2 = Three to six months ago 3 = From six to twelve months ago 4 = More than a year ago 8 = Don't know 9 = Refused

3.9 Services Received

Rationale: To determine the services provided during a program stay and any resulting outcomes. Some funders may want information on service receipt as a performance measure. Service receipt may also be useful in identifying service gaps in a community.

Data Source: Case manager records.

When Data are Collected: In the course of client assessment and at appropriate points during the program stay. Needed to complete Annual Progress Reports for certain HUD McKinney-Vento Act programs.

Subjects: All clients served.

Definition and Instructions: For each service encounter, two types of information must be determined and recorded in two separate fields. Record “date of service” as the two-digit month, two-digit day and four-digit year. Record “type of service” as one of the service types listed below.

Required Response Categories: Note that the services listed here cover all of the types of services that a homeless person receives. Not all of these services are eligible uses of HUD program funds.

Program-Specific Data Element

3.9 Services received	Response Category	Examples
Date of service	_ _/_ _/_ _ _ _ (Month) (Day) (Year)	(08/31/1965)
Service type	1 = Food	Emergency food programs and food pantries.
	2 = Housing placement	Housing search
	3 = Material goods	Clothing and personal hygiene items.
	4 = Temporary housing and other financial aid	Rent payment or deposit assistance
	5 = Transportation	Bus passes and mass transit tokens
	6 = Consumer assistance and protection	Money management counseling and acquiring identification/SSN
	7 = Criminal justice/legal services	Legal counseling and immigration services
	8 = Education	GED instruction, bilingual education, and literacy programs
	9 = Health care	Disability screening, health care referrals, and health education (excluding HIV/AIDS-related services, mental health care/counseling, and substance abuse services)
	10 = HIV/AIDS-related services	HIV testing, AIDS treatment, AIDS/HIV prevention and counseling
	11 = Mental health care/counseling	Telephone crisis hotlines and psychiatric programs
	12 = Substance abuse services	Detoxification and alcohol/drug abuse counseling
	13 = Employment	Job development and job finding assistance
	14 = Case/care management	Development of plans for the evaluation, treatment and/or care of persons needing assistance in planning or arranging for services
	15 = Day care	Child care centers and infant care centers
	16 = Personal enrichment	Life skills education, social skills training, and stress management
	17 = Outreach	Street outreach
	18 = Other

Special Issues: With few exceptions, the response categories for the type of services provided and the associated examples are based on A Taxonomy of Human Services: A Conceptual Framework with Standardized Terminology and Definitions for the Field, 1994 (published by the Alliance of Information and Referral Systems (AIRS) and INFO LINE of Los Angeles). The “HIV/AIDS-related services” category is not included in the taxonomy under a single heading; instead there are multiple types of HIV/AIDS services found at various service typology levels. The examples associated with this response category are specific types of services identified in the taxonomy. The “housing placement,” “outreach” and “other” response categories are not derived from the taxonomy.

The taxonomy is a classification system for human services that has been adopted by information and referral programs, libraries, crisis lines and other programs throughout the United States. It features a five-level hierarchical structure that contains 4,300 terms that are organized into 10 basic service categories. The taxonomy provides a common language for human services, ensuring that people have common terminology for naming services, agreements regarding definitions for what a service involves and a common way of organizing service concepts.

Programs are encouraged to review the Taxonomy of Human Services as a model for a complete list of examples, standardizing terminology and definitions of homeless services.

Programs may choose to disaggregate the types of services into more detailed service categories as long as they can be aggregated into the above stated service types.

For APR reporting purposes, programs should use the following coding approach to conform to the response categories in the current APR:

Cross-Walk of HMIS and APR Response Categories for Services Received

Response categories in the final notice	Corresponding response categories in the current APR
1 = Food	n = Other
2 = Housing/shelter	i = Housing placement
3 = Material goods	n = Other
4 = Temporary housing and other financial aid	n = Other
5 = Transportation	l = Transportation
6 = Consumer assistance and protection	c = Life skills
7 = Criminal justice/legal services	m = Legal
8 = Education	h = Education
9 = Health care	g = Other health care services
10 = HIV/AIDS-related services	f = HIV/AIDS-related services
11 = Mental health care/counseling	e = Mental health services
12 = Substance abuse services	d = Alcohol or drug abuse services
13 = Employment	j = Employment assistance
14 = Case/care management	b = Case management
15 = Day care	k = Child care
16 = Personal enrichment	c = Life skills (outside of case management)
17 = Outreach	a = Outreach
18 = Other	n = Other

3.10 Destination

Rationale: Destination is an important outcome measure.

Data Source: Client interview or self-administered form.

When Data Are Collected: At program exit. Needed to complete Annual Progress Reports for certain HUD McKinney-Vento Act programs.

Subjects: All clients served.

Definition and Instructions: Determine and record in three separate data fields: (1) Where the client will be staying after they leave the program; (2) if this move is permanent or transitional; and (3) does the move involve a HUD subsidy or other subsidy.

Required Response Categories:

Program-Specific Data Element

3.10 Destination	Response category
Destination	1 = Emergency shelter (including a youth shelter, or hotel, motel, or campground paid for with emergency shelter voucher)*
	2 = Transitional housing for homeless persons (including homeless youth)*
	3 = Permanent housing for formerly homeless persons (such as SHP, S+C, or SRO Mod Rehab)
	4 = Psychiatric hospital or other psychiatric facility
	5 = Substance abuse treatment facility or detox center
	6 = Hospital (non-psychiatric)
	7 = Jail, prison or juvenile detention facility
	10 = Room, apartment, or house that you rent
	11 = Apartment or house that you own
	12 = Staying or living in a family member's room, apartment, or house
	13 = Staying or living in a friend's room, apartment, or house
	14 = Hotel or motel paid for without emergency shelter voucher
	15 = Foster care home or foster care group home
	16 = Place not meant for habitation (e.g., a vehicle, an abandoned building, bus/train/subway station/airport or anywhere outside)
	17 = Other
	8 = Don't Know
	9 = Refused
Tenure	1 = Permanent
	2 = Transitional
	8 = Don't Know
	9 = Refused
Subsidy Type	0 = None
	1 = Public housing
	2 = Section 8
	3 = S+C
	4 = HOME program
	5 = HOPWA program
	6 = Other housing subsidy
	8 = Don't Know
	9 = Refused

Special Issues: For response categories marked with an asterisk (*), these destinations are currently not eligible for HOPWA funding.

Also, programs may choose to ask additional questions such as whether upon leaving the program the client will be reuniting with other family members who have not been with them during the program stay.

For APR reporting purposes, programs should use the following coding approach to conform to the response categories in the current APR:

Cross-Walk of HMIS and APR Response Categories for Destination

Response categories in the final notice	Corresponding response categories in the APR
Destination = 1	n = Emergency shelter.
Destination = 2	i = Transitional housing for homeless persons.
Destination = 3	d = Shelter Plus Care (S+C).
Subsidy Type = 3
Destination = 3	o = Other supportive housing.
Subsidy Type = not equal to 3
Destination = 4	k = Institution psychiatric hospital.
Destination = 5	l = Institution inpatient alcohol or other drug treatment facility.
Destination = 6	q = Other.
Destination = 7	m = Institution jail/prison.
Destination = 8, 9, 10, or 16	b = Public housing.
Subsidy Type = 1
Destination = 8, 9, 10, or 16	c = Section 8.
Subsidy Type = 2
Destination = 8, 9, 10, or 16	d = Shelter Plus Care (S+C).
Subsidy Type = 3
Destination = 8, 9, 10, or 16	e = HOME subsidized house or apartment.
Subsidy Type = 4
Destination = 8, 9, 10, or 16	f = Permanent other subsidized house or apartment.
Tenure = 1
Subsidy Type = 5
Destination = 8, 9, 10, or 16	q = Other (Please specify).
Tenure = 2
Subsidy Type = 5
Destination = 8 or 9	r = Unknown.
Subsidy Type = 6, 8 or 9
Destination = 10	a = Rental House or Apt (no subsidy).
Subsidy Type = 6, 8, or 9
Destination = 16	q = Other (Please specify).
Subsidy Type = 6, 8, 9
Destination = 11	g = Homeownership.
Destination = 12	h = Permanent: moved in with family or friends.
Tenure = 1
Destination = 12	j = Transitional: moved in with family or friends.
Tenure = 2, 8, or 9
Destination = 13	q = Other (Please specify).
Destination = 14	q = Other (Please specify).
Destination = 15	p = Other places not meant for human habitation (e.g., street).

3.11 Reasons for Leaving

Rationale: Reasons for leaving are used, in part, to identify the barriers and issues clients face in completing a program or staying in a residential facility, which may affect their ability to achieve economic self-sufficiency.

Data Source: Recorded by program staff.

When Data Are Collected: At program exit. Needed to complete Annual Progress Reports for certain HUD McKinney-Vento Act programs.

Subjects: All clients served.

Definition and Instructions: Identify the reason why the client left the program. If a client left for multiple reasons, record only the primary reason.

Required Response Categories:

Program-Specific Data Element

3.11 Reason for leaving	Response category
	1 = Left for a housing opportunity before completing program
	2 = Completed program
	3 = Non-payment of rent/occupancy charge
	4 = Non-compliance with project
	5 = Criminal activity/destruction of property/violence
	6 = Reached maximum time allowed by project
	7 = Needs could not be met by project
	8 = Disagreement with rules/persons
	9 = Death
	10 = Unknown/disappeared
	11 = Other

3.12 Employment

Rationale: To assess the program participant's employment status and need for employment services. This can serve as an important outcome measure.

Data Source: Client interview or self-administered form.

When Data Are Collected: In the course of client assessment and at program exit.

Subjects: All adults and unaccompanied youth served.

Definition and Instructions: In separate fields, determine: (1) If the client is currently employed; (2) if currently employed, how many hours did the client work in the last week; (3) if currently employed, is the work permanent, temporary, or seasonal; and (4) if the client is not currently working, if they are currently looking for work. Seasonal employment is work that can, by the nature of it, ordinarily only be performed during a certain season in the year. Temporary employment is work for a limited time only or for a specific piece of work and that work will last a short duration. Permanent employment is work that is contemplated to continue indefinitely.

Required Response Categories:

Program-Specific Data Element

3.12 Employment	Response category
Employed	0 = No 1 = Yes
If currently working, number of hours worked in the past week	___ hours
Employment tenure	1 = Permanent 2 = Temporary 3 = Seasonal
If client is not currently employed, is the client looking for work	0 = No 1 = Yes

Special Issues: Programs may choose to ask additional information about a person's employment status, for example any benefits (health insurance) received through employment or more detailed information on the type of employment.

3.13 Education

Rationale: To assess the program participant's readiness for employment and need for education services. It can also serve as an important outcome measure.

Data Source: Client interview or self-administered form.

When Data are Collected: In the course of client assessment and at program exit.

Subjects: All adults and unaccompanied youth served.

Definition and Instructions: In four separate fields, determine: (1) If the client is currently in school or working on any degree or certificate; (2) whether the client has received any vocational training or apprenticeship certificates; (3) what is the highest level of school that the client has completed; and (4) if the client has received a high school diploma or General Equivalency Diploma (GED), what degree(s) has the client earned. Allow clients to identify multiple degrees.

Required Response Categories:

Program-Specific Data Element

3.13 Education	Response category
Currently in school or working on any degree or certificate	0 = No 1 = Yes
Received vocational training or apprenticeship certificates	0 = No 1 = Yes
Highest level of school completed	0 = No schooling completed 1 = Nursery school to 4th grade 2 = 5th grade or 6th grade 3 = 7th grade or 8th grade 4 = 9th grade 5 = 10th grade 6 = 11th grade 7 = 12th grade, No diploma 8 = High school diploma 9 = GED 10 = Post-secondary school
If client has received a high school diploma, GED or enrolled in post-secondary education, what degree(s) has the client earned	0 = None 1 = Associates Degree 2 = Bachelors 3 = Masters 4 = Doctorate 5 = Other graduate/professional degree

3.14 General Health Status

Rationale: Information on general health status is a first step to identifying what types of health services a client may need. Changes in health status between intake and exit can be a valuable outcome measure. This data element permits the self-reported health status of homeless persons to be compared with the self-reported health status of the U.S. population in general.

Data Source: Client interview or self-administered form.

When Data are Collected: In the course of client assessment and at program exit.

Subjects: All clients served.

Definition and Instructions: Determine how the client assesses their health in comparison to other people their age.

Required Response Categories:

Program-Specific Data Element

3.14 General health	Response category
	1 = Excellent
	2 = Very good
	3 = Good
	4 = Fair
	5 = Poor
	8 = Don't Know

3.15 Pregnancy Status

Rationale: To determine eligibility for benefits and need for services, and to determine the number of women entering programs for homeless persons while pregnant.

Data Source: Client interview or self-administered form.

When Data are Collected: In the course of client assessment.

Subjects: All females of child-bearing age served.

Definition and Instructions: In separate fields, determine (a) if a client is pregnant and (b), if so, what is the due date. The due date is one field that consists of the two-digit month, two-digit day and four-digit year. If the day is unknown, programs are encouraged to record “01” as a default value. Communities that already have a policy of entering another approximate day may continue this policy. If the month is unknown, programs should leave the data field blank.

Required Response Categories:

Program-Specific Data Element

3.15 Pregnancy status	Response category
Pregnancy status	0 = No 1 = Yes
Due date	_ _/_ _/_ _ _ _ (Month) (Day) (Year).

3.16 Veteran's Information

Rationale: To collect a more detailed profile of the homeless veteran's experience and to determine eligibility for Department of Veterans Affairs (VA) programs and benefits. These questions were developed in consultation with the VA and reflect HUD's continuing effort to standardize data definitions and standards across federal agencies.

Data Source: Client interview or self-administered form.

When Data are Collected: In the course of client assessment.

Subjects: All persons who answered “Yes” to Veterans Status data element.

Definition and Instructions: In separate fields, determine: (1) Which military service era did the client serve; (2) how many months did the client serve on active duty in the military; (3) if the client served in a war zone; (4) if the client served in a war zone, the name of the war zone; (5) if the client served in a war zone, the number of months served in the war zone; (6) if the client served in a war zone, whether the client received hostile or friendly fire; (7) what branch of the military did the client serve in; and (8) what type of discharge did the client receive. In identifying the military service era served by the client, programs are encouraged to begin with the most recent service era and proceed in descending order through the various eras. Allow clients to identify multiple service eras and branches of the military.

Required Response Categories:

Program-Specific Data Element

3.16 Veteran's information	Response category
Military service eras	1 = Persian Gulf Era (August 1991-Present)
	2 = Post Vietnam (May 1975-July 1991)
	3 = Vietnam Era (August 1964-April 1975)
	4 = Between Korean and Vietnam War (February 1955-July 1964)
	5 = Korean War (June 1950-January 1955)
	6 = Between WWII and Korean War (August 1947-May 1950)
	7 = World War II (September 1940-July 1947)
	8 = Between WWI and WWII (December 1918-August 1940)
	9 = World War I (April 1917-November 1918)
Duration of active duty	__months
Served in a war zone	0 = No 1 = Yes
If yes, name of war zone	1 = Europe
	2 = North Africa
	3 = Vietnam
	4 = Laos and Cambodia
	5 = South China Sea
	6 = China, Burma, India
	7 = Korea
	8 = South Pacific
	9 = Persian Gulf
	10 = Other
If yes, number of months in war zone	__Months
If yes, received hostile or friendly fire	0 = No 1 = Yes
Branch of the military	1 = Army 2 = Air Force 3 = Navy 4 = Marines 5 = Other
Discharge status	1 = Honorable 2 = General 3 = Medical 4 = Bad conduct 5 = Dishonorable 6 = Other

3.17 Children's Education

Rationale: To determine if homeless children and youth have the same access to free, public education, including public preschool education, that is provided to other children and youth. It can also serve as an important outcome measure. These questions were developed in consultation with the U.S. Department of Education.

Data Source: Client interview or observations of program staff.

When Data Are Collected: In the course of client assessment. The data element is strongly recommended and may be added to HUD's APR in the future.

Subjects: All children between 5 and 17 years of age.

Definition and Instructions: For each child, determine in separate fields: (1) If the child is currently enrolled in school; (2) if the child is currently enrolled, the name of the school; (3) if the child is currently enrolled, the type school; (4) if the child is not currently enrolled in school, what date was the child last enrolled in school; and (5) what problems has the head of household had in getting the child enrolled into school. The last date of enrollment consists of the two-digit month and four-digit year. If the month is unknown, programs are encouraged to record “01” as a default value. Communities that already have a policy of entering another approximate month may continue this policy. If the year is unknown, programs should leave the data field blank. When identifying the problems the head of household encountered when enrolling the child in school, allow clients to identify multiple reasons for not enrolling the child in school.

Required Response Categories:

Program-Specific Data Element

3.17 Children's education	Response category
Current enrollment status	0 = No 1 = Yes
If yes, name of child's school	____ (Example: Lone Pine Elementary School)
If yes, type of school	1 = Public school 2 = Parochial or other private school
If not enrolled, last date of enrollment	__/____ (Month) (Year)
If not enrolled, identify problems in enrolling child	1 = None 2 = Residency requirements 3 = Availability of school records 4 = Birth certificates 5 = Legal guardianship requirements 6 = Transportation 7 = Lack of available preschool programs 8 = Immunization requirements 9 = Physical examination records 10 = Other

Special Issues: Programs may choose to obtain additional information related to children's education, such as the number of school days missed over a specific period of time, the barriers to school attendance and the name and type of the school.

Exhibit 4: Summary of Program-Specific Data Elements

Data standards	Subjects	Required for APR?	Data entry or computer-generated
3.1 Income and Sources	All Clients	Yes	Data Entry.
3.2 Non-Cash Benefits	Adults and Unaccompanied Youth	Yes	Data Entry.
3.3 Physical Disability	All Clients	Yes	Data Entry.
3.4 Developmental disability	All Clients	Yes	Data Entry.
3.5 HIV/AIDS	Adults and Unaccompanied Youth	Yes	Data Entry.
3.6 Mental health	Adults and Unaccompanied Youth	Yes	Data Entry.
3.7 Substance Abuse	Adults and Unaccompanied Youth	Yes	Data Entry.
3.8 Domestic Violence	Adults and Unaccompanied Youth	Yes	Data Entry.
3.9 Services Received	All Clients	Yes	Data Entry.
3.10 Destination	All Clients	Yes	Data Entry.
3.11 Reasons for Leaving	All Clients	Yes	Data Entry.
3.12 Employment	Adults and Unaccompanied Youth	No	Data Entry.
3.13 Education	Adults and Unaccompanied Youth	No	Data Entry.
3.14 General Health Status	All Clients	No	Data Entry.
3.15 Pregnancy Status	All Females of Child-bearing Age	No	Data Entry.
3.16 Veterans Information	All Persons who Answered “Yes” to Veterans Status data Element	No	Data Entry.
3.17 Children's Education	Children 5-17 Years of Age	No	Data Entry.

Income and Sources

Q: “I am going to read a list of income sources and I would like for you to tell me if you [and/or the children who are coming into this program with you] have received money from any of these sources in the last month and the amount from each?” (Read each source.)

Q: “Over the last month, what was your total income? Please do not include the income of any persons in your household who are 18 years of age or older.”

Non-Cash Benefits

Q: “Have you [and/or the children who are coming into this program with you] received food stamps or money for food on a benefits card in the past month?”

Q: “Do you participate in the [insert response category] program?” (or replace with local name)

Physical Disability

Q: “Do you consider yourself to have a physical disability? By physical disability, I mean that you have a physical problem that is not temporary and that limits your ability to get around or work, or your ability to live on your own.”

Developmental disability

Q: “Have you ever received benefits or services (such as an income supplement or special education classes) for a developmental disability?'

HIV/AIDS

Q: “Have you been diagnosed with AIDS or have you tested positive for HIV?”

Mental health

Q: “Do you feel that you have a mental health problem such as serious depression, serious anxiety, hallucinations, violent behavior, thoughts of suicide?”

If yes, ask the following question:

Q: “Do you feel that this mental health problem will last for a long time and limits your ability to live on your own?”

Substance Abuse

Q: “Do you feel that you have a problem with alcohol?”

Q: “Do you feel that you have a problem with drugs?”

If yes to either or both questions, ask the following question:

Q: “Do you feel that this substance abuse problem will last for a long time and limits your ability to live on your own?”

Domestic Violence

Q: “Have you experienced domestic or intimate partner violence?”

If yes, ask the following question:

Q: “How long ago did you have this experience?”

Services Received

No question needed.

Destination

Q: “After you leave this program, where will you be living?”

Q: “Is this move permanent (more than 90 days) or temporary?”

Q: “Does the move involve a HUD subsidy or other subsidy?”

Reasons for Leaving

Q: “What is the main reason for leaving this program?”

Employment

Q: “Are you currently employed?”

If yes, ask the following questions:

Q: “How many hours did you work last week?”

Q: “Was this permanent, temporary, or seasonal work?”

If client reports that he/she is not working, ask the following question:

Q: “Are you currently looking for work?”

Education

Q: “Are you in school now, or working on any degree or certificate?”

Q: “Have you received any vocational training or apprenticeship certificates?”

Q: “What is the highest level of school that you have completed?”

If client has received a high school diploma or GED, ask the following questions:

Q: “Have you received any of the following degrees?” (Ask about each degree until the client answers “no.”)

General Health Status

Q: “Compared to other people your age, would you say your health is excellent, very good, good, fair, or poor?”

Pregnancy Status

Q: “Are you pregnant?”

If yes, then ask the following question:

Q: “What is your due date?”

Veterans Information

Q: “In which military service eras did you serve (choose all that apply)?”

Q: “How many months did you serve on active duty in the military?”

Q: “Did you serve in a war zone?”

Q: “What war zone(s) (choose all that apply)?”

Q: “What was the number of months served in a war zone?”

Q: “Did you ever receive hostile or friendly fire in a war zone?”

Q: “What branch of the military did you serve in?”

Q: “What type of discharge did you receive?”

Children's Education

Q: “Is [name of child] currently enrolled in school?”

If child is currently enrolled, ask:

Q: “What is the name of the child's school(s)?”

Q: “What type of school is it? Is it a public or private school?”

If child is currently not enrolled in school, ask:

Q: “When was [name of child] last enrolled in school?”

Q: “I'm going to read a list of problems that you may have had getting your child into a school. Please tell me if you have experienced any of these problems for [name of child].” (Ask each.)

Exhibit 6: Required Response Categories for Program-Specific Data Elements

	Response category
	Source of income	Amount from source
3.1 Income and source:
Source and amount of income	1 = Earned Income	$_ _ _ _.00
	2 = Unemployment Insurance	_ _ _ _.00
	3 = Supplemental Security Income or SSI	_ _ _ _.00
	4 = Social Security Disability Income (SSDI)	_ _ _ _.00
	5 = A veteran's disability payment	_ _ _ _.00
	6 = Private disability insurance	_ _ _ _.00
	7 = Worker's compensation	_ _ _ _.00
	8 = Temporary Assistance for Needy Families (TANF) (or use local program name)	_ _ _ _.00
	9 = General Assistance (GA) (or use local program name)	_ _ _ _.00
	10 = Retirement income from Social Security	_ _ _ _.00
	11 = Veteran's pension	_ _ _ _.00
	12 = Pension from a former job	_ _ _ _.00
	13 = Child support	_ _ _ _.00
	14 = Alimony or other spousal support	_ _ _ _.00
	15 = Other source	_ _ _ _.00
	16 = No financial resources
Total monthly income		_ _ _ _.00

	Response category
3.2 Source of non-cash benefit:
Source of non-cash benefit	1 = Food stamps or money for food on a benefits card.
	2 = MEDICAID health insurance program (or use local name).
	3 = MEDICARE health insurance program (or use local name).
	4 = State Children's Health Insurance Program (or use local name).
	5 = Special Supplemental Nutrition Program for Women, Infants, and Children (WIC).
	6 = Veteran's Administration (VA) Medical Services.
	7 = TANF Child Care services (or use local name).
	8 = TANF transportation services (or use local name).
	9 = Other TANF-funded services (or use local name).
	10 = Section 8, public housing, or other rental assistance.
	11 = Other source.
3.3 Physical disability	0 = No   1 = Yes
3.4 Developmental disability	0 = No   1 = Yes
3.5 HIV/AIDS	0 = No   1 = Yes
3.6 Mental Health:
Mental health problem	0 = No   1 = Yes
Expected to be of long-continued and indefinite duration and substantially impairs ability to live independently	0 = No   1 = Yes
3.7 Substance abuse:
Substance abuse problem	1 = Alcohol abuse. 2 = Drug abuse. 3 = Dully diagnosed.
Expected to be of long-continued and indefinite duration and substantially impairs ability to live independently	0 = No   1 = Yes
3.8 Domestic violence:
Domestic violence experience	0 = No   1 = Yes
(If yes) When experience occurred	1 = Within the past three months.
	2 = Three to six months ago.
	3 = From six to twelve months ago.
	4 = More than a year ago.
	8 = Don't know.
	9 = Refused.

	Response Category	Examples;
3.9 Services received:
Date of service	_ _/_ _/_ _ _ _ (Month) (Day) (Year)	(08/31/1965)
Service type	1 = Food	Emergency food programs and food pantries.
	2 = Housing placement	Housing search.
	3 = Material goods	Clothing and personal hygiene items.
	4 = Temporary housing and other financial aid	Rent payment or deposit assistance.
	5 = Transportation	Bus passes and mass transit tokens.
	6 = Consumer assistance and protection	Money management counseling and acquiring identification/SSN.
	7 = Criminal justice/legal services	Legal counseling and immigration services.
	8 = Education	GED instruction, bilingual education, and literacy programs.
	9 = Health care	Disability screening, health care referrals, and health education (excluding HIV/AIDS-related services, mental health care/counseling, and substance abuse services).
	10 = HIV/AIDS-related services	HIV testing, AIDS treatment, AIDS/HIV prevention and counseling.
	11 = Mental health care/counseling	Telephone crisis hotlines and psychiatric programs.
	12 = Substance abuse services	Detoxification and alcohol/drug abuse counseling.
	13 = Employment	Job development and job finding assistance.
	14 = Case/care management	Development of plans for the evaluation, treatment and/or care of persons needing assistance in planning or arranging for services.
	15 = Day care	Child care centers and infant care centers.
	16 = Personal enrichment	Life skills education, social skills training, and stress management.
	17 = Outreach	Street outreach.
	18 = Other

	Response category
3.10 Destination:
Destination	1 = Emergency shelter (including a youth shelter, or hotel, motel, or campground paid for with emergency shelter voucher)*.
	2 = Transitional housing for homeless persons (including homeless youth)*.
	3 = Permanent housing for formerly homeless persons (such as SHP, S+C, or SRO Mod Rehab).
	4 = Psychiatric hospital or other psychiatric facility.
	5 = Substance abuse treatment facility or detox center.
	6 = Hospital (non-psychiatric).
	7 = Jail, prison or juvenile detention facility.
	10 = Room, apartment, or house that you rent.
	11 = Apartment or house that you own.
	12 = Staying or living in a family member's room, apartment, or house.
	13 = Staying or living in a friend's room, apartment, or house.
	14 = Hotel or motel paid for without emergency shelter voucher.
	15 = Foster care home or foster care group home.
	16 = Place not meant for habitation (e.g., a vehicle, an abandoned building, bus/train/subway station/airport or anywhere outside).
	17 = Other.
	8 = Don't Know.
	9 = Refused.
Tenure	1 = Permanent.
	2 = Transitional.
	8 = Don't Know.
	9 = Refused.
Subsidy Type	0 = None.
	1 = Public housing.
	2 = Section 8.
	3 = S+C.
	4 = HOME program.
	5 = HOPWA program.
	6 = Other housing subsidy.
	8 = Don't Know.
	9 = Refused.
For response categories marked with an asterisk (*), these destinations are currently not eligible for HOPWA funding.
3.11 Reason for leaving:
Reason for leaving	1 = Left for a housing opportunity before completing program.
	2 = Completed program.
	3 = Non-payment of rent/occupancy charge.
	4 = Non-compliance with project.
	5 = Criminal activity/destruction of property/violence.
	6 = Reached maximum time allowed by project.
	7 = Needs could not be met by project.
	8 = Disagreement with rules/persons.
	9 = Death.
	10 = Unknown/disappeared.
	11 = Other.
3.12 Employment:
Employed	0 = No   1 = Yes
If currently working, number of hours worked in the past week	___hours.
Employment tenure	1 = Permanent.
	2 = Temporary.
	3 = Seasonal.
If client is not currently employed, is the client looking for work	0 = No   1 = Yes
3.13 Education:
Currently in school or working on any degree or certificate	0 = No   1 = Yes
Received vocational training or apprenticeship certificates	0 = No   1 = Yes
Highest level of school completed	0 = No schooling completed.
	1 = Nursery school to 4th grade.
	2 = 5th grade or 6th grade.
	3 = 7th grade or 8th grade.
	4 = 9th grade.
	5 = 10th grade.
	6 = 11th grade.
	7 = 12th grade, No diploma.
	8 = High school diploma.
	9 = GED.
	10 = Post-secondary school.
If client has received a high school diploma, GED, or enrolled in post-secondary education, what degree(s) has the client earned	0 = None.
	1 = Associates Degree.
	2 = Bachelors.
	3 = Masters.
	4 = Doctorate.
	5 = Other graduate/professional degree.
3.14 General Health:
	1 = Excellent.
	2 = Very good.
	3 = Good.
	4 = Fair.
	5 = Poor.
	8 = Don't Know.
3.15 Pregnancy Status:
Pregnancy Status	0 = No   1 = Yes
Due Date	_ _/_ _/_ _ _ _ (Month) (Day) (Year).
3.16 Veteran's Information:
Military Service Eras	1 = Persian Gulf Era (August 1991-Present).
	2 = Post Vietnam (May 1975-July 1991).
	3 = Vietnam Era (August 1964-April 1975).
	4 = Between Korean and Vietnam War (February 1955-July 1964).
	5 = Korean War (June 1950-January 1955).
	6 = Between WWII and Korean War (August 1947-May 1950).
	7 = World War II (September 1940-July 1947).
	8 = Between WWI and WWII (December 1918-August 1940).
	9 = World War I (April 1917-November 1918).
Duration of Active Duty	___months.
Served in a War Zone	0 = No   1 = Yes.
If yes, name of war zone	1 = Europe.
	2 = North Africa.
	3 = Vietnam.
	4 = Laos and Cambodia.
	5 = South China Sea.
	6 = China, Burma, India.
	7 = Korea.
	8 = South Pacific.
	9 = Persian Gulf.
	10 = Other.
If yes, number of months in war zone	___months.
If yes, received hostile or friendly fire	0 = No   1 = Yes
Branch of the Military	1 = Army.
	2 = Air Force.
	3 = Navy.
	4 = Marines.
	5 = Other.
Discharge Status	1 = Honorable.
	2 = General.
	3 = Medical.
	4 = Bad conduct.
	5 = Dishonorable.
	6 = Other.
3.17 Children's Education:
Current Enrollment Status	0 = No   1 = Yes
If yes, name of child's school	_____________ (Example: Lone Pine Elementary School).
If yes, type of school	1 = Public school.
	2 = Parochial or other private school.
If not enrolled, last date of enrollment	_ _/_ _ _ _ (Month) (Year).
If not enrolled, identify problems in enrolling child	1 = None.
	2 = Residency requirements.
	3 = Availability of school records.
	4 = Birth certificates.
	5 = Legal guardianship requirements.
	6 = Transportation.
	7 = Lack of available preschool programs.
	8 = Immunization requirements.
	9 = Physical examination records.
	10 = Other.

4. HMIS Privacy and Security Standards

This section of the Notice describes standards for the privacy and security of personal information collected and stored in an HMIS. The standards seek to protect the confidentiality of personal information while allowing for reasonable, responsible, and limited uses and disclosures of data. These privacy and security standards are based on principles of fair information practices and on security standards recognized by the information privacy and technology communities. The standards were developed after careful review of the Health Insurance Portability and Accountability Act (HIPAA) standards for securing and protecting patient information. Given the importance of ensuring data confidentiality, HUD intends to provide training and technical assistance for its grantees on this topic.

The section defines baseline standards that will be required of any organization (such as a Continuum of Care, homeless assistance provider, or HMIS software company) that records, uses, or processes PPI on homeless clients for an HMIS. This section also identifies additional protocols or policies that organizations may choose to adopt to enhance further the privacy and security of information collected through HMIS. Organizations are encouraged to apply these additional protections to protect client information as they deem appropriate. They must also comply with federal, state and local laws that require additional confidentiality protections.

This two-tiered approach recognizes the broad diversity of organizations that participate in HMIS and the differing programmatic and organizational realities that may demand a higher standard for some activities. Some organizations (e.g., such as those serving victims of domestic violence) may choose to implement higher levels of privacy and security standards because of the nature of their homeless population and/or service provision. Others (e.g., large emergency shelters) may find the higher standards overly burdensome or impractical. At a minimum, however, all organizations must meet the baseline privacy and security requirements described in this section. This approach provides a uniform floor of protection for homeless clients with the possibility of additional protections for organizations with additional needs or capacities.

Sections 4.1 and 4.2 discuss HMIS privacy standards. Section 4.3 discusses security standards.

4.1. HMIS Privacy Standards: Definitions and Scope

4.1.1. Definition of Terms

1. Protected Personal Information (PPI). Any information maintained by or for a Covered Homeless Organization about a living homeless client or homeless individual that: (1) Identifies, either directly or indirectly, a specific individual; (2) can be manipulated by a reasonably foreseeable method to identify a specific individual; or (3) can be linked with other available information to identify a specific individual.

2. Covered Homeless Organization (CHO). Any organization (including its employees, volunteers, affiliates, contractors, and associates) that records, uses or processes PPI on homeless clients for an HMIS.

3. Processing. Any operation or set of operations performed on PPI, whether or not by automated means, including but not limited to collection, maintenance, use, disclosure, transmission and destruction of the information.

4. HMIS Uses and Disclosures. The uses and disclosures of PPI that are allowed by these standards.

4.1.2. Applying the HMIS Privacy and Security Standards

These privacy standards apply to any homeless assistance organization that records, uses or processes protected personal information (PPI) for an HMIS. A provider that meets this definition is referred to as a covered homeless organization (CHO). All PPI maintained by a CHO is subject to these standards.

Any CHO that is covered under the HIPAA is not required to comply with the privacy or security standards in this Notice if the CHO determines that a substantial portion of its PPI about homeless clients or homeless individuals is protected health information as defined in the HIPAA rules. Exempting HIPAA covered entities from the HMIS privacy and security rules avoids all possible conflicts between the two sets of rules. The HMIS standards give precedence to the HIPAA privacy and security rules because: (1) The HIPAA rules are more finely attuned to the requirements of the health care system; (2) the HIPAA rules provide important privacy and security protections for protected health information; and (3) requiring a homeless provider to comply with or reconcile two sets of rules would be an unreasonable burden.

It is possible that part of a homeless organization's operations may be covered by the HMIS standards while another part is covered by the HIPAA standards. A CHO that, because of organizational structure, legal requirement, or other reason, maintains personal information about a homeless client that does not fall under the privacy and security standards in this section (e.g., the information is subject to the HIPAA health privacy rule) must describe that information in its privacy notice and explain the reason the information is not covered. The purpose of the disclosure requirement is to avoid giving the impression that all personal information will be protected under the HMIS standards if other standards or if no standards apply.

4.1.3. Allowable HMIS Uses and Disclosures of Protected Personal Information (PPI)

A CHO may use or disclose PPI from an HMIS under the following circumstances: (1) To provide or coordinate services to an individual; (2) for functions related to payment or reimbursement for services; (3) to carry out administrative functions, including but not limited to legal, audit, personnel, oversight and management functions; or (4) for creating de-identified PPI.

CHOs, like other institutions that maintain personal information about individuals, have obligations that may transcend the privacy interests of clients. The following additional uses and disclosures recognize those obligations to use or share personal information by balancing competing interests in a responsible and limited way. Under the HMIS privacy standard, these additional uses and disclosures are permissive and not mandatory (except for first party access to information and any required disclosures for oversight of compliance with HMIS privacy and security standards). However, nothing in this standard modifies an obligation under applicable law to use or disclose personal information.

Uses and disclosures required by law. A CHO may use or disclose PPI when required by law to the extent that the use or disclosure complies with and is limited to the requirements of the law.

Uses and disclosures to avert a serious threat to health or safety. A CHO may, consistent with applicable law and standards of ethical conduct, use or disclose PPI if: (1) The CHO, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public; and (2) the use or disclosure is made to a person reasonably able to prevent or lessen the threat, including the target of the threat.

Uses and disclosures about victims of abuse, neglect or domestic violence. A CHO may disclose PPI about an individual whom the CHO reasonably believes to be a victim of abuse, neglect or domestic violence to a government authority (including a social service or protective services agency) authorized by law to receive reports of abuse, neglect or domestic violence under any of the following circumstances:

• Where the disclosure is required by law and the disclosure complies with and is limited to the requirements of the law;
• If the individual agrees to the disclosure; or
• To the extent that the disclosure is expressly authorized by statute or regulation; and the CHO believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; or if the individual is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents that the PPI for which disclosure is sought is not intended to be used against the individual and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.

A CHO that makes a permitted disclosure about victims of abuse, neglect or domestic violence must promptly inform the individual that a disclosure has been or will be made, except if:

• The CHO, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or
• The CHO would be informing a personal representative (such as a family member or friend), and the CHO reasonably believes the personal representative is responsible for the abuse, neglect or other injury, and that informing the personal representative would not be in the best interests of the individual as determined by the CHO, in the exercise of professional judgment.

Uses and disclosures for academic research purposes. A CHO may use or disclose PPI for academic research conducted by an individual or institution that has a formal relationship with the CHO if the research is conducted either:

• By an individual employed by or affiliated with the organization for use in a research project conducted under a written research agreement approved in writing by a program administrator (other than the individual conducting the research) designated by the CHO; or
• By an institution for use in a research project conducted under a written research agreement approved in writing by a program administrator designated by the CHO.

A written research agreement must: (1) Establish rules and limitations for the processing and security of PPI in the course of the research; (2) provide for the return or proper disposal of all PPI at the conclusion of the research; (3) restrict additional use or disclosure of PPI, except where required by law; and (4) require that the recipient of data formally agree to comply with all terms and conditions of the agreement.

A written research agreement is not a substitute for approval of a research project by an Institutional Review Board, Privacy Board or other applicable human subjects protection institution.

Disclosures for law enforcement purposes. A CHO may, consistent with applicable law and standards of ethical conduct, disclose PPI for a law enforcement purpose to a law enforcement official under any of the following circumstances:

• In response to a lawful court order, court-ordered warrant, subpoena or summons issued by a judicial officer, or a grand jury subpoena;
• If the law enforcement official makes a written request for protected personal information that: (1) Is signed by a supervisory official of the law enforcement agency seeking the PPI; (2) states that the information is relevant and material to a legitimate law enforcement investigation; (3) identifies the PPI sought; (4) is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and (5) states that de-identified information could not be used to accomplish the purpose of the disclosure.
• If the CHO believes in good faith that the PPI constitutes evidence of criminal conduct that occurred on the premises of the CHO;
• In response to an oral request for the purpose of identifying or locating a suspect, fugitive, material witness or missing person and the PPI disclosed consists only of name, address, date of birth, place of birth, Social Security Number, and distinguishing physical characteristics; or
• If (1) the official is an authorized federal official seeking PPI for the provision of protective services to the President or other persons authorized by 18 U.S.C. 3056, or to foreign heads of state or other persons authorized by 22 U.S.C. 2709(a)(3), or for the conduct of investigations authorized by 18 U.S.C. 871 and 879 (threats against the President and others); and (2) the information requested is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought.

4.2. Privacy Requirements

All CHOs must comply with the baseline privacy requirements described here with respect to: data collection limitations; data quality; purpose and use limitations; openness; access and correction; and accountability. A CHO may adopt additional substantive and procedural privacy protections that exceed the baseline requirements for each of these areas. A CHO must comply with federal, state and local laws that require additional confidentiality protections. All additional protections must be described in the CHO's privacy notice. A CHO must comply with all baseline privacy protections and with all additional privacy protections included in its privacy notice.

A CHO may maintain a common data storage medium with another organization (including but not limited to another CHO) that includes the sharing of PPI. When PPI is shared between organizations, responsibilities for privacy and security may reasonably be allocated between the organizations. Organizations sharing a common data storage medium and PPI may adopt differing privacy and security policies as they deem appropriate, administratively feasible, and consistent with these HMIS privacy and security standards, as long as these privacy and security policies allow for the unduplication of homeless clients at the CoC level.

4.2.1. Collection Limitation

Baseline requirement. A CHO may collect PPI only when appropriate to the purposes for which the information is obtained or when required by law. A CHO must collect PPI by lawful and fair means and, where appropriate, with the knowledge or consent of the individual.

A CHO must post a sign at each intake desk (or comparable location) that explains generally the reasons for collecting this information. Consent of the individual for data collection may be inferred from the circumstances of the collection. Providers may use the following language to meet this standard: “We collect personal information directly from you for reasons that are discussed in our privacy statement. We may be required to collect some personal information by law or by organizations that give us money to operate this program. Other personal information that we collect is important to run our programs, to improve services for homeless persons, and to better understand the needs of homeless persons. We only collect information that we consider to be appropriate.”

Additional Privacy Protections. A CHO may, in its privacy notice, commit itself to additional privacy protections consistent with HMIS requirements, including, but not limited to:

(1) Restricting collection of personal data, other than required HMIS data elements;

(2) Collecting PPI only with the express knowledge or consent of the individual (unless required by law); and

(3) Obtaining oral or written consent from the individual for the collection of personal information from the individual or from a third party.

4.2.2. Data Quality

Baseline Requirement. PPI collected by a CHO must be relevant to the purpose for which it is to be used. To the extent necessary for those purposes, PPI should be accurate, complete and timely.

A CHO must develop and implement a plan to dispose of or, in the alternative, to remove identifiers from, PPI that is not in current use seven years after the PPI was created or last changed (unless a statutory, regulatory, contractual, or other requirement mandates longer retention). Standards for destroying information are provided in Section 4.3.

4.2.3. Purpose Specification and Use Limitation

Baseline Requirement. A CHO must specify in its privacy notice the purposes for which it collects PPI and must describe all uses and disclosures. A CHO may use or disclose PPI only if the use or disclosure is allowed by this standard and is described in its privacy notice. A CHO may infer consent for all uses and disclosures specified in the notice and for uses and disclosures determined by the CHO to be compatible with those specified in the notice.

Except for first party access to information and any required disclosures for oversight of compliance with HMIS privacy and security standards, all uses and disclosures are permissive and not mandatory. Uses and disclosures not specified in the privacy notice can be made only with the consent of the individual or when required by law.

Additional Privacy Protections. A CHO may, in its privacy notice, commit itself to additional privacy protections consistent with HMIS requirements, including, but not limited to:

(1) Seeking either oral or written consent for some or all processing when individual consent for a use, disclosure or other form of processing is appropriate;

(2) Agreeing to additional restrictions on use or disclosure of an individual's PPI at the request of the individual if the request is reasonable. The CHO is bound by the agreement, except if inconsistent with legal requirements;

(3) Limiting uses and disclosures to those specified in its privacy notice and to other uses and disclosures that are necessary for those specified;

(4) Committing that PPI may not be disclosed directly or indirectly to any government agency (including a contractor or grantee of an agency) for inclusion in any national homeless database that contains personal protected information unless required by statute;

(5) Committing to maintain an audit trail containing the date, purpose and recipient of some or all disclosures of PPI;

(6) Committing to make audit trails of disclosures available to the homeless individual; and

(7) Limiting disclosures of PPI to the minimum necessary to accomplish the purpose of the disclosure.

4.2.4. Openness

Baseline Requirement. A CHO must publish a privacy notice describing its polices and practices for the processing of PPI and must provide a copy of its privacy notice to any individual upon request. If a CHO maintains a public web page, the CHO must post the current version of its privacy notice on the web page. A CHO may, if appropriate, omit its street address from its privacy notice. A CHO must post a sign stating the availability of its privacy notice to any individual who requests a copy.

A CHO must state in its privacy notice that the policy may be amended at any time and that amendments may affect information obtained by the CHO before the date of the change. An amendment to the privacy notice regarding use or disclosure will be effective with respect to information processed before the amendment, unless otherwise stated. All amendments to the privacy notice must be consistent with the requirements of these privacy standards. A CHO must maintain permanent documentation of all privacy notice amendments.

CHOs are reminded that they are obligated to provide reasonable accommodations for persons with disabilities throughout the data collection process. This may include but is not limited to, providing qualified sign language interpreters, readers or materials in accessible formats such as Braille, audio, or large type, as needed by the individual with a disability. See 24 CFR 8.6; 28 CFR 36.303. Note: This obligation does not apply to CHOs who do not receive federal financial assistance and who are also exempt from the requirements of Title III of the Americans with Disabilities Act because they qualify as “religious entities” under that Act.

In addition, CHOs that are recipients of federal financial assistance shall provide required information in languages other than English that are common in the community, if speakers of these languages are found in significant numbers and come into frequent contact with the program. See HUD Limited English Proficiency Recipient Guidance published on December 18, 2003 (68 FR 70968).

Additional Privacy Protections. A CHO may, in its privacy notice, commit itself to additional privacy protections consistent with HMIS requirements, including, but not limited to:

(1) making a reasonable effort to offer a copy of the privacy notice to each client at or around the time of data collection or at another appropriate time;

(2) giving a copy of its privacy notice to each client on or about the time of first data collection. If the first contact is over the telephone, the privacy notice may be provided at the first in-person contact (or by mail, if requested); and/or

(3) adopting a policy for changing its privacy notice that includes advance notice of the change, consideration of public comments, and prospective application of changes.

4.2.5. Access and Correction

Baseline Requirement. In general, a CHO must allow an individual to inspect and to have a copy of any PPI about the individual. A CHO must offer to explain any information that the individual may not understand.

A CHO must consider any request by an individual for correction of inaccurate or incomplete PPI pertaining to the individual. A CHO is not required to remove any information but may, in the alternative, mark information as inaccurate or incomplete and may supplement it with additional information.

In its privacy notice, a CHO may reserve the ability to rely on the following reasons for denying an individual inspection or copying of the individual's PPI:

(1) Information compiled in reasonable anticipation of litigation or comparable proceedings;

(2) information about another individual (other than a health care or homeless provider);

(3) information obtained under a promise of confidentiality (other than a promise from a health care or homeless provider) if disclosure would reveal the source of the information; or

(4) information, the disclosure of which would be reasonably likely to endanger the life or physical safety of any individual.

A CHO can reject repeated or harassing requests for access or correction. A CHO that denies an individual's request for access or correction must explain the reason for the denial to the individual and must include documentation of the request and the reason for the denial as part of the protected personal information about the individual.

Additional Privacy Protections. A CHO may, in its privacy notice, commit itself to additional privacy protections consistent with HMIS requirements, including, but not limited to:

(1) Accepting an appeal of a denial of access or correction by adopting its own appeal procedure and describing the procedure in its privacy notice;

(2) Limiting the grounds for denial of access by not stating a recognized basis for denial in its privacy notice;

(3) Allowing an individual whose request for correction has been denied to add to the individual's information a concise statement of disagreement. A CHO may agree to disclose the statement of disagreement whenever it discloses the disputed PPI to another person. These procedures must be described in the CHO's privacy notice; and/or

(4) Providing to an individual a written explanation of the reason for a denial of an individual's request for access or correction.

4.2.6. Accountability

Baseline Requirement. A CHO must establish a procedure for accepting and considering questions or complaints about its privacy and security policies and practices. A CHO must require each member of its staff (including employees, volunteers, affiliates, contractors and associates) to sign (annually or otherwise) a confidentiality agreement that acknowledges receipt of a copy of the privacy notice and that pledges to comply with the privacy notice.

Additional Privacy Protections. A CHO may, in its privacy notice, commit itself to additional privacy protections consistent with HMIS requirements, including, but not limited to:

(1) Requiring each member of its staff (including employees, volunteers, affiliates, contractors and associates) to undergo (annually or otherwise) formal training in privacy requirements;

(2) Establishing a method, such as an internal audit, for regularly reviewing compliance with its privacy policy;

(3) Establishing an internal or external appeal process for hearing an appeal of a privacy complaint or an appeal of a denial of access or correction rights; and/or

(4) Designating a chief privacy officer to supervise implementation of the CHO's privacy standards.

4.3. Security Standards

This section describes the standards for system, application and hard copy security. All CHOs must comply with the baseline security requirements. A CHO may adopt additional security protections that exceed the baseline requirements if it chooses.

4.3.1. System Security

Applicability. Baseline Requirement. A CHO must apply system security provisions to all the systems where personal protected information is stored, including, but not limited to, a CHO's networks, desktops, laptops, mini-computers, mainframes and servers.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by applying system security provisions to all electronic and hard copy information that is not collected specifically for the HMIS. A CHO may also seek an outside organization to perform an internal security audit and certify system security.

User Authentication. Baseline Requirement. A CHO must secure HMIS systems with, at a minimum, a user authentication system consisting of a username and a password. Passwords must be at least eight characters long and meet reasonable industry standard requirements. These requirements include, but are not limited to:

(1) Using at least one number and one letter;

(2) Not using, or including, the username, the HMIS name, or the HMIS vendor's name; and/or

(3) Not consisting entirely of any word found in the common dictionary or any of the above spelled backwards.

Using default passwords on initial entry into the HMIS application is allowed so long as the application requires that the default password be changed on first use. Written information specifically pertaining to user access (e.g., username and password) may not be stored or displayed in any publicly accessible location. Individual users must not be able to log on to more than one workstation at a time, or be able to log on to the network at more than one location at a time.

Additional Security Protections. A CHO may commit to additional security protections consistent with HMIS requirements by including one of each of the following kinds of characters in the password:

(1) upper and lower-case letters;

(2) numbers; and/or

(3) symbols.

A common solution to creating complex passwords is to use phrases instead of individual words as passwords, capitalize each new word in the phrase, and substitute numbers and symbols for letters in any given word. For example, the phrase “secure password” can be modified to “$3cur3P@$$w0rd” by replacing the letter “s” with “$,” the letter “e” with the number “3,” the letter “a” with “@” and the letter “o” with the number “0,” and eliminating spaces between words.

Virus Protection. Baseline Requirement. A CHO must protect HMIS systems from viruses by using commercially available virus protection software. Virus protection must include automated scanning of files as they are accessed by users on the system where the HMIS application is housed. A CHO must regularly update virus definitions from the software vendor.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by automatically scanning all files for viruses when the system is turned on, shut down or not actively being used.

Firewalls. Baseline Requirement. A CHO must protect HMIS systems from malicious intrusion behind a secure firewall. Each individual workstation does not need its own firewall, as long as there is a firewall between that workstation and any systems, including the Internet and other computer networks, located outside of the organization. For example, a workstation that accesses the Internet through a modem would need its own firewall. A workstation that accesses the Internet through a central server would not need a firewall as long as the server has a firewall. Firewalls are commonly included with all new operating systems. Older operating systems can be equipped with secure firewalls that are available both commercially and for free on the Internet.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by applying a firewall to all HMIS workstations and systems.

Public Access. Baseline Requirement. HMIS that use public forums for data collection or reporting must be secured to allow only connections from previously approved computers and systems through Public Key Infrastructure (PKI) certificates, or extranets that limit access based on the Internet Provider (IP) address, or similar means. A public forum includes systems with public access to any part of the computer through the Internet, modems, bulletin boards, public kiosks or similar arenas. Further information on these tools can be found in the HMIS Consumer Guide and the HMIS Implementation Guide, both available on HUD's Web site.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by using PKI certificates and extranets that limit access based on the IP address. A very secure system would not house any HMIS data on systems that are accessible to the general public.

Physical Access to Systems With Access to HMIS Data. Baseline Requirement. A CHO must staff computers stationed in public areas that are used to collect and store HMIS data at all times. When workstations are not in use and staff are not present, steps should be taken to ensure that the computers and data are secure and not usable by unauthorized individuals. After a short amount of time, workstations should automatically turn on a password protected screen saver when the workstation is temporarily not in use. Password protected screen savers are a standard feature with most operating systems and the amount of time can be regulated by a CHO. If staff from a CHO will be gone for an extended period of time, staff should log off the data entry system and shut down the computer.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by automatically logging users off of the HMIS application after a period of inactivity and automatically logging users off of the system after a period of inactivity. Most server operating systems come equipped with the needed software to automatically perform these functions. If staff from a CHO will be gone for an extended period of time, staff should store the computer and data in a locked room.

Disaster Protection and Recovery. Baseline Requirement. A CHO must copy all HMIS data on a regular basis to another medium (e.g., tape) and store it in a secure off-site location where the required privacy and security standards would also apply. A CHO that stores data in a central server, mini-computer or mainframe must store the central server, mini-computer or mainframe in a secure room with appropriate temperature control and fire suppression systems. Surge suppressors must be used to protect systems used for collecting and storing all the HMIS data.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by providing, among other options, fire and water protection at the off-site location that houses the storage medium. A CHO may also seek an outside organization to conduct a disaster protection audit.

Disposal. Baseline Requirement. In order to delete all HMIS data from a data storage medium, a covered homeless organization must reformat the storage medium. A CHO should reformat the storage medium more than once before reusing or disposing the medium.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by destroying media at a bonded vendor to ensure all the HMIS data is completely destroyed.

System Monitoring. Baseline Requirement. A CHO must use appropriate methods to monitor security systems. Systems that have access to any HMIS data must maintain a user access log. Many new operating systems and web servers are equipped with access logs and some allow the computer to email the log information to a designated user, usually a system administrator. Logs must be checked routinely.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by checking user access logs routinely for inappropriate access, hardware and software problems, errors and viruses, or purchasing one of several software applications available that track the status of individual files on computers. These applications are used to make sure that files are not being changed when they are not supposed to be. The applications inform the system administrator if a computer has been hacked, infected with a virus, has been restarted, or if the data files have been tampered with.

4.3.2. Application Security

These provisions apply to how all the HMIS data are secured by the HMIS application software.

Applicability. Baseline Requirement. A CHO must apply application security provisions to the software during data entry, storage and review or any other processing function.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements as needed.

User Authentication. Baseline Requirement. A CHO must secure all electronic HMIS data with, at a minimum, a user authentication system consisting of a username and a password. Passwords must be at least eight characters long and meet reasonable industry standard requirements. These requirements include, but are not limited to:

(1) Using at least one number and one letter;

(2) Using default passwords on initial entry into the HMIS application is allowed so long as the application requires that the default password be changed on first use;

(3) Not using, or including, the username, the HMIS name, or the HMIS vendor's name; and

(4) Not consisting entirely of any word found in the common dictionary or any of the above spelled backwards.

Written information specifically pertaining to user access (e.g., username and password) may not be stored or displayed in any publicly accessible location. Individual users should not be able to log on to more than one workstation at a time, or be able to log on to the network at more than one location at a time.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by including one of each of the following kinds of characters in the password:

(1) Upper and lower-case letters;

(2) Numbers; and

(3) Symbols.

A common solution to creating complex passwords is to use phrases instead of individual words as passwords, capitalize each new word in the phrase and substitute numbers and symbols for letters in any given word. For example, the phrase “secure password” can be modified to “$3cur3P@$$w0rd” by replacing the letter “s” with “$,” the letter “e” with the number “3,” the letter “a” with “@” and the letter “o” with the number “0,” and eliminating spaces between words.

Electronic Data Transmission. Baseline Requirement. A CHO must encrypt all HMIS data that are electronically transmitted over the Internet, publicly accessible networks or phone lines to current industry standards. The current standard is 128-bit encryption. Unencrypted data may be transmitted over secure direct connections between two systems. A secure direct connection is one that can only be accessed by users who have been authenticated on at least one of the systems involved and does not utilize any tertiary systems to transmit the data. A secure network would have secure direct connections.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by using PKI certificates to verify the workstations involved in the electronic data transmission, and by restricting access between the workstations using IP addresses. A very secure system would not transmit any protected information over a public system like the Internet.

Electronic Data Storage. Baseline Requirement. A CHO must store all HMIS data in a binary, not text, format. A CHO that uses one of several common applications (e.g., Microsoft Access, Microsoft SQL Server and Oracle) are already storing data in binary format and no other steps need to be taken.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by requiring that all PPI be stored in an encrypted format using at least the current industry standard. The current standard is a 128-bit key.

4.3.3. Hard Copy Security

This section provides standards for securing hard copy data.

Applicability. Baseline Requirement. A CHO must secure any paper or other hard copy containing personal protected information that is either generated by or for HMIS, including, but not limited to reports, data entry forms and signed consent forms.

Additional Security Protections. A CHO may commit itself to additional security protections consistent with HMIS requirements by applying hard copy security provisions to paper and hard copy information that is not collected specifically for the HMIS.

Security. Baseline Requirement. A CHO must supervise at all times any paper or other hard copy generated by or for HMIS that contains PPI when the hard copy is in a public area. When CHO staff are not present, the information must be secured in areas that are not publicly accessible.

Written information specifically pertaining to user access (e.g., username and password) must not be stored or displayed in any publicly accessible location.

5. Technical Standards

This section presents the technical standards that will be required for HMIS applications and for the organizations responsible for storing HMIS data. Except as otherwise provided, these standards do not specify or recommend any particular operating system, development environment, networking environment, database, hardware or other aspect of the HMIS application. This part of the Notice is primarily directed to HMIS developers and CoC system administrators.

5.1. Required HMIS Capabilities

5.1.1. Automatic Generation of Identification Numbers and Information

Based on the data collected through the client assessment process, program staff interviews, self-administered forms or review of case management records, the HMIS application must be capable of automatically generating data for each record. This capability includes the automatic generation of:

(1) Unique Personal Identification Numbers (PINs) for persons who have not been previously served within the CoC, and reassignment of PINs for persons who have been served previously within a program and/or the CoC;

(2) Program Identification Information that is uniquely associated with each program within a CoC and is assigned to every service episode for each client; and,

(3) Household Identification Numbers for persons who have been identified as members of a household that participated in the same service episode.

Personal Identification Numbers (PINs). A PIN is a number automatically generated by the HMIS application. All records associated with the same person should be assigned the same PIN. There is no required format for the PIN as long as there is a single unique PIN for every client served in the CoC and it contains no personally-identifying information. The PIN is used to produce an unduplicated count of all persons at three levels: (1) Within a single program; (2) across multiple programs that share HMIS data (where programs agree to share such data); and/or (3) across the entire CoC database, whether or not data are shared across programs within a CoC. At each level, an HMIS must be capable of searching client records to determine if clients have been previously served. The search must involve the matching of client records using personal identifier fields (e.g., Name, Social Security Number, Date of Birth, and Gender) to retrieve a record(s) with identical or similar values in each of these fields.

Program Identification Information. Program identification information for every program offered in a CoC consists of the following four fields:

(1) Federal Information Processing Standards (FIPS) Code. To find the 10-digit FIPS code consisting of a 2-digit state code, 3-digit county code and 5-digit place code: (1) Go to Web site http://geonames.usgs.gov/​fips55.html;​; (2) click on “Search the FIPS55 Data Base;” (3) click on state from “State Number Code” pull down menu (this also tells you 2-digit state code); (4) type town or city name in “FIPS 55 Feature Name” box; and (5) click on “Send Query” and 3-digit county code and 5-digit place code will be shown;

(2) Facility Code (to be locally determined);

(3) Continuum of Care (CoC) Code (HUD-assigned); and

(4) Program Type Code:

1 = Emergency shelter (e.g., facility or vouchers)

2 = Transitional housing

3 = Permanent supportive housing

4 = Street outreach

5 = Homeless prevention (e.g., security deposit or one month's rent)

6 = Services-only type of program

7 = Other

The FIPS code, facility code, CoC code and program type code should be separate fields in the HMIS application. There is no requirement to merge them into a single field. For each client intake program staff are only required to enter the program type code. Programs may choose to provide more detailed response categories for the services-only type program response. However, for reporting purposes, these detailed categories must be collapsed into a single service-only type category and its associated code.

A corresponding FIPS code, facility code and CoC code should be automatically generated by the HMIS based on which facility is doing the intake. Once program identification information has been created, the HMIS must ensure that the information is associated with every service episode recorded within the CoC.

Household Identification Numbers. HMIS must generate the same Household Identification Number for every person designated by program staff as being together for an episode of service. The household identification numbers assigned will be maintained in each person's permanent record and will be unique for each service episode experienced by the client.

As discussed in previous parts of this final Notice, when a group of persons apply for services together (as a household or family), information is first recorded for the household head who is applying for services and then information is recorded for any children under 18 years of age who are applying for services with the household head. The children do not need to be present at the time the household head applies for services. The same household identification number is assigned to the adult head of household and any children who have been identified as applying for services with the head. If there are other adult members of the household (over 18 years of age) who are reported to be part of this household, a separate intake is conducted. As part of this intake, this individual is assigned the same household identification number as the other household members.

5.1.2. Missing Value Categories

A limited number of data elements require “don't know,” “not applicable” and “refused” response categories for close-ended questions. These missing value categories and their associated codes should appear on the same list as the valid responses. For open-ended questions (e.g., name), the HMIS application should include the “don't know,” “not applicable” and “refused” response categories for each field in the data element (e.g., first name, last name, middle initial and suffix).

5.1.3. Other Response Categories

Certain data elements may contain a response category labeled “other.” When a data element contains such an option, there should also be within the same database table a separate alphanumeric field where the “other” value may be entered by program staff. For instance, a coded field that accepts the values “0=Red,” “1=Yellow,” or “9=Other” should have an accompanying field that accepts open-ended answers such as tangerine, blue or magenta.

5.1.4. Response Category Codes

Where character or numeric codes are shown next to each response category, only the character or numeric response code needs to be stored in the database. For example, “1=Yes” will be the response code on the computer screen or hard copy, but the electronic database can store “1=Yes” responses as “1” in the database. For open-ended or text answers (such as name), the full text answer or an encrypted version of it should be stored in the database.

5.1.5. Exit Dates

The HMIS should identify programs that have fixed lengths of enrollment. When a client enters such a program, the HMIS should automatically generate the exit date based on the entry date and the program's fixed length of enrollment. For example, an overnight emergency shelter has a fixed length of stay of one day. This information would be stored with the other program information like FIPS code and program code. When a client enrolls in an overnight emergency shelter, the HMIS will automatically set the client's exit date for the next day.

5.1.6. Maintaining Historical Data

An HMIS should have the ability to record client data from a limitless number of service transactions for longitudinal data analysis and assessment of client outcomes (often referred to as a “transactional” or “relational” database structure). A transactional or relational database organizes data within a set of tables from which data can be accessed or reassembled in many different ways without having to erase historical data or reorganize the database tables. For example, an HMIS may include a table that describes a client's demographic profile with columns for name, SSN, date of birth, gender, and so on. In most cases, the information in the profile table will not change. Another table may describe the client's income status: source of income, amount of income from each source, receipt of non-cash benefits, and so forth. The information in the income status table may change overtime, but all historical data should be preserved. Additional tables may include data from each service encounter by program type (e.g., mental health and/or substance abuse).

5.1.7. Data Export

Although a standard environment is not specified, any HMIS application must be capable of exporting any and all data collected into a comma-separated values text file using the following format:

• All fields in a given record are separated by a comma;
• All records within a given text file contain the same fields;
• Blank fields are signified by the comma ending the previous field (or the beginning of the line if the field is the first in the record) followed by a comma indicating the end of the empty field;
• Fields containing text information (as opposed to numeric) will be surrounded by double quotes whenever the field includes blank spaces, commas, or other symbols not part of the standard alphabet;
• The first line of the file shall be a list of the field names included in every record in the file; and
• The list of field names shall be in the same format described above.

5.2. Continuum of Care Requirements

5.2.1. Storage Requirements

The CoC must have or designate a central coordinating body that will be responsible for centralized collection and storage of HMIS data.

HMIS data must be collected to a central location at least once a year from all HMIS users within the CoC.

HMIS data must be stored at the central location for a minimum of seven years after the date of collection by the central coordinating body or designee of the CoC. The seven-year requirement is the current government standard for health and medical information.

Environmental Impact

This notice does not direct, provide for assistance or loan and mortgage insurance for, or otherwise govern or regulate, real property acquisition, disposition, leasing, rehabilitation, alteration, demolition, or new construction, or establish, revise or provide for standards for construction or construction materials, manufactured housing, or occupancy. Accordingly, under 24 CFR 50.19(c)(1), this notice is categorically excluded from environmental review under the National Environmental Policy Act of 1969 (42 U.S.C. 4321).

Dated: July 21, 2004.

Nelson R. Bregón,

General Deputy Assistant Secretary for Community Planning and Development.

Footnotes

1.  The term Continuum of Care or CoC is used throughout the remainder of this notice to refer to the entities that are typically responsible for developing and managing the local HMIS.