HMIS Releases of Information Guide & FAQs

For the majority of the projects within the HMIS, an HMIS-related Release of Information (ROI) is required in order to share data with other agencies that participate in HMIS. Each CoC within the implementation is able to establish its own HMIS ROI, though many CoCs in the implementation have agreed to share an HMIS ROI. Any release of information that is established to allow sharing of data within the Missouri HMIS is generally referred to as the "HMIS ROI."

There are some projects which are "protected" because they provide specific services or serve specific populations. Those projects generally are not required to gather HMIS ROIs as their data is not shared with other agencies in the system. If you're unsure whether your project is protected, we encourage you to reach out to the helpdesk so we can let you know.

Frequently Asked Questions

What is the purpose of the HMIS ROI?

The HMIS ROI is intended to ensure clients consent to their information being shared with all of the agencies within the Missouri HMIS. The form is designed to allow the client to understand what information will (and will not) be shared, and ensures they understand that the information shared within the system is kept strictly confidential. The form also informs the client that they can revoke the HMIS ROI at any time.  

Do I need written consent to enter data into the HMIS?

No. Posting the Consumer Notice in an area where intakes are completed or in an area where clients will see it during or prior to intake allows the data to be entered into the HMIS without written consent. The Consumer Notice can be downloaded on the forms page of our website.

Do all household members have to sign the HMIS ROI?

No. The HMIS ROI is only required to be signed by the client who has been designated the head of household. The signature of the head of household indicates that the data for the entire household may be shared within the HMIS. Click here to see examples of completed ROIs.

What if my client refuses to sign the HMIS ROI?

In the event a client refuses to sign the HMIS ROI, you must take the following steps:

1. Document that the client refused to sign the ROI on a paper or digital copy of the ROI itself. Click here to see examples of completed ROIs.
2. Contact the ICA Missouri Helpdesk to request a locked record for the client. If the client already exists in the system, please include the ID number that is present in the system. If the client does not already exist in the system, then you will not provide any client-specific information for that client.
3. Wait until you have been given the "go ahead" from the ICA Missouri Helpdesk before entering any data about the client into the HMIS. Generally, the helpdesk will provide you with a new client ID number in which you should enter the information.
4. Document the refused ROI within the HMIS.
5. Ensure the document showing the refused ROI is properly stored.

Are there special rules in place during the COVID-19 pandemic?

Yes. All of the CoCs in the implementation have agreed to permit HMIS ROIs to be "signed" verbally during the COVID-19 pandemic. Here are the steps required to document the verbally signed release.

1. On a paper copy of the HMIS ROI, the form must be completed except for the client signature. This means the agency representative signature must still be present.
2. In place of the client signature, the words "Verbal Consent" must be written or typed. Click here to see examples of completed ROIs.
3. The next time the agency is able to be in physical contact with the client, the agency is expected to ask the client to sign the HMIS ROI which was previously completed verbally, generally by having the client sign near the words "Verbal Consent" to indicate that the client still agrees to the sharing of the information.
4. The HMIS ROI must be documented within the HMIS appropriately, as well.

What providers are generally protected (and exempt from gathering the HMIS ROI)?

Projects that serve exclusively the following populations and/or exclusively provide specific services are generally protected, but there are exceptions. If you're unsure whether your project is protected, we encourage you to reach out to the helpdesk so we can let you know.

• Persons with a mental illness and their household members
• Persons with a history of substance use/abuse and their household members
• Persons with HIV/AIDS and their household members
• Persons with individuals who are fleeing domestic violence*
• Households served by agencies which are considered legal service providers
• Households where all persons are under the age of 18

Note that these are generally only when the project serves exclusively the population above. A project which requires at least one of the populations above, but does not require a specific one, is generally not going to be protected. For example, if a project requires that a client have a mental illness or a history of substance abuse, generally that project will not be protected.

*Victim Service Providers

Victim Service Providers are prohibited from entering any data into the HMIS per the Violence Against Women Act (VAWA). Victim Service Providers must establish an HMIS-Comparable Database instead. It is important to note, however, that some projects which require a client be fleeing domestic violence do enter into HMIS because the agency does not meet the definition of a Victim Service Provider. Learn more about Victim Service Providers here.

What are the requirements for storing the HMIS ROI?

The HMIS ROI must be kept either in a paper or digital format following the rules below.

Maintaining a paper copy

If the agency chooses to maintain a paper copy of the HMIS ROI, it must be stored within the client's file and be available for review by the HMIS Lead Agency upon request. The paper form must also be maintained for at least 7 years after it expires. Once the 7 years have passed, the agency may destroy it in a secure fashion (i.e., shredding).

Maintaining a digital copy

Agencies may choose to have the client sign a paper HMIS ROI and then scan and upload it to the client's record in HMIS, or may have it digitally signed using a digital signature service (e.g., DocuSign, signNow, eSign, Adobe Sign, HelloSign, PandaDoc, etc.) and then upload the digitally signed HMIS ROI to the head of household's client record within the HMIS. If the agency chooses to upload a digital copy to the HMIS, there is no requirement to maintain a paper copy.

Note: Storing a digital copy of the HMIS ROI solely in a system other than the HMIS does not meet the minimum requirements.

How does ICA ensure HMIS ROIs are gathered and documented properly?

At least two times a year, ICA reviews the records within the HMIS to ensure that all clients in projects that are not protected have an HMIS ROI documented within the HMIS. If any clients do not have an HMIS ROI recorded, ICA will investigate to ensure that the client record was locked down prior to any data being entered into the system. If ICA finds that the agency entered data before having the record locked down by ICA, the agency will be found out of compliance and may be subject to sanctions.

In addition, about once a year ICA visits Missouri HMIS-participating agencies in-person and spot-checks client files to ensure that the HMIS ROI documented within the system matches the HMIS ROI in the client's paper file. If the HMIS ROI in the client's file does not match the information documented within the HMIS, the agency may be found out of compliance and may be subject to sanctions.

What about other releases?

The rules above apply only to the HMIS ROI. ICA understands that agencies frequently gather other releases from clients in order to coordinate with other service providers. Those ROIs, unless they include the sharing of part or all of the client's HMIS file, are not subject to these rules. If agencies wish to share information from a client HMIS record to entities external to the Missouri HMIS, they are encouraged to reach out to the helpdesk for guidance.

Are there special rules for street outreach projects?

Yes, to an extent. We've developed the HMIS ROI Need-to-Know for Street Outreach guide as a supplement to this guide to address street outreach specific questions. 

Example HMIS Releases of Information

There are three examples of properly completed and documented HMIS ROIs below. The top row shows the form properly completed, and the bottom row shows how it should be documented within WellSky Community Services on the ROI tab. Click on the pictures to see a larger version.

Please note that the form used in the sample is the Client Informed Consent to Share and Release of Information which is used by most, but not all, CoCs in the implementation.

What if I still have questions? 

We encourage you to reach out to our helpdesk with any additional questions you may have.

Copyright 2021 Institute for Community Alliances. All Rights Reserved.