The Standard Operating Procedure (SOP) provides the policies, procedures, guidelines, and standards that govern the DuPage County Continuum HMIS operations and the roles and responsibilities for participating agency staff.
Section 1: Introduction & Responsibilities
Introduction
The Homeless Management Information System (HMIS) is a database platform designed to capture uniform client information over time. This system is essential to efforts to streamline client services and inform public policy. Through HMIS, clients benefit from improved coordination in and between Participating Agencies within their respective Continuum of Care (CoC), informed advocacy efforts, and policies that result in targeted services. Analysis of information gathered by HMIS is critical to accurately calculate the size, characteristics, and needs of homeless and at-risk populations; data necessary to serve clients appropriately and for systems planning and advocacy.
Agencies who receive funding through the following federal partners and their respective programs are to participate in their local HMIS: U.S. Department of Health and Human Services, U.S. Department of Housing and Urban Development, U.S. Department of Veteran Affairs, and any additional funding source requiring participation. Victim Service Providers must utilize a comparable HMIS that meets all minimum privacy, security, and data requirements as set forth in these standard operating procedures.
DuPage County Community Services is the designated HMIS Lead which participates in the Northeast Illinois HMIS (NIL HMIS). The NIL HMIS is a shared, regional HMIS in which multiple CoC’s participate, and is managed by a single Technical Lead Agency, the Alliance to End Homelessness in Suburban Cook County. The NIL HMIS is Governed through a separate Memorandum of Understanding and Administration and Communication Plans.
This document provides policies and procedures for partnering agencies and users under the DuPage County Continuum of Care. These policies and procedures are collectively referred to as the Standard Operating Procedures (SOP). The SOP have been developed to comply with HUD regulations, state and federal laws, meet local service coordination and reporting needs, and to retain consistency in developing and maintaining the HMIS.
The DuPage County CoC Data & Performance Committee is responsible for reviewing the SOP annually and proposing changes for approval by the DuPage County CoC Leadership Committee.
Roles and Responsibilities
The following documents outline the various roles and responsibilities as they relate to the DuPage County Continuum of Care Homeless Management Information System, in addition to the policies and procedures as outlined in the Standard Operating Procedures. These documents are available on the HMIS website, dupagehomeless.org/hmis/forms.
| Document Title | Description |
| Memorandum of Understanding between the DuPage County Continuum of Care and DuPage County Department of Community Services | This document outlines the regional governing structure of the HMIS including the regional governing forum, the HMIS technical lead agencies, local CoCs, and local HMIS Leads. |
| Memorandum of Understanding between the DuPage County Continuum of Care and DuPage County Department of Community Services | This document designates the DuPage County Department of Community Services as the HMIS Lead and describes its responsibilities as such. |
| HMIS Partner Agreement between DuPage County Community Services and the Participating Agency | This document describes the responsibilities of HMIS participating agencies and their users. |
| HMIS Agency Data Administrator Policy and Code of Ethics | This document describes the responsibilities of HMIS participating agencies and their users. |
| HMIS End User Policy and Code of Ethics | This agreement describes the responsibilities and code of ethics by which each HMIS user must abide. |
| NIL HMIS System Administrator Plan
| Outlines the NIL HMIS roles and requirements as they apply to local policies and procedures and management of the HMIS. |
Last Reviewed 4/9/2025
Section 2: Privacy Plan
Privacy Plan Overview
On July 30, 2004, the US Department of Housing and Urban Development (HUD) released the standards for Homeless Management Information Systems (69 Federal Register 45888). This standard outlines the responsibilities of the HMIS and for the agencies which participate in an HMIS. This section of our Standard Operating Procedure describes the Privacy Plan of the DuPage County HMIS. We intend our policy and plan to be consistent with the HUD standards. All users, agencies and system administrators must adhere to this Privacy Plan.
We intend our Privacy Plan to support our mission of providing an effective and usable case management tool. We recognize that clients served by individual agencies are not exclusively that “agency’s client” but instead are truly a client of the DuPage County Continuum of Care. Thus, we have adopted a Privacy Plan which supports limited sharing of client-level data with the intent to improve coordination of care and resource linkages amongst partnering agencies.
The core tenet of our Privacy Plan is the Baseline Privacy Notice. The Baseline Privacy Notice describes how client information may be used and disclosed and how clients can get access to their information. Each agency must either adopt the Baseline Privacy Notice or develop a Privacy Notice which meets or exceeds all minimum requirements set forth in the Baseline Privacy Notice (this is described in the Agency Responsibilities section of this Privacy Plan). This ensures that all agencies who participate in the HMIS are governed by the same minimum standards of client privacy protection. Although the Baseline Privacy Notice and its related forms are appendices to this section, they act as the cornerstone of our Privacy Plan.
All amendments to the Privacy Plan (including changes to the Baseline Privacy Notice and related forms) are proposed by the Data & Performance Committee and reviewed by the Leadership Committee of the DuPage County Continuum of Care. All forms as referenced are posted online, dupagehomeless.org/hmis/forms.
| Privacy Plan Documents & Forms | Description | Use by Agency |
| Baseline Privacy Notice | This is the main document of this Privacy Plan. This document outlines the minimum standard by which an agency collects, utilizes and discloses information. | *REQUIRED* Agencies must adopt a privacy notice which meets all minimum standards. |
| Privacy Posting | This posting explains the reason for asking for personal information and notifies the client of the Privacy Notice. | *REQUIRED* Agencies must adopt and utilize a Privacy Posting. |
| Request to Not Share Information in HMIS | This form gives the client the opportunity to opt out or revoke the sharing of their information to other agencies in HMIS. | *REQUIRED* Agencies must have this form available for the client. |
| Acknowledgement of Receipt | This form provides physical documentation that the client was informed of the privacy notice and their rights regarding opting-out of data sharing. | *Optional* Agencies are encouraged, but not required to utilize this form. |
User Responsibilities
A client’s privacy is upheld only to the extent that the users and direct service providers protect and maintain their privacy. The role and responsibilities of the user cannot be over-emphasized. A user is defined as a person that has direct interaction with a client or their data. (This could potentially be any person at the agency: a staff member, volunteer, contractor, etc.)
Users have the responsibility to:
- Understand their agency’s Privacy Notice.
- Be able to explain their agency’s Privacy Notice to clients.
- Follow their agency’s Privacy Notice.
- Know where to refer the client if they cannot answer the client’s questions.
- Present their agency’s Privacy Notice to the client before collecting any information.
- Uphold the client’s privacy in the HMIS.
Agency Responsibilities
The 2004 HUD HMIS Standards emphasize that it is the agency’s responsibility for upholding client privacy. All agencies must take this task seriously and take time to understand the legal, ethical and regulatory responsibilities. This Privacy Plan and the Baseline Privacy Notice provide guidance on the minimum standards by which agencies must operate if they wish to participate in the HMIS.
Meeting the minimum standards in this Privacy Plan and the Baseline Privacy Notice are required for participation in the HMIS. Any agency may exceed the minimum standards described and are encouraged to do so. Agencies must have an adopted Privacy Notice which meets the minimum standards before data entry into the HMIS can occur.
Agencies have the responsibility to:
- Review their program requirements to determine what industry privacy standards must be met that exceed the minimum standards outlined in this Privacy Plan and Baseline Privacy Notice (examples: Substance Abuse Providers covered by 24 CFR Part 2, HIPAA Covered Agencies, Legal Service Providers).
- Review the 2004 HUD HMIS Privacy Standards (69 Federal Register 45888)
- Adopt and uphold a Privacy Notice which meets or exceeds all minimum standards in the Baseline Privacy Notice as well as all industry privacy standards. The adoption process is to be directed by the individual agency. Modifications to the Baseline Privacy Notice must be approved by the HMIS Committee.
- Ensure that all clients are aware of the adopted Privacy Notice and have access to it. If the agency has a website, the agency must publish the Privacy Notice on their website.
- Make reasonable accommodations for persons with disabilities, language barriers or education barriers.
- Ensure that anyone working with clients covered by the Privacy Notice can meet the User Responsibilities.
- Designate at least one user that has been trained to technologically uphold the agency’s adopted Privacy Notice.
System Administration Responsibilities
DuPage County Community Services HMIS Staff have the responsibility to:
- Adopt and uphold a Privacy Notice which meets or exceeds all minimum standards in the Baseline Privacy Notice.
- Train and monitor all users with System Administrator access on upholding system privacy.
- Monitor agencies to ensure adherence to their adopted Privacy Notice.
- Develop action and compliance plans for agencies that do not have adequate Privacy Notices.
- Maintain the HMIS Website to keep all references within the Baseline Privacy Notice up to date.
- Provide training to agencies and users on this Privacy Plan.
Last Reviewed 4/9/2025
Section 3: Data Quality Plan
Introduction to Data Quality
Data quality in the Homeless Management Information System (HMIS) is crucial for accurately representing the reality of homelessness and program and system performance. To achieve good data quality, data must be assessed using a client centered approach, all tools must align with HMIS Data Standards and our local Data Quality Plan, and all data entry is to be completed in a timely fashion using a HMIS Staff approved workflow.
The Data Quality Plan applies to all HMIS partners regardless of project type or funding source as described in the table below. HMIS Users should regularly review the HMIS Data Standards Manual and related program manuals [1] for further guidance. Victim Service Providers (VSP) shall maintain a comparable database that meets all minimum Federal and local data collection and reporting requirements, where all project data for any VSP will be maintained in the CoC HMIS.
Data Coverage
The concept of data coverage refers to the sample size and diversity of the agencies and programs who utilize the HMIS. If we want an accurate picture of our community, we must not overlook any agency or program providing services within the Continuum of Care. It is important to note that this includes HUD funded and non-HUD funded programs and agencies.
Bed Coverage Rate
DuPage Continuum of Care has set a threshold of 100% bed coverage rates for dedicated homeless lodging providers in HMIS. VSP point-in-time data will be submitted to HMIS annually, or more frequently as needed, from their HMIS comparable database.
The Bed Coverage Rate is calculated by project type,
= (# dedicated homeless beds in HMIS) divided by (# dedicated homeless beds in DuPage CoC)
Other
The Data & Performance Committee, along with the partnership of DuPage Continuum of Care’s Leadership and related committees, will continue to assess community data needs, including the inclusion of new agencies and data elements.
Data Quality
Data Quality is broken down into 5 equally important components: Completeness, Timeliness, Accuracy, Training and Consistency. Each of these components must be individually monitored by those completing the data entry, Agency Data Administrators, and System Administrators.
Completeness
HMIS and Agency Data Administrators are to ensure that the Project Descriptor Data Elements are complete for all HMIS projects[2] and that the data is reviewed annually for each project.
Each participating agency, project, Agency Data Administrator, and user entering data into HMIS must ensure that Client Records have complete data elements that accurately reflect the client situation at that point in time, achieving an Error Rate[3] less than the amount as specified in the Data Quality Error Rate Thresholds Table below.
Data Quality Error Rate Thresholds
| Element Type | Data Element | For Whom | Collection Point | Project Type | Error Rate Threshold | Tools to Measure |
| Project Descriptor | Organization Information | All Projects | Creation and reviewed annually | All Projects | 0% | 0227 Project Descriptor Elements Data Quality |
| Project Descriptor | Project Information | All HMIS Projects | Creation and reviewed annually | All HMIS Projects | 0% |
|
| Project Descriptor | Continuum of Care Information | All HMIS Projects | Creation and reviewed annually | All HMIS Projects | 0% |
|
| Project Descriptor | Funding Sources | All HMIS Projects | Creation and reviewed annually | All HMIS Projects | 0% |
|
| Project Descriptor | Bed and Unit Information | All HMIS Projects | Creation and re-assessed quarterly | ES, SH, TH, RRH, PSH, and all PH. | 0% |
|
| Project Descriptor | HMIS Participation Status | All HMIS Projects | Creation and reviewed annually | All HMIS Projects | 0% | TBD |
| Project Descriptor | CE Participation Status | All HMIS Projects | Creation and reviewed annually | All HMIS Projects | 0% | TBD |
| Universal Data Element | Name and Name Data Quality | All Clients | Record Creation | All HMIS Projects | 5% |
|
| Universal Data Element | [4]Full or last 4 of the Social Security Number (SSN) and SSN Data Quality | All Clients | Record Creation | All HMIS Projects | 10% |
|
| Universal Data Element | Date of Birth and Date of Birth Data Quality | All Clients | Record Creation | All HMIS Projects | 5% |
|
| Universal Data Element | Race and Ethnicity | All Clients | Record Creation | All HMIS Projects | 5% |
|
| Universal Data Element | Gender | All Clients | Record Creation | All HMIS Projects | 5% |
|
| Universal Data Element | Veteran Status | All Adults | Record Creation | All HMIS Projects | 10% |
|
| Universal Data Element | Disabling Condition (Y/N) | All Clients | Project Start | All HMIS Projects | 10% |
|
| Universal Data Element | Project Start Date | All Clients | Project Start | All HMIS Projects | 10% |
|
| Universal Data Element | Destination at Exit | All Clients | Project Exit | Emergency Shelter (ES) and Street Outreach (SO) | 21% |
|
| Universal Data Element | Destination at Exit | All Clients | Project Exit | All Other HMIS Projects | 10% |
|
| Universal Data Element | Relationship to Head of Household | All Clients | Project Start | All HMIS Projects | 5% |
|
| Universal Data Element | Client Location | Head of Household | Project Start, Update | All HMIS Projects | 5% |
|
| Universal Data Element | Prior Living Situation and related fields | Head of Household, Adults | Project Start | All HMIS Projects | 10% |
|
| Program Specific Data Element | Income | Head of Household, Adults | Project Start, Update, Exit | All HMIS Projects | 10% |
|
| Program Specific Data Element | Income | Head of Household, Adults | Annual | ES | 49% |
|
| Program Specific Data Element | Income | Head of Household, Adults | Annual | SO | 90% |
|
| Program Specific Data Element | Income | Head of Household, Adults | Annual | All Other HMIS Projects | 20% |
|
| Program Specific | Non-Cash Benefits | Head of Household, Adults | Project Start, Update, Annual, Exit | ES | 49% |
|
| Program Specific | Non-Cash Benefits | Head of Household, Adults | Project Start, Update, Annual, Exit | SO | 90% |
|
| Program Specific | Non-Cash Benefits | Head of Household, Adults | Project Start, Update, Annual, Exit | All HMIS Projects | 10% |
|
| Program Specific | Health Insurance | All Clients | Annual | ES | 49% |
|
| Program Specific | Health Insurance | All Clients | Annual | SO | 90% |
|
| Program Specific | Health Insurance | All Clients | Annual | All Other HMIS Projects | 20% |
|
| Program Specific | Disability | All Clients | Project Start, Update, Exit | All HMIS Projects | 10% |
|
| Program Specific | Domestic Violence | Head of Household, Adults | Project Start, Update | All HMIS Projects | 10% |
|
| Program Specific | Current Living Situation | Head of Household, Adults | At occurrence | Coordinated Entry (CE) and SO | 10% | ESG CAPER |
| Program Specific | Engagement | Head of Household, Adults | At occurrence | SO | NA | ESG CAPER |
| Program Specific | Coordinated Entry Assessment | Head of Household | At Project Start, Update, Annual, | Coordinated Entry | TBD |
|
| Program Specific | Coordinated Entry Event | Head of Household | At Occurrence | Coordinated Entry | NA |
|
| Federal Partner Program Specific | Percent of AMI | Head of Household, Adults | Project Start, Update, Annual, Exit | All HMIS Projects | 10% |
|
| Federal Partner Program Specific | Moving On Assistance | Head of Household | At occurrence | PSH | NA | APR |
| Federal Partner Program Specific | Translation Assistance Needed | Head of Household | Project Start | All HMIS Projects | TBD |
|
| Federal Partner Program Specific | Housing Assessment at Exit | All Clients | Project Exit | HP | TBD | ESG CAPER |
| Federal Partner Program Specific | Connection with SOAR | Head of Household and Adults | Project Start, Update, Annual, and Exit | SSVF HP and RRH | NA | VA Repository Export –IncomeBenefits.csv |
| Federal Partner Program Specific | Sexual Orientation | Head of Households and Adults | Project Start | PSH | NA | APR |
| Federal Partner Program Specific | Last Grade Completed | Head of Household and Adults | Project Start and Exit | All VASH, SSVF | NA | VA Repository Export – Employment Education.csv |
| Federal Partner Program Specific | Employment Status | Head of Household and Adults | Project Start and Exit | All VASH, SSVF, GPD | NA | VA Repository Export – Employment Education.csv |
| Federal Partner Program Specific | General Health | Head of Household and Adults | Project Start and Exit | All VASH | NA | VA Repository – Export Health and DV.csv |
| Federal Partner Program Specific | Veteran’s Information | All Veterans | Project Start | All VA and VASH | NA | VA Repository – Export Client.csv |
| Federal Partner Program Specific | Services Provided – SSVF | All clients receiving services | At Occurrence | All SSVF | NA | VA Repository – Export Services.csv |
| Federal Partner Program Specific | Financial Assistance – SSVF | All clients receiving financial assistance | At Occurrence | All SSVF | NA | VA Repository – Export Services.csv |
| Federal Partner Program Specific | VAMC Station Number | Head of Household | Project Start | All VA and VASH | NA | VA Repository Export – Enrollment.csv |
| Federal Partner Program Specific | HP Targeting Criteria | Head of Household | Project Start | SSVF HP | NA | VA Repository Export – Enrollment.csv |
| Federal Partner Program Specific | HUD VASH Voucher Tracking | Head of Household/Veteran | At Occurrence | VASH | NA | TBD |
| Federal Partner Program Specific | HUD VASH Exit Information | Head of Household/Veteran | Project Exit | VASH | NA | TBD |
| Local | Client Zip | Head of Household and Adults | Project Start, Update, Annual | All Projects | Basic Demographic, Service, and EE Details | |
| Local | Client City | Head of Household and Adults | Project Start, Update, Annual | All Projects | Basic Demographic, Service, and EE Details | |
| Local | Previous Zip | Head of Household and Adults | Project Start | All Projects | Basic Demographic, Service, and EE Details | |
| Local | Previous Zip Data Quality | Head of Household and Adults | Project Start | All Projects | NA | |
| Local | Client’s Residence/Last Permanent Address | Head of Household and Adults | Project Start, Update, Annual | All Projects | NA | Client Address |
| Local | Emergency Contacts | Head of Household and Adults | Project Start, Update, Annual | All Projects | NA | TBD |
| Local | Is there a valid consent on file to share information with the participating agencies? | All clients | Project Start, Update, Annual | Coordinated Entry | Coordinated Entry By Name List reports on the actual ROI record for CE – not this field. | |
| Local | Any household member a US Veteran | Head of Household | Project Start, Update, Annual | Coordinated Entry | Coordinated Entry By Name List | |
| Local | Phone 1, 2, 3 | Head of Household | Project Start, Update, Annual | Coordinated Entry | Coordinated Entry By Name List | |
| Local | Email Address | Head of Household | Project Start, Update, Annual | Coordinated Entry | Coordinated Entry By Name List | |
| Local | Safe to leave message | Head of Household | Project Start, Update, Annual | Coordinated Entry | NA | |
| Local | Best time to contact | Head of Household | Project Start, Update, Annual | Coordinated Entry | NA | |
| Local | Is anyone in the household with you now diagnosed with a disability | Head of Household | Project Start, Update, Annual | Coordinated Entry | Coordinated Entry By Name List | |
| Local | Is anyone pregnant | Head of Household | Project Start, Update, Annual | Coordinated Entry | NA | |
| Local | Share an apartment | Head of Household | Project Start, Update, Annual | Coordinated Entry | NA | |
| Local | Share a bedroom | Head of Household | Project Start, Update, Annual | Coordinated Entry | NA | |
| Local | Housing Referral Tracking | Head of Household | Project Start, Update, Annual | Coordinated Entry |
|
Timeliness
To ensure accuracy of our data at any given time, HMIS data entry is to be completed in less than 7 days of the client interaction. Timeliness standards apply to all projects and information collected and entered into HMIS, including but not limited to assessment data, project entries, annual reviews, project exits, and service transactions.
Our committee has determined timeliness thresholds for Entry and Annual reviews, as shown in the Timeliness Thresholds table below, with the goal of continued improvement over time. No project can retroactively improve this measure but can establish protocols to help ensure timely data entry going forward. Given our HMIS’s capabilities, we have determined that we are unable to provide an accurate measure of timeliness at Exit. We will continue to work with our Vendor to address this matter and will utilize quarterly point-in-time reporting and project specific reports to help ensure timely project exits.
Timeliness Thresholds
| Timeliness Measure | Description | Project Type | Threshold: 7+ Days | Tools to Measure |
| Program Start | A Program Start Date will be created less than 7 days from the first day of service (ES, TH, SSO), contact (SO), or eligibility determination (all PH). The Program Start Date will be equal to the first day of service (ES, TH, SSO), contact (SO), or eligibility determination (PH). | All HMIS Projects | 25% |
|
| Annual Review | Required for all clients in a project for 365 days or more. Annual Reviews must be completed within 30 days from the anniversary of the Head of Household’s project start date. | All HMIS Projects | 25% |
|
| Program Exit | A Program Exit Date will be recorded in HMIS in less than 7 days of learning of the client’s last service date or residence date. The Exit Date will be equal to the last day of service or residence. | All HMIS Projects, but SO and CE | Not Available | NONE – Our system does not capture the date an Exit record is created, but rather when the Entry/Exit record is updated. This is not an accurate reflection of when an Exit is created, therefore we are unable to accurately measure the timeliness of this data element. We recommend agencies utilize current reporting to spot check for accurate service and bed utilization. Those reports include:
|
| Program Exit | A Program Exit Date will be recorded in HMIS in less than 7 days of learning of the client leaving the program, or when it has been 30 days since the last Contact (tracked in Current Living Situation). The Exit Date will be equal to the last day a Contact was made. | SO, CE | Not Available | NONE – Our system does not capture the date an Exit record is created, but rather when the Entry/Exit record is updated. This is not an accurate reflection of when an Exit is created, therefore we are unable to accurately measure the timeliness of this data element. We recommend agencies utilize current reporting to spot check for accurate service and bed utilization. Those reports include:
|
Accuracy
When collecting personal information, a client-centered approach should be used. Every client must be asked for their self-reported information. Staff observations should never be used to collect information regarding how a client identifies. Inaccurate data, whether intentional or unintentional, is generally worse than incomplete information as it allows for acknowledging gaps. Thus, it should be emphasized to clients and staff that it is better to enter nothing than to enter inaccurate information.
Agencies are required to monitor their own accuracy using some of the following guidelines:
- If using paper assessments, ensure that all required data elements are included, matching all client options and wording. DuPage has a Universal Intake form available online, org/hmis/forms.
- Review data quality and program specific reports for inaccurate information (a negative age, single child enrollment, minor who is a veteran, etc.)
- Confirm that the client understands what is being asked of them, they know what their options are, and that staff do not stray from the intent of the question.
- Audit a random sample of client records.
- Thoroughly review information with the client at program start, update, annual, and exit, ensuring the information provided is current and complete.
- Verify that the project start, annual review, and exit dates are accurate and complete for all participants. (See Timeliness Thresholds Table above in this document).
Training
End User training is a major component to a data quality plan. The roles and responsibilities of training users is outlined in the following: Section 1 of this SOP, DuPage Continuum of Care and HMIS Memorandum of Understanding, HMIS Partnership Agreement, Agency Data Administrator Agreement, and the End User Agreement.
All users must complete new user training prior to receiving access to the HMIS. Training may be provided through the System or Agency Data Administrator. New user training must review the Standard Operating Procedures, HMIS software, and the data entry workflow, in addition to any project specific information. Users will be expected to demonstrate understanding and proper data entry workflow prior to obtaining access to the live site. Alternative training modules may be required depending on the user’s role and access in the system.
To stay current and maintain access to HMIS, all Users must complete an annual training provided by System Administrators. Training topics will include privacy, security, data standards, and common issues and questions.
Agency Data Administrators or an agency/program representative shall participate in Agency Data Administrator trainings, and in turn relay this and all HMIS related information to the agency users.
If, at any time, a user is not able to demonstrate proper use or knowledge of the system or has not completed the required training, they will lose access to the system.
Consistency
The ability to accurately generate system-level reports is dependent upon a common understanding of the data being captured, options being provided to the client, ensuring only the client responses are being entered, and all tools meeting minimum data collection requirements where data is not directly captured in HMIS. It is up to each agency to ensure adherence to HMIS Staff approved data entry workflows.
Monitoring Data Quality
Monitoring Data Quality is a shared responsibility between the participating agency, HMIS Staff and the Data & Performance Committee. Each of the 5 elements of data quality (Completeness, Timeliness, Accuracy, Training and Consistency) is to be monitored.
Agency and Program data quality is to be monitored by the Agency Data Administrator monthly. Each agency may choose different reports to monitor their data quality. Each Agency Data Administrator should work with the HMIS Staff to ensure they are running correct data quality reports. HMIS Staff may set up a schedule by which agencies are required to submit specific data quality reports to the HMIS Lead for review.
As a guideline, the HUD CoC APR is the recommended report for monitoring program data quality. It touches on all areas of data quality and allows Agency Data Administrators an opportunity to simultaneously monitor project performance. The following reports should additionally be considered for monitoring data quality:
| Agency Reports | Annual Performance Report (APR)/ESG CAPER | Data Quality Framework | Point-In-Time and Housing Inventory Reports | Project specific reports | Frequency |
| Data Completeness | x | x | x | x | Monthly or more frequently |
| Incongruities | x | x | x | x | Monthly or more frequently |
| Timeliness of Data Entry | x | x | x | x | Monthly or more frequently |
| Project Performance | x | x | x | Quarterly or more frequently |
System data quality & performance is to be monitored by the HMIS Lead monthly. This may be done by requesting agencies to submit specified data quality reports and/or monitoring data quality directly in the system. The HMIS Lead should report any concerns to the Data & Performance Committee.
| System Reports | Annual Performance Report (APR) | Data Quality Framework | Duplicate Client | User Last Login | Point-In-Time and Housing Inventory Reports | System Performance Measures | Longitudinal System Analysis (LSA) | Frequency |
| Data Quality | x | x | x | x | x | x | Quarterly or more frequently | |
| System Utilization | x | Monthly or more frequently | ||||||
| System Performance | x | x | x | x | Semi-Annually or more frequently |
[1] https://www.hudexchange.info/programs/hmis/hmis-guides/#project-setup-and-data-collection-resources
[2] HMIS Projects are projects that are dedicated to ending or preventing homelessness such as Street Outreach (SO), Emergency Shelter (SO), Transitional Housing (TH), Safe Haven (SH), all Permanent Housing (PH – RRH, PSH, Other), Supportive Services only (SSO), Coordinated Entry (CE), and Homeless Prevention (HP).
[3] Error Rate includes null, client doesn’t know, client refused/client prefers not to answer, data not assessed, and incongruent data.
[4] Agencies should check with their funder to determine if the full vs. last 4 of the SSN is a requirement for their program.
Last Reviewed: 4/9/25
Section 4: Security Plan
Introduction to the Homeless Management Information System Security Plan
Homeless Management Information System (HMIS) security standards are established to ensure the confidentiality, integrity, and availability of all HMIS information. The security standards are designed to protect against any reasonably anticipated threats or hazards to security and must be enforced by system administrators, agency administrators as well as end users. This section is written to comply with section 4.3 of the 2004 Homeless Management Information Systems (HMIS) Data and Technical Standards Final Notice (69 Federal Register 45888) as well as local legislation pertaining to maintaining an individual’s personal information.
Meeting the minimum standards in this Security Plan is required for participation in the HMIS. Any agency may exceed the minimum standards described in this plan and are encouraged to do so. All Agency Data Administrators are responsible for understanding this policy and effectively communicating the Security Plan to individuals responsible for security at their agency.
Security Plan Applicability
The HMIS and all agencies must apply the security standards addressed in this Security Plan to all the systems where personal protected information is stored or accessed. Additionally, all security standards must be applied to all networked devices. This includes, but is not limited to, an agency’s networks, desktops, laptops, mobile devices, mainframes, and servers.
All agencies, including the HMIS Lead, will be monitored by the HMIS System Administrators annually to ensure compliance with the Security Plan. Agencies that do not adhere to the security plan will be given a reasonable amount of time to address any concerns. Egregious violations of the security plan may result in immediate termination of an agency or user’s access to the HMIS as determined by the HMIS Lead.
System Security
User Authentication
Agency Data Administrators and System Administrators shall limit access to those who meet each of the following requirements:
- Access is required for the purpose of data assessment, entry, or reporting
- New User Training has been completed including the Standard Operating Procedures, Agency Privacy Policies, the Standard Workflow, and the overall HMIS software orientation.
- User is covered by the agency privacy notice
- User has signed and agreed to the HMIS End User Policy and Code of Ethics.
- Have an agency email address to ensure HMIS access is granted to active employees only. Publicly available domain names are not appropriate (gmail.com, Hotmail.com, etc.) unless the agency uses these domain names as their agency standard.
It is the responsibility of Agency Data Administrators to provide 24-hour notice to the System Administrators when the person leaves or is scheduled to leave the agency or no longer requires access to the HMIS. Users who have not successfully logged into HMIS for 30 or more days may be inactivated by the System Administrator to further assure that access is only granted to those who require it.
The HMIS System only permits users to be logged into HMIS from one workstation or device at any given time.
UseraccessanduseraccesslevelswillbedeterminedbytheSystemAdministratorinconsultationwiththeAgencyDataAdministrator to ensure the correct level of access is provided for the user to complete their required tasks in the system.
Each user must have a unique user ID and password. The User ID and a default password will be set up by the System Administrator upon completion of training. The user will then use the “Forgot Password” feature in HMIS to establish a new password at initial log-in.
Passwords are the individual’s responsibility and must meet minimum system requirements, be kept secure, and be difficult to guess. Users are prohibited from sharing user IDs or passwords. If a user forgets their password or is locked out after multiple failed attempts, they may use the ‘forgot password’ feature in HMIS or contact the HMIS Help Desk for support, nilhmis.cayzu.com.
Passwords will expire every 45 days and users will be prompted upon log-in to reset their password. If a user has not logged into the system for more than 30 days, their account will be inactivated, and they will need to contact the HMIS Help Desk for support, nilhmis.cayzu.com.
Virus Protection
Industry-compliant virus protection software must be installed on all devices directly accessing the HMIS or accessing the HMIS via a network. The virus protection software must also include anti-spyware functionality.
Virus definitions must be set to be updated and applied automatically and virus scans must be completed weekly, at minimum.
Operating Systems
Operating Systems must be supported by their vendors and must have updates or patches checked for, and applied, monthly, at minimum. Monthly computer restarts of system are recommended to ensure that any pending updates are applied.
Firewalls
An agency must protect the HMIS and client data from malicious intrusion behind a secure and up-to-date firewall. Each individual device does not need its own firewall if there is a firewall between that device and any systems, including the Internet and other computer networks, located outside of the organization. For example, a device that accesses the Internet through a modem, Wi-Fi or cellular data network would need its own firewall. A device that accesses the Internet through a central server would not need a firewall if the server has a firewall. Firewalls are commonly included with all new operating systems.
Physical Access
All computers and devices must be controlled through physical security measures and/or a password.
Users must logoff from the HMIS and their device if they leave their workstation. The HMIS System automatically logs users off after 30 minutes of inactivity. When devices are not in use, a password protected screensaver or lock screen should automatically turn on within 15 minutes of inactivity. Users on mobile devices or working in outreach locations in addition to system administrators are encouraged to decrease this time to 5 minutes.
Users should be trained on how to quickly lock their computer or device if they need to step away. On windows workstations, this is achieved by typing the command “Windows Key + L.” Different operating systems have different locking mechanisms.
If users are going to be away from the computer or device for an extended period of time, they are encouraged to shut down the computer or device. Users should follow their agency’s “shut-down procedures” to ensure proper device, network, and virus updates.
Disposal
Agency policies, consistent with applicable state and federal laws, should be established regarding appropriate locations for storage, transmission, use and disposal of HMIS generated hardcopy or digital data. Reasonable care should be used, and media should be secured when left unattended. Magnetic media containing HMIS data which is released and/or disposed of from the participating organization and central server should first be processed to destroy any data residing on that media. Degaussing and overwriting are acceptable methods of destroying data. On request, DuPage County IT may also be able to destroy hard drives or SSDs that have been used to access HMIS data.
System Monitoring
The HMIS maintains an audit trail that tracks user log-in attempts and modifications to client records. Each audit entry reflects the user that created the entry and the date and name of the user that made the most recent modification.
These user logs will be checked routinely according to best practices established by the HMIS Lead Agency. Possible mechanisms the HMIS Lead may utilize are comparing the volume of search records accessed compared to the size of the agency, looking for multiple user logins from multiple locations, client searches occurring without record adjustment, users logging into the system at strange times and looking at the frequency of user password reset and lockout.
Hard Copy Data
Printed versions (hardcopy) of confidential data should not be left unattended and open to compromise. Media containing HMIS client identified data may not be shared with any person or agency other than the owner of the data for any reason not disclosed within the agency’s Privacy Notice.
HMIS information in hardcopy format should be disposed of properly. This may include shredding finely enough to ensure that the information is unrecoverable.
Data Purge
Annually, Client records without any activity (program entries, needs, calls, case notes, etc.) for 7 or more years will be removed from HMIS by the software vendor.
Software Application Security
Disaster Recovery
The Northern Illinois (NIL) HMIS Technical Lead Agency is responsible for ensuring that its vendors meet all regulated Disaster Protection and Recovery requirements. NIL HMIS is covered under WellSky’s “Basic Disaster Recovery Plan.”
Electronic Data Transmission
The NIL HMIS Technical Lead Agency is responsible for ensuring that its vendors meet all regulated Electronic Data Transmission requirements.
Electronic Data Storage
TheNIL HMIS TechnicalLeadAgencyisresponsibleforensuringthatitsvendorsmeetallregulatedElectronicDataStoragerequirements.
Workstation Minimum Requirements
Any computer that interfaces with the HMIS must meet the minimum specifications or functionality cannot be guaranteed. Three main factors that can impact system performance are data transfer efficiency, memory management, and machine speed. Currently, the requirements are as follows:
- Operating System – Windows 11 (Windows 10 will reach End-Of-Support on Oct 14, 2025)
- Memory – 2GB RAM minimum, 4GB recommended
- Monitor – Screen Display – 1024 x 768 (XGA)
- Processor – Dual-Core processor
- Internet Connection – Broadband
- Internet Browsers: Google Chrome, Mozilla Firefox, Microsoft Edge, Apple Safari.
There may be additional requirements for report creation.
Computer Crime
Computer crimes violate state and federal law. They include but are not limited to: unauthorized disclosure, modification or destruction of data, programs or hardware; theft of computer services; illegal copying of software; invasion of privacy; theft of hardware, software, peripherals, data or printouts; misuse of communication networks; promulgation of malicious software such as viruses; and breach of contract. Perpetrators may be prosecuted under state or federal law, held civilly liable for their actions, or both. The System Administrator and users must comply with license agreements for copyrighted software and documentation. Licensed software must not be copied unless the license agreement specifically provides for it. Copyrighted software must not be loaded or used on systems for which it is not licensed. All users agree to this upon logging into the system for the first time and accepting the software’s End User License Agreement.
Illinois Personal Information Protection Act
As discussed in Section 1 of this standard operating procedure, all agencies and users are bound to follow state and federal law and following those laws precede following this standard operating procedure. The steps outlined here are requirements of HMIS System Participation and should not be considered legal advice.
The Illinois Personal Information Protection Act (815 ILCS 530/5)[1] requires that data collectors who maintain Social Security numbers take sufficient measures to ensure the security of the data and to notify Illinois Residents if a data breach occurs. The collection of Social Security numbers is a mandatory requirement of HUD’s minimum data collection requirements and thus both individual agencies as well as the HMIS are “Data Collectors” and are bound to the law. A client may be notified multiple times by each level of ‘data holding’ (HMIS Vendor, HMIS Lead, and individual agencies).
If a Breach Occurs at the Individual Agency
Upon detection of a breach of the security of the agency’s data, the agency’s Executive Director or Agency Data Administrator, must take the following actions:
- Notification will be made to all Continuum of Care Contacts as listed on the Alliance to End Homelessness website, https://suburbancook.org/hmis.
- Notification will be made to individual agency clients in one of the following ways
- Written notice
- Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing as set forth in section 7001 of title 15 of the united states code[2]; or
- Substitute notice, if the data collector demonstrates that the cost of providing notice would exceed $250,000 or that the affected class of subject persons to be notified exceeds $500,000, or the data collector does not have sufficient contact information. Substitute notice shall consist of all the following:
- Email notice if the data collector has an email address for the subject persons;
- Conspicuous posting of the notice on the data collector’s web site page if the data collector maintains one; and
- Notification to major statewide media
If Breach Occurs at a System Level
Upon detection of a breach of the security of the system data, the HMIS Lead must take the following actions:
- Notification will be made to all Continuum of Care Contacts as listed on the Alliance to End Homelessness website, https://suburbancook.org/hmis.
- Notify each participating agency’s Agency Data Administrator and Executive Director
- The HMIS does not maintain adequate records for individual notification if a breach occurs (current address, phone number or email address). Provide a substitute notification by completing all the following:
- Email Notice when an email address is available
- Conspicuous Posting to be added to the HMIS website
- Press Release to major statewide media
In either situation, the notice(s) must contain the following information:
- The actual or approximate date of the security breach
- The nature of the breach
- A description of the steps that have or will be taken to address the breach
- Toll-free number and address for each major consumer reporting agency and the Federal Trade Commission
- Include a statement informing the individual that they can obtain information from each of the consumer reporting agencies about fraud alerts and security
| Contact | Website | Phone | Address |
| Equifax | equifax.com/personal/credit-report-services | 888-EQUIFAX (888-378-4329) | PO Box 740241 Atlanta, GA 30374 |
| Transunion | transunion.com/credit-help | 800-916-8800 | PO Box 2000, Chester, PA 19022-2000 |
| Experian | experian.com/help | 888-EXPERIAN (888-397-3742) | P.O. Box 4500, Allen, TX 75013 |
| Federal Trade Commission | https://reportfraud.ftc.gov/ | 877-FTC-HELP (877-382-4357) | 600 Pennsylvania Ave., NW, Washington DC 20580 |
[1] http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&ChapterID=67
[2] http://www.gpo.gov/fdsys/pkg/USCODE-2011-title15/pdf/USCODE-2011-title15-chap96-subchapI-sec7001.pdf
Last Reviewed 4/9/2025