The Standard Operating Procedure (SOP) provides the policies, procedures, guidelines, and standards that govern the DuPage County Continuum HMIS operations and the roles and responsibilities for participating agency staff.

Section 1 User Roles and Responsibilities

Section 1: Introduction & Responsibilities

Introduction

The Homeless Management Information System (HMIS) is a secure database platform designed to collect and maintain standardized client information over time. HMIS is a vital tool for improving coordination of services, strengthening advocacy efforts, supporting system planning, and informing public policy. Through the use of HMIS, clients benefit from improved service delivery and more effective coordination among Participating Agencies within their Continuum of Care (CoC).

Data collected in HMIS is critical for accurately understanding the size, characteristics, and needs of individuals and families experiencing homelessness or at risk of homelessness. This information guides both direct client services and broader system-level planning.

Agencies receiving funding from the following federal partners and their respective programs are required to participate in their local HMIS:

U.S. Department of Housing and Urban Development (HUD)
U.S. Department of Health and Human Services (HHS)
U.S. Department of Veterans Affairs (VA)
Any additional funding source requiring HMIS participation

Victim Service Providers (VSPs) are required to use a comparable database that meets HUD’s minimum privacy, security, and data standards.

Victim Service Providers (VSPs)

VSPs that maintain a comparable database and/or participate in the Coordinated Entry process will operate under a separate HMIS implementation to ensure client confidentiality. Key safeguards include:

No client records will be shared across agencies.
Data will be entered anonymously to reduce identifiability.
VSPs must comply with HUD HMIS Data Standards to the greatest extent possible while protecting client privacy.
Support staff from the Northeast Illinois HMIS (NIL HMIS) implementation and the HMIS vendor will have limited access to comparable database records.
Each VSP is responsible for securely maintaining a crosswalk of client identifiers outside of HMIS for internal de-duplication; there will be no attempt to de-duplicate clients across agencies.
With specific client consent, limited de-identified client-level data may be submitted to the Coordinated Entry process.

HMIS Governance and Oversight

DuPage County Community Services serves as the HMIS Lead Agency for the DuPage County CoC and participates in the regional Northeast Illinois HMIS (NIL HMIS). The NIL HMIS is a shared system serving multiple CoCs, managed by a single Technical Lead Agency—the Alliance to End Homelessness in Suburban Cook County. Governance is established through a Memorandum of Understanding (MOU) and supporting Administration and Communication Plans.

These Standard Operating Procedures (SOP) provide policies and procedures for HMIS participation under the DuPage County CoC. They are designed to:

Ensure compliance with HUD regulations, federal and state laws
Support local service coordination and reporting needs
Maintain consistency in HMIS development and implementation

The DuPage County CoC Data & Performance Committee reviews the SOP annually and recommends updates for approval by the CoC Leadership Committee.

Roles and Responsibilities

HMIS Lead Agency (DuPage County Community Services): Provides overall oversight, ensures compliance with federal regulations, manages training and support, and serves as the primary liaison to the Technical Lead Agency.
Technical Lead Agency (Alliance to End Homelessness in Suburban Cook County): Manages the NIL HMIS infrastructure, system configuration, vendor coordination, and overall system security.
Participating Agencies: Enter and maintain accurate, timely client data; follow all privacy, security, and data quality requirements; designate staff as HMIS Users; and ensure compliance with these SOP.
HMIS Users: Authorized staff within Participating Agencies responsible for data entry, management of client records, and adherence to privacy and security protocols.
Victim Service Providers (VSPs): Operate a comparable database, maintain client anonymity, ensure secure storage of crosswalk files, and follow workflows established for Coordinated Entry participation.
CoC Data & Performance Committee: Reviews data quality, system performance, and policy compliance; evaluates and proposes revisions to SOP annually.
CoC Leadership Committee: Approves SOP updates, provides governance oversight, and ensures alignment of HMIS operations with broader CoC goals.

Documentation

The following further define the roles and responsibilities related to the DuPage County Continuum of Care Homeless Management Information System (HMIS). These documents are maintained on the HMIS website at dupagehomeless.org/hmis/forms and are considered companion materials to this Standard Operating Procedures (SOP).

Document Title	Description
Memorandum of Understanding between the Regional Governing Forum, HMIS Technical Lead Agencies, Local CoCs, and Local HMIS Leads	Outlines the regional governance structure of the Northeast Illinois HMIS (NIL HMIS), including roles of the regional governing forum, technical lead agencies, local CoCs, and local HMIS Leads.
Memorandum of Understanding between the DuPage County Continuum of Care and DuPage County Department of Community Services	Designates the DuPage County Department of Community Services as the HMIS Lead and defines its responsibilities.
HMIS Partner Agreement between DuPage County Community Services and the Participating Agency	Describes the responsibilities of HMIS Participating Agencies and their designated users.
HMIS Agency Data Administrator Policy and Code of Ethics	Defines the responsibilities of Agency Data Administrators, including oversight of data quality, user access, and compliance with HMIS standards.
HMIS End User Policy and Code of Ethics	Outlines the responsibilities and code of ethics each HMIS user must follow, including confidentiality and data security requirements.
NIL HMIS System Administrator Plan	Details the roles and requirements of the NIL HMIS System Administrators as they apply to local policies, procedures, and system management.

Together, these documents and the SOP ensure that all parties involved in the HMIS—at the regional, local, agency, and user levels—understand their responsibilities and maintain compliance with HUD standards, federal and state laws, and CoC requirements.

Last Reviewed 4/8/2026

Section 2 Privacy Plan

Section 2: Privacy Plan

Privacy Plan Overview

On July 30, 2004, the US Department of Housing and Urban Development (HUD) released the Homeless Management Information System (HMIS) Data and Technical Standards. This standard outlines the responsibilities of the HMIS and for the agencies which participate in an HMIS. This section of our Standard Operating Procedure describes the Privacy Plan of the DuPage County HMIS. We intend our policy and plan to be consistent with the HUD standards. All users, agencies and system administrators must adhere to this Privacy Plan.

We intend our Privacy Plan to support our mission of providing an effective and usable case management tool. We recognize that clients served by individual agencies are not exclusively that “agency’s client” but instead are truly a client of the DuPage County Continuum of Care. Thus, we have adopted a Privacy Plan which supports limited sharing of client-level data with the intent to improve coordination of care and resource linkages amongst partnering agencies.

The core tenet of our Privacy Plan is the Baseline Privacy Notice. The Baseline Privacy Notice describes how client information may be used and disclosed and how clients can get access to their information. Each agency must either adopt the Baseline Privacy Notice or develop a Privacy Notice which meets or exceeds all minimum requirements set forth in the Baseline Privacy Notice (this is described in the Agency Responsibilities section of this Privacy Plan). This ensures that all agencies who participate in the HMIS are governed by the same minimum standards of client privacy protection. Although the Baseline Privacy Notice and its related forms are appendices to this section, they act as the cornerstone of our Privacy Plan.

All amendments to the Privacy Plan (including changes to the Baseline Privacy Notice and related forms) are proposed by the Data & Performance Committee and reviewed by the Leadership Committee of the DuPage County Continuum of Care. All forms as referenced are posted online, dupagehomeless.org/hmis/forms.

Privacy Plan Documents & Forms	Description	Use by Agency
Baseline Privacy Notice	This is the main document of this Privacy Plan. This document outlines the minimum standard by which an agency collects, utilizes and discloses information.	REQUIRED Agencies must adopt a privacy notice which meets all minimum standards.
Privacy Posting	This posting explains the reason for asking for personal information and notifies the client of the Privacy Notice.	REQUIRED Agencies must adopt and utilize a Privacy Posting.
Request to Not Share Information in HMIS	This form gives the client the opportunity to opt out or revoke the sharing of their information to other agencies in HMIS.	REQUIRED Agencies must have this form available for the client.
Acknowledgement of Receipt	This form provides physical documentation that the client was informed of the privacy notice and their rights regarding opting-out of data sharing.	Optional Agencies are encouraged but not required to utilize this form.

User Responsibilities

A client’s privacy is upheld only to the extent that the users and direct service providers protect and maintain their privacy. The role and responsibilities of the user cannot be over-emphasized. A user is defined as a person that has direct interaction with a client or their data. (This could potentially be any person at the agency: a staff member, volunteer, contractor, etc.)

Users have the responsibility to:

Understand their agency’s Privacy Notice.
Be able to explain their agency’s Privacy Notice to clients.
Follow their agency’s Privacy Notice.
Know where to refer the client if they cannot answer the client’s questions.
Present their agency’s Privacy Notice to the client before collecting any information.
Uphold the client’s privacy in the HMIS.

Agency Responsibilities

The 2004 HUD HMIS Standards emphasize that it is the agency’s responsibility for upholding client privacy. All agencies must take this task seriously and take time to understand the legal, ethical and regulatory responsibilities. This Privacy Plan and the Baseline Privacy Notice provide guidance on the minimum standards by which agencies must operate if they wish to participate in the HMIS.

Meeting the minimum standards in this Privacy Plan and the Baseline Privacy Notice are required for participation in the HMIS. Any agency may exceed the minimum standards described and are encouraged to do so. Agencies must have an adopted Privacy Notice which meets the minimum standards before data entry into the HMIS can occur.

Agencies have the responsibility to:

Review their program requirements to determine what industry privacy standards must be met that exceed the minimum standards outlined in this Privacy Plan and Baseline Privacy Notice (examples: Substance Abuse Providers covered by 24 CFR Part 2, HIPAA Covered Agencies, Legal Service Providers, and Victim Service Providers must adhere to the requirements of the VAWA Confidentiality Provision (34 U.S.C. 12291(b)(2)).
Review the HMIS Data and Technical Standards.
Adopt and uphold a Privacy Notice which meets or exceeds all minimum standards in the Baseline Privacy Notice as well as all industry privacy standards. The adoption process is to be directed by the individual agency. Modifications to the Baseline Privacy Notice must be approved by the HMIS Committee.
Ensure that all clients are aware of the adopted Privacy Notice and have access to it. If the agency has a website, the agency must publish the Privacy Notice on their website.
Make reasonable accommodations for persons with disabilities, language barriers or education barriers.
Ensure that anyone working with clients covered by the Privacy Notice can meet the User Responsibilities.
Designate at least one user that has been trained to technologically uphold the agency’s adopted Privacy Notice.

System Administration Responsibilities

DuPage County Community Services HMIS Staff have the responsibility to:

Adopt and uphold a Privacy Notice which meets or exceeds all minimum standards in the Baseline Privacy Notice.
Train and monitor all users with System Administrator access on upholding system privacy.
Monitor agencies to ensure adherence to their adopted Privacy Notice.
Develop action and compliance plans for agencies that do not have adequate Privacy Notices.
Maintain the HMIS Website to keep all references within the Baseline Privacy Notice up to date.
Provide training to agencies and users on this Privacy Plan.

Last Reviewed 4/8/2026

Section 3 Data Quality Plan

Section 3: Data Quality Plan

Introduction to Data Quality

Data quality is crucial for accurately representing the reality of homelessness and program and system performance. To achieve good data quality, data must be assessed using a client centered approach, all tools must align with HMIS Data Standards and our local Data Quality Plan, and all data entry is to be completed in a timely fashion using a HMIS Staff approved workflow.

The Data Quality Plan applies to all HMIS partners regardless of project type or funding source as described in the table below. HMIS Users should regularly review the HMIS Data Standards Manual and related program manuals [1] for further guidance. Victim Service Providers (VSP) shall maintain a comparable database that meets all minimum Federal and local data collection and reporting requirements, where all project data for any VSP will be maintained in the CoC HMIS.

Data Coverage

The concept of data coverage refers to the sample size and diversity of the agencies and programs who utilize the HMIS. If we want an accurate picture of our community, we must not overlook any agency or program providing services within the Continuum of Care. It is important to note that this includes HUD funded and non-HUD funded programs and agencies.

Bed Coverage Rate

DuPage Continuum of Care has set a threshold of 100% bed coverage rates for dedicated homeless lodging providers in HMIS. VSP point-in-time data will be submitted to HMIS annually, or more frequently as needed, from their HMIS comparable database.

The Bed Coverage Rate is calculated by project type,

= (# dedicated homeless beds in HMIS) divided by (# dedicated homeless beds in DuPage CoC)

Other

The Data & Performance Committee, along with the partnership of DuPage Continuum of Care’s Leadership and related committees, will continue to assess community data needs, including the inclusion of new agencies and data elements.

Data Quality

Data Quality is broken down into 5 equally important components: Completeness, Timeliness, Accuracy, Training and Consistency. Each of these components must be individually monitored by those completing the data entry, Agency Data Administrators, and System Administrators.

Completeness

HMIS and Agency Data Administrators are responsible for ensuring that all Project Descriptor Data Elements are complete for each HMIS project[2] and are reviewed at least annually to confirm accuracy and completeness.

Each participating agency, project, Agency Data Administrator, and HMIS user is required to ensure that Client Records include all required data elements that accurately reflect the client’s situation at the time of assessment. Data Completeness must meet or exceed the Error Rate[3] thresholds established in the Data Quality Error Rate Thresholds Table below.

While some missing data is permissible, clients have the right to refuse to answer questions or may not know specific information at the time of the assessment. In such cases, staff must document the client’s response accurately using the designated response options.

It is the responsibility of staff completing the assessment to use a client-centered and trauma-informed approach when collecting information. Staff must ensure that all required questions are asked and that clients are informed of their right to decline to answer. If necessary, the assessment may be completed over multiple interactions to ensure both data integrity and client comfort.

Data Quality Error Rate Thresholds

Element Type	Data Element	For Whom	Collection Point	Project Type	Error Rate Threshold	Tools to Measure
Project Descriptor	Organization Information	All Projects	Creation and reviewed annually	All Projects	0%	– 0227 Project Descriptor Elements Data Quality
Project Descriptor	Project Information	All HMIS Projects	Creation and reviewed annually	All HMIS Projects	0%	– 0227 Project Descriptor Elements Data Quality – Housing Inventory Count
Project Descriptor	Continuum of Care Information	All HMIS Projects	Creation and reviewed annually	All HMIS Projects	0%	– 0227 Project Descriptor Elements Data Quality – Housing Inventory Count
Project Descriptor	Funding Sources	All HMIS Projects	Creation and reviewed annually	All HMIS Projects	0%	– 0227 Project Descriptor Elements Data Quality – Housing Inventory Count
Project Descriptor	Bed and Unit Information	All HMIS Projects	Creation and re-assessed quarterly	ES, SH, TH, RRH, PSH, and all PH.	0%	– 0227 Project Descriptor Elements Data Quality – Housing Inventory Count
Project Descriptor	HMIS Participation Status	All HMIS Projects	Creation and reviewed annually	All HMIS Projects	0%	– TBD
Project Descriptor	CE Participation Status	All HMIS Projects	Creation and reviewed annually	All HMIS Projects	0%	– TBD
Universal Data Element	Name and Name Data Quality	All Clients	Record Creation	All HMIS Projects	5%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	[4]Full or last 4 of the Social Security Number (SSN) and SSN Data Quality	All Clients	Record Creation	All HMIS Projects	10%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Date of Birth and Date of Birth Data Quality	All Clients	Record Creation	All HMIS Projects	5%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Race and Ethnicity	All Clients	Record Creation	All HMIS Projects	5%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Veteran Status	All Adults	Record Creation	All HMIS Projects	10%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Disabling Condition (Y/N)	All Clients	Project Start	All HMIS Projects	10%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Project Start Date	All Clients	Project Start	All HMIS Projects	10%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Destination at Exit	All Clients	Project Exit	Emergency Shelter (ES) and Street Outreach (SO)	21%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Destination at Exit	All Clients	Project Exit	All Other HMIS Projects	10%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Relationship to Head of Household	All Clients	Project Start	All HMIS Projects	5%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Client Location	Head of Household	Project Start, Update	All HMIS Projects	5%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Prior Living Situation and related fields	Head of Household, Adults	Project Start	All HMIS Projects	10%	– Data Quality Framework – APR – ESG CAPER
Universal Data Element	Sex	All Clients	Record Creation	All HMIS Projects	5%	– Data Quality Framework – APR – ESG CAPER
Program Specific Data Element	Income	Head of Household, Adults	Project Start, Update, Exit	All HMIS Projects	10%	– Data Quality Framework – APR – ESG CAPER
Program Specific Data Element	Income	Head of Household, Adults	Annual	ES	49%	– Data Quality Framework – APR – ESG CAPER
Program Specific Data Element	Income	Head of Household, Adults	Annual	SO	90%	– Data Quality Framework – APR – ESG CAPER
Program Specific Data Element	Income	Head of Household, Adults	Annual	All Other HMIS Projects	20%	– Data Quality Framework – APR – ESG CAPER
Program Specific	Non-Cash Benefits	Head of Household, Adults	Project Start, Update, Annual, Exit	ES	49%	– Data Quality Framework – APR – ESG CAPER
Program Specific	Non-Cash Benefits	Head of Household, Adults	Project Start, Update, Annual, Exit	SO	90%	– Data Quality Framework – APR – ESG CAPER
Program Specific	Non-Cash Benefits	Head of Household, Adults	Project Start, Update, Annual, Exit	All HMIS Projects	10%	– Data Quality Framework – APR – ESG CAPER
Program Specific	Health Insurance	All Clients	Annual	ES	49%	– APR – ESG CAPER
Program Specific	Health Insurance	All Clients	Annual	SO	90%	– APR – ESG CAPER
Program Specific	Health Insurance	All Clients	Annual	All Other HMIS Projects	20%	– APR – ESG CAPER
Program Specific	Disability	All Clients	Project Start, Update, Exit	All HMIS Projects	10%	– APR – ESG CAPER
Program Specific	Domestic Violence	Head of Household, Adults	Project Start, Update	All HMIS Projects	10%	– APR – ESG CAPER
Program Specific	Current Living Situation	Head of Household, Adults	At occurrence	Coordinated Entry (CE) and SO	10%	– ESG CAPER
Program Specific	Engagement	Head of Household, Adults	At occurrence	SO	NA	– ESG CAPER
Program Specific	Coordinated Entry Assessment	Head of Household	At Project Start, Update, Annual,	Coordinated Entry	TBD	– CE APR – CE Events and Assessments
Program Specific	Coordinated Entry Event	Head of Household	At Occurrence	Coordinated Entry	NA	– CE APR – CE Events and Assessments
Federal Partner Program Specific	Percent of AMI	Head of Household, Adults	Project Start, Update, Annual, Exit	All HMIS Projects	10%	– Basic Demographic, Service, and EE Details – Income Level by EE & HH Size – VA Repository Export – Enrollment.csv
Federal Partner Program Specific	Moving On Assistance	Head of Household	At occurrence	PSH	NA	– APR
Federal Partner Program Specific	Housing Assessment at Exit	All Clients	Project Exit	HP	12%	– ESG CAPER
Federal Partner Program Specific	Connection with SOAR	Head of Household and Adults	Project Start, Update, Annual, and Exit	SSVF HP and RRH	NA	– VA Repository Export –IncomeBenefits.csv
Federal Partner Program Specific	Last Grade Completed	Head of Household and Adults	Project Start and Exit	All VASH, SSVF	NA	– VA Repository Export – Employment Education.csv
Federal Partner Program Specific	Employment Status	Head of Household and Adults	Project Start and Exit	All VASH, SSVF, GPD	NA	– VA Repository Export – Employment Education.csv
Federal Partner Program Specific	General Health	Head of Household and Adults	Project Start and Exit	All VASH	NA	– VA Repository Export – Health and DV.csv
Federal Partner Program Specific	Veteran’s Information	All Veterans	Project Start	All VA and VASH	NA	– VA Repository Export – Client.csv
Federal Partner Program Specific	Services Provided – SSVF	All clients receiving services	At Occurrence	All SSVF	NA	– VA Repository Export – Services.csv
Federal Partner Program Specific	Financial Assistance – SSVF	All clients receiving financial assistance	At Occurrence	All SSVF	NA	– VA Repository Export – Services.csv
Federal Partner Program Specific	VAMC Station Number	Head of Household	Project Start	All VA and VASH	NA	– VA Repository Export – Enrollment.csv
Federal Partner Program Specific	HP Targeting Criteria	Head of Household	Project Start	SSVF HP	NA	– VA Repository Export – Enrollment.csv
Federal Partner Program Specific	Mental Health Consultation	Veterans	Project Start	All SSVF	NA	– VA Repository Export – Enrollment.csv
Federal Partner Program Specific	HUD VASH Voucher Tracking	Head of Household/Veteran	At Occurrence	VASH	NA	– TBD
Federal Partner Program Specific	HUD VASH Exit Information	Head of Household/Veteran	Project Exit	VASH	NA	– TBD
Local	Gender	All Clients	Project Start		5%
Local	Translation Assistance Needed	Head of Household	Project Start		NA
Local	Client Zip	Head of Household and Adults	Project Start, Update, Annual	All Projects		– Basic Demographic, Service, and EE Details
Local	Client City	Head of Household and Adults	Project Start, Update, Annual	All Projects		– Basic Demographic, Service, and EE Details
Local	Previous Zip	Head of Household and Adults	Project Start	All Projects		– Basic Demographic, Service, and EE Details
Local	Previous Zip Data Quality	Head of Household and Adults	Project Start	All Projects		– NA
Local	Client’s Residence/Last Permanent Address	Head of Household and Adults	Project Start, Update, Annual	All Projects	NA	– Client Address
Local	Emergency Contacts	Head of Household and Adults	Project Start, Update, Annual	All Projects	NA	– TBD
Local	Is there a valid consent on file to share information with the participating agencies?	All clients	Project Start, Update, Annual	Coordinated Entry		– Coordinated Entry By Name List reports on the actual ROI record for CE – not this field.
Local	Any household member a US Veteran	Head of Household	Project Start, Update, Annual	Coordinated Entry		– Coordinated Entry By Name List
Local	Phone 1, 2, 3	Head of Household	Project Start, Update, Annual	Coordinated Entry		– Coordinated Entry By Name List
Local	Email Address	Head of Household	Project Start, Update, Annual	Coordinated Entry		– Coordinated Entry By Name List
Local	Safe to leave message	Head of Household	Project Start, Update, Annual	Coordinated Entry		– NA
Local	Best time to contact	Head of Household	Project Start, Update, Annual	Coordinated Entry		– NA
Local	Is anyone in the household with you now diagnosed with a disability	Head of Household	Project Start, Update, Annual	Coordinated Entry		– Coordinated Entry By Name List
Local	Is anyone pregnant	Head of Household	Project Start, Update, Annual	Coordinated Entry		– NA
Local	Share an apartment	Head of Household	Project Start, Update, Annual	Coordinated Entry		– NA
Local	Share a bedroom	Head of Household	Project Start, Update, Annual	Coordinated Entry		– NA
Local	Housing Referral Tracking	Head of Household	Project Start, Update, Annual	Coordinated Entry		– Coordinated Entry By Name List – DuPage CoC CE Active Housing Referrals (Report Writer)

Timeliness

To ensure accuracy of our data at any given time, data entry into HMIS or a comparable database is to be completed in less than 7 days of the client interaction. Timeliness standards apply to all projects and information collected and entered into HMIS or a comparable database, including but not limited to assessment data, project entries, annual reviews, project exits, and service transactions.

Our committee has determined timeliness thresholds for Entry and Annual reviews, as shown in the Timeliness Thresholds table below, with the goal of continued improvement over time. Projects cannot retroactively correct past timeliness issues; however, they shall implement internal protocols to improve timeliness for future data entry. Agency Data Administrators are responsible for monitoring data entry timeliness and addressing patterns of delay.

Given our HMIS’s capabilities, we have determined that we are unable to provide an accurate measure of timeliness at Exit. We will continue to work with our Vendor to address this matter and will utilize quarterly point-in-time reporting and project specific reports to help ensure timely project exits.

Timeliness Thresholds

Timeliness Measure	Description	Project Type	Threshold: 7+ Days	Tools to Measure
Program Start	A Program Start Date will be created less than 7 days from the first day of service (ES, TH, SSO), contact (SO), or eligibility determination (all PH). The Program Start Date will be equal to the first day of service (ES, TH, SSO), contact (SO), or eligibility determination (PH).	All HMIS Projects	25%	– Data Quality Framework – APR – ESG CAPER – Point-in Time/Housing Inventory Supplemental
Annual Review	Required for all clients in a project for 365 days or more. Annual Reviews must be completed within 30 days from the anniversary of the Head of Household’s project start date.	All HMIS Projects	25%	– Data Quality Framework – APR – ESG CAPER – Annual Review Dashboard Report
Program Exit	A Program Exit Date will be recorded in HMIS in less than 7 days of learning of the client’s last service date or residence date. The Exit Date will be equal to the last day of service or residence.	All HMIS Projects, but SO and CE	Not Available	NONE – Our system does not capture the date an Exit record is created, but rather when the Entry/Exit record is updated. This is not an accurate reflection of when an Exit is created, therefore we are unable to accurately measure the timeliness of this data element. We recommend agencies utilize current reporting to spot check for accurate service and bed utilization. Those reports include: – Data Quality Framework – APR – ESG CAPER – Point-in Time
Program Exit	A Program Exit Date will be recorded in HMIS in less than 7 days of learning of the client leaving the program, or when it has been 30 days since the last Contact (tracked in Current Living Situation). The Exit Date will be equal to the last day a Contact was made.	SO, CE	Not Available	NONE – Our system does not capture the date an Exit record is created, but rather when the Entry/Exit record is updated. This is not an accurate reflection of when an Exit is created, therefore we are unable to accurately measure the timeliness of this data element. We recommend agencies utilize current reporting to spot check for accurate service and bed utilization. Those reports include: – ESG CAPER – Trifecta – Point-in Time – By Name List

Accuracy

When collecting personal information, a client-centered approach should be used. Agencies shall ensure all required data elements are self-reported by the client whenever possible. Inaccurate data, whether intentional or unintentional, is generally worse than incomplete information as it allows for acknowledging gaps. Thus, it should be emphasized to clients and staff that it is better to enter nothing than to enter inaccurate information.

Agencies are required to monitor their own accuracy using some of the following guidelines:

If using paper assessments, ensure that all required data elements are included, matching all client options and wording. DuPage has a Universal Intake form available online, dupagehomeless.org/hmis/forms.
Review data quality and program specific reports for inaccurate information (a negative age, single child enrollment, minor who is a veteran, etc.)
Confirm that the client understands what is being asked of them, they know what their options are, and that staff do not stray from the intent of the question.
Audit a random sample of client records.
Thoroughly review information with the client at program start, update, annual, and exit, ensuring the information provided is current and complete.
Verify that the project start, annual review, and exit dates are accurate and complete for all participants. (See Timeliness Thresholds Table above in this document).

Training

End User training is a major component to a data quality plan. The roles and responsibilities of training users is outlined in the following: Section 1 of this SOP, DuPage Continuum of Care and HMIS Memorandum of Understanding, HMIS Partnership Agreement, Agency Data Administrator Agreement, and the End User Agreement.

All users must complete new user training prior to receiving access to the HMIS. Training may be provided through the System or Agency Data Administrator. New user training shall review the Standard Operating Procedures, HMIS software, and the data entry workflow, in addition to any project specific information. Users will be required to demonstrate understanding and proper data entry workflow prior to obtaining access to the live site. Alternative training modules may be required depending on the user’s role and access in the system.

To stay current and maintain access to HMIS, all Users are required to complete an annual training provided by System Administrators. Training topics will include privacy, security, data standards, and common issues and questions.

Agency Data Administrators or an agency/program representative shall participate in Agency Data Administrator trainings, and in turn relay this and all HMIS related information to the agency users.

If, at any time, a user is not able to demonstrate proper use or knowledge of the system or has not completed the required training, they will lose access to the system.

Consistency

Consistency ensures uniform data collection and reporting across the HMIS. Agencies shall adhere to HMIS Staff-approved data entry workflows and maintain standardized practices for data collection tools, ensuring alignment with HUD HMIS Data Standards.

The ability to accurately generate system-level reports is dependent upon a common understanding of the data being captured, options being provided to the client, ensuring only the client responses are being entered, and all tools meeting minimum data collection requirements where data is not directly captured in HMIS.

Monitoring Data Quality

Ongoing monitoring of data quality is essential to ensure compliance with Federal and local data standards. Monitoring responsibilities are shared between participating agencies, HMIS Staff, and the Data & Performance Committee. Each of the 5 elements of data quality (Completeness, Timeliness, Accuracy, Training and Consistency) is to be monitored.

Agency Reports

Agency and Program data quality is to be monitored by the Agency Data Administrator monthly. Each agency may choose different reports to monitor their data quality. Each Agency Data Administrator should work with the HMIS Staff to ensure they are running correct data quality reports. HMIS Staff may set up a schedule by which agencies are required to submit specific data quality reports to the HMIS Lead for review.

As a guideline, the HUD CoC APR is the recommended report for monitoring program data quality. It touches on all areas of data quality and allows Agency Data Administrators an opportunity to simultaneously monitor project performance. The following reports should additionally be considered for monitoring data quality.

Agency Reports	Annual Performance Report (APR)/ESG CAPER	Data Quality Framework	Point-In-Time and Housing Inventory Reports	Project specific reports	Frequency
Data Completeness	x	x	x	x	Monthly or more frequently
Incongruities	x	x	x	x	Monthly or more frequently
Timeliness of Data Entry	x	x	x	x	Monthly or more frequently
Project Performance	x		x	x	Quarterly or more frequently

System Reports

System data quality & performance is to be monitored by the HMIS Lead monthly. This may be done by requesting agencies to submit specified data quality reports and/or monitoring data quality directly in the system. The HMIS Lead should report any concerns to the Data & Performance Committee.

System Performance Reports	Annual Performance Report	Data Quality Framework	Duplicate Clients	User Last Login	Point-in-Time and Housing Inventory Reports	System Performance Measures	Longitudinal Systems Analysis (LSA)	Frequency
Data Quality	x	x	x		x	x	x	Quarterly or more frequently
System Utilization				x				Monthly or more frequently
System Performance		x			x	x	x	Semi-Annually or more frequently

[1] https://www.hudexchange.info/programs/hmis/hmis-guides/#project-setup-and-data-collection-resources

[2] HMIS Projects are projects that are dedicated to ending or preventing homelessness such as Street Outreach (SO), Emergency Shelter (SO), Transitional Housing (TH), Safe Haven (SH), all Permanent Housing (PH – RRH, PSH, Other), Supportive Services only (SSO), Coordinated Entry (CE), and Homeless Prevention (HP).

[3] Error Rate includes null, client doesn’t know, client refused/client prefers not to answer, data not assessed, and incongruent data.

[4] Agencies should check with their funder to determine if the full vs. last 4 of the SSN is a requirement for their program.

Last Reviewed: 4/8/26

Section 4 Security Plan

Section 4: Security Plan

Introduction to the Homeless Management Information System Security Plan

Homeless Management Information System (HMIS) security standards are established to ensure the confidentiality, integrity, and availability of all HMIS information. The security standards are designed to protect against any reasonably anticipated threats or hazards to security and must be enforced by system administrators, agency administrators as well as end users. This section is written to comply with section 4.3 of the Homeless Management Information Systems (HMIS) Data and Technical Standards as well as local legislation pertaining to maintaining an individual’s personal information.

Meeting the minimum standards in this Security Plan is required for participation in the HMIS. Any agency may exceed the minimum standards described in this plan and are encouraged to do so. All Agency Data Administrators are responsible for understanding this policy and effectively communicating the Security Plan to individuals responsible for security at their agency.

Security Plan Applicability

The HMIS and all agencies must apply the security standards addressed in this Security Plan to all the systems where personal protected information is stored or accessed. Additionally, all security standards must be applied to all networked devices. This includes, but is not limited to, an agency’s networks, desktops, laptops, mobile devices, mainframes, and servers.

All agencies, including the HMIS Lead, will be monitored by the HMIS System Administrators annually to ensure compliance with the Security Plan. Agencies that do not adhere to the security plan will be given a reasonable amount of time to address any concerns. Egregious violations of the security plan may result in immediate termination of an agency or user’s access to the HMIS as determined by the HMIS Lead.

System Security

User Authentication

Agency Data Administrators and System Administrators shall limit access to those who meet each of the following requirements:

Access is required for the purpose of data assessment, entry, or reporting
New User Training has been completed including the Standard Operating Procedures, Agency Privacy Policies, the Standard Workflow, and the overall HMIS software orientation.
User is covered by the agency privacy notice
User has signed and agreed to the HMIS End User Policy and Code of Ethics.
Have an agency email address to ensure HMIS access is granted to active employees only. Publicly available domain names are not appropriate (gmail.com, Hotmail.com, etc.) unless the agency uses these domain names as their agency standard.

It is the responsibility of Agency Data Administrators to provide 24-hour notice to the System Administrators when the person leaves or is scheduled to leave the agency or no longer requires access to the HMIS. Users who have not successfully logged into HMIS for 30 or more days may be inactivated by the System Administrator to further assure that access is only granted to those who require it.

The HMIS System only permits users to be logged into HMIS from one workstation or device at any given time.

User access and user access levels will be determined by the System Administrator in consultation with the Agency Data Administrator to ensure the correct level of access is provided for the user to complete their required tasks in the system.

Each user must have a unique user ID and password. The User ID and a default password will be set up by the System Administrator upon completion of training. The user will then use the “Forgot Password” feature in HMIS to establish a new password at initial log-in.

Passwords are the individual’s responsibility and must meet minimum system requirements, be kept secure, and be difficult to guess. Users are prohibited from sharing user IDs or passwords. If a user forgets their password or is locked out after multiple failed attempts, they may use the ‘forgot password’ feature in HMIS or contact the HMIS Help Desk for support, nilhmis.cayzu.com.

Passwords will expire every 45 days and users will be prompted upon log-in to reset their password. If a user has not logged into the system for more than 30 days, their account will be inactivated, and they will need to contact the HMIS Help Desk for support, nilhmis.cayzu.com.

Virus Protection

Industry-compliant virus protection software must be installed on all devices directly accessing the HMIS or accessing the HMIS via a network. The virus protection software must also include anti-spyware functionality.

Virus definitions must be set to be updated and applied automatically, and virus scans must be completed weekly, at minimum.

Operating Systems

Operating Systems must be supported by their vendors and must have updates or patches checked for, and applied, monthly, at minimum. Monthly computer restarts of system are recommended to ensure that any pending updates are applied.

Firewalls

An agency must protect the HMIS and client data from malicious intrusion behind a secure and up-to-date firewall. Each individual device does not need its own firewall if there is a firewall between that device and any systems, including the Internet and other computer networks, located outside of the organization. For example, a device that accesses the Internet through a modem, Wi-Fi or cellular data network would need its own firewall. A device that accesses the Internet through a central server will not need a firewall if the server has a firewall. Firewalls are commonly included with all new operating systems.

Physical Access

All computers and devices must be controlled through physical security measures and/or a password.

Users must logoff from the HMIS and their device if they leave their workstation. The HMIS System automatically logs users off after 30 minutes of inactivity. When devices are not in use, a password protected screensaver or lock screen should automatically turn on within 15 minutes of inactivity. Users on mobile devices or working in outreach locations in addition to system administrators are encouraged to decrease this time to 5 minutes.

Users should be trained on how to quickly lock their computer or device if they need to step away. On windows workstations, this is achieved by typing the command “Windows Key + L.” Different operating systems have different locking mechanisms.

If users are going to be away from the computer or device for an extended period of time, they are encouraged to shut down the computer or device. Users should follow their agency’s “shut-down procedures” to ensure proper device, network, and virus updates.

Disposal

Agency policies, consistent with applicable state and federal laws, should be established regarding appropriate locations for storage, transmission, use and disposal of HMIS generated hardcopy or digital data. Reasonable care should be used, and media should be secured when left unattended. Magnetic media containing HMIS data which is released and/or disposed of from the participating organization and central server should first be processed to destroy any data residing on that media. Degaussing and overwriting are acceptable methods of destroying data. On request, DuPage County IT may also be able to destroy hard drives or SSDs that have been used to access HMIS data.

System Monitoring

The HMIS maintains an audit trail that tracks user log-in attempts and modifications to client records. Each audit entry reflects the user that created the entry and the date and name of the user that made the most recent modification.

These user logs will be checked routinely according to best practices established by the HMIS Lead Agency. Possible mechanisms the HMIS Lead may utilize are comparing the volume of search records accessed compared to the size of the agency, looking for multiple user logins from multiple locations, client searches occurring without record adjustment, users logging into the system at strange times and looking at the frequency of user password reset and lockout.

Hard Copy Data

Printed versions (hardcopy) of confidential data should not be left unattended and open to compromise. Media containing HMIS client identified data may not be shared with any person or agency other than the owner of the data for any reason not disclosed within the agency’s Privacy Notice.

HMIS information in hardcopy format should be disposed of properly. This may include shredding finely enough to ensure that the information is unrecoverable.

Data Purge

Annually, Client records without any activity (program entries, needs, calls, case notes, etc.) for 7 or more years will be removed from HMIS by the software vendor.

Software Application Security

Disaster Recovery

The Northern Illinois (NIL) HMIS Technical Lead Agency is responsible for ensuring that its vendors meet all regulated Disaster Protection and Recovery requirements. NIL HMIS is covered under WellSky’s “Basic Disaster Recovery Plan.”

Electronic Data Transmission

The NIL HMIS Technical Lead Agency is responsible for ensuring that its vendors meet all regulated Electronic Data Transmission requirements.

Electronic Data Storage

The NIL HMIS Technical Lead Agency is responsible for ensuring that its vendors meet all regulated Electronic Data Storage requirements.

Workstation Minimum Requirements

Any computer that interfaces with the HMIS must meet the minimum specifications or functionality cannot be guaranteed. Three main factors that can impact system performance are data transfer efficiency, memory management, and machine speed. Currently, the requirements are as follows:

Operating System – Windows 11 (Windows 10 will reach End-Of-Support on Oct 14, 2025)
Memory – 2GB RAM minimum, 4GB recommended
Monitor – Screen Display – 1024 x 768 (XGA)
Processor – Dual-Core processor
Internet Connection – Broadband
Internet Browsers: Google Chrome, Mozilla Firefox, Microsoft Edge, Apple Safari.

There may be additional requirements for report creation.

Computer Crime

Computer crimes violate state and federal law. They include but are not limited to: unauthorized disclosure, modification or destruction of data, programs or hardware; theft of computer services; illegal copying of software; invasion of privacy; theft of hardware, software, peripherals, data or printouts; misuse of communication networks; promulgation of malicious software such as viruses; and breach of contract. Perpetrators may be prosecuted under state or federal law, held civilly liable for their actions, or both. The System Administrator and users must comply with license agreements for copyrighted software and documentation. Licensed software must not be copied unless the license agreement specifically provides for it. Copyrighted software must not be loaded or used on systems for which it is not licensed. All users agree to this upon logging into the system for the first time and accepting the software’s End User License Agreement.

Illinois Personal Information Protection Act

As discussed in Section 1 of this standard operating procedure, all agencies and users are bound to follow state and federal law and following those laws precede following this standard operating procedure. The steps outlined here are requirements of HMIS System Participation and should not be considered legal advice.

The Illinois Personal Information Protection Act (815 ILCS 530/5)^[1] requires that data collectors who maintain Social Security numbers take sufficient measures to ensure the security of the data and to notify Illinois Residents if a data breach occurs. The collection of Social Security numbers is a mandatory requirement of HUD’s minimum data collection requirements and thus both individual agencies as well as the HMIS are “Data Collectors” and are bound to the law. A client may be notified multiple times by each level of ‘data holding’ (HMIS Vendor, HMIS Lead, and individual agencies).

If a Breach Occurs at the Individual Agency

Upon detection of a breach of the security of the agency’s data, the agency’s Executive Director or Agency Data Administrator, must take the following actions:

Notification will be made to all Continuum of Care Contacts as listed on the Alliance to End Homelessness website, https://suburbancook.org/hmis.
Notification will be made to individual agency clients in one of the following ways
- Written notice
- Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing as set forth in section 7001 of title 15 of the united states code ^[2]; or
- Substitute notice, if the data collector demonstrates that the cost of providing notice would exceed $250,000 or that the affected class of subject persons to be notified exceeds $500,000, or the data collector does not have sufficient contact information. Substitute notice shall consist of all the following:
  1. Email notice if the data collector has an email address for the subject persons;
  2. Conspicuous posting of the notice on the data collector’s web site page if the data collector maintains one; and
  3. Notification to major statewide media

If Breach Occurs at a System Level

Upon detection of a breach of the security of the system data, the HMIS Lead must take the following actions:

Notification will be made to all Continuum of Care Contacts as listed on the Alliance to End Homelessness website, https://suburbancook.org/hmis.
Notify each participating agency’s Agency Data Administrator and Executive Director
The HMIS does not maintain adequate records for individual notification if a breach occurs (current address, phone number or email address). Provide a substitute notification by completing all the following:
- Email Notice when an email address is available
- Conspicuous Posting to be added to the HMIS website
- Press Release to major statewide media

In either situation, the notice(s) must contain the following information:

The actual or approximate date of the security breach
The nature of the breach
A description of the steps that have or will be taken to address the breach
Toll-free number and address for each major consumer reporting agency and the Federal Trade Commission
Include a statement informing the individual that they can obtain information from each of the consumer reporting agencies about fraud alerts and security

Contact	Website	Phone	Address
Equifax	equifax.com/personal/credit-report-services	888-EQUIFAX (888-378-4329)	PO Box 740241 Atlanta, GA 30374
Transunion	transunion.com/credit-help	800-916-8800	PO Box 2000, Chester, PA 19022-2000
Experian	experian.com/help	888-EXPERIAN (888-397-3742)	P.O. Box 4500, Allen, TX 75013
Federal Trade Commission	https://reportfraud.ftc.gov/	877-FTC-HELP (877-382-4357)	600 Pennsylvania Ave., NW, Washington DC 20580

[1] http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&ChapterID=67

[2] http://www.gpo.gov/fdsys/pkg/USCODE-2011-title15/pdf/USCODE-2011-title15-chap96-subchapI-sec7001.pdf

Last Reviewed 4/8/2026

Forms

View and download related forms.