HMIS Data Requests from Courts or Law Enforcement

Sometimes, agencies get requests from a court or a law enforcement entity for information on a specific client or group of clients. We want you to know what to do.

If someone asks or demands that you give them client information from HMIS, never fulfill such a request on your own.

Loop in your supervisor and ICA immediately, so that we can work together to determine the validity and scope of the request and ensure we are meeting legal obligations while protecting the privacy of clients we serve.

On occasion, agencies that use HMIS will receive requests from a court or a law enforcement entity for information on a specific client or group of clients. These requests can take numerous forms. This does not happen frequently, but it is important to know what to do if it happens at your organization.

What does the HMIS Data Privacy Notice (DPN) say about this?

In the DPN, under the "Who can see information that is listed in HMIS?", it says

• We may release your information to protect the health or safety of you or others as required by law.

• Others as required by law, including officials with a valid subpoena, warrant, or court order.

This means that there are certain circumstances under which an agency may be obligated to share client information from HMIS.

How would I know if the request is "valid"?

No single HMIS user should determine on their own whether or not a request is valid. Never ever share client information without seeking further guidance first!

So what should I do?

If you receive a request for client information, immediately escalate the request to your supervisor and director. Agency leadership should then loop in ICA by contacting our Helpdesk and our HMIS Director, Britt Heinz-Amborn. Together we can assess the validity of the request, and in consultation with our legal team, determine how/if to fulfill such a request.

In short - If someone ever asks or demands that you give them client information from HMIS, refer to your supervisor and director. Never fulfill such a request on your own. Agency leadership, loop in ICA immediately, so that we can work together to determine the validity and scope of the request and ensure we are meeting legal obligations while protecting the privacy of clients we serve.

Here is a resource with information about protocols, rights, and preparedness for homeless service providers: ICE Raid Guidance for Homeless Service Providers | National Homelessness Law Center and Crowell & Moring LLP