[Federal Register Volume 69, Number 201 (Tuesday, October 19, 2004)]
[Notices]
[Pages 61517-61519]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 04-23438]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Docket No. FR 4848-N-03]


Homeless Management Information Systems (HMIS) Data and Technical 
Standards Final Notice; Clarification and Additional Guidance on 
Special Provisions for Domestic Violence Provider Shelters

AGENCY: Office of the Assistant Secretary for Community Planning and 
Development, HUD.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: This notice clarifies and provides further guidance on the 
special provisions for domestic violence provider shelters 
participating in Homeless Management Information Systems (HMIS). This 
clarification and additional guidance follows issuance of the HMIS Data 
and Technical Standards Final Notice published on July 30, 2004, and 
the HMIS Data and Technical Standards Draft Notice, published on July 
22, 2003.

DATES: Effective Date: August 30, 2004.

FOR FURTHER INFORMATION CONTACT: Michael Roanhouse, Office of Special 
Needs Assistance Programs, Office of the Assistant Secretary for 
Community Planning and Development, Room 7262, Department of Housing 
and Urban Development, 451 Seventh Street, SW., Washington, DC 20410-
7000; telephone (202) 708-1226, ext. 4482 (this is not a toll-free 
number). Hearing- or speech-impaired individuals may access this number 
by calling the toll-free Federal Information Relay Service at 1-800-
877-8339.

SUPPLEMENTARY INFORMATION:

I. Introduction

    This notice provides clarification and further guidance on the 
special provisions for domestic violence provider shelters (section 
1.5.6.) in the Homeless Management Information Systems (HMIS) Data and 
Technical Standards Final Notice (Final Notice), published on July 30, 
2004 (69 FR 45888). This notice provides clarification and additional 
guidance on the timing of participation and data collection, 
submission, and aggregation requirements for HUD McKinney-Vento funded 
domestic violence shelters.

II. Background

    HUD supported the development of local HMISs in response to 
Congressional direction \1\ on the need for improved data on and the 
analysis of the extent of homelessness and the effectiveness of the 
McKinney-Vento Act programs including: (1) Production of an 
unduplicated count of clients served at the local level; (2) analysis 
of patterns of use of people entering and exiting the homeless 
assistance system; and (3) evaluation of the effectiveness of the 
homeless assistance system. Broad-based participation of all homeless 
service providers at the local level in HMIS and the collection of 
longitudinal data are critical to meeting this directive.
---------------------------------------------------------------------------

    \1\ Conference Report (H.R. Report 106-988) for the Fiscal Year 
(FY) 2001 HUD Appropriations Act (Pub. L. 106-377).
---------------------------------------------------------------------------

    Domestic violence programs play a critical role in many Continuums 
of Care (CoC) and constitute a large proportion of shelter beds and 
homeless service slots. Their absence from participation in an HMIS 
would prevent these communities from obtaining an unduplicated count of 
homeless persons in their community or understanding adequately the 
needs of the homeless population, including victims of domestic 
violence. In deciding whether domestic violence programs should be 
expected to participate in HMIS, HUD reviewed carefully the comments on 
the HMIS Data and Technical Standards Draft Notice, published on July 
22, 2003 (68 FR 43430), and consulted with a wide range of 
stakeholders.
    These stakeholders included local homeless assistance providers, 
domestic violence providers, national HMIS experts, national advocacy 
organizations, leading researchers and other federal agencies. Comments 
on the draft notice and subsequent stakeholder discussions led HUD to 
conclude that it was critical for domestic violence programs to 
participate in HMIS so as to fully understand homelessness at the local 
and national levels. It was also determined that safety concerns for 
domestic violence programs could be addressed effectively if:
     A distinction is made between (1) data that domestic 
violence providers collect from homeless persons and (2) data that 
domestic violence providers submit to a central server in order to 
produce an unduplicated count of homeless persons at the CoC level;
     Domestic violence programs are given ample time to 
implement technological, administrative, and other safeguards to 
participate in their community's HMIS;
     Adequate local privacy and security standards are 
developed to protect client information; and
     HUD offers extensive technical assistance support to 
communities and domestic violence programs.
    To address the specific concerns regarding participation, HUD is 
providing the following clarification and additional guidance on the 
timing of participation and data collection, submission, and 
aggregation requirements for HUD McKinney-Vento funded domestic 
violence shelters.

III. The Timing of Domestic Violence Shelter Provider Participation in 
HMIS

    HUD recognizes that communities and domestic violence programs need 
time to develop and implement methods to effectively address domestic 
violence provider participation in HMIS and, therefore, permits CoCs to 
stage the entry of domestic violence programs last, including after the 
October 2004, goal for HMIS implementation. The later staging of 
domestic violence providers will not affect HUD's assessment of CoC 
progress in HMIS implementation in the national CoC competitive ranking 
process.
    HUD did not state a deadline for domestic violence provider 
participation in the HMIS and recommended the staging of their addition 
to the HMIS implementation last to allow for adequate time for 
planning, discussion, investigation, and development of local 
participation policies. HUD acknowledges the privacy and security 
concerns of domestic violence providers and has given discretion to 
each CoC to work with their domestic violence providers to identify 
methods of participation that will maximize the safety of persons 
served by those providers. The Final

[[Page 61518]]

Notice also recognizes stronger state confidentiality provisions. In 
the event that state laws conflict with the Final Notice, as determined 
by an appropriate state government entity, state law will prevail (see 
Section 4 of the Final Notice).

IV. Data Collection Versus Data Submission Requirements of Domestic 
Violence Providers to a COC

    The Final Notice states that domestic violence programs that 
receive HUD McKinney-Vento funds are expected to implement the 
universal and those program-specific data elements required for 
generation of an Annual Progress Report and Emergency Shelter Grant 
reporting (see section Sections 1.5.3. and 1.5.6. of the Final Notice). 
To clarify and provide additional guidance concerning the 
implementation, the following elaborates on the requirements for data 
collection, data submission, and data aggregation for domestic violence 
providers participating in HMIS.
    Data Collection: All recipients of McKinney-Vento funds collect 
client-specific information at the program level to meet aggregate 
reporting requirements for the Annual Progress Report. This includes 
the following programs: Supportive Housing, Shelter Plus Care, Section 
8 Moderate Rehabilitation Single Room Occupancy, and Emergency Shelter 
Grants. Accordingly, domestic violence programs that receive McKinney-
Vento funds must collect the universal and program-specific data 
elements required for reporting. HUD does not require domestic violence 
providers to collect or report an address for a client served by a 
domestic violence provider.
    Data Submission: HUD understands the concerns regarding submission 
of client-identified data from domestic violence programs to a central 
location. HUD will not require the submission of personal identifiers 
(name and Social Security Number (SSN)) from these programs to the CoC. 
Domestic violence programs can choose to use a proxy, coded, encrypted, 
or hashed unique identifier--in lieu of name and SSN--that is appended 
to the full service record of each client served and submitted to the 
central server at least once annually for purposes of unduplication and 
data analysis. The coded unique identifier would need to include, but 
is not limited to, characters and digits from a portion of a client's 
name, date of birth, and gender. This unique identifier can be 
generated either manually or through the use of an advanced 
technological encryption algorithm. Programs participating in HMIS are 
not required to share client data with any other organization besides 
the central coordinating entity identified by the CoC as described 
below.
    Data Aggregation: CoCs should decide how they will use coded unique 
identifiers in consultation with their domestic violence programs and 
determine how to produce an unduplicated count of homeless clients at 
the CoC level using these coded identifiers. CoCs must have or 
designate a coordinating body responsible for collection and storage of 
data to a central location at least once a year (see Section 5.2.1. of 
the Final Notice). HUD fully supports alternative methods of 
participation by domestic violence providers. Domestic violence 
programs are charged to meet with CoC representatives to identify 
administrative solutions, such as delaying entry of data into the HMIS 
until after the client has exited the domestic violence program, or 
other technological or administrative solutions that adequately protect 
data and allow for an accurate unduplicated count of homeless persons 
and analysis of homeless data throughout the CoC to meet the goals of 
the congressional directive.

V. HMIS Privacy and Security Provisions

    HUD recognizes that the privacy and security concerns of domestic 
violence victims are unlike those of other homeless clients. In 
response to these concerns, HUD has developed HMIS privacy and security 
standards that are improvements to current practices, set high baseline 
standards for all users of HMIS data, and adequately protect personal 
information collected from domestic violence victims as well as all 
homeless clients.
    As stated in the Final Notice, the baseline privacy and security 
standards are based on principles of fair information practice and on 
security standards recognized by the information technology and privacy 
communities. The privacy standards were developed after careful review 
of the Health Insurance Portability and Accountability Act (HIPAA) 
standards for protecting patient information. The HIPAA privacy rule 
establishes a national baseline of privacy standards for most health 
information. For some key provisions in the HMIS privacy standards, HUD 
set baseline standards that exceeded those in HIPAA, especially for 
provisions that are important to domestic violence programs.
    HUD also developed multi-layered security provisions that meet or 
surpass current Information Technology (IT) industry standards 
requiring: (1) User authentication; (2) industry standard encryption 
(128-bit Secure Socket Layer) of all HMIS data that are electronically 
transmitted over the Internet, publicly accessible networks, or phone 
lines; and (3) strict limitations to physical and network access to 
systems with HMIS data. In addition to these baseline standards, HUD 
recommends additional privacy and security standards that CoCs and 
programs could implement to further increase the security of the 
system. The baseline privacy and security standards for HMIS required 
by the Final Notice far exceed the requirements for many other systems 
into which these client data are entered. HUD continues to encourage 
organizations to apply these additional protections as they deem 
appropriate.

VI. Providing Technical Assistance to Communities and Domestic Violence 
Programs

    HUD recognizes that the development of an HMIS with adequate 
technological and/or administrative solutions to protect client data 
can be challenging. HUD will continue to provide technical assistance 
to local CoCs to help them develop solutions that meet the needs of 
domestic violence victims and the programs that serve this population.
    Research is currently underway to document successful methods of 
participation of domestic violence providers in existing HMIS 
implementations. Some of these methods use coded unique client 
identifiers that do not require providers to submit name, SSN, or other 
identifying information to the central server, but do allow for an 
unduplicated count at the CoC level. Other methods currently in use 
include delayed entry of data into the HMIS until after the client has 
exited the program or HMIS system administration/hosting by the 
domestic violence provider agency. Information about the specific 
methods will be posted on HUD's HMIS page and also distributed via the 
[email protected] list-serve.

VII. Summary

    HUD will exempt domestic violence providers from submission of 
client identifiers (name and SSN) to the CoC for unduplication and data 
analysis. Those programs electing this exemption are required to use 
either a proxy, coded, encrypted, or hashed unique identifier--in lieu 
of name and SSN--that is appended to the full service

[[Page 61519]]

record of each client served and submitted to the CoC central server at 
least once annually for purposes of unduplication and data analysis. 
Domestic violence providers may also choose to adopt a delayed data 
entry protocol whereby client records are not entered into the HMIS 
system until a set period of time after exit.
    CoC representatives are instructed to meet with domestic violence 
providers to develop and implement a method by which the CoC can 
unduplicate data across all providers in the HMIS. HUD fully supports 
alternative methods of participation by domestic violence providers 
including those that incorporate technological or administrative 
solutions that adequately protect data and allow for an accurate 
unduplicated local count of homeless persons and analysis of homeless 
data to meet the goals of the Congressional directive.

    Dated: October 14, 2004.
Patricia A. Carlile,
Deputy Assistant Secretary for Special Needs Assistance.
[FR Doc. 04-23438 Filed 10-15-04; 12:08 pm]
BILLING CODE 4210-29-P