Homeless Management Information Systems: what HMIS requires

Reference article · 5 min read

A Homeless Management Information System is the local database a Continuum of Care uses to record client level information about people who receive housing and services in its geography. There is no national HMIS: each CoC picks a product, designates an HMIS Lead Agency to operate it, and enrolls providers under written agreements. What makes a system an HMIS is conformance with federal data standards, not any particular technology.

For a county or city that funds homeless services, the HMIS is a compliance system and an operational one at once. Federal funding depends on complete, accurate, timely data, and the same records drive coordinated entry referrals and the performance measures a governing board reviews. Requirements are revised regularly, so confirm specifics against HUD's current published standards, your CoC governance documents, and your counsel.

Who operates the system

The CoC governing body sets HMIS policy and designates the HMIS Lead Agency. The Lead runs the system day to day: it holds the vendor relationship, executes provider agreements, issues and reviews user accounts, delivers training, maintains the privacy, security, and data quality plans, and submits federal reports. A governance charter records which decisions belong to the CoC and which to the Lead.

A participation agreement with each provider agency should cover:

• Scope. Which projects enter data, which elements apply, and how soon after intake or exit.
• User obligations. Named accounts only, an agency security contact, workstation and password rules, and a signed end user agreement per user.
• Data disposition. What the agency may export, and what happens to its records if it leaves.
• Breach handling. Who notifies whom, in what time frame, and who bears the cost.

The data standards and universal data elements

HUD publishes an HMIS data standards manual and data dictionary defining each element, its response categories, and the logic connecting them. Other federal partner programs that fund homeless services generally align with the same dictionary, so one record can serve several funders.

Elements fall into two groups. Universal data elements are collected about every client in every participating project: name, date of birth, race and ethnicity, gender, veteran status, disabling condition, relationship to the head of household, prior living situation, project start and exit, and destination. Program specific elements, such as income, non-cash benefits, and health insurance, follow the funder of the project. Lists and response categories change between versions, so avoid hard coding them into downstream reports.

The standards also define required outputs, including a standard CSV export for migration and analysis, annual performance reporting for CoC and ESG projects, and system performance measures.

Coordinated entry

Every CoC operates a coordinated entry process across its geography: consistent access points, a common assessment, written prioritization standards, and referrals to openings. The data standards include elements for coordinated entry assessments, events, and referral results, so the process can be measured, not just described.

Verify three things locally: that the prioritization list is a live queue staff work, that referral outcomes are recorded including declines and expirations, and that access is genuinely available to survivors of domestic violence, who are not entered into HMIS.

Data quality monitoring

A data quality plan sets expectations and a routine for checking them. Useful plans state thresholds by project type for missing values, for answers recorded as refused or not collected, and for timeliness between an event and its entry. They also address bed and unit coverage, utilization outside expected ranges, enrollments with no exit, and duplicate client records.

Monitoring works when it is regular, agency specific, and attached to a consequence: a report per agency on a set schedule, a correction window, and repeated failures carried into renewal decisions.

Consent, privacy, and comparable databases

HUD's HMIS privacy and security standards set a baseline: a posted privacy notice, defined permitted uses and disclosures, and controls on access, storage, and transmission. State confidentiality law, and HIPAA where a provider is a covered entity, may be stricter, and the stricter rule governs.

Choose a sharing model deliberately. In a closed model each agency sees only its own records. In an open or partially open model, agencies see what others entered, normally after the client signs a release of information. That release should be informed, revocable, time limited, and specific about which agencies see which data. Clients should not be pressed into sharing beyond what their funder requires.

Victim service providers are handled separately. Federal law bars them from entering client level data into an HMIS. They use a comparable database that meets the same data standards, produces the required reports, and keeps records apart, contributing only de-identified aggregate information to system wide counts. Providers subject to HIPAA and legal services programs raise related questions for counsel.

What to ask before you buy

• Standards upkeep. A written commitment to implement each published revision of the data standards by its effective date at no extra charge.
• Reports included. The federal reports and exports above, without custom development or per report fees.
• Your data on demand. A full standard export and a documented database extract, with format and turnaround stated in the contract and termination clause.
• Access control. Permissions to the project level, visibility rules matching your sharing model, and audit logs the HMIS Lead can query directly.
• Security. Hosting location, subprocessors, encryption, breach notification timing, and independent assessment results.
• Configuration. Changing assessment questions, prioritization rules, and referral workflows as policy changes, without a billable project each time.
• Comparable database. If you procure one for victim service providers, hold it to the same standards and require separation from the HMIS.

Before a procurement, read your governance charter and participation agreements, pull recent monitoring findings, and run a data quality report. Many HMIS problems that look like software problems are policy and training problems.

HQT works with state and local agencies on data systems, integrations, and reporting in health and human services.

Frequently asked questions