policies and procedures - mid florida … florida homeless coalition ... 602.3 point in time &...

POLICIESANDPROCEDURES

MidFloridaHomelessCoalition

TableofContents

201 ParticipationRequirement201.1 Federal&StateFundedProviders201.2 NonFederal&StateFundedProviders203 AgencyStaffRoles&Requirements204 EndUserRoles&Responsibilities205 MFINInitialSiteVisit206 MFINMinimumTechnicalRequirements301 DataSharing401 UserAdministration401.1 EndUserPrerequisites402 UserTraining403 Usernames403.1 UserLicenseAdministration403.2 MFINRemovalofUserforCause501 SecurityPlan501.1 WorkforceSecurityScreening501.2 SecurityTraining501.3 ReportingSecurityIncidents501.4 DisasterPlan501.5 PhysicalSafeguards501.6 TechnicalSafeguards601 DataQualityPlan601.1 DataEntryTimeliness601.2 DataQualityRevision601.3 UtilizationReport601.4 ReportingErrorsinClarityReports602 GrantContracts602.1 EmergencySolutionsGrant&CoCoGrant602.2 AnnualHousingAssessmentReport602.3 PointinTime&HousingInventoryCounts701 PrivacyPolicy&Practices

STANDARDOPERATINGPROCEDURE/POLICY


Department: MidFloridaInformationNetwork(HMIS) Policy# 201

DateApproved: 05/04/2007 Author: MFINCommittee

LastReviewed: 7/12/2017 LastUpdated: 8/25/2017

AUTHORITY:

24CFRParts91,576,580,and583HMISMFINRoles&Responsibilities–ParticipationRequirements

POLICY:

ParticipationRequirements:AqualifiedMFINMemberAgencyisrequiredtosignandabidebythetermsoftheMFINMemberAgencyAgreement.TheMFINMemberAgencyAgreementisalegalcontractbetweentheMFINMemberAgencyandMFINregardingspecificguidelinesanduse.TheagreementoutlinesspecificdetailsabouttheMFINMemberAgency’sMFINinvolvementincluding,butnotlimitedto,theareasofconfidentiality,dataentry,security,dataquality,andreporting.

PROCEDURE:

1. TheAgency’sExecutiveDirector(orlegalauthorizedofficer)willsigntwocopiesoftheMFINMemberAgencyAgreementandforwardthemtotheMFHC.

2. Uponreceiptofthesignedagreement,itwillbesignedbytheMFHCExecutiveDirector.3. UponsignatureoftheMFHCExecutiveDirector,oneoriginalwillbefiledwiththe

MFHC;theotherwillbereturnedtotheMFINMemberAgency.

SeeForm201-A-MFINMemberAgencyAgreement



Department: MidFloridaInformationNetwork(HMIS) Policy# 201.1



AUTHORITY:

24CFRParts91,576,580,and583HMISMFINRoles&Responsibilities–Federal/StateFundedProviders

POLICY:

AserviceproviderwhoseprimarymissioninvolvessolvinghomelessnessandreceivescertainMcKinney-VentoorotherhomelessfundingisrequiredtoactivelyenterdataintheMidFloridaInformationNetwork.DomesticViolencesheltersarenotrequiredtoparticipateinMFIN.However,DomesticViolencesheltersreceivingcertainMcKinney-Ventofundingagreetocollectdatainaccordancewiththefunder’sguidelines,enterthedataintoacomparabledatabase,andprovideaccesstoMFINadminstafftoverifydatacollection.

PROCEDURE:

ToparticipateinMFIN,memberagenciesmustsignandagreetoabidebythetermsofallagencyanduser-relatedMFINformsaswellpoliciesandproceduresoutlinedinthisdocument

AllmemberagenciesthatreceivefundingfromtheU.S.DepartmentofHUDCoCPrograms,andthosereceivingEmergencySolutionsGrantfundsthroughFloridaDepartmentofChildrenandFamilies are mandated to participate in the local HMIS, which is MFIN in FL520 – Citrus,Hernando,Lake,SumterCountiesCoC.Additionally,allmemberagencieswhichreceivefundingfromMFHCarerequiredtoparticipateinMFIN.Somelocalorganizations(CitrusCountyFEMA

for example) providing funding for homeless or homeless prevention services also requireparticipationinMFINbycontract.

Definitions:

Under§580.3,acomparabledatabasemeansadatabaseusedbyavictimserviceproviderthatcollectsclient-leveldataovertimeandgeneratesunduplicatedaggregatereportsbasedonthedata.ItmustalsomeetHMISdata,technicalandsecuritystandardsestablishedby24CFR§580andoutlinedwithinthisPolicyandProcedureManual.






AUTHORITY:

24CFRParts91,576,580,and583HMISMFINRoles&Responsibilities–NonFederal/StateFundedProviders

POLICY:

Homeless providers who are not receiving grants that require entry into HMIS (excludingDomesticViolencefacilities)orserviceproviderswhoseprimarymissionisnothomelessrelated,but who provides basic needs, prevention, diversion or wrap around service are stronglyencouragedtoactivelyenterdataintheMidFloridaInformationNetwork(MFIN).

PROCEDURE:

Any501c3organizationor governmententity thatprovidesahealthandhuman servicemayqualify to participate in Mid Florida Information Network. To participate in MFIN, memberagenciesmustsignaMFINMemberAgencyAgreementandagreetoabidebythetermsofallagency anduser-relatedMFIN forms andpolicies andprocedures outlined in this document.Participationisvoluntarybutstronglyencouraged.






AUTHORITY:

24CFRParts91,576,580,and583HMISMFINRoles&Responsibilities–AgencyStaffRoles&Requirements

POLICY:

EachMidFloridaInformationNetwork(MFIN)MemberAgencyisrequiredtohaveeitheranagencyadministrator(foragencieswith5ormoreactivelicenses)orapointofcontacttocoordinateMFINactivitiesfortheirorganization.

PROCEDURE:

TheExecutiveDirector(orlegalauthorizedofficer)oftheagencywillcompletetheagencyadministratordesignation/pointofcontactformtoassignthepositiontoaspecificstaffperson.ThisroleisvitaltothesuccessofMFINtoensurethatthedataisenteredinatimelymanner,thequalityofdataiscontinuouslymonitored,andcommunicationandsupportbetweenMFINandtheMFINMemberAgencyisstreamlined.

Definitions:

AgencyAdministrator–isthecentralizedcontactforMFINstaff;firstlineoftechnicalassistancetotheirusers;participatesinMFINAdvisoryCommitteeMeetingsPointofContact–isthecentralizedcontactforMFINstaffSeeForm203-A–DesignationofAgencyAdministratororPointofContactForm






AUTHORITY:

24CFRParts91,576,580,and583HMISMFINRoles&Responsibilities-EndUserRoles&Responsibilities

POLICY:

EachMidFloridaInformationNetwork(MFIN)EndUsermustattendatleastonenewusertraining,attendannualsecuritytraining,andsignaMFINprivacynoticereceiptinordertoaccessliveclientdatainMFIN.EveryMFINEndUserisresponsibleforthefollowing:

Adheringtoallthepolicy&proceduresoutlinedinthisdocumentAttendingalltrainingsrequiredbyMFINstaffandtheMFINMemberAgency

administratorEnteringqualitydatainatimelyandaccuratemannerAdheringtothedatarequirementssetbytheMFINstaffandtheMFINMemberAgency






AUTHORITY:

24CFRParts91,576,580,and583HMISMFINRoles&Responsibilities–InitialMFINStaffSiteVisit

POLICY:

AftersigningtheMidFloridaInformationNetwork(MFIN)agreement,anewMFINMemberAgencywillscheduleandcompleteanon-siteinitialMFINvisitattheAgencylocationwhereclientdataisenteredandstored.

PURPOSE:

Atthesitevisit,MFINstaffwillreviewthedatasecurity&qualitycomplianceprocedures,reviewpolicies&procedures,andrequireddataelements.ThesitevisitalsoallowsMFINstafftoidentifyanypotentialsecurityrisksthatwillneedtobemitigatedbytheMFINMemberAgencypriortobeginningdataentry.

PROCEDURE:

MFINStaffwillcontactnewMFINMemberAgencytoscheduletheon-sitevisit.ThisvisitisbetweentheMFINstaff,andtheAgencyAdministratororPointofContact(refertoPolicy203);

itisrecommendedtheAgencyincludeanystafftheyfeelisnecessarytoMFINdataentry,dataqualityorreportingprocess.

SeeForm205-A-MFINOn-SiteInitialVisitChecklist






AUTHORITY:

24CFRParts91,576,580,and583HMISMFINRoles&Responsibilities–MFINMinimumTechnicalRequirements

POLICY:

AllMidFloridaInformationNetwork(MFIN)enduserworkstationsmustmeetminimumtechnicalrequirementsinorderforMFINtobefunctionalandtomeettherequiredsecurityspecifications.

PURPOSE:

ThefollowingdetailsaretheminimumsetoftechnicalrequirementsforhardwareandinternetconnectivitytoMFIN: MinimumRequirements

OperatingSystem:Windows7+,MacOSX10.5+ProcessorSpeeds:IntelorAMDDualCoreRAM:1GBRAMConnectivity:CableorISDN

Authorizedbrowsers:InternetExplorer9+,GoogleChrome,Firefox,orSafari Firewalls:Yes

Routers:Yes

DesiredRequirementsOperatingSystem:Windows7+,MacOSX10.11ProcessorSpeeds:Inteli3RAM:4GBRAMConnectivity:20kbpsperUser

Workstation:shouldhavetheircachesrefreshedonaregularbasistoallowforproperspeedandfunctionality;shouldcontinuetobeupdatedtothemostcurrentversionofJava;mayneedtohavetheirvirtualmemoryincreased

Virusprotection:EverycomputerthataccessesMFINmusthavecurrentvirusprotection.

Form206-AMFINComplianceChecklist






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)DataSharing–DataSharing

POLICY:

TheMidFloridaInformationNetwork(MFIN)isanopt-outsystemasweareanopenCoCthatwantstosharedatawithotheragencies.

Ithasbeenestablishedthatthedatathatisbeingenteredbyeachagencybelongstothatagency.Agenciescanrunreportsthatincludeanyandalldataenteredbythatagency’spersonnel.MidFloridaHomelessCoalition,astheAdministratorfortheMFIN,hasclientlevelandreportaccesstobothSharedandNotShareddata,butwillnotprovideclientleveldatathatbelongstooneagencytoanother.

AHomelessManagementInformationSystemisnotapartoftheSunshineLawandinformationshouldonlybeprovidedtolawenforcementviaacourtorder.

HoworganizationsusePersonalInformationthatiscollectedandSharedorNot-SharedislistedintheMidFloridaInformationNetworkFullPrivacyNotice.

MFIN’scurrentsystemhasavarietyofsharingoptions.Settingsmaybedifferentforeachofthefollowingcategories:

ClientsCreated–thiscategoryreferstotheClientProfile

NotSharedwillallowalluserstoviewSSN,name,DOBandclientid;Sharedwillallowalluserstoseeallelementsoftheclientprofilescreen.

Default setting for all agencies on initial set up in system is Shared. AgencieswishingtomakethisfunctionNotSharedmustindicatesoonform301-1.

Services/Programs/AssessmentsPlaced

Not Shared – other agencies will not see any information about service, program orassessmenttransactions

Basic Shared – other agencies will see that service and program transactions haveoccurred,butwillnotbeabletoeditorseedetailsofthesetransactions.

Full Shared–users fromother agencieshave full access to all information relating toserviceorprogramtransactions,andhavetheabilitytoeditthetransaction.


Notes–includesClientNotesandPublicAlerts

NotShared–stafffromotheragenciescannotviewpublicalertsorclientnotesBasicShared– staff fromotheragencieswill see thePublicAlerton theClientProfile

Screen;theycanalsoaddanewNote,butcannotedit/deleteanexistingnotefromotheragencies,andonlyseethetitle,thestaffpersonwhoenteredthenote,andthedateoftheexistingnotesbyotheragencies

Fullshared–stafffromotheragenciescanadd/editpublicalerts,butcannotdeletepublicalerts generated by another agency; can add/edit client notes, but cannot deleteclientnotesgeneratedbyanotheragency


Files–includesClientFilesandClientFormsthatcanbedownloadedandstoredinFilestaboftheclientrecord

NotShared–staff fromotheragencieswillnotbeable toviewClientFilesandClientForms

BasicShared–stafffromotheragencieswillbeabletoreviewClientFilesandClientFormsbutcannotdeletethem.

FullShared–stafffromotheragencieswillbeabletoviewClientForms,andViewanduploadnewversionsofClientfiles;however,theycannotdeleteClientfilesorClientforms.


Location(referstothevarioustypesofaddressesthatarerecordable)

Notshared–stafffromotheragencieswillnothaveaccesstoanyaddressesenteredbytheagency

BasicShared–stafffromotheragencieswillbeabletoviewtheclient’saddress,butwillnotbeabletoeditordeleteanyaddressentered

Fullshared–stafffromotheragencieswillbeabletoviewandedittheclient’slocation,butwillbeunabletodeletethelocation.


Individual Exceptions –Anagency can choose tohavea category set toBasic Sharedor FullShared,butforsometypesofentries,ausercansetanindividualentryto“private”,andeventhoughtheagency’ssharesettingisbasicsharedorfullshared,thatparticularentrywillbeNotShared. Types of entries that have this option: Programs & Services, Notes, Public Alerts,Locations,Files,Forms

AgencyExceptions

AnagencyexceptioncanbecreatedwhenyouneedaparticularagencytohavesharingsettingsthatdifferfromtheSharingDefaultsettings.

Procedure:Eachagencymustprovidewrittenrequestforsharesettingstobechanged.RefertoForm301-A–MFINShareSettingsintheappendices.

Seeform301-A–MFINShareSettings






AUTHORITY:

24CFRParts91,576,580,and583HMISUserAdministration-EndUsers

POLICY:

AllEndUsersmustbeprovidedwithtrainingthroughMFINstaffpriortoenteringoraccessingclientdatainMFIN.

PROCEDURE:

AgencieswhowishtohaveanewusertrainedmustcontacttheMFINAdministratortoscheduletraining.Wewillworktoscheduletrainingasquicklyaspossible,butwewillalwaysattempttoscheduleagroupofuserstokeeptrainingandtravelcostsdown.






AUTHORITY:

24CFRParts91,576,580,and583HMISUserAdministration-EndUsersPrerequisites

POLICY:

AllendusersarerequiredtohaveaminimumsetofbasiccomputerskillstoadequatelyperformtheirdataentryrolesinMidFloridaInformationNetwork(MFIN).

PROCEDURE:

Userswillbeevaluatedforcompetencyduringthebeginningofthetraining.Usersthataredeterminedtonotmeetthecompetencyrequirementswillbeinvitedtoremainandobservetheclass.ThePointofContactwillbecontactedaftertheclass.Classestoimprovecomputerproficiencycanbefoundatalocallibrary,communitycenter,college,etc.Basiccomputercompetencyincludes:useamousetopoint,clickanddouble-click;useakeyboard;openandclosesoftwarefiles;locatingasavedfile;copyandpastetext;accesstheinternetviabrowser;enteraURL;scrollthroughwebpage;movesmoothlythroughdataentryfieldsusingtabbuttons,arrowbuttonsand/ormouse.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)UserAdministration–UserTraining

POLICY:

MidFloridaInformationNetwork(MFIN)providesthefollowingtrainingopportunitiesforitsendusers.

• StandardOperatingProcedures–trainingfocusesonrequirementsofdataentrybasedon state/federal funding, definitions relating to homelessness, data requirements ofMFIN,etc.

• Privacy & Client Consent Policy & Procedure –training focuses on clients’ rights andprivacy,anddatasecurityinMFIN.

• BasicHMISSoftware&DataEntry–trainingfocusesonthesoftware:howtoaddclients,enrollintoprogramsandservices,dischargingclients,etc.

• ReferralTraining–trainingwillfocusontheprocedurestoreferaclienttoanotherMFINagencyviaHMISsoftware.

• Intermediate /AdvancedHMIS software– trainingwill focusonbasicMicrosoft Excel(enteringdata, inserting/deletingcolumnsandcells, formattingcells,calculatingsums,

sortingdata;trainingalsofocusesonthereportsinHMIS,howtorun,export,andusereports.

• SystemAdministratorTrainingforITstaff

• MonthlyUserTraining

• AnnualSecurityTraining–trainingwillfocusonmaintainingsecurityofclientdata

• Grantbudgetprojectionspreadsheet–trainingwillfocusonhowtoutilizeExceltoplanservicestobeprovidedinordertofullyexpendagrantbudget.

PROCEDURE:

AgencieswhowishtohaveanewusertrainedmustcontacttheMFINadministratortoscheduletraining. MFINAdministratorwillattempttoscheduletrainingat locationsandtimestobestservemultiplenewusers.

Training locations are typically held in centralized locations: Lake County – Lake CountyGovernment Admin Building – HR Conference Room; Hernando County – Hernando CountyGovernmentBuilding–HHSConferenceRoom;CitrusCounty–LecantoGovernmentBuilding–ComputerLab.Usersarefreetoattendwhicheverlocationismostconvenient.

Trainingtimesfornewuserclassestypicallyare:morningclasseswillrunfrom8:30am–12pm,andafternoonclasseswillrunfrom1pm–4:30pm.

Trainingforareasotherthannewuserclasseswillbescheduledonanas-neededbasis.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)UserAdministration–Usernames

POLICY:

EndUsersmust be provided a licensedusername andprovided training throughMid FloridaInformationNetwork(MFIN)priortoenteringoraccessingclientdatainMFIN.

PROCEDURE:

Uponapprovalofanewuser,MFINAdministratorwillcreateausernameandprovide log-oninformationtotheuserduringtheNewUserTraining.MultipleusersutilizingthesameusernameisprohibitedexceptundercertaincircumstancesandwithpriorknowledgeandpermissionfromtheHMISAdministrator.Asalways,anynewuserswhowouldbeusingthissharedusernamewillberequiredtoattendnewusertrainingprovidedbyHMISstaff.





LastReviewed: 7/12/2017 LastUpdated:

AUTHORITY:

24CFRParts91,576,580,and583HMISUserAdministration–UserLicenseAdministration

POLICY:

NotificationofissuanceandrevocationofaccesswithintheMidFloridaInformationNetwork(MFIN)istheresponsibilityoftheMemberAgencyAdministrator.

PROCEDURE:

TheMemberAgencyadministratorsareresponsiblefornotifyingMFINstaffofanewuser,changeinuseraccess,ordeletionofuseraccesswithin24hoursoftheneededchangetoMFINaccess.

MFINstaffwillassignthesecuritylevelofeveryenduserbasedontheagreeduponsecuritysettingsestablishedbytheMemberAgencyattheinitialMFINSiteVisit.Usersshouldbeassignedthelowestlevelofsecurityneededtoperformtheirnormalworkduties.

UsersmustlogintotheliveHMISwithin5daysofinitialtraining,andallownomorethan60daysbetweenloginsessionstokeeptheirusernameactive.ViolationoftheseruleswillresultinauserhavingtheirloginaccessinactivatedbyMFINstaff,andtheuserwillberequiredtoattendre-trainingpriortoregainingaccess.






AUTHORITY:

24CFRParts91,576,580,and583HMISUserAdministration–MFINRemovalofUserforCause

POLICY:

MidFloridaInformationNetwork(MFIN)reservestherighttoimmediatelyinactivateordeletetheusernameofanyenduserforcause.

PROCEDURE:

Inallcaseswhereausernameisremovedforcause,theassignedMFINmemberagencyadministratorandExecutiveDirectorwillbenotifiedimmediatelyviaemailwiththestatedcauseofuserremoval.

Reasonsthatauserwouldberemovedorotherwisehavetheiraccesstemporarilyinactivatedorrevokedwouldinclude,butnotbelimitedto:

• Multiplefailedlogonattemptsinthesameday(thisisanautomaticprocesswherethesystemlockstheuserafter3failedattempts;usernameisautomaticallyunlockedafter2hours)

• Aconsistentlackofgooddataquality

• Failuretologontosystematleastonceinaconsecutive60-dayperiod

• Sharingsystemcredentials(usernameandpassword)withanyotherparty

• Violationofclientprivacyorsecurity






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)SecurityPlan–SecurityPlan

POLICY:

AsperHUDHMISSecurityStandards(§580.35)theHomelessManagementInformationSystem(HMIS)Lead,MidFloridaHomelessCoalition,mustestablishasecurityplan(approvedbytheContinuumofCare),designateaSecurityOfficer,conductworkforcesecurityscreenings,reportsecurityincidents,establishadisasterplan,establishphysicalandtechnicalsafeguards,andconductanannualsecurityreview.Thesepoliciesaredocumentedin501.1through501.6.

PROCEDURE:

TheSecurityOfficeroftheMidFloridaInformationNetwork(MFIN),thenameofthisCoC’shomelessmanagementinformationsystem,isherebydesignatedtobeMidFloridaHomelessCoalition’sMFINAdministrator.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)SecurityPlan–WorkforceSecurity

POLICY:

AsperHUDHomelessManagementInformationSystem(HMIS)SecurityStandards(§580.35)andasestablishedbyFL520–Citrus,Hernando,LakeandSumterCoC,everyCoveredHomelessOrganization(CHO):

1. mustdesignateanHMISsecurityofficertoberesponsibleforensuringcompliancewithapplicablesecuritystandards;

2. mustconductcriminalbackgroundchecksonSecurityOfficerandallAdministrativelevelusers.

Definition:CoveredHomelessOrganization(CHO)-Anyorganization(includingitsemployees,volunteers,affiliates,contractors,andassociates)thatrecords,usesorprocessesdataonhomelessclientsforanHMIS.

PROCEDURE:

TheMidFloridaInformationNetwork(MFIN)requirestheHMISSecurityOfficertopassabackgroundcheck.

TheFloridaLegislaturehaspassedalaw,effective8/1/10,thatplacesnewrequirementsonpersonswhoworkwithvulnerablepopulations(children,elderly,andthedisabled).Thislaw,partof2011FloridaStatuteXXXI,Section435regardinglaborbackgroundchanges,hasbeenadoptedbytheDepartmentofChildrenandFamilies,AgencyforHealthCareAdministration(AHCA),DepartmentofElderAffairs,andtheFloridaDepartmentofLawEnforcement.

Thislawrequiresthatemployeesandvolunteerswhoworkwithvulnerablepopulationsundergoandpassabackgroundcheck.

Allparticipatingagenciesarerequiredtoensuretheyareincompliancewiththislaw.TheMemberAgencyAgreementwillattesttothis.

InordertosecurethesharedclientdatainMFIN,weencourageeachorganizationtofollowthislawforalluserswhohaveaccesstoMFINdata.

SeeForm501-A–DesignationofSecurityOfficer






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)SecurityPlan–SecurityTraining

POLICY:

TheMFINAdministrator,alsoknownastheMFINSecurityOfficer:

1. willensurethatallusersreceivesecuritytrainingpriortobeinggivenuseraccesstoHMIS;

2. willproviderequiredannualsecuritytrainingatleastannuallyforallusers,andthatthetrainingcurriculumreflectsthepoliciesoftheContinuumofCareandtherequirementsasperDEPARTMENTOFHOUSINGANDURBANDEVELOPMENT24CFRParts91,576,580,and583[DocketNo.FR-5475-P-01]HomelessManagementInformationSystemsRequirements.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)SecurityPlan–ReportingSecurityIncidents

POLICY:

AllCoveredHomelessOrganizations(CHOs)areobligatedtoreport,within24hours,suspectedinstancesofnoncompliancewithpoliciesandproceduresthatmayleaveMFINdatavulnerabletointrusion.Eachisresponsibleforreportinganysecurityincidentsinvolvingtherealorpotentialintrusion of theMid Florida Information Network to theMFIN Administrator atMid FloridaHomelessCoalition.

PROCEDURE:

MFINusersmustreporttotheiragency’sSecurityOfficeranyincidentinwhichunauthorizeduseordisclosureofPersonallyIdentifiableInformation(PII)hasoccurredandanyincidentinwhichPIImayhavebeenusedinamannerinconsistentwiththeMFINSecurityPlan.SecuritybreachesthathavethepossibilitytoimpacttheMidFloridaInformationNetworkmustbereportedtotheMFINAdministrator.TheagencySecurityOfficemustContacttheMFINAdministratorviaemailatmfhc02@gmail.com.Provideallpertinentinformationrelatedtothebreachofsecurity.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)SecurityPlan–DisasterPlan

POLICY:

Bitfocus, Inc.,ownersofClarityHumanServices,providesdisasterprotectionandrecoverybycopyingdataonaregularbasistoanothermediumandtoasecureoff-sitelocation.Dataisstoredin a central server that is in a secure room with appropriate temperature control and firesuppressionsystems.Surgeprotectorsareusedonall serversused tocollectandstoredata.DisasterRecoveryexercisesarecarriedouttwiceperyear.

Back-upsoftheMFINDatabaseisconductedeverynightatmidnightandincludesallprogramconfigurationinformation,applicationconfiguration,anddatabases.

PROCEDURE:






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)SecurityPlan–PhysicalSafeguards

POLICY:

AsperHUDHomelessManagementInformationSystem(HMIS)SecurityStandards(§580.35)andas establishedby FL 520–Citrus,Hernando, Lake and SumterCoC, everyCoveredHomelessOrganization(CHO):

1. Should have a policy defining the confidential storage of paper records containingpersonallyidentifiableinformation(PII);

2. Should have a policy defining the length of time records containing PII and otherinformation relating to MFIN are retained; policy should consider funded programrequirements;

3. ShouldhaveapolicydefiningdestructionofhardcopyanddigitalrecordscontainingPII.

Definition:CoveredHomelessOrganization (CHO) -Anyorganization (including its employees,volunteers, affiliates, contractors, and associates) that records, uses or processes data onhomelessclientsforanHMIS.

Form206-AMFINComplianceChecklist






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISSecurityStandards(§580.35)SecurityPlan–TechnicalSafeguards

POLICY:

ToprotectandcontrolaccesstoprotectedelectronicMFINinformation:

1. Agency users must not share usernames and passwords, nor store usernames andpasswordsinpubliclocations.

2. Computers and other internet accessible devices such as notepads and cell phonesaccessing theMFIN should be password protected, and screensavers should have anautomatictimeoutrequiringapassword.

3. Digitalmediashouldbeappropriatelywipedorreformattedasindicatedbythetypeofmedia.

4. Computer hardwaremust have virus protection in placewith auto-update turnedon;virusprotectionshouldbeupdatedannually.

5. FirewallsarerecommendedtoprotecttheMFINfromoutsideintrusion.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISDataQualityStandards(§580.37)DataQualityPlan–DataQualityPlan

POLICY:

DataQualityStandardsandBenchmarksfortheFL-520-Citrus,Lake,Hernando,&SumterCoCareasfollows:

• Bed Coverage Rates – the CoC strives for 100% bed coverage each year,meaning allsheltersinthegeographicareaexceptdomesticviolencesheltersareenteringdataintotheMFIN.

• BedUtilizationorOccupancyRates–CHOsaretostriveforautilizationrateof65%andhigher(theminimumratesrequiredfortheAnnualHomelessAssessmentReport)

• Service-VolumeCoverageRates – this rate applies toHUDprojectswithout overnightaccommodations(homelessnesspreventionprojectsorstreetoutreachprojects)andwillbe obtained by dividing the number of persons served annually by the projects thatparticipateintheHMISbythenumberofpersonsservedannuallybyalloftheContinuumofCareprojectswithintheHUD-definedcategory.

• UniversalDataElements

o Facilitiesandlocal,stateorfederallyfundedprogramsrequiringentryintoHMIS-usersMUSTanswerthefollowingdataelementquestions:Name,SSN,DOB,Race,Ethnicity,Gender,VeteranStatus,DisablingCondition,ProjectStartDate,ProjectExitDate,Destination,andRelationship toHeadofHousehold,ClientLocation,Housing Move-In Date, and Living Situation. (Client Location is automaticallycompletedbysystem.)

o PreventionServices–itisrecommendedthatagenciesprovidingrentalandutilityassistance thatarenot stateor federallygrant-fundedshouldcollect the sameUniversal Data Elements as the Facilities and other grant-funded programsrequiringentryintoHMIS.

o OtherServicesOnly&FoodPrograms–forservicesnotprovidedunderlocal,stateand federalprogramthatarenot financial innature, theMFHCRECOMMENDSagenciesanswerName,SSN,DOB,Gender,Race,Ethnicity,VeteranStatus,aswellasLivingSituation,EmploymentStatus,IncomeStatus,andDisablingCondition.

• Missing/Don’tKnow/RefusedData–o Facilities and local, state or federally funded programs (street outreach, rapid

rehousing,homelessprevention) should strive for less than3%missing /don’tknow/refuseddataonuniversaldataelements;

o ServicesOnlyandFoodPantriesshouldstrivefor20%orlessmissing/don’tknow/refuseddataonuniversaldataelements.

PROCEDURE:

It isexpected thatallmemberagenciesenteringdata into theMFINwillworkwithclients tocollectandenterallnecessarydata.

Dataqualitywillbeevaluatedonamonthlybasis,andifneeded,theMFINAdministratorwillcontactnecessary agencies to corrector completedata. Agenciesmust respond to requestswithin5businessdays.

DataqualityreportcardsarepreparedbyMFINAdminstaffandsharedwiththePerformanceMeasuresCommittee,andinclude,butarenot limitedto,Utilizationrates,TimelinessofdataentryandDataQualityforallUniversalDataElements(UDE).






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISDataQualityStandards(§580.37)DataQualityPlan–DataEntryTimeliness

POLICY:

Dataentrymustbedoneinatimelymanner.Agenciesprovidingshelterwillinputentryandexitdataonaclientwithin5daysofactivity.Agenciesprovidingservicesonlywillinputentryandexitdataonaclientwithin30daysofactivity.

AgenciesreceivingstateorfederalgrantsrequiringHomelessManagementInformationSystemdataentrywillinputentryandexitdata,aswellasservicesprovidedforaclientwithin5daysofactivity.

PROCEDURE:

MFINAdministratorwillrunandforwarddataqualityreportstoAgencyAdministratorsthatshowusers’dataentrytimeliness.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISDataQualityStandards(§580.37)DataQualityPlan–DataQualityRevision

POLICY:

DataQualityisreviewedbyMidFloridaInformationNetwork(MFIN)staffonatleastamonthlybasis.MemberAgencyadministratorswillbecontactedaboutMissingdata,andRefusedorDon’tKnowanswers,aswellasdatathatisconflicting.

PROCEDURE:

MFINAdministratorwillprovidedataqualityreportsshowingthemissingand/orconflictingdata,andrequesttheclient’sfilesbecheckedforthecorrectinformation,oraskthattheclientbere-interviewedtogatherthecorrectinformation.

UserswillneedtomakethecorrectionsintheHMISdatarecordwithin5businessdaysofnotification.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISDataQualityStandards(§580.37)DataQualityPlan–UtilizationReport

POLICY:

ShelterutilizationrateswillbereportedtotheContinuumofCare(CoC)onaquarterlybasis.

PROCEDURE:

TheUtilizationReportwillbepreparedafterthe6thofeachmonth.Agenciesshouldensurealldataforthepreviousmonthisup-to-dateinorderfortheutilizationratestobeaccurate.

Areportconsistingofeachindividualshelter’sutilizationrates(#ofnightsavailableforuse,#ofnightsused,percentagerateofusage,andnumberofindividualsserved)forthepreviousmonth,anda report showing the last12month’soccupancy ratesofall shelterswillbe createdandsharedwiththeCoCandpublishedontheCoC’swebsite.






AUTHORITY:

Bitfocus,Inc.(HMISvendor)DataQualityPlan–ReportingErrorsinClarityReports

POLICY:

MidFloridaHomelessCoalition’sHMISvendor,Clarity,hasspecificdocumentationrequirementsinorderreproducetheissueandresolveitinamoretimelymanner.

PROCEDURE:

UsersreportingissueswiththeReportsfeatureofClarityshouldprovidethefollowinginformationtotheMFINAdministrator:

1. Fullnameofthereport(i.e.-[HUDX-101]AnnualPerformanceReport[APR])2. Whatparametersdidyouuse?-(pleaseincludeeverything:startdate,enddate,

programsorservicesselected,etc.)3. Describeindetailwhathappened,ormaybewhatshouldhavehappenedbutdidn't.4. Didyoucheckyourdatatoseeifmaybeyouhadanerror?5. Whatistheimportanceofthereport:Low,Medium,High6. Ifpossibleforwardascreenshotoftheerrormessage(clickthekey"printscreen"or

"prtsc"onyourkeyboard,then"paste"theimageintoyouremail).






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISDataQualityStandards(§580.37)DataQualityPlan–GrantContracts

POLICY:

AllorganizationsthatarerequiredtouseHMISasthereportingdatabaseforaStateorFederalgrant,mustprovideacopyofallgrantcontracts,orawardnotificationletters,withintendaysofbeingfullyexecuted.ThesecontractswillbeusedMFINAdministratortosetupneededreports,andwillprovideneededguidelinestobeusedtoassurecorrectdataisbeingcollectedandentered.

PROCEDURE:

Uponreceiptofyourfullyexecutedcontract,forwardacopy,viaemailifpossible.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISDataQualityStandards(§580.37)DataQualityPlan–FederalGranteesandSub-GranteesofMFHC

POLICY:

ContractswiththeDepartmentofHousingandUrbanDevelopment(HUD)willbereviewedbytheMidFloridaInformationNetwork(MFIN)stafftodeterminewhatdatamustbecollectedandreported. Beginning in2016, all Stateof Florida funding is granted to the LeadAgency,MidFloridaHomelessCoalition,andthensub-grantedtovariousMemberagencies.

PROCEDURE:

MFINstaffwilladviseMemberAgencieswithanychangesnecessaryindatacollectionordataentrybasedontheircontractswithHUD.

Sub-granteeswillberequiredtoattendapre-grantmeetingand/ortrainingwheretheywillbeprovidedalldatacollectionrequirements.

MFINstaffwillreviewcollecteddataonamonthlybasis,advisingMemberAgencyadministratorofanymissingorconflictingdatainatimelymanner,allowingagencyachancetocorrectthe

datapriortomonthly,quarterlyorannualreportsbeingpulledfromtheHMISdatabase. PerPolicy601.1,data relating to stateand federal grants requiringentry into theMFINmustbeenteredwithin5daysofoccurrence.

The Annual Performance Report (APR) for the HUD Homeless Assistance Grants that aresubmitted to the granting agency must be copied to MFIN staff (via email is the preferredmethod).Monthly,quarterlyandfinalESGCAPERreportsfortheEmergencySolutionsGrantswillberunbyMFINstaffandsubmittedtothethegrantingagency.AgenciesreceivingEmergencySolutionsGrantsareencouragedtoruntheESGCAPERreportsthemselvestoreviewtheirdataforanyinconsistencies.

TheMFHCPerformanceMeasurementCommitteewill reviewthequarterly/finalESGreports.TherecipientagencieswillbeaskedtopresenttheirAPRduringaregularContinuumofCaremeetingheldfollowingtheAPR’ssubmission.Thesereportsprovideinformationondataquality,aswellasoutcomesforstablehousing,income,andearnedincomemeasures.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISDataQualityStandards(§580.37)DataQualityPlan–AnnualHomelessAssessmentReport

POLICY:

TheContinuumofCare(CoC)mustreporttoHUD,onanannualbasis,informationpertainingtoallpersonswhohavestayedinafacilityviatheAnnualHomelessAssessmentReport(AHAR).

PROCEDURE:

ThisinformationispulledfromtheclientdataeachagencyentersintotheMidFloridaInformationNetwork(MFIN).Datareportedincludesage,race,ethnicity,residencepriortoprogramentry,zipcodeoflastpermanentaddress,disablingconditionandtypes,veteranstatus,andhouseholdsize.

MFINstaffreviews,onamonthlybasis,thedataqualityofallfacilities,andwillusethisdatatocreatetheAHARreport.

MissingorconflictinginformationwillbesharedviaemailwitheachMemberAgencyinordertoreflectthemostaccuratedatapossible.MemberAgenciesareaskedtorespondtodataqualityrequestswithin5daysofreceipt.

DataiscombinedwithinformationfromtheHousingInventoryCount(HIC)toproduceautilizationrateforindividualsandfamilieswithchildrenforeachproject(EmergencyShelter,TransitionalHousing,andPermanentSupportedHousing).Theoverallutilizationrategoalis65%fortheAHARreporttobeconsideredusablebyHUD.






AUTHORITY:

24CFRParts91,576,580,and583-HUDHMISDataQualityStandards(§580.37)DataQualityPlan–AnnualPointinTimeCount(PIT)andHousingInventoryCount(HIC)

POLICY:

TheContinuumofCare(CoC)mustreport,onanannualbasis,informationpertainingtoallpersonswhoarehomelessononedayduringthelast10daysinJanuary.Everyyear,allshelteredliterallyhomelessindividualsandthosewhoareliterallyhomelesswithoutsheltermustbecountedandreportedtobothHUDandtheStateofFlorida.Onalternatingyears(evenyears),thereporttotheStateofFloridamayalsoincludethoseindividualswhoarehomelessbutlivinginadoubled-upsituationsuchaswithfamilyorfriendsbasedontherequirementsoftheState.OnthatsamedayinJanuary,theCoCmustalsoreportforeachfacility,usingtheHousingInventoryCount(HIC),thenumberofbedsandunitsavailableforindividualsandfamilieswithchildrenwhoarehomelessthroughoutourcommunities.

PROCEDURE:

TheCoCwilldetermineonwhichofthelast10daysofJanuarythecountwilloccur.MidFloridaInformationNetwork(MFIN)willutilizeHMISfortheshelteredcount,andplanswillbemadeforstreetcountsoftheliterallyhomelessineachofourcommunities,utilizingvolunteersfromtheMemberAgenciesandotheragenciesservingthoseinneed.

RepresentativesofeachschoolsystemwithintheCoCwillreportthenumberofhomelessstudents,andthesewillbeaddedtotheshelteredandstreetcounts.

AllMemberAgencieswhoenterdataforfacilitiesmusthavetheirdataentrycompletedwithin5daysofthedateofthecount.TheMFINAdministratorwillreviewthedata,andifnecessarycontacteachMemberAgencywithanyquestionsregardingmissingorconflictingdata.Ifnecessary,basedontheState’srequirements,MemberAgenciesmayneedtocompleteaShelterAssessmentforeachindividualcontaininganyadditionalquestionsrequiredbytheState.

TheMFINAdministratorwillcompletethePoint-in-TimereportonHUD’sDataExchangewebsite,andtheExecutiveDirectorwillsubmitthereport.

DuringthemonthofFebruary,theMFINAdministratorwillvisiteachsheltertocertifythenumberofyear-roundbeds,thenumberofoverflowbeds,andthenumberofseasonalbeds.ThenumberofbedswillbebasedonMemberAgencyinput,aswellasareviewofpastusage.

ItisimportantthateachshelteraccuratelyreportthenumberofyearroundusebedsastheHousingInventoryCountresultswillbeutilizedaspartoftheAnnualHomelessAssessmentReporttodeterminetheutilizationrateforeachshelter.






AUTHORITY:

24CFRParts91,576,580,and583PrivacyPlan–PrivacyPlan

POLICY:

ThisPlandescribestheprivacypolicyandpracticesofMidFloridaInformationNetwork(MFIN).MFINisadministeredbytheMidFloridaHomelessCoalition(MFHC).TheMFHCcanbecontactedbymailatP.0.Box3031,Inverness,FL34451-3031orbyphoneat(352)860-2308/ThisPlancoverstheprocessingofprotectedpersonalinformationforclientsofallparticipatingagenciesoftheMidFloridaInformationNetwork.

ProtectedPersonalInformation(PPI)isanyinformationwemaintainaboutaclientthat:

a) Allowsidentificationofanindividualdirectlyorindirectly

b) Canbemanipulatedbyareasonablyforeseeablemethodtoidentifyaspecificindividualor

c) Canbelinkedwithotheravailableinformationtoidentifyaspecificclient.Whenthesepoliciesrefertopersonalinformation,theymeanPPI.

ThisPlanwasadoptedbytheMFINbecauseofstandardsforHomelessManagementInformationSystems(HMIS)issuedbytheDepartmentofHousingandUrbanDevelopment(HUD).ItistheintentofMFINforourpoliciesandpracticestobeconsistentwiththesestandards.SeeFederalRegisterVol77,No147(July31,2012).

ThisPlanpertaintoClientPrivacyandAgencyPracticesavailableinaPrivacyNoticeforMidFloridaInformationNetwork(MFIN).TheMFINmayamendthisnoticeandchangethepolicyorpracticesatanytime.Amendmentsmayaffectpersonalinformationthatisobtainedbeforetheeffectivedateoftheamendment.

Awrittencopyofthisprivacynoticeisprovidedtoanyindividualwhoasks.Asignispostedatintakedesksorotherlocationsvisibletoclientsexplainingthereasonspersonalinformationisrequested.Thesignsays:

Wecollectpersonalinformationdirectlyfromyouforreasonsthatarediscussedinourprivacystatement.Wemayberequiredtocollectsomepersonalinformationbylaworbyorganizationsthatgiveusmoneytooperatethisprogram.Otherpersonalinformationthatwecollectisimportanttorunourprograms,toimproveservicesforhomelessindividuals,andtobetterunderstandtheneedofhomelessindividuals.Weonlycollectinformationthatweconsidertobeappropriate.

ThesignalsoincludesallcurrentandactivemembersoftheMidFloridaInformationNetwork(MFIN).

PROCEDURE:

ThePrivacyNoticeforMidFloridaInformationNetwork(MFIN)FullNoticeandtheBriefNoticesignareprovidedtoeachuserinMFIN.Usersmustreceive,read,andfollowinordertoreceiveausernameandpassword.Eachusermustsignareceiptacknowledgingthisintent.

TheMFINAdministratorwill,asneeded,provide,viaemail,updatedBriefNoticesasagenciesareaddedorremoved.

policies and procedures - mid florida … florida homeless coalition ... 602.3 point in time &...

Documents