Common questions about data sharing and the ROI
Author: Britt | Date Created: July 21, 2025 | Date Updated: July 30, 2025
Can clients give verbal consent?
- Clients can give verbal consent if you're meeting over the phone.
- Mark “verbal consent” on the form and keep a copy in the paper file.
- At the first in-person meeting, have the client sign the form.
Exception to verbal consent: If your agency is covered by HIPAA, verbal consent is not allowed. The client must sign in person.
What is the Data Privacy Notice (DPN)?
The first page of the ROI. It explains what data is collected, why, who can see it, and client rights. Review it with the client and give them a copy.
What is the "Posted" DPN?
A short version of the DPN. Post it where clients can see it. It does not replace the full DPN at intake.
Do clients need to sign the new ROI?
Yes. All clients, including those who signed one before August 2024, need to sign the current version.
What if household members have different sharing preferences?
That is ok. When enrolling the household, you can select each client's data sharing choice on the program enrollment screen. The default selection is All Organizations. If a household member does not want to share enrollment information, change theirs to Creating Organization Only.
What if a client wishes to have closed transaction visibility but is being assessed for Coordinated Entry?
If your client chose not to share their transactional information in the past but is now being assessed for Coordinated Entry or would like to reserve a shelter bed - pause. 🛑
You will want to discuss the benefits of data sharing in to help their situation and limitations of not doing so. If they still prefer not to share in HMIS, that is ok. You will restrict their transactions to Creating Organization Only. Your agency will need to coordinate services and housing referrals outside of HMIS.
What if a client changes their mind?
Have them sign a new ROI. Update their sharing setting in HMIS for their current enrollment with your project. The change applies to new data only. You can update old entries from your agency as a courtesy, but it’s not required.
What’s the difference between Standard, HIPAA, and MGDPA ROIs?
- HIPAA-covered agencies must collect in-person signatures. Verbal consent is not allowed.
- MGDPA-covered agencies follow similar rules.
- If you don’t know if your agency needs to follow these data privacy regulations, ask your supervisor.