21-089.00 City of Spokane: County CMIS System �( -OS1
CMIS Agency Partner Agreement
Agency Partner Agreement
Spokane City/County CMIS
The Community Management Information System ("CMIS") is an HMIS compliant management system
that maintains information regarding the characteristics and service needs of Clients for a variety of reasons,
including the provision of more effective and streamlined services to Clients and the creation of information
that communities can use to determine the use and effectiveness of services.
Ultimately, when used correctly and faithfully by all involved parties, the CMIS is designed to benefit
multiple stakeholders, including provider agencies, persons who are homeless or in need of supportive
services, fenders and the community,through improved knowledge about people who are homeless,their
services and service needs,and a more effective and efficient service delivery system.
C ;1 f o f 1 o IL4M... V A lit , ("Agency")has elected to participate in CMIS.
Agency and the CHHS Department agree as follows:
1. General Understandings:
a. In this Agreement,the following terms will have the following meanings:
(i) "Client"refers to a consumer of services;
(ii) "HMIS"refers to the Homeless Management Information System compliance standard
that is a prerequisite requirement to receive federal and state funding.
(iii) "CMIS"Community Management Information System,a CMIS compliant database.
(iv) "Agency"refers to the legal entity participating in the CMIS.
(v) "Partner Agency" refers to any Agency participating in the CMIS.
(vi) "Agency Staff'refers to both paid employees and volunteers.
(vii) "CMIS Lead Agency" refers to the agency responsible for administering the CoC's
CMIS database.
(viii) "CoC"refers to the Continuum of Care,a consortium of service providers that establish
rules, plan, and determine funding priorities for homeless and at-risk programs within
the region established by the Department of Housing and Urban Development known as
WA-502.
(ix) "Enter(ing)"or"entry"refers to the entry of any Client information into CMIS.
(x) "Shar(e)(ing),"or"Information Shar(e)(ing)"refers to the sharing of information which
has been entered in CMIS with another Partner Agency.
(xi) "CMIS Committee" the advisory committee charged with overseeing and advising on
CMIS related activities and priorities for the CoC.
(xii) "Identified Information"refers to Client data that can be used to identify a specific Client.
Also referred to as"Confidential"data or information.
(xiii) "De-identified Information" refers to data that has specific Client demographic
information removed,allowing use of the data without identifying a specific Client. Also
referred to as"non-identifying"information.
Agency Partner Agreement 9/30/2020 Page 1 of 9
CHHS Department
CMIS Agency Partner Agreement
(xiv) "Read Only" refers to a level of access that affords the ability to see data within the
CMIS,but not be able to enter/modify data.
b. Agency understands that when it enters information into the CMIS, such information will be
available to CHHS staff who may review the data to administer the CMIS. Data may also be
shared with the Washington State Department of Commerce, other federal, state, and local
partners, to prepare reports that may be submitted to others in de-identified form without
individual identifying Client information.
c. Agency understands that data entered will be shared with other signatories to the Agency
Partner Agreement,provided there is a signed CMIS Client Release of Information on file
indicating each client's consent to have personally identifiable information entered into the
CMIS and shared with other Partner Agencies.A list of the current Partner Agencies is
available at all times via the CMIS website at: www.spokaneCMlS.org.
d. Agency understands that it must also comply with the Spokane City/County CoC CMIS
Policies and Procedures Manual and other regulations as promulgated by the CMIS Lead
Agency and/or the CMIS Committee.Perceived conflicts between the Agency Partner
Agreement and the Spokane City/County CoC CMIS Policies and Procedures Manual should
be referred to the CMIS Program Manager.
2. Level of Access—SELECT ONE OPTION
a. Full CMIS Access:
(i) Agency is requesting full access to the CMIS,which includes the ability to
enter data and export data out of the CMIS.All provisions within this agreement
apply and will be enforced.
b. Read Only Access:
(i) ❑ Agency is requesting Read Only access,which is the ability to see/view data
entered by other Partner Agencies only.
I. All references within this agreement to `entering/inputting'
data/information do not apply to those with Read Only access;
2. Read Only access level participants are not responsible for the following
activities: obtaining client consent,making corrections to existing
records,or any other activity that would require the ability to enter
data/information into the CMIS.
(ii) Agency is responsible for adhering to all other aspects of this agreement.
(iii) Agency is responsible for submitting requests for de-identification of client data
via the online support tool present within the CMIS.
3. Confidentiality
a. Agency will not:
(i) enter information into the CMIS which it is not authorized to enter; and
(ii) designate information for sharing which Agency is not authorized to share, under any
relevant federal, state, or local confidentiality laws, regulations or other restrictions
applicable to Client information. By entering information into the CMIS or designating
it for sharing, Agency represents that it has the authority to enter such information or
designate it for sharing.
Agency Partner Agreement 9/30/2020 Page 2 of 9
CHHS Department
CMIS Agency Partner Agreement
b. Agency represents that: (check applicable items)
(i) ❑it is;®is not;a"covered entity"whose disclosures are restricted under HIPAA (45
CFR 160 and 164); More information about "covered entities" can be found here:
http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/index.html
(ii) ❑ it is; ® is not; a program whose disclosures are restricted under Federal Drug and
Alcohol Confidentiality Regulations:42 CFR Part 2;
(iii) If Agency is subject to HIPAA,(45 CFR 160 and 164)or 42 CFR Part 2,a fully executed
Business Associate or Business Associate/Qualified Service Organization Agreement
must be attached to this agreement before information may be entered. Sharing of
information will not be permitted otherwise.
(iv) If Agency is subject to any laws or requirements which restrict Agency's ability to either
enter or authorize sharing of information,Agency will ensure that any entry it makes and
all designations for sharing fully comply with all applicable laws or other restrictions.
c. Agency shall comply with the Violence Against Women and Department of Justice
Reauthorization Act of 2005 (VAWA) and Washington State RCW 43.185C.030. No
Identified Information may be entered into the CMIS for Clients in licensed domestic violence
programs or for Clients fleeing domestic violence situations.
d. Agency shall not enter confidential information regarding HIV/AIDS status,in accordance with
RCW 70.02.220. If funding (i.e., HOPWA) requires CMIS use, those clients' data shall be
entered without Identifying Information.
e. To the extent that information entered by Agency into the CMIS is or becomes subject to
additional restrictions,Agency will immediately inform CHHS in writing of such restrictions.
4. Information Collection,Release,and Sharing Consent:
a. Collection of Client Identified information: the Agency shall collect client identified
information only when appropriate to the purposes for which the information is obtained or
when required by law. The Agency must collect client information by lawful and fair means
and with the knowledge or consent of the individual.
b. Obtaining Client Consent: In obtaining Client consent, each adult Client in the household
must sign the CMIS Client Release of Information form (or a CHHS-approved equivalent
release document)to indicate consent to enter Client identified information into the CMIS. If
minors are present in the household,at least one adult in the household must consent by writing
the names of dependents on the space provided in the CMIS Client Release of Information
form. If any adult member of a household does not provide written consent, identifying
information may not be entered into CMIS for anyone in the household.Unaccompanied youth
may sign the consent form for themselves.Agency acknowledges the following:
(i) Do not enter personally identifying information into the CMIS for clients who are in
licensed domestic violence agencies or currently fleeing or in danger from a domestic
violence,dating violence,sexual assault or stalking situation.
(ii) Do not enter HIV/AIDS status in the CMIS. If funding (i.e, HOPWA) requires CMIS
use,those clients' data shall be entered without personally identifying information.
(iii) Telephonic consent from the individual may temporarily substitute for written consent
provided that written consent is obtained at the first time the individual is physically
present at Agency.
Agency Partner Agreement 9/30/2020 Page 3 of 9
CHHS Department
CMIS Agency Partner Agreement
(iv) A Client may withdraw or revoke consent for Client identified information collection by
indicating verbally,or in writing,to the agency that entered the information,or any other
CMIS participating Agency,that they wish to have their identified information removed
from CMIS. All CMIS participating agencies are responsible for communicating de-
identification requests to the CMIS Lead Agency through the CMIS support system or,
if that is unavailable,through email to: spokaneCMIS@spokanecity.org
(v) This information is being gathered for the collection and maintenance of a research
database, data repository, and case management tool. The consent is in effect until the
client revokes the consent verbally or in writing.
(vi) Each client that signs the CMIS Client Release of Information form must be informed
that signing the release indicating consent to share their data will permit other Partner
Agencies access to their data.
(vii) Each client that signs the CMIS Client Release of Information must be notified that other
Partner Agencies can join at any time and be shown, upon request, the list of current
Partner Agencies. This list can be obtained via the CMIS website:
www.spokaneCMIS.org.
(viii) Agency will display the CMIS Client Notice of Uses and Disclosures Rights form
prominently as close as possible to where data is typically collected and/or where it will
be most visible to clients.A copy can be obtained via: www.spokaneCMIS.org.
5. No Conditioning of Services: Agency will not condition any services upon or decline to provide
any services to a Client based upon a Client's refusal to allow entry of information into CMIS.In the event
that a funder requires the entry of identified--or other types of protected data--into the CMIS,and the client
refuses to provide said information,the agency must make a good faith effort to use alternative funding to
serve the client and/or refer the client to the Coordinated Entry program. The Agency refusing services
assumes all risk and liability from the refusal of service.
6. Re-release Prohibited: Agency agrees not to release any Client identifying information received
from CMIS to any other person or organization, unless required by law or as provided in the Spokane
City/County CoC CMIS Policies and Procedures. By sharing, or releasing, information Agency is
acknowledging that it has the right to share or release said information and assumes liability for
shared or released information.
7. Client Inspection/Correction: Agency will allow a Client to inspect and obtain a copy of his/her
own personal information.Agency will also allow a Client to correct information that is inaccurate.
8. Security: Agency will maintain security and confidentiality of CMIS information and is responsible
for the actions of its users and for their training and supervision. Among the steps Agency will take to
maintain security and confidentiality are:
a. Access: Agency will permit access to the CMIS or information obtained from it only to
authorized Agency Staff who need access to the CMIS for legitimate business purposes(such
as to provide services to the Client, to conduct evaluation or research, to administer the
program, or to comply with regulatory requirements). Agency will limit the access of such
staff to only those records that are immediately relevant to their work assignments.
b. User Policy: Prior to permitting any user to access the CMIS,Agency will require the user to
sign the CMIS User Agreement ("User Policy"), which is found on the CHHS web page
(www.spokaneCMIS.org) and is incorporated into this agreement and may be amended from
Agency Partner Agreement 9/30/2020 Page 4 of 9
CHHS Department
CMIS Agency Partner Agreement
time to time by CHHS. Agency will comply with,and enforce the User Policy and will inform
CHHS immediately in writing of any breaches of the User Policy
c. Computers: Security for data maintained in the CMIS depends on a secure computing
environment. Computer security is adapted from relevant provisions of the Department of
Housing and Urban Development's (HUD) "Homeless Management Information Systems
(HMIS) Data and Technical Standards Notice" (Docket No. FR 4848-N-01; see
https://www.hudexchange.info/resource/1318/2004-HMIS-data-and-technical-standards-final-
notice/). Agencies are encouraged to directly consult that document for complete documentation
of HUD's standards relating to CMIS.
Agency agrees to allow access to the CMIS only from computers which are:
i. owned by Agency or approved by Agency for the purpose of accessing and
working with the CMIS
ii. protected from viruses by commercially available virus protection software
iii. protected with a software or hardware firewall
iv. maintained to insure that the computer operating system running the computer
used for the CMIS is kept up to date in terms of security and other operating
system patches,updates,and fixes
v. accessed through web browsers with 256-bit encryption(e.g.,Internet
Explorer,version 11.0). Some browsers have the capacity to remember
passwords,so that the user does not need to type in the password when
returning to password-protected sites. This default shall not be used with
respect to the CMIS;the end-user is expected to physically enter the password
each time he or she logs on to the system
vi. staffed at all times when in public areas. When computers are not in use and
staff is not present,steps should be taken to ensure that the computers and
data are secure and not publicly accessible. These steps should minimally
include:Logging off the data entry system,physically locking the computer in
a secure area,or shutting down the computer entirely
d. Passwords: Agency will permit access to CMIS only with use of a User ID and password,
which the user may not share with others. Written information pertaining to user access(e.g.
username and password)shall not be stored or displayed in any publicly accessible location.
e. Training/Assistance: Agency will permit access to the CMIS only after the authorized user
receives appropriate confidentiality training including that provided by CHHS staff. Agency
will also conduct ongoing basic confidentiality training for all persons with access to the CMIS
and will train all persons who may receive information produced from the CMIS on the
confidentiality of such information. Agency will participate in such training as is provided
from time to time by CHHS staff. CHHS staff will be available during the CHHS defined
weekday business hours for technical assistance(i.e.troubleshooting and report generation).
f. Retention of paper copies of personally identifying information: Agencies must develop
and adopt policies governing the retention of paper records containing personally identifying
information derived from a Homeless Management Information System. The policy must
define how long paper records are retained after they are no longer being actively utilized,and
Agency Partner Agreement 9/30/2020 Page 5 of 9
CHHS Department
CMIS Agency Partner Agreement
the process that will be used to destroy the records to prevent the release of personally
identifying information. The policy must require the destruction of the paper records derived
from the CMIS no longer than seven years after the last day the person was served by the
organization or when the data is no longer in use.
g. Physical Data Security: Agency is responsible for maintaining appropriate safeguards to
ensure the security of Identified Information maintained in physical form(e.g.assessment
tools, SSN card,etc.),to include,but not limited to,the following:
(i) Access to physical data is restricted to only those staff that need access to conduct
their duties and/or provide service(s).
(ii) Physical data is kept in a secure location(e.g. locked filing cabinet)in an area not
immediately accessible to the general public(e.g. locked office)when not in
immediate use.
(iii) Additional measures may or may not be needed depending on the application of
HIPAA or other relevant federal/state laws.Agency will abide by all applicable
laws,regulations,or policies.
9. Training and Support Provisions: regular training and TA support will be provided by the CMIS
Lead Agency.Ongoing training will be provided,upon request and as defined under Section 8,
Subsection E,of this agreement.Training content,beyond initial training orientation training as
defined below,will be collaboratively pre-determined based on the stated needs of the CMIS
participating agency and as identified by the CMIS Lead Agency.
(i) Initial orientation training will cover the following topics:
1. How to access the web-based CMIS software;
2. Navigating the user interface;
3. CMIS security architecture and key features related to client
confidentiality and security;
4. Overview of assessments,workflows,and other processes by which
client data is collected and inputted into the CMIS;
5. System reporting capabilities and key features,including the difference
between reporting options and the development of custom reports and
ways of exporting system data;
6. Adaptability/customizability of platform to individual agency needs,
including examples in the community.
7. Discussion of'best practices' related to maximizing the effectiveness
and use of the CMIS,including a brief history of the database and how
other communities use their CMIS databases in support of vulnerable
populations.
(ii) Security and Confidentiality Training—upon request,the CMIS Lead Agency will
provide annual security and confidentiality training,specific to the rules and
regulations governing operation of the CMIS and the specific system features that
provide users the ability to control access to client level data. Other TA,related to
security and confidentiality,will be provided as needed.
10. Information Entry Standards:
Agency Partner Agreement 9/30/2020 Page 6 of 9
CHHS Department
CMIS Agency Partner Agreement
a. Information entered into CMIS by Agency will be truthful, accurate and complete to the best
of Agency's knowledge and will follow the standards specified in the CoC's Data Quality Plan
and Spokane City/County CoC CMIS Policies and Procedures Manual.
b. Agency will not solicit from Clients or enter information about Clients into the CMIS database
unless the information is required for a legitimate business purpose such as to provide services
to the Client,to conduct evaluation or research,to administer the program, or to comply with
regulatory requirements.
c. Agency will only enter information into CMIS database with respect to individuals that it serves
or intends to serve,including through referral.
d. Agency will not alter or over-write information entered by another Agency without first
obtaining consent from the owning agency or CMIS Lead Agency.
11. Use of the CMIS:
a. Agency will not access identifying information for any individual for whom services are neither
sought nor provided by the Agency, unless the Agency is engaged in an approved research
study.
(i) If the Agency is engaging in research meant to provide direct benefit to the CoC a
CMIS Research Request Agreement must be completed.
b. Agency may access identifying information of the Clients it serves and may request via writing
access to statistical,non-identifying information on both the Clients it serves and Clients served
by other CMIS participating agencies.
c. Agency may report non-identifying information to other entities for funding or planning
purposes. Such non-identifying information shall not directly identify individual Clients.
(i) Non-aggregated data shared with other entities must be approved by the
CMIS Lead agency in writing,prior to release of said information.
d. Agency and CHHS will report only non-identifying information in response to requests for
information from the CMIS unless otherwise required by law.
e. Agency will use the CMIS database for legitimate business purposes only.
f. Agency will not use the CMIS in violation of any federal or state law,including,but not limited
to, copyright, trademark and trade secret laws, and laws prohibiting the transmission of
material,which is threatening,harassing,or obscene.
g. Agency will not use the CMIS database to defraud federal, state or local governments,
individuals or entities,or conduct any illegal activity.
12. Proprietary Rights of the CMIS:
a. Agency shall not give or share assigned passwords and access codes for the CMIS with any
other Agency,business,or individual. Each user shall request their own login and password.
b. Agency shall take due diligence not to cause in any manner, or way, corruption of the CMIS
database,and Agency agrees to be responsible for any damage it may cause.
13. CMIS Committee: CHHS staff will consult with the CMIS Committee regarding issues such as
revision to the form of this Agreement. Written Agency complaints that are not resolved may be forwarded
to the CMIS Committee,which will try to reach a voluntary resolution of the complaint.
Agency Partner Agreement 9/30/2020 Page 7 of 9
CHHS Department
CMIS Agency Partner Agreement
14. Limitation of Liability and Indemnification: No party to this Agreement shall assume any
additional liability of any kind due to its execution of this agreement of participation in the CMIS. It is the
intent of the parties that each party shall remain liable,to the extent provided by law,regarding its own acts
and omissions;but that no party shall assume additional liability on its own behalf or liability for the acts
of any other person or entity except for the acts and omissions of their own employees,volunteers,agents
or contractors through participation in the CMIS. The parties specifically agree that this agreement is for
the benefit of the parties only and this agreement creates no rights in any third party.
15. Limitation of Liability. CHHS shall not be held liable to any member Agency for any cessation,
delay or interruption of services,nor for any malfunction of hardware,software or equipment.
16. Disclaimer of Warranties. CHHS makes no warranties, express or implied, including the
warranties of merchantability and fitness for a particular purpose, to any Agency or any other person or
entity as to the services of the CMIS to any other matter.
17. Amendment
a. The Parties agree to take such action as is necessary to amend this Agreement from time to time
as is necessary for compliance with applicable law and/or the requirements of the Spokane
City/County CoC Governance Board.
18. Additional Terms and Conditions:
a. Agency will abide by such guidelines as are promulgated by HUD and/or CHHS from time to
time regarding administration of the CMIS.
b. Agency and CHHS intend to abide by applicable law. Should any term of this agreement be
inconsistent with applicable law, or should additional terms be required by applicable law,
Agency and CHHS agree to modify the terms of this agreement so as to comply with applicable
law.
c. Neither CHHS nor Agency will transfer or assign any rights or obligations regarding the CMIS
without the written consent of either party.
d. Agency agrees to indemnify and hold CHHS and its agents and staffs harmless from all claims,
damages,costs,and expenses,including legal fees and disbursements paid or incurred,arising
from any breach of this Agreement or any of Agency's obligations under this Agreement.
e. This Agreement will be in force until terminated by either party. Either party may terminate
this agreement at will with 30 days written notice. Either party may terminate this agreement
immediately upon a material breach of this Agreement by the other party, including but not
limited to the breach of the CHHS Security Policy by Agency.
f. If this Agreement is terminated,Agency will no longer have access to the CMIS. CHHS and
the remaining Partner Agencies will maintain their right to use all of the Client information
previously entered by Agency except to the extent a restriction is imposed by Client or law.
g. Copies of Agency data will be provided to the Agency upon written request of termination of
this agreement. Data will be provided on CDs or other mutually agreed upon media. Unless
otherwise specified in writing,copies of data will be delivered to Agency within fourteen(14)
calendar days of receipt of written requests for data copies.
Signed,
Agency Partner Agreement 9/30/2020 Page 8 of 9
CHHS Department
CMIS Agency Partner Agreement
dark (AlW(114 2, __ _7(2d2j
Executive Director Signature Print Executive Director Name Date
OF k Vkii7/
Ag cy Name
Kat0 E . lz.roe ;
-91i Avt.e Van,/ a 6192Z,
Street Address c (ity State Zip Code
Mailing Address (Leave Blank If Same As Above) City State Zip Code
r ,
__.---,__,,_ ___i 6\°\\-1A
Cupid Alexander, Director Date
Community, Housing and Human Services Department
Atte t: Approved as to form:
Y.77 ,e,41,/(144---e--f--
City Clerk Assistant City Attorney
• sP•
rllr
....rri......11,...
it / --Ip►
ING
Agency Partner Agreement 9/30/2020 Page 9 of 9
CHHS Department