As the HOPWA regulations make clear, grantees and their sponsors have a responsibility to protect client confidentiality. This includes the names “and
any other information” regarding individuals receiving HOPWA assistance.This broad mandate to protect privacy and ensure confidentiality
requires both grantees and their sponsors have adequate policies and procedures in place. Policies and procedures should address
how data will be gathered, recorded, and stored; the consent process for releasing information; how program participants will be notified
of their privacy rights; and the protocols for privacy breaches. It is important to emphasize that privacy protections are not intended
to be barriers to the provision and coordination of HOPWA and other services by grantees and project sponsors. Indeed,
even HIPAA standards were developed to facilitate - not block - the sharing of patient data. That is why it is important that grantees and project sponsors
work together to establish confidentiality standards and protocols that both protect privacy and enable the coordination of services.
The grantee should take the lead and develop standards that are used by all of their sponsors. The grantee should also train project sponsors
on confidentiality requirements. Having standardized release of information forms is also a good practice, in order to
ensure consistency of practice among sponsors. For more information and detail regarding best practices for confidentiality protection,
please review the HOPWA Confidentiality User Guide posted on the HUD Exchange website.
For direct monitoring of confidentiality practices, you should watch for; The adequacy of a sponsor’s policies and procedures
related to the protection of confidentiality; How securely paper client records are stored and managed;
How securely electronic data is stored and managed; How knowledgeable project management and staff are regarding privacy protections;
and that client files contain release of information documents that are signed, dated, current,
and that clearly specify what information can be shared with whom and for what purpose.