HMIS Privacy and Security Quiz

Question Title

* 1. User Information - Please answer all of the following questions to ensure you receive credit for completing this quiz:

Name: *

Email Address (use the email associated with training registration): *

Agency:

Job Title:

Question Title

* 2. Which of the following are part of HMIS Ethics?

*Select all that apply:

End Users shall adhere to the delivery of services with the highest standards of professionalism, integrity and competence.

All end-users must perform all duties in compliance with the spirit and letter of federal, state, and local laws and avoid any involvement in illegal, unethical, or improper conduct.

Treating all clients and collaborating parties respectfully, fairly, and honestly.

Creating a work environment that promotes open and honest communications and encourages raising ethical concerns without fear of retribution or retaliation.

None of the Above

Question Title

* 3. The following are all responsibilities that users are expected to fulfill related to using HMIS:

Review and abide by all requirements in HMIS Policies and Procedures.

Enter data accurately and based on client self-report.

Follow the 3-Step Privacy Process for collecting HMIS data.

Report observed security violations.

Only enter and view HMIS records for the purposes of delivering and coordinating services for clients.

True

False

Question Title

* 4. What is Personally Protected Information (PPI)?

*Select all that apply:

Information that identifies a specific individual

Gender, Race, Zipcode

Information that is unlikely to be linked to a specific individual

First name, last name, DOB, SSN

Question Title

* 5. Please select the appropriate way of sharing client's information with other HMIS users:

Client's initials

Last four of their SSN

Client's Unique Identifier (UID)

Capturing a screenshot of the clients record

Question Title

* 6. Please select all that apply to the 3-Step Privacy Process for collecting HMIS data:

Multiparty Authorization (MPA)

Take a photo of client

Run a background check to verify client information

Notice of Privacy Practices (NPP)

Mandatory Data Collection Notice

Question Title

* 7. HMIS users should implement which of the following practices to secure their workstation

*Select all that apply:

Write your Clarity username and password where it is easily accessible.

Place a privacy screen on your computer if visible to others.

Lock your computer any time you step away from your workstation.

If you retain hard copy records with HMIS information, secure them by keeping them inside a locked file cabinet and/or in an office that is locked when not in use.

Leave all signed paper MPAs on desk after leaving for the day so that you do not to forget to upload them in Clarity the next day.

Question Title

* 8. Which of the following statements accurately describe the requirements for the HMIS Mandatory Data Collection Notice?

*Select all that apply:

The Mandatory Data Collection Notice should be posted and clearly visible at client intake areas.

The Mandatory Data Collection Notice fully informs a client that their information is collected and shared in HMIS, making it possible to share their data as long as they see it.

The Mandatory Data Collection Notice should only be presented to clients after their information has already been entered in HMIS.

A letter-sized version of the Mandatory Data Collection Notice should be printed and carried with homeless outreach teams when they provide services in the field.

Question Title

* 9. Which of the following statements accurately describes the Notice of Privacy Practices (NPP)?

*Select all that apply:

The NPP should be provided to a client if they request more information related to their data being entered into HMIS.

The NPP is used to notify clients on why their personal data is being collected.

The NPP notifies clients of the uses and disclosures of their personal information.

How client's can file a complaint if they believe their privacy rights have been violated.

The NPP must be signed by clients.

The NPP must be uploaded to the clients record.

Question Title

* 10. According to the HMIS User Agreement, if a user becomes inactive in Clarity, because of no usage for 180 days or more, the RTFH can terminate access by deleting inactive user licenses from HMIS.

True

False

Question Title

* 11. HMIS Privacy and Security Standards seek to protect the confidentiality of client's personal information while allowing for reasonable, responsible, and limited uses and disclosures of data.

True

False

Question Title

* 12. Which of the following statements are true in regards to data sharing in HMIS?

*Select all that apply:

Clients that do not share data can be denied services.

Client records are shared by default in Clarity (with a few exceptions for restricted agencies, programs or victim service providers).

Sharing data in HMIS helps de-duplicate client records and improves coordination.

Data entered in HMIS is shared between all the agencies within the Trusted Network.

Improves providers ability to coordinate services and needs.

Question Title

* 13. Which of the following statements are true in regards to the San Diego's Trust Network?

*Select all that apply:

The HMIS Trust Network is made up of all HMIS Participating Agencies that have signed an Agency Participation Agreement agreeing to enter data in HMIS and fulfill HMIS requirements.

Trust Network providers can share clients' HMIS information with organizations who are not yet in the Trust Network, if they are likely to join soon.

Client information is shared with other agencies within the HMIS Trust Network in order to mitigate housing and services for clients.

Client information can be shared with providers within the HMIS Trust Network.

Question Title

* 14. Which of the following statements describe the Revocation of Authorization to Release Information?

*Select all that apply:

When a client signs the Revocation of Authorization to Release Information, the client is revoking all prior authorizations (signed MPAs).

The Revocation of Authorization to Release Information is used after a client has already consented to the MPA, and now no longer wants to share their information.

Once a client signs the Revocation of Authorization to Release Information, RTFH, 2-1-1 San Diego, and all agencies within the HMIS Trusted Network, will no longer be able to share client data.

A client can be refused services when they choose to revoke their MPA

Any information that has been entered in HMIS, prior to the client signing the revoke, will remain in the system; but the existing information is only viewable to the agency that entered the data.

Question Title

* 15. Which of the following statements describes the requirements that Participating Agencies and HMIS Users need to fulfill regarding the Multiparty Authorization (MPA)?

*Select all that apply:

When clients sign the MPA they authorize RTFH, 2-1-1 San Diego, and Participating Agencies to collect, record, use, and share their information to coordinate care and provide comprehensive services.

Discuss the MPA with all clients and collect their response.

Inform clients that it is their right to share or not share their data, and reassure them that only providers serving them will regularly view their information.

If a client declines to share data, do not create a client record for them in Clarity.

If a client does not want to share their data and chooses to decline the MPA, email support@rtfhsd.org to request that this client's Clarity record is restricted.

If you forget to discuss the MPA with a client, email support@rtfhsd.org to request that RTFH restrict access to the record.

Question Title

* 16. Which of the following statements describes how restricting records in Clarity works when a client declines or revokes authorization to share data?

*Select all that apply:

If only one agency has entered data into a client's record, the record can be privatized through RTFH using Clarity's automatic privacy feature and all data can be retained.

If multiple agencies have entered data into a client's Clarity record, the record needs to be de-identified.

If a client you are actively serving in Clarity is de-identified, you will be informed by RTFH and should retain the clients PII and Unique Identifier (UID) on a paper that is kept in a secure/locked location.

If a client declines or revokes the MPA, do not continue to enter their data in HMIS.

The first step to restricting a client's record in Clarity is always emailing support at support@rtfhsd.org.

Question Title

* 17. When is it appropriate to collect Verbal Consent?

****Select all that apply:***

If you are 2-1-1 San Diego and have telephonic features that record verbal consent.

When you are with a client but do not have a pen for them to sign the MPA.

When the Lead Agency Admin enacts an Emergency Verbal Consent Protocol

None of these options are appropriate.

Question Title

* 18. Which of the following statements apply to Verbal Consent?

*Select all that apply:

Verbal Consent shall temporarily replace a written signature on the MPA until a signature can safely be collected.

This emergency protocol allows clients to verbally authorize providers to access their data when a signature cannot safely be collected.

The Verbal Consent process shall be monitored on an ongoing basis and should be used sparingly when a written signature is possible.

Once the emergency protocol is lifted for Verbal Consent, a signed MPA will have to be collected.

Verbal Consent should never be collected.

None of these options apply to Verbal Consent.

Question Title

* 19. From the list below, which options are correct ways to handle a client's decline or revocation of authorization to share data in HMIS?

*Select all that apply:

If a client has previously consented/authorized the MPA, but are now saying they no longer wish to share data, ask them to sign a "Revocation of Authorization" form.

De-identify the client record on your own.

Email support@rtfhsd.org immediately after documenting the client's data sharing wishes in Clarity.

Scan and upload the Revocation of Authorization form to the clients "files" tab.

Skip informing RTFH about client's data sharing wishes because you are confident in restricting the clients record in Clarity.

Question Title

* 20. How long is authorization to share data via the MPA valid for?

1 year

3 years

7 years

10 years

Indefinitely or until a client states they no longer wish to share.

HMIS Privacy and Security Quiz

Question Title

* 1. User Information - Please answer all of the following questions to ensure you receive credit for completing this quiz:

Question Title

* 2. Which of the following are part of HMIS Ethics?*Select all that apply:

Question Title

Question Title

* 4. What is Personally Protected Information (PPI)?*Select all that apply:

Question Title

* 5. Please select the appropriate way of sharing client's information with other HMIS users:

Question Title

* 6. Please select all that apply to the 3-Step Privacy Process for collecting HMIS data:

Question Title

* 7. HMIS users should implement which of the following practices to secure their workstation*Select all that apply:

Question Title

* 8. Which of the following statements accurately describe the requirements for the HMIS Mandatory Data Collection Notice?*Select all that apply:

Question Title

* 9. Which of the following statements accurately describes the Notice of Privacy Practices (NPP)?*Select all that apply:

Question Title

* 10. According to the HMIS User Agreement, if a user becomes inactive in Clarity, because of no usage for 180 days or more, the RTFH can terminate access by deleting inactive user licenses from HMIS.

Question Title

* 11. HMIS Privacy and Security Standards seek to protect the confidentiality of client's personal information while allowing for reasonable, responsible, and limited uses and disclosures of data.

Question Title

* 12. Which of the following statements are true in regards to data sharing in HMIS?*Select all that apply:

Question Title

* 13. Which of the following statements are true in regards to the San Diego's Trust Network?*Select all that apply:

Question Title

* 14. Which of the following statements describe the Revocation of Authorization to Release Information?*Select all that apply:

Question Title

* 15. Which of the following statements describes the requirements that Participating Agencies and HMIS Users need to fulfill regarding the Multiparty Authorization (MPA)? *Select all that apply:

Question Title

* 16. Which of the following statements describes how restricting records in Clarity works when a client declines or revokes authorization to share data?*Select all that apply:

Question Title

* 17. When is it appropriate to collect Verbal Consent?﻿*Select all that apply:

Question Title

* 18. Which of the following statements apply to Verbal Consent?*Select all that apply:

Question Title

* 19. From the list below, which options are correct ways to handle a client's decline or revocation of authorization to share data in HMIS?*Select all that apply:

Question Title

* 20. How long is authorization to share data via the MPA valid for?

* 2. Which of the following are part of HMIS Ethics?

*Select all that apply:

* 4. What is Personally Protected Information (PPI)?

*Select all that apply:

* 7. HMIS users should implement which of the following practices to secure their workstation

*Select all that apply:

* 8. Which of the following statements accurately describe the requirements for the HMIS Mandatory Data Collection Notice?

*Select all that apply:

* 9. Which of the following statements accurately describes the Notice of Privacy Practices (NPP)?

*Select all that apply:

* 12. Which of the following statements are true in regards to data sharing in HMIS?

*Select all that apply:

* 13. Which of the following statements are true in regards to the San Diego's Trust Network?

*Select all that apply:

* 14. Which of the following statements describe the Revocation of Authorization to Release Information?

*Select all that apply:

* 15. Which of the following statements describes the requirements that Participating Agencies and HMIS Users need to fulfill regarding the Multiparty Authorization (MPA)?

*Select all that apply:

* 16. Which of the following statements describes how restricting records in Clarity works when a client declines or revokes authorization to share data?

*Select all that apply:

* 17. When is it appropriate to collect Verbal Consent?

****Select all that apply:***

* 18. Which of the following statements apply to Verbal Consent?

*Select all that apply:

* 19. From the list below, which options are correct ways to handle a client's decline or revocation of authorization to share data in HMIS?

*Select all that apply: