NCHMIS Disclosure
What is HMIS?
Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW YOUR PERSONAL INFORMATION MAY BE USED/DISCLOSED, AND HOW YOU MAY OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice describes the privacy practices of Homeward Bound of WNC with respect to our use of the Homeless Management Information System (“HMIS”).
HMIS:
We participate in shared software called HMIS that allows certified homeless service providers to share information about the people we serve. HMIS keeps information about clients that get help in each participating agency to better assist them. These trusted agencies have committed to maintaining the privacy of your information in accordance with this notice and keeping it secure.
Through HMIS, we and other trusted agencies can share information about you and your family in accordance with your sharing selection on the HMIS Client Release of Information form (HMIS ROI).
This Notice informs you as to how we and HMIS treat the personal information we collect, use, and share with other agencies.
HIPAA:
Note that if we are a “Covered Entity” as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and must comply with the requirements set forth in HIPAA, we will provide you with a separate HIPAA Privacy Policy. Our classification as a Covered Entity, if applicable, in no way makes any other HMIS users a “Business Associate” as defined in HIPAA. In the event that any provisions of this Notice conflict with the HIPAA Privacy Policy, the HIPAA Privacy Policy will control. There may be information we collect about you that is governed by the HIPAA standards that is not covered by this Notice. In such a case, only the HIPAA standards and not those in this Notice, will apply.
Protected Personal Information:
We may also share any personal information you consent to us releasing beyond basic identifiers, as outlined in the HMIS ROI. Your basic identifiers and all additional personal information are referred to as Protected Personal Information.
How We May Use and Disclose Your Protected Personal Information:
We may use and disclose your Protected Personal Information for the following purposes:
(1) to provide or coordinate services for you or your family;
(2) for functions related to payment or reimbursement for services;
(3) to carry out administrative functions, including but not limited to legal, audit, personnel, oversight and management functions; or
(4) for creating de-identified Protected Personal Information.
Other Uses and Disclosures:
We may use or disclose your Protected Personal Information for other reasons, even without your permission. Subject to applicable federal or state law, we are permitted to disclose your Protected Personal Information without your permission for the following purposes:
Required by Law:
We may use/disclose your Protected Personal Information when such use/disclosure is required by law, subject to the requirements of such law. The relevant laws are the Federal Law of Confidentiality for Alcohol and Drug Abuse Patients, (42 CFR, Part 2), the Health Insurance Portability and Accountability Act of 1996 (HIPAA, 45 CFR, Parts 160 & 164 as revised by the Health Information Technology for Economic and Clinical Health Act of 2009 aka the HITECH Act), and certain North Carolina laws.
Serious threat to health or safety:
We may use and disclose your Protected Personal Information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
Abuse, Neglect or Domestic Violence:
We may disclose your Protected Personal Information when the disclosure relates to victims of domestic violence, abuse or neglect, or the neglect or abuse of a child or an adult who physically or mentally incapacitated, where the disclosure is required by law, you agree to such disclosure, or the disclosure is authorized by law and we believe it is necessary to prevent serious harm to you or other potential victims.
Research:
Your Protected Personal Information may be shared for research, analysis, or reporting, but only with a written agreement that protects my rights and ensures that the research benefits people experiencing homelessness approved by the Asheville-Buncombe Continuum of Care. Such projects must be conducted by qualified individuals or institutions and must benefit people experiencing homelessness.
Law enforcement purposes:
Subject to certain restrictions, we may disclose your Protected Personal Information under certain circumstances.
Even if you agree or do not object, however, the foregoing uses/disclosures may also be limited by certain North Carolina laws governing pharmacy, mental health facility or nursing facility records, or records related to controlled substance use and communicable diseases.
Authorization to Use or Disclose Your Protected Personal Information:
In any situations other than those where your permission is not required, as described above, we will ask for your written authorization before using or disclosing your Protected Personal Information, which you may do or have already done by signing the HMIS ROI. If you choose to sign the HMIS ROI to disclose your Protected Personal Information, you can later revoke that authorization to stop any future uses and disclosures. However, you cannot revoke your authorization for uses and disclosures that we have made in reliance upon such authorization.
Destruction or De-Identification of Your Protected Personal Information:
We will dispose of or, in the alternative, remove identifiers from, Protected Personal Information that is not in current use seven years after your Protected Personal Information was created or last changed, unless a statutory, regulatory, contractual or other requirement mandates we keep it longer.
Individual Rights:
You have the following rights with regard to your Protected Personal Information. Please contact the person listed below to obtain the appropriate forms for exercising these rights.
Request Restrictions : You may request restrictions on uses and disclosures of your Protected Personal Information, unless such restriction is inconsistent with our legal requirements. We are not required to agree to such restrictions, but if we do agree, we must abide by those restrictions.
Inspect and Obtain Copies : You have the right to inspect and obtain a copy of your health information. We can also explain to you any information you may not understand.
Amend Information : If you believe that the Protected Personal Information in your record is incorrect, or if important information is missing, you have the right to request that we correct the existing information or add the missing information. We are not required to remove any information but we may mark information as inaccurate or incomplete and may supplement it with additional information.
We reserve the right to deny for the following reasons, individual inspection or copying of your Protected Personal Information:
(1) Information compiled in reasonable anticipation of litigation or comparable proceedings;
(2) information about another individual (other than a health care or homeless provider);
(3) information obtained under a promise of confidentiality (other than a promise from a health care or homeless provider) if disclosure would reveal the source of the information; or
(4) information, the disclosure of which would be reasonably likely to endanger the life or physical safety of any individual. We can reject repeated or harassing requests for access or correction. If we do, we will explain the reason for the denial to you and we will include documentation of the request and the reason for the denial as part of your Protected Personal Information.
Changes in Privacy Practices:
We reserve the right to change our privacy policies and the terms of this Notice at any time and to make the new policies and provisions effective for all Protected Personal Information. You have the right to obtain a paper copy of our Notice at any time upon request.
Contact Person:
To request a copy, make a complaint or ask a question about our privacy practices, contact:
To request a copy of our Privacy Notice, please contact:
Homeward Bound of WNC
PO Box 1166 – Asheville, NC, 28802
Tel: 828.258.1695
Fax: 828.252.5944
Effective Date:
The effective date of this Notice is January 1, 2026.
Asheville-Buncombe Continuum of Care Notice of Privacy Practices – rev. 1-1-2026