HMIS Initial Security Audit Checklist

HMIS Security Audit Checklist
Using this Security Audit Checklist document, your agency must certify that it will adhere to the HMIS Privacy & Security Plan or provide a plan for remediation of non-compliant systems, including milestones to demonstrate elimination of the shortfall over time.

Submission of the Security Audit Checklist indicates that the agency understands the purpose of this audit and vouches for its results. Please communicate any security questions, requests, or security breaches to the HMIS Administrator (hmis@sacstepsforward.org).

Please note you will be required to complete a Security Audit Checklist on an annual basis.
Date

MonthDayYear
Date
Hour MinutesAM/PM Option
Agency Name*
Agency Email*
example@example.com
Which HMIS Security Audit Checklist do you need to complete?

Initial Security Audit Checklist to help my organization get into HMIS.Annual Security Audit Checklist to maintain my organization's HMIS access.

HMIS Security Audit Checklist
Do you have any of the following staff updates for the Annual HMIS Security Audit?*

Change to your Agency's Security OfficerChange to your Agency's HMIS Lead ContactOther
New Agency Security Officer Name

First NameLast Name
New Agency Security Officer Email
example@example.com
New Agency Security Officer Phone Number
Please enter a valid phone number.
New Agency HMIS Lead Contact Name

First NameLast Name
New Agency HMIS Lead Contact Email
example@example.com
New Agency HMIS Lead Contact Email
Please enter a valid phone number.
Please detail the updates for contact information or other changes below from your Initial HMIS Security Audit Checklist:

HMIS Security Audit Checklist
Partner Agency Security Duties
Please review the duties required on behalf of the Partner Agency's Security Officer in the HMIS Privacy & Security Plan (Page 7) and indicate below your point of contact for agency security requirements.
Name of Partner Agency's Security Officer*

First NameLast Name
Email of the Partner Agency's Security Officer*
example@example.com
Phone Number of the Partner Agency's Security Officer*
Please enter a valid phone number.
Name of staff member completing the checklist, if different than the Partner Agency's Security Officer

First NameLast Name
I understand that my Agency will need complete an Annual Security Audit Checklist.*

Yes

HMIS Security Audit Checklist
Lead HMIS Agency Contact
Name of agency designated lead HMIS contact person.*

First NameLast Name
Phone number of lead HMIS contact person*
Please enter a valid phone number.
Email of lead HMIS contact person*
example@example.com

HMIS Security Audit Checklist
Privacy: Consumer Notice and Privacy Statements
HMIS Consumer Notices explain why HMIS participating agencies ask for client’s personal private information (PPI) and how it is used to address issues of homelessness in our community. These documents must be printed and physically posted for clients to see.

HMIS Consumer Notice HUD-Funded HMIS Consumer Notice Non-HUD Funded

HMIS Privacy Statements outline the minimum safety standards that our community has set for how client PPI is collected, used, and protected. It is strongly recommended that this document be posted on the agency’s website if possible.

HMIS Privacy Statements HUD-Funded HMIS Privacy Statement Non-HUD Funded
Does your agency have a posted Consumer Notice & HMIS Privacy Statements in places visible to clients, such as a lobby or intake rooms?*

YesNo
Please provide the location(s) where the Consumer Notice & HMIS Privacy Statements are posted.*
Does your agency have the Consumer Notice and HMIS Privacy Statements posted on your website?*

YesNo
Please provide the website link(s) where the Consumer Notice and HMIS Privacy Statements are posted.
Does your agency use the standard Continuum of Care Consumer Notice and HMIS Privacy Statements provided by Sacramento Steps Forward?*

YesNo, we use documents customized to our agency.
Will your agency use the standard Continuum of Care Consumer Notice and HMIS Privacy Statements provided by Sacramento Steps Forward?*

YesNo, we use documents customized to our agency.
If you selected "no", for any question above, please provide a plan to obtain compliance with all items needing action in the Privacy: Consumer Notice and Privacy Statements section. If you selected "yes", please indicate N/A.*

HMIS Security Audit Checklist
Privacy: Release of Information (ROI)
Please upload a copy of your agency's customized Release of Information (ROI):*

Cancelof

If your Agency uses, or will use, a customized ROI, does it contain the following:*

	Yes	No
A brief description of HMIS including a summary of the HUD Consumer Notice
A specific description of the Client Dashboard and an opportunity for the client to request that the screen be closed
A description of the agency’s sharing partners (if any) and a description of what is shared
A specified end date on the ROI

HMIS Security Audit Checklist
Privacy: Special Considerations
Does the agency have policies in place to assist with specific populations and special needs?*

YesNo
Does your agency have a procedure to assist clients who are hearing impaired or do not speak English as their primary language (e.g., provisions for Braille, audio, multiple languages, or large print)?*

YesNo
If you selected "no", for any question above, please provide a plan to obtain compliance with all items needing action in the Privacy: Special Considerations section. If you selected "yes", please indicate N/A.*

HMIS Security Audit Checklist
Computer Systems: Virus Protection and System Updates
Do all computers have virus protection with automatic updates? (Verified through spot check of several computers.)*

YesNo
Please provide the name(s) and version(s) of the antivirus software used, along with the date(s) of the last update for each computer checked.*
Are Operating System (OS) updates ran regularly?*

YesNo
If you selected "no", for any question above, please provide a plan to obtain compliance with all items needing action in the Computer Systems: Virus Protection and System Updates section. If you selected "yes", please indicate N/A.*

HMIS Security Audit Checklist
Computer Systems: Firewall
Does your agency use a firewall to protect internal network servers and local user computers?*

YesNo
For individual workstation(s), please provide the name(s) and version(s) of the software.*
For networked computers, please provide the name(s) and version(s) of the software.*
If you selected "no", for any question above, please provide a plan to obtain compliance with all items needing action in the Computer Systems: Firewall section. If you selected "yes", please indicate N/A.*

HMIS Security Audit Checklist
Data Collection
Does your agency have consistent, systematic processes for entering client data in the system?*

YesNo
Will your agency have consistent, systematic processes for entering client data in the system?*

YesNo
If you selected "no", for any question above, please provide a plan to obtain compliance with all items needing action in the Data Collection section. If you selected "yes", please indicate N/A.*

HMIS Security Audit Checklist
Please submit the form below or save your submission to finish later! If submitted, hmis@sacstepsforward.org will be connecting with you further in 3 business days.
Should be Empty:

	Yes	No
Specifies the purpose for collection of client information
Brief description of policies and procedures including vulnerable population protections
Data collection, use and purpose limitations, including de-identified data
Client right to copy/inspect/correct record
The client compliance procedure
Notice to consumer that Privacy Notice may be updated over time and applies to all client info within the agency

HMIS Security Audit Checklist

HMIS Security Audit Checklist

HMIS Security Audit Checklist

Partner Agency Security Duties

HMIS Security Audit Checklist

Lead HMIS Agency Contact

HMIS Security Audit Checklist

Privacy: Consumer Notice and Privacy Statements

HMIS Security Audit Checklist

Privacy: Consumer Notice and Privacy Statements

HMIS Security Audit Checklist

Privacy: Hard Copy Data

HMIS Security Audit Checklist

Privacy: Release of Information (ROI)

HMIS Security Audit Checklist

Privacy: Release of Information (ROI)

HMIS Security Audit Checklist

Privacy: Special Considerations

HMIS Security Audit Checklist

Computer Systems: Virus Protection and System Updates

HMIS Security Audit Checklist

Computer Systems: Firewall

HMIS Security Audit Checklist

Computer Systems: Physical Access

HMIS Security Audit Checklist

Data Collection

HMIS Security Audit Checklist

HMIS User Requests and Trainings

HMIS Security Audit Checklist