Homeless Management Information Systems Reporting and the Illinois Domestic Violence Act

THE STATE OFFICE OF THE ATTORNEY GENERAL STATE OF ILLINOIS Lisa Madigan ATTORNEY GENERAL December 29, 2006 FILE NO. 06-006 FEDERAL RELATIONS: Homeless Management Information Systems Reporting and the Illinois Domestic Violence Act The Honorable Alphonso Jackson Secretary U.S. Department of Housing and Urban Development c/o Mr. Elton J. Lester Assistant General Counsel Office of Assisted Housing and Community Development 451 Seventh Street, SW, Room 8188 Washington, D.C 20410 Re: Request for Exemption from Requirements of HMIS Dear Secretary Jackson: As the Attorney General for the State of Illinois, I have been asked whether the reporting requirements of the Homeless Management Information Systems, established under the McKinney-Vento Homeless Assistance Act (the McKinney-Vento Act) (42 U.S.C. §11301 et. seq. (2000)), conflict with the confidentiality provisions of the Illinois Domestic Violence Act of 1986 (750 ILCS 60/227 (West 2004)). For the reasons set out below, it is my opinion that the Federal reporting requirements conflict with the Illinois Domestic Violence Act's provisions 500 South Second Street, Springfield, Illinois 62706 (217) 782-1090 TTY: (217) 785-2771 Fax: (217) 782-7046 100 West Randolph Street, Chicago, Illinois 60601 (312) 814-3000 TTY: (312) 814-3374 Fax: (312) 814-3806 1001 East Main, Carbondale, Illinois 62901 (618) 529-6400 TTY: (618) 529-6403 Fax: (618) 529-6416 The Honorable Alphonso Jackson - 2 protecting the confidentiality of information regarding domestic violence victims, and that Illinois domestic violence programs may not disclose personally identifying information of any person receiving services from a domestic violence shelter. Further, it is my opinion that the use of a proxy, coded, encrypted, or hashed unique identifier as contemplated by Federal law would not resolve the conflict with Illinois law, nor would client consent. BACKGROUND Federal Provisions Concerned over the accuracy of estimates of the homeless population and the effectiveness of homeless assistance programs, Congress directed the United States Department of Housing and Urban Development (HUD) to collect an array of data on homelessness at the local level to prevent duplicate counting of homeless persons and to assess the effectiveness of the homeless assistance service system. See Consolidated Appropriations Act, 2004, Pub. L. No. 108-199, Div. G, Title II, 118 Stat. 3, 383; Consolidated Appropriations Resolution, 2003, Pub. L. No. 108-7, Div. K, Title II, 117 Stat. 11, 493-94; H.R. Rep. No. 108-10, at 1419-20 (2003) (Conf. Rep.); H.R. Rep. No. 106-988, at 106 (2000) (Conf. Rep.); S. Rep. No. 106-410, at 51-52 (2000); H.R. Rep. No. 105-610, at 32-33 (1998); see also Pub. L. No. 106-377, 114 Stat. 1441, 1441A-18, 1441A-30 (2000); S. Rep. No. 108-353, at 57 (2004). To fulfill this congressional mandate, HUD adopted data and technical standards to implement the Homeless Management Information Systems (HMIS). Homeless Management Information Systems (HMIS); Data and Technical Standards Final Notice (Final Notice), 69 Fed. Reg. 45888 (July 30, 2004). The HMIS is a computerized data system for collecting and storing in an electronic format information The Honorable Alphonso Jackson - 3 about individuals and families using homeless assistance services in a community. Final Notice, 69 Fed. Reg. 45888, 45897 (July 30, 2004). The HMIS is intended to integrate data from all homeless service providers within a certain geographic area and capture basic descriptive information on every person receiving service. Final Notice, 69 Fed. Reg. 45888 (July 30, 2004). The identified purposes of this data collection effort include improved understanding of the characteristics of homeless persons in a community, improved service delivery, and improved assessment and documentation of a community's progress in reducing homelessness. Final Notice, 69 Fed. Reg. 45888 (July 30, 2004). To implement the data gathering component of HMIS, HUD requires all grant recipients, including domestic violence programs that receive McKinney-Vento Act program funds, to participate in a local HMIS.¹ Final Notice, 69 Fed. Reg. 45888, 45901, 45902-03 (July 30, 2004). HUD mandates that its grant recipients collect and transmit to the local HMIS a specific set of client level information, called universal data elements, regarding homeless individuals. The 14 universal data elements to be collected, as set forth in the Final Notice, are: name, social security number, date of birth, ethnicity and race, gender, veteran status, disabling condition, residence prior to program entry, zip code of last permanent address, program entry date, program exit date, unique personal identification number, program identification number, and household identification number. Final Notice, 69 Fed. Reg. 45888, 45905 (July 30, 2004). Because victims of domestic violence are served by programs funded by HUD and domestic violence programs play an important role in providing homeless services, HUD determined that it was essential that domestic violence program providers participate in HMIS to obtain an accurate, unduplicated count of homeless persons in a community and to adequately understand the needs of the homeless population. Final Notice, 69 Fed. Reg. 45888, 45892, 45902 (July 30, 2004). The Honorable Alphonso Jackson - 4 In addition, program-specific data elements must also be collected from clients served by various programs. This information, reported to HUD in annual progress reports, is used by HUD to assess services, determine eligibility for services, and to monitor service provisions and outcomes for clients. The program-specific client data elements include: income and sources, non-cash benefits, physical disability, developmental disability, HIV/AIDS status, mental health, substance abuse, domestic violence, services received, destination, and reasons for leaving. Final Notice, 69 Fed. Reg. 45888, 45901, 45913-14 (July 30, 2004). HUD grant recipients are required to report the client data to their central data storage facility at least annually. Final Notice, 69 Fed. Reg. 45888, 45901, 45910, 45934 (July 30, 2004). Continuums of Care (CoC), a local body that plans for and coordinates homeless services, can then eliminate duplicate records and aggregate the data to generate an unduplicated count of clients receiving homeless services within a geographic area. Final Notice, 69 Fed. Reg. 45888 (July 30, 2004). The HMIS data is reported to HUD annually by CoCs in the aggregate, not by individual. Final Notice, 69 Fed. Reg. 45888, 45890 (July 30, 2004). The Final Notice also establishes baseline privacy and security standards required for all programs that record, use, or process HMIS data to protect the confidentiality of client data. Final Notice, 69 Fed. Reg. 45888, 45889, 45895, 45927-33 (July 30, 2004). The security standards include password protection, firewalls, and physical access restrictions. Final Notice, 69 Fed. Reg. 45888, 45931-32 (July 30, 2004). Additional, optional privacy protections are also provided for programs that choose to implement higher privacy standards due to the services provided or the clients served. Final Notice, 69 Fed. Reg. 45888, 45931-33 (July 30, 2004). The Honorable Alphonso Jackson - 5 Recognizing the sensitivity of disclosing personal information collected and stored in an HMIS, the HMIS reporting requirements indicate that organizations also must comply with Federal, state, and local laws that require additional confidentiality protections. Final Notice, 69 Fed. Reg. 45888, 45928 (July 30, 2004). The Final Notice also sets forth required and permitted uses and disclosures of "protected personal information," which is generally information that: (1) identifies an individual; (2) can be manipulated to identify an individual; or (3) can be linked with other information to identify an individual. Final Notice, 69 Fed. Reg. 45888, 45928-29 (July 30, 2004). Due to sensitivity concerning providing personal information about domestic violence victims, HUD also issued additional clarification and guidance on application of the HMIS data collection and reporting requirements to domestic violence shelters. Homeless Management Information Systems (HMIS) Data and Technical Standards Final Notice; Clarification and Additional Guidance on Special Provisions for Domestic Violence Provider Shelters (Clarification), 69 Fed. Reg. 61517 (October 19, 2004). The Clarification recognizes that state laws may have stronger confidentiality provisions and provides that, in the event that state laws conflict with the Final Notice, as determined by an appropriate state government entity,² state law would prevail. Clarification, 69 Fed. Reg. 61517, 61518 (October 19, 2004). Although domestic violence programs that receive McKinney-Vento Act funds must collect the ²The HUD Office of General Counsel has determined that the appropriate state government entity to make such a determination is the Attorney General of the state. U.S. Department of Housing and Urban Development, Domestic Violence Provider Participation in Homeless Management Information Systems (HMIS) Questions and Answers, No. 7, at 2 (June 2005), http://www.hud.gov/offices/ cpd/homeless/hmis/ (follow "Want More Information?, Domestic Violence Provider Participation in HMIS Q & A" hyperlink). The Honorable Alphonso Jackson - 6 universal and program-specific data elements required for reporting, the Clarification explains that HUD does not require domestic violence providers to collect or report an address for a client served by a domestic violence provider. Clarification, 69 Fed. Reg. 61517, 61518 (October 19, 2004). The Clarification also provides the following with respect to data submission by domestic violence programs: HUD will not require the submission of personal identifiers (name and Social Security Number (SSN)) from these programs to the CoC. Domestic violence programs can choose to use a proxy, coded, encrypted, or hashed unique identifier in lieu of name and SSN - that is appended to the full service record of each client served and submitted to the central server at least once annually for purposes of unduplication and data analysis. The coded unique identifier would need to include, but is not limited to, characters and digits from a portion of a client's name, date of birth, and gender. This unique identifier can be generated either manually or through the use of an advanced technological encryption algorithm. Programs participating in HMIS are not required to share client data with any other organization besides the central coordinating entity identified by the CoC as described below. *** HUD fully supports alterative methods of participation by domestic violence providers. Domestic violence programs are charged to meet with CoC representatives to identify administrative solutions, such as delaying entry of data into the HMIS until after the client has exited the domestic violence programs, or other technological or administrative solutions that adequately protect data and allow for an accurate unduplicated count of homeless persons and analysis of homeless data throughout the CoC to meet the goals of the congressional directive. Clarification, 69 Fed. Reg. 61517, 61518 (October 19, 2004). Based on the Final Notice and the Clarification, HUD will exempt domestic violence providers from submission of client identifiers (name and social security number) to the CoC for unduplication and data analysis. Programs electing this exemption are required to use The Honorable Alphonso Jackson - 7 either a proxy, coded, encrypted, or hashed unique identifier, in lieu of a name and social security number, "that is appended to the full service record of each client served and submitted to the [CoC] central server at least once annually for purposes of unduplication and data analysis." Clarification, 69 Fed. Reg. 61517, 61518-19 (October 19, 2004). Domestic violence providers may also choose to delay entry of client data until after the client has exited the domestic violence program. In addition, HUD supports alternative methods of participation by domestic violence providers, including those that adequately protect data and allow for an accurate, unduplicated, local count of homeless persons. Clarification, 69 Fed. Reg. 61517, 61519 (October 19, 2004). On January 5, 2006, section 423 of the McKinney-Vento Act was amended by section 605 of the Violence Against Women and Department of Justice Reauthorization Act of 2005 (VAWA) (Pub. L. No. 109-162, §605, 119 Stat. 2960, 3041 (2006)) to prohibit any victim service provider that receives funding under the HUD Supportive Housing Program from disclosing personally identifying information of any client for HMIS purposes. Pub. L. No. 109- 162, §605(1), 119 Stat. 2960, 3041 (2006) (to be codified at 42 U.S.C. §11383(a)(8)(A)). Personally identifying information or personal information means: individually identifying information for or about an individual including information likely to disclose the location of a victim of domestic violence, dating violence, sexual assault, or stalking, including-- (I) a first and last name; (II) a home or other physical address; (III) contact information (including a postal, e-mail or Internet protocol address, or telephone or facsimile number); The Honorable Alphonso Jackson - 8 (IV) a social security number; and (V) any other information, including date of birth, racial or ethnic background, or religious affiliation, that, in combination with any other non-personally identifying information would serve to identify any individual. Pub. L. No. 109-162, §605(1), 119 Stat. 2960, 3041 (2006) (to be codified at 42 U.S.C. §11383(a)(8)(B)). The amendment, however, allows HUD to require recipients to disclose, for purposes of an HMIS, non-personally identifying data that has been de-identified, encrypted, or otherwise encoded. Pub. L. No. 109-162, §605(1), 119 Stat. 2960, 3041 (2006) (to be codified at 42 U.S.C. §11383(a)(8)(A)). The amendment also reiterated that nothing in section 423 of the McKinney- Vento Act (42 U.S.C. §11383 (2000), as amended by Pub. L. No. 109-162, §605, 119 Stat. 2960, 3041 (2006)) superseded any provision of any Federal, state, or local law that provides greater protection for victims of domestic violence, dating violence, sexual assault, or stalking.³ Pub. L. No. 109-162, §605(1), 119 Stat. 2960, 3041 (2006) (to be codified at 42 U.S.C. §11383(a)(8)(A)). Illinois Provisions Recognizing that the legal system historically had ineffectively dealt with family violence and that domestic violence is a serious crime, the General Assembly enacted the Illinois Domestic Violence Act of 1986 (the Act). 750 ILCS 60/101 et seq. (West 2004). Section 227 of ³HUD has acknowledged that the new VAWA legislation raises questions about whether and how local victim service providers can participate in HMIS. HUD has indicated that it will continue to work with its legal counsel, information privacy experts, and security experts to find a solution that protects victims of domestic violence, allows providers and communities to maximize participation in HMIS, and meet its congressional directive of improving information on homelessness. U.S. Department of Housing and Urban Development, Report to Congress: Fifth Progress Report on HUD's Strategy for Improving Homeless Data Collection, Reporting and Analysis, at 23-24 (2006), http://www.hud.gov/offices/cpd/homeless/library/2006reporttocongress.pdf. The Honorable Alphonso Jackson - 9 the Act (750 ILCS 60/227 (West 2004)) specifically protects the confidentiality of information provided by victims of domestic violence to domestic violence programs and states, in pertinent part: (b) No domestic violence advocate or counselor shall disclose any confidential communication or be examined as a witness in any civil or criminal case or proceeding or in any legislative or administrative proceeding without the written consent of the domestic violence victim except (1) in accordance with the provisions of the Abused and Neglected Child Reporting Act or (2) in cases where failure to disclose is likely to result in an imminent risk of serious bodily harm or death of the victim or another person. (Emphasis added.) 750 ILCS 60/227(b) (West 2004).4 "Confidential communication" is defined under the Act to include: any communication between an alleged victim of domestic violence and a domestic violence advocate or counselor in the course of providing information, counseling, or advocacy. The term includes all records kept by the advocate or counselor or by the domestic violence program in the course of providing services to an alleged victim concerning the alleged victim and the services provided. The confidential nature of the communication is not waived by the presence at the time of the communication of any additional persons, including but not limited to an interpreter, to further express the interests of the domestic violence victim or by the advocate's or counselor's disclosure to such an additional person with the consent of the victim when reasonably necessary to accomplish the purpose for which the advocate or counselor is consulted. (Emphasis added.) 750 ILCS 60/227(a)(3) (West 2004). 4"Domestic violence advocate or counselor' means any person (A) who has undergone a minimum of forty hours of training in domestic violence advocacy, crisis intervention, and related areas, and (B) who provides services to victims through a domestic violence program either on an employed or volunteer basis." 750 ILCS 60/227(a)(2) (West 2004). "Domestic violence victim' means any person who consults a domestic violence counselor for the purpose of securing advice, counseling or assistance related to one or more alleged incidents of domestic violence." 750 ILCS 60/227(a)(4) (West 2004). "Domestic violence" means abuse as defined in the Act. 750 ILCS 60/103(1), 227(a)(5) (West 2004). The Honorable Alphonso Jackson - 10 The Act makes it a Class A misdemeanor for a domestic violence advocate or counselor to knowingly disclose any confidential communication, which is defined to include not only records kept by the counselor or advocate, but also all records kept by the organization concerning the victim and the services provided. 750 ILCS 60/227(c) (West 2004). Confidentiality extends to information concerning the services or referrals provided, as well as to identifying information. 750 ILCS 60/227(a)(3) (West 2004). ANALYSIS Conflict The Final Notice requires domestic violence programs that receive McKinney- Vento Act program funds to collect and transmit to the local HMIS a specific set of client information regarding homeless individuals. The Act, however, prohibits domestic violence advocates and counselors from disclosing any confidential communication without the written consent of the domestic violence victim, or as provided by an exception. 750 ILCS 60/227(b) (West 2004). The term "confidential communication" includes "any communication between an alleged victim of domestic violence and domestic violence advocate or counselor in the course of providing information, counseling, or advocacy."5 750 ILCS 60/227(a)(3) (West 2004). The term includes all records kept by the advocate, counselor, or program. 750 ILCS 60/227(a)(3) (West 2004). ⁵The term "communication" is not defined in the Act. A term that is undefined in a statute must be ascribed its ordinary and popularly understood meaning. In re Ryan B., 212 III. 2d 226, 232 (2004). The word "communication" commonly means "[t]he exchange of thoughts, messages, or information" (American Heritage College Dictionary 282 (3rd ed. 1993)); "facts or information communicated" (Webster's Third New International Dictionary 460 (1993)). The term also refers to "[i]nformation given; the sharing of knowledge by one with another." Black's Law Dictionary 279 (6th ed. 1990). The Honorable Alphonso Jackson - 11 The primary rule of statutory construction is to ascertain and give effect to the intent of the General Assembly. Wauconda Fire Protection District V. Stonewall Orchards, LLP, 214 Ill. 2d 417, 430 (2005). The statutory language is the best indicator of legislative intent, and that language must be given its plain and ordinary meaning. King V. First Capital Financial Services Corp., 215 III. 2d 1, 26 (2005). If the statutory text is clear and unambiguous, it should be given effect as written, without reading into it exceptions, limitations, or conditions that the General Assembly did not express. Land V. Board of Education of the City of Chicago, 202 III. 2d 414, 426 (2002). Moreover, the Act must be construed liberally to promote its underlying purposes (750 ILCS 60/102 (West 2004)), which is to aid the victims of domestic violence and to prevent further abuse. See generally, 750 ILCS 60/102 (West 2004); Sutherlin V. Sutherlin, 363 Ill. App. 3d 691 (2006). The plain language of subsection 227(b) of the Act provides that no domestic violence advocate or counselor shall disclose any confidential communication, except with the victim's consent or under other specified circumstances. This privilege is intentionally broad so that victims of domestic violence can receive shelter and counseling without fear that the very act of seeking and receiving such aid will subject them to stigmatization or, at some future time, cause them to be victimized again (e.g., by disclosing the victim's location to an abuser or in a fashion that would permit an abuser to locate the victim). To accomplish this, it is implicit from the terms and provisions of the Act that the victim must feel free to share confidential information with a counselor without fear that the information will be disclosed to a third party. See Krach-Naden V. Sauk Village, No. 97 C 1525 (N.D. III. July 22, 1999). The Honorable Alphonso Jackson - 12 The universal data elements to be elicited from a domestic violence victim under HMIS would be obtained through communications between a domestic violence advocate or counselor and a victim in the course of providing information, counseling, or advocacy on domestic violence. Thus, the universal data elements would be encompassed within the Act's broad definition of the term "confidential communication." Therefore, the provision by domestic violence program providers to the CoC of the described personal data concerning domestic violence victims would violate section 227, which prohibits the disclosure of any information, unless the victim consents or one of the other exceptions have been satisfied. The Act's exceptions authorize disclosure under the Abused and Neglected Child Reporting Act (325 ILCS 5/1 et seq. (West 2004)) and to avoid imminent risk of serious bodily harm. The exceptions bear no relationship to the purposes of the Final Notice. Further, the Act permits waiver of the privilege on behalf of a victim only when the victim is deceased or is legally incompetent to assert or waive it personally. 750 ILCS 60/227(d), (e) (West 2004). The Act does not contain an exception permitting disclosure of confidential information for research or statistical studies, or when permitted by other State or Federal law. The Act authorizes disclosure with the written consent of the domestic violence victim. There may be instances in which the confidentiality provisions set out in the Final Notice provide sufficient protection to a victim, such that the victim may agree to waive the greater protection of the Illinois statute and participate in the Federal data collection. However, unless such a waiver is made voluntarily by the victim or his or her personal representative, as provided in the Act, or one of the other exceptions are met, Illinois domestic violence counselors and The Honorable Alphonso Jackson - 13 advocates are not authorized to disclose to HMIS data concerning domestic violence victim clients. Moreover, as explained later, it is not likely that a domestic violence provider would be able to obtain consent from all domestic violence victims. Therefore, a domestic violence provider would not be able to comply with the HMIS reporting requirements that a domestic violence provider collect and report data on all domestic violence clients served. As of January 5, 2006, domestic violence programs that receive funding under the HUD Supportive Housing Program also are precluded under section 423 of the McKinney-Vento Act, as amended by section 605 of the VAWA, from disclosing the personally identifying information of any client for HMIS purposes. Pub. L. No. 109-162, §605(1), 119 Stat. 2960, 3041 (2006) (to be codified at 42 U.S.C. §11383(a)(8)(A)). Many of the universal data elements required under the Final Notice constitute personally identifying information under section 423. Accordingly, domestic violence programs that receive funding under the HUD Supportive Housing Program are prohibited from disclosing those data elements under section 423 of the McKinney-Vento Act. Service Record As previously discussed, domestic violence providers that receive McKinney- Vento Act program funds must collect universal data elements required for reporting. Due to concerns over submitting client-identifying data from domestic violence programs, HUD modified the reporting requirements for domestic violence programs. Under the Clarification, HUD will not require domestic violence programs to submit personal identifiers (name and social security number) to the CoC. Domestic violence programs may use a proxy, coded, The Honorable Alphonso Jackson - 14 encrypted, or hashed unique identifier, in lieu of the name and social security number, that is appended to the full service record of each client served. The coded unique identifier must include characters and digits from a portion of a client's name, date of birth, and gender. This unique identifier is generated either manually or through the use of an advanced technological encryption algorithm. Clarification, 69 Fed. Reg. 61517, 61518 (October 19, 2004). The Clarification also states that HUD supports alternative methods of participation by domestic violence providers. Clarification, 69 Fed. Reg. 61517, 61518 (October 19, 2004). Thus, HUD requires domestic violence providers to submit alternative client data if disclosing information in that form does not conflict with state law. Clarification, 69 Fed. Reg. 61517, 61518 (October 19, 2004). As noted earlier, the confidentiality provisions of the Act are very broad and prohibit disclosure of any confidential information unless the victim consents or an exception is satisfied. According to the Clarification, the coded unique identifier must be appended to the full service record of each client served. As the term "confidential communication" encompasses all records kept by the domestic violence advocate, counselor, and program, appending the service record of a client served would violate the confidentiality provisions of the Act. Therefore, the usage of a coded unique identifier appended to the service record of a domestic violence victim would not resolve the conflict between the Act and the Final Notice. HUD has made it clear that it supports alternative methods of compliance with the HMIS data collection and reporting requirements. For example, HUD has indicated that delaying entry of data into the HMIS until after a client has exited the program would be sufficient to meet The Honorable Alphonso Jackson - 15 the requirements of the Final Notice. However, under the Act, the confidential information remains confidential even after the victim has left the program. Thus, delaying entry of the client data into the HMIS would still violate the confidentiality provisions of the Act. Consent The Act does provide that confidential communications may be disclosed upon the written consent of the domestic violence victim. 750 ILCS 60/227(b), (d) (West 2004). There may be instances in which the confidentiality provisions set out in the Final Notice provide sufficient protection to a domestic violence victim, such that the particular victim may voluntarily agree to waive the greater protection of the Illinois statute and participate in the Federal data collection. However, unless such a waiver is made by the victim or his or her personal representative, Illinois domestic violence counselors and advocates are not authorized to disclose HMIS data concerning domestic violence victims. Moreover, as noted earlier, the confidentiality provisions of subsection 227(b) are intentionally broad so that victims may share confidential information to receive shelter and counseling without fear that the information will be disclosed to third parties. Therefore, the waiver of the privilege under the Act must be made voluntarily and domestic violence providers should be vigilant to ensure that consent is given freely and without pressure. See 750 ILCS 60/227(c) (West 2004); Vaughn V. Speaker, 126 III. 2d 150, 161 (1988), cert. denied, 492 U.S. 907, 109 S. Ct. 3218 (1989); Northwest Diversified, Inc. V. Desai, 353 III. App. 3d 378, 399 (2004) (a waiver is a voluntary relinquishment of a known right, claim, or privilege). The Honorable Alphonso Jackson - 16 Unless all domestic violence victims served by a program voluntarily consent to the provision of the personal data, a domestic violence provider cannot comply with the Federal mandate to collect and report data on all domestic violence clients served. The provision of personal data by a domestic violence provider of only those clients who have consented to such disclosure does not further the congressional goal of counting homeless persons and assessing the effectiveness of the homeless system. Submission of information for only those clients who consent is analogous to providing "point-in-time counts," which have been discounted by HUD. A domestic violence program cannot control whether a victim will voluntarily agree to consent to the disclosure of personal information, and it is not likely that all domestic violence victims will consent to such disclosure. Because a domestic violence program may not be able to obtain a victim's consent in all circumstances, obtaining client consent from some victims will not resolve the conflict with Illinois law. CONCLUSION For the foregoing reasons, it is my opinion that the Federal HMIS reporting requirements conflict with Illinois law, so that domestic violence programs may not disclose personally identifying information of any person receiving services from a domestic violence shelter absent consent. Further, it is my opinion that the use of a proxy, coded, encrypted, or ⁶Point-in-time counts have been discounted by HUD as misrepresenting service use patterns among individuals and families because this approach lacks the historical context provided by longitudinal HMIS data. Furthermore, as with point-in-time counts, CoCs cannot achieve an accurate, unduplicated headcount of homeless persons, if only clients who consent are counted. Communities will not be able to fully identify the needs of their homeless population and, in turn, will unknowingly under-serve these clients. See generally U.S. Department of Housing and Urban Development, Domestic Violence Provider Participation in Homeless Management Information Systems (HMIS) Questions and Answers, No. 10, at 3 (June 2005), http://www.hud.gov/offices/cpd/homeless/hmis/ (follow "Want More Information?, Domestic Violence Provider Participation in HMIS Q & A" hyperlink). The Honorable Alphonso Jackson - 17 hashed unique identifier would not resolve the conflict with Illinois law, nor would the possibility of individual, voluntary client consent resolve the conflict. This legal opinion may be relied on by HUD. Very truly yours, live LISA MADIGAN Madipu ATTORNEY GENERAL