Coordinated Entry (CE) is the process a community uses to make sure people experiencing homelessness are assessed and connected to housing and services in a consistent, prioritized way, rather than by whichever agency they happen to walk into first. HUD's Continuum of Care Program rule at 24 CFR 578.3 defines the "centralized or coordinated assessment system," which HUD now calls coordinated entry, as "a centralized or coordinated process designed to coordinate program participant intake, assessment, and provision of referrals." Under 24 CFR 578.7(a)(8), every CoC receiving HUD funding must use a coordinated entry system to determine who is prioritized for housing.

Case conferencing is the regular meeting, often weekly or biweekly, where providers sit down together to talk through specific people on the community's by-name list. Housing navigators, shelter and outreach staff, and often health care and behavioral health partners review each household's situation, resolve barriers, and match people to available housing. HUD's CoC regulation does not define case conferencing, and CoCs set the format in their own written standards and policies, so it differs by community. HUD's Coordinated Entry Management and Data Guide describes the idea this way: "Case conferences may take various forms, but generally constitute any meetings of coordinated entry staff from multiple projects and agencies to discuss cases, resolve barriers to housing, and make decisions about priority, eligibility, enrollment, termination, and appeal.” Both processes depend on sharing information about people among organizations that follow different legal rules.

 

PII, PHI, and the difference between them

HUD's Coordinated Entry Management and Data Guide states that, "Most homeless services providers are not Covered Entities.” HUD modeled its HMIS privacy standards on the HIPAA Privacy Rule, so the two feel similar, but they are separate frameworks.

Information becomes protected health information (PHI) when a covered entity or its business associate holds individually identifiable information related to a person's health, health care, or payment for care. The HIPAA definitions at 45 CFR 160.103 say that individually identifiable health information is, "Information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual."

The Coordinated Entry Management and Data Guide notes that "an agency not subject to HIPAA otherwise does not become subject to HIPAA merely because it receives health information from an individual or from a HIPAA-covered entity." Receiving a diagnosis in an email doesn't turn a shelter into a covered entity, and it doesn't carry HIPAA's protections along with it.

On the other hand, substance use disorder treatment records that come from a federally assisted program that holds itself out as providing SUD treatment, may fall under 42 CFR Part 2, which is stricter than HIPAA. It requires written patient consent for disclosure and carries limits on redisclosure. Coverage turns on the sender, not the subject matter, according to the Coordinated Entry Management and Data Guide, "Coverage is based on what the agency does or provides."

Learn more: PII vs. PHI in homeless services

 

Where email goes wrong

HUD's Coordinated Entry Management and Data Guide says, "Often for the sake of convenience, providers compromise data security in their day-to-day operations." Its examples include staff who "transmit PII in unencrypted files using unencrypted email" and who "leave printouts containing PII in a conference room after a meeting." Common failures include:

  • Identifiers in subject lines and bodies. A subject like "Discharge: John Smith, HIV clinic" exposes sensitive information before the message is opened. The guide makes the same point about shared reports, "It is not necessary to include sensitive medical or disability information," and "Referral to and enrollment in HOPWA projects, for example, could disclose a participant's HIV status.” Even a project name can say too much.
  • Autocomplete and reply-all errors. A message meant for a single housing navigator reaches an entire case conferencing distribution list.
  • Unencrypted transmission. Shelters and small nonprofits could use standard email without encryption, while hospitals often require secure messaging.
  • Attachments. By-name list exports, referral packets, and discharge summaries often contain more than the recipient needs. The same goes for spreadsheets, the guide specifically warns against storing PII "in unencrypted google sheets to maintain by-name or active lists," and says any CE data kept outside HMIS "must be managed according to the HMIS privacy and security requirements."
  • Mismatched assumptions. A hospital employee assumes everyone on the thread is bound by HIPAA. A shelter employee assumes that sharing within the CoC is automatically allowed. The guide cautions that HMIS end-user agreements "may be insufficient to cover the disclosures within a case conferencing meeting because providers that do not contribute to HMIS may be present."

Learn more: Secure, HIPAA compliant email for healthcare

 

What each framework requires

HIPAA

Permitted disclosures

The Privacy Rule's permission is at 45 CFR 164.506(a), it states, "Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) through (4) or that are prohibited under § 164.502(a)(5)(i), a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of this subpart."

For treatment, the rule says, "A covered entity may disclose protected health information for treatment activities of a health care provider."

Many case conferences go beyond treatment, though, and a disclosure to a non-covered housing provider is not automatically a treatment disclosure. When it isn't, the minimum necessary standard applies, and authorization may be needed.

 

Minimum necessary

HHS describes the standard this way, "The minimum necessary standard requires covered entities to evaluate their practices and enhance safeguards as needed to limit unnecessary or inappropriate access to and disclosure of protected health information." The same guidance lists an important exception, the standard does not apply to "disclosures to or requests by a health care provider for treatment purposes."

 

Email security

The Security Rule requires covered entities to assess risks and implement reasonable safeguards for electronic PHI. On transmission, the regulation says, "Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network."

Encryption is an addressable specification, "Encryption (Addressable). Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate." "Addressable" means email without encryption must be justified and documented through a risk analysis, and in practice OCR expects encryption for ePHI sent over open networks like email. HHS proposed Security Rule changes in January 2025 that would make encryption a required specification. As of October 2026, that proposal has not been finalized, and the current rule remains in effect.

 

HUD's HMIS Standards

Under HUD's HMIS standards, providers must post a privacy notice, collect only information that is appropriate and necessary, and use and disclose data only for permitted purposes.

According to the Coordinated Entry Management and Data Guide, HUD's 2004 HMIS Data and Technical Standards permit certain uses and disclosures without participant consent, including disclosures "to provide or coordinate services to an individual," as long as they are listed in the CoC's Privacy Notice. "If any of these uses and disclosures is not listed in the Privacy Notice, consent is required." Disclosures outside the permitted categories also require consent, and the guide suggests CoCs adopt a standard authorization form, often called a Release of Information, to cover them. The Coordinated Entry Notice adds that CoCs "must include written policies and procedures for obtaining participant consent to share and store participant information for purposes of assessing and referring participants through the coordinated entry process."

HUD also frames sharing as a matter of degree. "Disclosures are not 'all or nothing,'" the guide says, and a CoC should design coordinated entries so that "data should be shared on a 'need to know' basis." That is the HMIS-side version of the minimum necessary standard. Each CoC's policies set the specifics, and they can be stricter than HUD's minimum.

 

Victim service providers

As the Coordinated Entry Management and Data Guide puts it, "Victim service providers must not enter or provide identifiable information about a participant for entry into an HMIS." They use a comparable database instead, so emailing their client information to an HMIS-affiliated team needs caution, with safety planning.

Learn more: How HUD's HMIS privacy standards and HIPAA overlap

 

Steps for your CoC

  • Map who is a covered entity. Create a list of CoC participants marked as HIPAA covered entity, business associate, Part 2 program, victim service provider, or none. Share it with everyone who emails client information.
  • Standardize consent. Use a release of information that covers coordinated entry and case conferencing and names the types of information to be shared, including health information and SUD records where relevant.
  • Use secure channels. Adopt encrypted email or a secure portal for anything that is not de-identified content. The guide recommends that CE policies set security protocols for any disclosure outside a secure electronic database, including a plan for how "electronic and paper files will be stored, transported, and destroyed."
  • Minimize identifiers. Use HMIS client IDs or initials in subject lines and keep clinical detail out of them. Share only what the recipient needs for the decision. HUD's guide recommends limiting PII in active and missing client reports "to only the information necessary to conduct assessment, prioritization, and referral."
  • Control distribution lists and meeting attendance. Review case conferencing lists, remove former participants, and disable reply-all where possible. HUD's guide advises that "attendance in case conferencing meetings or portions of meetings should be limited to necessary staff and managed thoughtfully," which may mean limiting meetings to agencies that have signed agreements binding them to the CoC's privacy and security policies.
  • Define data-sharing agreements. Memoranda of understanding and business associate agreements should state who is bound by what, and what happens after a disclosure.
  • Plan for mistakes. Misdirected emails happen. Staff should know how to report them, because the HIPAA Breach Notification Rule sets an outer limit, "A covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." The CoC's own policies may require faster action, and the Coordinated Entry Management and Data Guide expects CE data systems to have "documented procedures for responding to and reporting security breaches."
  • Train across sectors. HMIS staff need a working understanding of PHI. Hospital compliance staff need to understand HMIS consent and the legal protection a shelter's email system may have by default.

Read also: Do you need a BAA with your HMIS vendor or CoC lead agency?

 

FAQs

What is a by-name list?

It is a real-time list of the people in a community known to be experiencing homelessness, used to prioritize and track housing referrals.

 

What is a release of information?

It is a signed consent form that allows an organization to share specific client information with named parties for stated purposes.

 

What is de-identified data?

It is information with identifying details removed so it cannot reasonably be linked to a specific person, which makes it lower risk to share.

 

Can clients see their own records?

Yes, because both HUD's HMIS standards and HIPAA give individuals a right to access their own information.