Keep Household Information Confidential to Avoid Liability, Protect Residents

From time to time, your site may get phone calls, letters, or other inquiries for information about residents. The request can seem innocent, or it may seem official. And some requests will be. But granting even innocent requests can cause trouble. Sites are responsible for ensuring the privacy and confidentiality of the information they collect from applicants and households. And, if you give information to the wrong person, a resident could be harmed and you could get sued.

Even when site staff are vigilant, they may be tricked into giving confidential information to the wrong person. To avoid problems, adopt a policy requiring site staff to refer all inquiries to the site manager, and prohibiting the site manager from giving out household information except in limited situations.

We’ll explain how to train site staff to handle requests for household information. And we’ll give you a Model Policy: Set Policy on Disclosure of Household Information that you can include in your employee handbook.

How Disclosure Puts Site at Risk

Sites have on file a great deal of personal information about households that may be valuable to others. For example, you know the value, source, and location of all your low-income residents’ income and assets. You know how to contact them, and perhaps even where their closest relatives live. And you may know when household members go to work and when they come home. Many parties—from collection agencies, repo men, and process servers to disgruntled spouses and lovers, con artists, and criminals—may want this information.

If you disclose information to a third party, household members can sue you for violating their right to privacy. The HUD Handbook prohibits owners and managers from disclosing household information, as do many state and local laws relating to confidentiality [HUD Handbook 4350.3, par. 3-11]. Many state housing agencies as part of their compliance regulations require owners to maintain applicant and resident information in a way to ensure confidentiality. And any applicant or resident affected by negligent disclosure or improper use of information may be allowed to bring civil action for damages and seek other relief. This responsibility extends to the disposal of records. Owners must dispose of records in a manner that will prevent any unauthorized access to personal information—such as burning, pulverizing, shredding, etc.

Create Nondisclosure Policy

To avoid potential problems, create a policy prohibiting site staff from releasing household information. Your policy should do three things:

Limit who can respond to inquiries. The fewer stie staff members with discretion to decide whether to disclose information, the less likely it is that a mistake will happen. Don’t allow site staff such as office assistance and maintenance personnel to respond to inquiries about households and their members. Instead, require them to direct all such inquiries to the site manager.

Require written request. Tell site managers to respond only to written inquiries. If anyone calls or inquires in person, the site manager should inform him or her that the site will respond only to written requests that provide enough information to verify the source and purpose of the request.

Limit disclosures. Tell site managers to provide household information only to official government sources unless you have a policy of responding to requests for landlord references. For example, site managers may give occupancy information to the city building department or provide information in response to a fair housing investigation. Site managers should respond to requests from any other sources with a polite refusal such as, “I am not at liberty to divulge that information.”

Also, make sure site staff understand that they may give out household information in an emergency to law enforcement or fire and rescue personnel.

With landlord references, some sites refuse to issue them because of liability concerns. But references can be a source of valuable information on applicants for sites, and you may want other sites to reciprocate by giving you references from time to time. In this case, you can steer a middle course by setting a policy that strictly limits the information you’ll give to other sites.

In response to a written request, site managers can confine their responses to specific and indisputable information such as whether the former resident was evicted, paid rent on time, and whether the resident caused serious damage to the unit. Managers shouldn’t offer opinions on the desirability of households, and shouldn’t offer information they can’t easily prove with documentary evidence. For example, site managers shouldn’t make broad statements about households being “bad,” “loud,” “a pain to deal with,” or “frequent lease violators,” and should never go into the circumstances of specific incidents of problem behavior.

Train Staff on Policy

Make sure that present and future site staff are familiar with your policy. Also, make them aware that callers may use ploys to try to get around your policy. For example, a collection agency may send a form entitled, “Resident Verification.” It may ask the manager to verify certain information about a household, stating that the collection agency has a right to the information and that the site manager should respond within 24 hours to avoid unnecessary delays. However, collection agencies don’t have a right to household information, even though they may be trying to collect a legitimate debt. And your site could be held liable for responding to such a request.

You should also warn site staff to be wary of anyone claiming to be a resident’s attorney, relative, or friend, or claiming to have an award or delivery for the resident.