CIMS Privacy Policy

TWINSIS, LLC ("TWINSIS," "we," "our," or "us") provides the CIMS (Consolidated Information Management System) application and the CIMS Reports application to human services agencies ("agencies"). This Privacy Policy explains how TWINSIS handles information when authorized users sign in to and use CIMS and CIMS Reports.

Scope of this Policy

This policy applies to the CIMS application, the CIMS Reports application, the CIMS help pages available after you sign in, and the email and text message notifications CIMS sends (together, "CIMS").

CIMS is used by the staff and contractors of agencies that subscribe to CIMS. Individuals who receive services, and their families and guardians, do not sign in to CIMS. This policy does not describe how an agency itself collects, uses, or shares information; the agency's own policies and notices do that. Visitors to our public website should read the TWINSIS, LLC Privacy Policy.

Your Agency and TWINSIS

Your agency decides what information is entered into CIMS, who can see it, and how long it is kept. TWINSIS stores and processes that information on the agency's behalf, following the agency's instructions and the agency's agreement with TWINSIS, including a Business Associate Agreement (BAA) where one is in place. If this policy conflicts with the agency's agreement or BAA, the agreement or BAA controls.

Individuals who receive services should read their agency's Notice of Privacy Practices, which explains how the agency uses and shares their health information. Questions and requests about those records should go to the agency.

Information in CIMS

CIMS holds the following kinds of information:

• Your account and sign-in information. Your name, work email address or user name, your Microsoft organization, and the Microsoft security groups your agency uses to assign CIMS roles. You sign in with your agency's Microsoft account through Microsoft Entra ID. CIMS never receives or stores your password, and your agency's Microsoft policies decide when multi-factor authentication is required.
• Staff records your agency keeps. Contact and job details, emergency contacts, training, human resources, and compensation records, and identifiers needed for employment, payroll, and visit verification, such as date of birth, Social Security number, driver's license, and work eligibility information.
• Records about individuals who receive services. Identifying and demographic information, insurance and Medicaid identifiers, health, medication, and behavioral information, service plans and documentation, incident reports, contacts and guardians, photos, signatures, and uploaded documents. This information may include protected health information (PHI).
• Records about other people your agency works with, such as training participants, contractors, and vendors.
• Service delivery information. When you clock in or out of a service, CIMS may record your device's location and, if your agency uses this feature, a photo taken with your device's camera. CIMS also records signatures captured on screen.
• Activity and technical information. Sign-ins and sign-outs, who created and last changed records and when, detailed change history for some records, your IP address, browser information, the pages and actions requested, errors, and feedback you choose to send. For AI features, CIMS keeps usage records showing who used which feature and how much.

How We Use Information

TWINSIS uses information in CIMS to:

• Provide, operate, maintain, and support CIMS for your agency, as your agency directs.
• Sign you in and apply the roles and permissions your agency assigns.
• Send the email, text message, and in-app notifications your agency sets up.
• Exchange information with outside systems your agency turns on, such as state Medicaid billing, electronic visit verification (EVV), and pharmacy systems.
• Investigate problems and respond to your agency's requests, such as a request to review who changed a record.
• Protect, monitor, back up, and recover CIMS and the information in it.
• Meet our obligations under the law and our agreements with agencies.

We do not sell personal information, and we do not use information in CIMS for advertising. TWINSIS personnel access an agency's information only as needed to provide, support, and secure CIMS, or as the agency requests.

AI Features

CIMS offers optional AI features, such as service log reviews, shift briefings, plan step suggestions, and assistive technology recommendations. Your agency decides which features are turned on. When you use one, CIMS sends the relevant record information, which can include an individual's name and service or health information, to AI services in Microsoft Azure to generate the result. Generated results, such as audio briefings, may be stored with your agency's CIMS data.

TWINSIS does not use information in CIMS to train AI models. Under Microsoft's terms for its Azure AI services, Microsoft does not use this information to train its models either. AI output is advisory and can be wrong, so staff must check it against the records before relying on it.

How Information Is Shared

• Within your agency. Information in CIMS is available to users your agency authorizes, and the roles your agency assigns control which parts of CIMS each user can use. Your agency's administrators can see staff records and can ask TWINSIS to review activity records.
• Service providers. TWINSIS uses service providers for cloud hosting and sign-in (Microsoft Azure and Microsoft Entra ID), email delivery, text message delivery, and AI processing. They receive only the information needed to perform their services for us, under agreements that require them to protect it. CIMS pages also load fonts from a web font provider, which receives your IP address and browser information.
• Systems your agency connects. When your agency turns on an integration, CIMS sends the information that integration needs. For example, EVV systems receive identifiers for individuals and staff, and visit times and locations. State Medicaid billing systems receive claim information, and pharmacies exchange medication orders.
• Training calendar. The CIMS training calendar can be viewed without signing in. It can show course details, such as dates, locations, and instructor names.
• Legal and safety reasons. We may disclose information when required by law or legal process, or to protect the rights, safety, or security of people or systems, subject to applicable law and our agreements with agencies, including any BAA.
• Business transfers. If TWINSIS is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to our agreements with agencies.

Cookies and Browser Storage

CIMS uses only cookies that are needed for it to work: an encrypted sign-in cookie that keeps you signed in and expires after a period of inactivity, and short-lived cookies used during Microsoft sign-in. Microsoft sets its own cookies on its sign-in pages.

CIMS also saves display preferences and filter choices in your browser. Some screens keep recent search criteria, such as a name you searched for, until you close the browser tab. CIMS does not use advertising cookies, tracking pixels, or third-party analytics.

Where Information Is Kept and How It Is Protected

• CIMS runs in Microsoft Azure data centers in the United States. Each agency has its own CIMS application, database, and file storage, and its information isn't stored together with other agencies' information.
• Information is encrypted in transit with HTTPS, and connections to pharmacies use private, encrypted VPN connections.
• Databases, file storage, and backups are encrypted at rest. Copies are kept in a second Azure region in the United States for disaster recovery.
• Only Microsoft organizations that TWINSIS has approved for your agency can sign in, and the roles your agency assigns control which parts of CIMS each user can use. CIMS signs you out after a period of inactivity.
• CIMS records sign-ins, sign-outs, and changes to records, and logs errors and suspicious requests.
• As a business associate of the agencies it serves, TWINSIS complies with its obligations under the Health Insurance Portability and Accountability Act (HIPAA), and signs a BAA with agencies that request one.
• TWINSIS has completed a SOC 2 Type I audit of its security controls.

No system can be guaranteed to be completely secure. If TWINSIS learns of a security or privacy incident that affects an agency's information, we investigate and notify the agency as required by our agreement, the BAA, and the law. The agency decides what to tell its staff, individuals, and families.

Data Retention

CIMS does not delete records automatically after a set time. Your agency decides how long to keep records, based on its own policies and legal obligations, and can ask TWINSIS to dispose of records or provide a copy of its data. Activity and technical logs are kept as long as needed to operate, secure, and troubleshoot CIMS. When an agency's agreement ends, its information is returned or deleted as the agreement and BAA describe. Backup copies are removed as backups expire.

Text Messages

CIMS sends you text messages, such as open shift requests and training reminders, only if you have agreed to the Mobile text messages policy and have a mobile phone number on file. Standard message and data rates may apply. You can give or withdraw consent at any time in CIMS under My Profile → My Consents.

Your Choices

• CIMS users can update personal contact details and emergency contacts in My Profile. For other requests to see, correct, or delete your information, contact your agency. TWINSIS helps agencies respond to these requests.
• Individuals who receive services, and their families and guardians, should contact the agency that provides services. If TWINSIS receives such a request, we will refer it to the agency.

Children's Information

CIMS users are agency staff and contractors. Agencies may keep records about children who receive services, and TWINSIS protects those records in the same way as all other information in CIMS.

Changes to this Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the effective date above, and we will notify agencies when their agreements require it.

Contact Us

If you use CIMS and have a question about this policy, contact your agency's CIMS administrator first. You or your administrator can also reach TWINSIS Support at support@twinsis.net. Please do not include protected health information in your message. Individuals who receive services should contact their agency.