Skip to site content

Indian Health Service The Federal Health Program for American Indians and Alaska Natives

     Indian Health Manual
Share This Page:

Part 2, Chapter 7:  Manual Exhibit 2-7-B

Policy and Procedure for Matters Related to Accounting of
Disclosures of Protected Health Information

  1. PURPOSE.  The purpose of Manual Exhibit 2-7-B is to specify Indian Health Service (IHS) policy and procedures for making and accounting of (documenting) disclosures and for receiving and processing requests by patients for an accounting of Protected Health Information (PHI) disclosures.


    1. 45 Code of Federal Regulations (CFR) § 164.528

    2. 45 CFR § 5b.9(c)

  3. POLICY.  Unless a patient requests an accounting of disclosures for a shorter period of time, a patient has the right to request and receive (with certain exceptions) an accounting of disclosures of PHI about the patient made by the IHS, including disclosures to or by its “business associates,” as defined at 45 CFR § 160.103, in the 5 years prior to the date on which the accounting is requested or for the life of the record, whichever is longer.

  4. PROCEDURES.  The following procedures shall be used to make an accounting and to respond to patient requests for an accounting of disclosures of PHI.

    1. Disclosures That Do Not Require an Accounting.  The following disclosures do not require an accounting to the patient:

      1. Disclosures to officers and employees of the Department of Health and Human Services (HHS) who have a need to know the information for the performance of their duties, including, but not limited to the performance of treatment, payment, or health care operations, or for disclosures to the Secretary, HHS, that are required in order to investigate or determine compliance with the Privacy Act and Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule requirements.

      2. Disclosures to the patient.

      3. Disclosures pursuant to the patient’s written authorization.

        Note:  These disclosures are reported as First Party Requests under the Freedom of Information Act (FOIA) reporting requirements.

      4. Disclosures required under the FOIA.

        Note:  These disclosures are reported as Third Party Requests under the FOIA reporting requirements.

    2. Disclosures That Do Require an Accounting.  The following Privacy Act Conditions of Disclosures as defined in 5 United States Code (U.S.C.) 552a(b)(3) through U.S.C. 552a(b)(12) must be accounted for and are listed below.  In addition, the following disclosures (published Routine Uses in the Privacy Act System of Records Notice 09-17-0001) require an accounting:

      (b)(1) is not reportable disclosures as noted in Section 4A of this exhibit.

      (b)(2) is not reportable disclosures as noted in Section 4A of this exhibit.

      (b)(3) For a routine use as defined as disclosure of a record outside the Department, without the consent of the subject individual, for a purpose which is compatible with the purpose for which the record was collected, see the listing of Routine Uses following the Privacy Act Disclosures in this section.

      (b)(4) To the Bureau of Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13 U.S.C.

      (b)(5) To a recipient who has provided the agency with advance written assurance that the record will be used solely as a statistical research or reporting record; Provided, That, the record is transferred in a form that does not identify the subject individual.

      (b)(6) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Administrator of General Services or his designee to determine whether the record has such value.

      (b)(7) To another government agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of such government agency or instrumentality has submitted a written request to the Department specifying the record desired and the law enforcement activity for which the record is sought.

      (b)(8) To an individual pursuant to a showing of compelling circumstances affecting the health and safety of any individual if a notice of the disclosure is transmitted to the last known address of the subject individual.

      (b)(9) To either House of Congress, or to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee.

      (b)(10) To the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office.

      (b)(11) Pursuant to the order of a court of competent jurisdiction; or

      (b)(12) To a consumer reporting agency in accordance with Section 3711(e) of Title 31 U.S.C.

      Indian Health Service Privacy Act Routine Uses from the System of Records Notice 09-17-0001 Medical, Health, and Billing Records:

      1. Records may be disclosed to Federal and non-Federal (public or private) health care providers that provide health care services to IHS individuals for purposes of planning for or providing such services or reporting results of medical examination and treatment.

      2. Records may be disclosed to Federal, State, local, or other authorized organizations that provide third-party reimbursement or fiscal intermediary functions for the purposes of billing or collecting third-party reimbursements.  Relevant records may be disclosed to debt collection agencies under a business associate agreement arrangement directly or through a third party.

      3. Records may be disclosed to State agencies or other entities acting pursuant to a contract with Centers for Medicare and Medicaid Services (CMS), for fraud and abuse control efforts, to the extent required by law or under an agreement between the IHS and respective State Medicaid agency or other entities.

      4. Records may be disclosed to school health care programs that serve American Indians/Alaska Natives (AI/AN) for the purpose of student health maintenance.

      5. Records may be disclosed to the Bureau of Indian Affairs (BIA) or its contractors under an agreement between IHS and the BIA relating to disabled AI/AN children for the purposes of carrying out its functions under the Individuals with Disabilities Education Act (IDEAS), 20 U.S.C. 1400, et. seq.

      6. Records may be disclosed to organizations deemed qualified by the Secretary, HHS, and under a business associate agreement to carry out quality assessment/improvement medical audits, utilization review or to provide accreditation or certification of health care facilities or programs.

      7. Records may be disclosed under a business associate agreement to individuals or authorized organizations sponsored by IHS, such as the National Indian Women’s Resource Center, to conduct analytical and evaluation studies.

      8. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.  An authorization, Form IHS 810, is required for the disclosure of sensitive PHI, (e.g., alcohol/drug abuse patient information, human immunodeficiency virus (HIV)/Acquired Immune Deficiency Syndrome (AIDS), Sexually Transmitted Diseases (STD), or mental health) that is maintained in the medical record.

      9. Records may be disclosed for research purposes to the extent permitted by:

        1. determining that the use(s) or disclosure(s) are met under 45 CFR §164.512(i), or

        2. determining that the use(s) or disclosure(s) are met under 45 CFR § 164.514(a) through (c) for de-identified PHI, and 5 U.S.C. 552a (b)(5), or

        3. determining that the requirements of 45 CFR § 164.514 (e) for limited data sets, and 5 U.S.C. 552a (b)(5) are met.

      10. Information from records, such as information concerning the commission of crimes, suspected cases of abuse (including child, elder and sexual abuse), neglect, sexual assault or domestic violence, births, deaths, alcohol or drug abuse, immunizations, cancer, or the occurrence of communicable diseases, may be disclosed to public health authorities or other appropriate government authorities, as authorized by Federal, State, Tribal, or local law or regulation of the jurisdiction in which the facility is located.

        Note:  In Federally conducted or assisted alcohol or drug abuse programs, under 42 CFR Part 2, disclosure of patient information for purposes of criminal investigations must be authorized by court order issued under 42 CFR Part 2.65, except that reports of suspected child abuse may be made to the appropriate State or local authorities under State law.

      11. Information may be disclosed regarding suspected cases of child abuse to:

        1. Federal, State or Tribal agencies that need to know the information in the performance of their duties, and

        2. members of community child protection teams for the purposes of investigating reports of suspected child abuse, establishing a diagnosis, formulating or monitoring a treatment plan, and making recommendations to the appropriate court.  Community child protection teams are comprised of individuals who are Tribal representatives, the BIA, child protection service agencies, the judicial system, law enforcement agencies, and the IHS.

      12. The IHS may disclose information from these records in litigations and/or proceedings related to an administrative claim when:

        1. the IHS has determined that the use of such records is relevant and necessary to the litigation and/or proceedings related to an administrative claim and would help in the effective representation of the affected party listed in subsections (i) through (iv) below, and that such disclosure is compatible with the purpose for which the records were collected.  Such disclosure may be made to the HHS/Office of General Counsel (OGC) and/or the Department of Justice (DOJ), pursuant to an agreement between IHS and OGC, when any of the following is a party to litigation and/or proceedings related to an administrative claim or has an interest in the litigation and/or proceedings related to an administrative claim:

          1. the HHS or any component thereof; or

          2. any HHS employee in his or her official capacity; or

          3. any HHS employee in his or her individual capacity where the DOJ (or HHS, where it is authorized to do so) has agreed to represent the employee; or

          4. the United States or any agency thereof (other than HHS) where HHS/OGC has determined that the litigation and/or proceedings related to an administrative claim is likely to affect HHS or any of its components.

        2. In the litigation and/or proceedings related to an administrative claim described in subsection (a) above, information from these records may be disclosed to a court or other tribunal, or to another party before such tribunal in response to an order of a court or administrative tribunal, provided that the covered entity discloses only the information expressly authorized by such order.

      13. Records may be disclosed under a business associate agreement to an IHS contractor for the purpose of computerized data entry, medical transcription, duplication services, or maintenance of records contained in this system.

      14. Records may he disclosed under a personal services contract or other agreement to student volunteers, individuals working for the IHS, and other individuals performing functions for IHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.

      15. Records regarding specific medical services provided to unemancipated minors may be disclosed to the unemancipated minor’s parent or legal guardian who previously consented to those specific medical services, to the extent permitted under 45 CFR § 164.502(g).

      16. Records may be disclosed to an individual having authority to act on behalf of an incompetent individual concerning health care decisions, to the extent permitted under 45 CFR § 164.502(g).

      17. Information may be used or disclosed from an IHS facility directory in response to an inquiry about a named individual from a member of the general public to establish the individual’s presence (and location when needed for visitation purposes) or to report the individual’s condition while hospitalized (e.g., satisfactory or stable), unless the individual objects to disclosure of this information.  IHS may provide the religious affiliation only to members of the clergy.

      18. Information may be disclosed to a relative, a close personal friend, or any other person identified by the individual that is directly relevant to that person’s involvement with the individual’s care or payment for health care.

        Information may also be used or disclosed in order to notify a family member, personal representative, or other person responsible for the individual’s care, of the individual’s location, general condition or death.

        If the individual is present for, or otherwise available prior to, a use or disclosure, and is competent to make health care decisions:

        1. may use or disclose after the facility obtains the individual’s consent,

        2. provides the individual with the opportunity to object and the individual does not object, or

        3. it could reasonably infer, based on professional judgment, which the individual does not object.

          If the individual is not present, or the opportunity to agree or object cannot practicably be provided due to incapacity or emergent circumstances, an IHS health care provider may determine, based on professional judgment, whether disclosure is in the individual‘s best interest, and if so, may disclose only what is directly relevant to the individual’s health care.

      19. Information concerning exposure to the HIV may be disclosed, to the extent authorized by Federal, State, or Tribal law, to the sexual and/or needle-sharing partner(s) of a subject individual who is infected with HIV under the following circumstances:

        1. the information has been obtained in the course of clinical activities at IHS facilities;

        2. the IHS has made reasonable efforts to counsel and encourage the subject individual to provide information to the individual’s sexual or needle-sharing partner(s);

        3. the IHS determines that the subject individual is unlikely to provide the information to the sexual or needle-sharing partner(s) or that the provision of such information cannot reasonably be verified; and

        4. the notification of the partner(s) is made, whenever possible, by the subject individual’s physician or by a professional counselor and shall follow standard counseling practices.

        5. the IHS has advised the partner(s) to whom information is disclosed that they shall not re-disclose or use such information for a purpose other than that for which the disclosure was made.

      20. Records may be disclosed to Federal and non-Federal protection and advocacy organizations that serve AI/AN for the purpose of investigating incidents of abuse and neglect of individuals with developmental disabilities (including mental disabilities), as defined in 42 U.S.C. §§ 10801-10805(a)(4) and 42 CFR §§ 51.41-46, to the extent that such disclosure is authorized by law and the conditions of 45 CFR § 1386.22(a)(2) are met.

      21. Records of an individual may be disclosed to a correctional institution or a law enforcement official, during the period of time the individual is either an inmate or is otherwise in lawful custody, for the provision of health care to the individual or for health and safety purposes.  Disclosure may be made upon the representation of either the institution or a law enforcement official that disclosure is necessary for the provision of health care to the individual, for the health and safety of the individual and others (e.g., other inmates, employees of the correctional facility, transport officers), and for facility administration and operation.  This routine use applies only for as long as the individual remains in lawful custody, and does not apply once the individual is released on parole or placed on either probation or on supervised release, or is otherwise no longer in lawful custody.

      22. Records including patient name, date of birth, Social Security Number (SSN), gender and other identifying information may be disclosed to the Social Security Administration (SSA) as is reasonably necessary for the purpose of conducting an electronic validation of the SSN(s) maintained in the record to the extent required under an agreement between IHS and SSA.

      23. Disclosure of relevant health care information may be made to funeral directors or representatives of funeral homes in order to allow them to make necessary arrangements prior to and in anticipation of an individual’s impending death.

      24. Records may be disclosed to a public or private covered entity that is authorized by law or charter to assist in disaster relief efforts (e.g., the Red Cross, Federal Emergency Management Administration), for purposes of coordinating information with other similar entities concerning an individual’s health care, payment for health care, notification of the individual’s whereabouts and his or her health status or death.

    3. How to Make an Accounting (i.e., Document a Disclosure).

      1. Disclosures of PHI that are subject to an accounting should be recorded on Form IHS-505, Disclosure Accounting Record or electronically, utilizing the Release of Information (ROI) software application of the Resource and Patient Management System (RPMS).

      2. Each accounting (which will be given to the patient upon written request) must be in writing, include disclosures to and by IHS contractors (business associates), and include for each disclosure:

        1. date of the disclosure;

        2. name and address of the person or organization receiving the PHI;

        3. a brief description of the PHI disclosed, e.g., immunization record, labs, x-ray;

        4. a brief statement of the purpose of the disclosure (or include a copy of the written request for disclosure, if appropriate); and

        5. Accountings of oral disclosures of PHI should also include the name, signature and title of staff that made the oral disclosure.

      3. If, during the period covered by the accounting, the IHS has made multiple disclosures of PHI to the same patient or entity for a single purpose, the accounting may be documented on the first disclosure (or authorization), the frequency or number of disclosures made during the accounting period and the date of the last disclosure during the accounting period.

      4. The IHS must provide the first accounting to a patient in any 12 month period without charge.

    4. Responding to Patient Requests for an Accounting of Disclosures.

      1. A request for an accounting of disclosures must be in writing, and should be made on Form IHS-913, “Request for an Accounting of Disclosures,” Manual Exhibit 2-7-B - Appendix 1.  The form should be submitted to the IHS Health Information Management (Health Records) Department that is responsible for receiving and processing such requests.

      2. When a patient requests an accounting of disclosures, the patient must present valid identification unless the patient is personally known to the employee responding to the patient request.  Guidance on identification procedures is found in the Manual Exhibit No. 2-7-R, “Policy and Procedures for Verification of Identity Prior to Disclosure of PHI.”

      3. The IHS must act on the request no later than 60 days after receipt of the request, and may extend this time for an additional 30 days, so long as it informs the patient in writing of the reason(s) for the delay and the date by which the patient can expect the accounting. The explanation sent to the patient must be retained in the patient’s medical record.

    5. Temporary Suspensions of Accounting for Disclosures to Health Oversight Agencies or Law Enforcement Officials.

      1. A health oversight Agency or a law enforcement official may submit a written statement to request the IHS to suspend a patient‘s right to receive an accounting of disclosures.  The written statement must specify:

        1. the reason that an accounting to the patient would be likely to impede the Agency or official's duties.

        2. how long the right to receive an accounting must be suspended.

      2. If the IHS agrees to suspend a patient's right to receive an accounting of disclosures:

        1. During the period of suspension, any disclosures requiring an accounting must still be recorded.

        2. At the end of the suspension of access, a patient's right to receive an accounting is reinstated.

      3. A health oversight Agency or a law enforcement official may request a temporary suspension orally.  If the request is made orally, the IHS must:

        1. document the identity of the Agency or official who made the request and

        2. must exclude the disclosure(s) for no longer than 30 days from the date of the request, unless a written request is provided during that time.

      4. If the Agency or official provides a written request that meets the requirements of E(1) (of this section), the IHS must temporarily suspend the patient's right to an accounting for the time period specified in the written request.

  5. FORMS. The Form IHS-913 is available at:

(For Public and Federal access) or

(For IHS staff only)

Manual Exhibit 2-7-B
Appendix 1

Special Note:  PDF documents require the Adobe Acrobat Reader plug-in in your web browser to view.  Please visit the I H S Plug-in page to install the plug-in you require.

Back To Top  |  Previous Page
CPU: 35ms Clock: 0s