Skip to site content

Indian Health Service The Federal Health Program for American Indians and Alaska Natives


     Indian Health Manual
Share This Page:

Part 2, Chapter 7:  Manual Exhibit 2-7-L

Policy and Procedure for Providing Indian Health Service
"Notice" of Privacy Practices


  1. PURPOSE.  To publish Indian Health Service (IHS) policy and procedure for providing the Notice of Privacy Practices, "Notice," to all patients.

  2. AUTHORITY.  45 Code of Federal Regulations (CFR) 164.520

  3. POLICY.  It is IHS policy to provide adequate "Notice" of its uses and disclosures of protected health information (PHI) and of the individual’s rights and IHS’ legal duties with respect to PHI to its beneficiaries.

  4. PROCEDURES.

    1. Display.  The IHS shall prominently and clearly display the IHS "Notice,” (see Appendix 1) in every service unit and treatment facility and on the IHS Web site at http://www.ihs.gov/.  In addition, the IHS may prominently display the IHS "Notice" in other public places within its facilities.

    2. Request.  Any individual, whether or not a patient, has the right to request and receive a copy of the IHS "Notice" at any time (except inmates).

    3. Initial Visit.  After April 13,2003, all patients, including both new and established patients, shall be provided a copy of the "Notice" at their first visit to an IHS facility:

      1. The Patient Registration Office or other appropriate department will provide a copy of the current "Notice" to the patient.

      2. A staff member will briefly summarize the purpose of the "Notice", in a statement such as the following:  “The purpose of the "Notice" is to inform you of the uses and disclosures which IHS may make of your protected health information, and it tells you of your rights and IHS’ legal duties with respect to such information.”

      3. The patient does not have to read the "Notice", instead an alternate means may be used to communicate the content, e.g., a video shown in the waiting room or a staff member or accompanying family member may read the "Notice" to the patient.

      4. The staff member must ask the patient if he or she has any questions.

      5. The staff member should answer any questions as best he or she can and refer unanswered questions to the service unit Privacy Official or designee.

      6. Ask the patient to acknowledge receipt of the "Notice" by signing the Acknowledgment of Receipt of IHS "Notice" of Privacy Practices.  (Appendix 1, "Notice of Privacy Practices.”)

        1. If the patient refuses to sign the Acknowledgement form, document the efforts made to obtain the acknowledgment and reason(s) why it was not obtained.

        2. If the patient cannot be provided with the "Notice" at the initial visit due to incapacitation or emergency, document the reason on the acknowledgment form.  An IHS staff member shall provide the patient with the "Notice" and have the patient sign the acknowledgement form as soon as the patient is no longer incapacitated or the emergency situation has passed.

        3. If another individual is acting as the patient’s representative in making healthcare decisions on behalf of the patient, provide that person with the "Notice" and have that person sign the acknowledgment form.

    4. Signatures.   The acknowledgement form must be signed and dated by the appropriate IHS staff.

      1. File the signed “Acknowledgement of Receipt of IHS "Notice" of Privacy Practices” into the patient’s medical record.

      2. If the "Notice" is revised by a material change, the revised "Notice" must be posted in clear and prominent locations in every service unit and treatment facility, on its web site, and in other public places, easily accessible on or after the effective date of the revision.  The revised "Notice" will also be given to all patients who come into the facility after the effective date of the revision.  The revised "Notice" will be posted on the IHS website within the 60 days of a material revision.

    5. Inmates have no rights to the “Notice.”


Manual Exhibit 2-7-L

Appendix 1

Indian Health Service

Notice of Privacy Practices

"THIS "Notice" DESCRIBES HOW MEDICAL INFORMATION ABOUT
YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET
ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."

xxx-xx-xxxx


SUMMARY OF YOUR PRIVACY RIGHTS

  1. Understand Your Medical Record/Information.  Each time you visit an Indian Health Service (IHS) facility for services, a record of your visit is made.  If you are referred by the IHS through the Contract Health Service (CHS) program, the IHS also keeps a record of your CHS visit.  Typically, this record contains your symptoms, examination, test results, diagnoses, treatment, and a plan for future care.  This information, often referred to as your medical record, serves as a:

    • Plan for your care and treatment.

    • Communication source between health care professionals.

    • Tool with which we can check results and continually work to improve the care we provide.

    • Means by which Medicare, Medicaid, or private insurance payers can verify the services billed.

    • Tool for education of health care professionals.

    • Source of information for public health authorities charged with improving the health of the people.

    • Source of data for medical research, facility planning, and marketing.

    • Legal document that describes the care you receive.

    Understanding what is in your medical record and how the information is used helps you to:

    • Ensure its accuracy.

    • Better understand why others may review your health information.

    • Make an informed decision when authorizing disclosures.

  2. Your Medical Record/Information Rights.  Although your medical record is the physical property of the IHS, the information belongs to you.  You have the right to:

    • Inspect and receive a copy of your medical record.

    • Request a restriction on certain uses and disclosures of your health information.  For example, you may ask that we not disclose your health information and/or treatment to a family member.  The IHS is not required to agree to your request; but if we do, we will comply with your request unless the information is needed to provide you with emergency services.

    • Request a correction/amendment to your medical record if you believe the health information we have about you is incorrect or incomplete, we may amend your record or include your statement of disagreement.

    • Request confidential communications about your health information.  You may ask that we communicate with you at a location other than your home or by a different means of communications such as telephone or mail.

    • Receive a listing of certain disclosures the IHS has made of your health information upon request.  This information is maintained for 5 years or the life of the record, whichever is longer.

    • Revoke your written authorization to use or disclose health information.  This does not apply to health information already disclosed or used or in circumstances where IHS have taken action in reliance on your authorization or the authorization was obtained as a condition of obtaining insurance coverage and the insurer has a legal right to contest a claim under the policy or the policy itself.

    • Obtain a paper copy of the IHS "Notice" of Privacy Practices upon request.

    • Obtain a paper copy of the IHS Medical, Health and Billing Records, System "Notice" Number 09-17-0001, upon request.

  3. Indian Health Service Responsibilities.  The IHS is required by law to:

    • Maintain the privacy of your health information.

    • Inform you about our privacy practices regarding health information we collect and maintain about you.

    • Notify you if we are unable to agree to a requested restriction.

    • Accommodate reasonable requests you may have to communicate health information by alternative means or at alternative locations.

    • Honor the terms of this "Notice" or any subsequent revisions of this "Notice".

    The IHS reserves the right to change its privacy practices and to make the new provisions effective for all protected health information (PHI) it maintains.  The IHS will post any revised "Notice" of Privacy Practices at public places within its health care facilities and on its web site at http://www.ihs.gov/AdminMngrResources/HIPAA/index.cfm and you may request a copy of the "Notice".

    The IHS understands that health information about you is personal and is committed to protecting your health information.  The IHS will not use or disclose your health information without your permission, except as described in this "Notice" and as permitted by the Privacy Act and the IHS Medical, Health and Billing Records; System "Notice" 09-17-0001.

  4. How IHS may use and disclose health information about you.  The following categories describe how we may use and disclose health information about you.

    We Will Use and Disclose Your Health Information to Provide Your Treatment.  For example:

    • Your personal information will he recorded in your medical record and used to determine the course of treatment for you.  Your health care provider will document in your medical record his or her instructions to members of your healthcare team.  The actions taken and the observations made by the members of your healthcare team will he recorded in your medical record so your health care provider will know how you are responding to treatment.

    • If the IHS refers you to another health care facility under the CHS program, the IHS may disclose your health information to that health care provider for treatment decisions.

    • If you are transferred to another facility for further care and treatment, the IHS may disclose information to that facility to enable them to know the extent of treatment you have received and other information about your condition.

    • Your health care provider(s) may give copies of your health information to others (health care professionals, personal representative, etc.) to assist in your treatment.

    We Will Use and Disclose Your Health Information for Payment Purposes.

    • If you have private insurance, Medicare, or Medicaid coverage, a bill will be sent to your health plan for payment.  The information on or accompanying the bill will include information that identifies you, as well as your diagnosis, procedures, and supplies used for your treatment.

    • If the IHS refers you to another health care provider under the CHS program, the IHS may disclose your health information with that provider for health care payment purposes.

    We Will Use and Disclose Your Health Information for Health Care Operations.  For example:

    • We may use your health information to evaluate your care and treatment outcomes with our quality improvement team.  This information will be used to continually improve the quality and effectiveness of the services we provide.  This includes health care services provided under CHS program.

    Business Associates.  The IHS provides some healthcare services and related functions through the use of contracts with business associates.  For example, the IHS may have contracts for medical transcription.  When these services are contracted, the IHS may disclose your health information to business associates so that they can perform their jobs.  We require our business associates to protect and safeguard your health information in accordance with all applicable Federal laws.

    Directory.  If you are admitted to an IHS inpatient facility, the IHS may use or disclose your name, general condition, religious affiliation, and location within our facility, for facility directory purposes, unless you notify us that you object to this information being listed.  The IHS may provide your religious affiliation only to members of the clergy.

    Notification.  The IHS may use or disclose your health information to notify or assist in the notification of a family member; personal representative or other authorized person(s) responsible for your care, unless you notify us that you object.

    Communication with Family.  All IHS health providers may use or disclose your health information to others responsible for your care unless you object.  For example, the IHS may provide your family members, other relatives, close personal friends, or any other person you identify, with health information that is relevant to that person's involvement with your care or payment for such care.

    Adults and Emancipated Minors with Personal Representatives or Legal Guardians.  IHS shall treat a personal representative or legal guardian of any such individual who has been declared incompetent due to physical or mental incapacity by a court of competent jurisdiction for the purposes of the use and disclosure of PHI as it relates to such personal representation.

    Interpreters.  In order to provide you proper care and services, the IHS may use the services of an interpreter.  This may require the use or disclosure of your personal health information to the interpreter.

    Research.  The IHS may use or disclose your health information for research purposes that has been approved by an IHS Institutional Review Board (IRB) that has reviewed the research proposal and established protocols to ensure the privacy of your health information.  The IHS may also use or disclose your health information for research purposes based on your written authorization.

    Organ Procurement Organizations.  The IHS may use or disclose your health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of facilitating organ, eye, or tissue donation and transplant.

    Uses and Disclosures about Decedents.  The IHS may use or disclose health information about decedents to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law.  The IHS also may disclose health information to funeral directors consistent with applicable law as necessary to carry out their duties.  In addition, the IHS may disclose protected health information about decedents where required under the Freedom of Information Act or otherwise required by law.

    Treatment Alternatives and Other Health-related Benefits and Services.  The IHS may contact you to provide information about treatment alternatives or other types of health-related benefits and services that may be of interest to you.  For example, we may contact you about the availability of new treatment or services for diabetes.

    Food and Drug Administration.  The IHS may use or disclose your health information to the Food and Drug Administration (FDA) in connection with a FDA-regulated product or activity.  For example, we may disclose to the FDA information concerning adverse events involving food, dietary supplements, product defects, or problems, and information needed to track FDA-regulated products or to conduct product recalls, repairs, replacements, or lookbacks (including locating people who have received products that have been recalled or withdrawn), or post marketing surveillance.

    Appointment Reminders.  The IHS may contact you with a reminder that you have an appointment for medical care at an IHS facility or to advise you of a missed appointment.

    Workers Compensation.  The IHS may use or disclose your health information for workers compensation purposes as authorized or required by law.

    Public Health.  The IHS may use or disclose your health information to public health or other appropriate government authorities as follows:

    1. the IHS may use or disclose your health information to government authorities that are authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, or conducting public health surveillance, investigations, and interventions;

    2. the IHS may disclose your health information to government authorities that are authorized by law to receive reports of child abuse or neglect; and

    3. the IHS may disclose your health information to government authorities that are authorized by law to receive reports of other abuse, neglect, or domestic violence as required by law, or as authorized by law if the IHS believes it is necessary to prevent serious harm.  Where authorized by law, the IHS may disclose your health information to an individual who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition.  In some situations (for example, if you are employed by IHS or another component of the Department of Health and Human Services (HHS), or if necessary to prevent or lessen a serious and imminent threat to the health and safety of an individual or the public), the IHS may disclose to your employer health information concerning a work-related illness or injury or a workplace-related medical surveillance.

    Correctional Institution.  If you are an inmate of a correctional institution, the IHS may use or disclose to the institution, health information necessary for your health and the health and safety of other individuals such as officers or employees or other inmates.

    Law Enforcement.  The IHS may use or disclose your health information for law enforcement activities as authorized by law or in response to a court of competent jurisdiction.

    Health Oversight Authorities.  The IHS may use or disclose your health information to health oversight agencies for activities authorized by law.  These oversight activities may include:  Investigations, audits, inspections, and other actions.  These are necessary for the government to monitor the health care system, government benefit programs, and entities subject to government regulatory programs and/or civil rights laws for which health information is necessary to determine compliance.  The IHS is required by law to disclose protected health information to the Secretary, HHS, to investigate or determine compliance with the HIPAA privacy standards.

    Members of the Military.  If you are a member of the military services, the IHS may use or disclose your health information if necessary to the appropriate military command authorities as authorized by law.

    Compelling Circumstances.  The IHS may use or disclose your health information in certain other situations involving compelling circumstances affecting the health or safety of an individual.  For example, in certain circumstances:

    1. The IHS may disclose limited protected health information where requested by a law enforcement official for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person;

    2. If you are believed to be a victim of a crime, a law enforcement official requests information about you and we are unable to obtain your agreement because of incapacity or other emergency circumstances, we may disclose the requested information if we determine that such disclosure would be in your best interests;

    3. The IHS may use or disclose protected health information as we believe is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person;

    4. The IHS may use or disclose protected health information in the course of judiciary and administrative proceedings if required or authorized by law;

    5. The IHS may use or disclose protected health information to report a crime committed on IHS health facility premises or when the IHS is providing emergency health care;

    6. The IHS may use or disclosure PHI during a disaster and for disaster relief purposes; and

    7. The IHS may make any other disclosures that are required by law.

    Non Violation of this Notice.  The IHS is not in violation of this "Notice" or the HIPAA Privacy Rule if any of its employees or its contractors (business associates) disclose protected health information under the following circumstances:

    1. Disclosures by Whistleblowers.  If an IHS employee or contractor (business associate) in good faith believes that the IHS has engaged in conduct that is unlawful or otherwise violates clinical and professional standards or that the care or services provided by the IHS has the potential of endangering one or more patients or members of the workplace or the public and discloses such information to:

      1. A Public Health Authority or Health Oversight Authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions, or the suspected violation, or an appropriate health care accreditation organization for the purpose of reporting the allegation of failure to meet professional standards or misconduct by the IHS; or

      2. An attorney on behalf of the workforce member, or contractor (business associate) or hired by the workforce member or contractor (business associate) for the purpose of determining their legal options regarding the suspected violation.

    2. Disclosures by Workforce Member Crime Victims.  Under certain circumstances, an IHS workforce member (either an employee or contractor) who is a victim of a crime on or off the IHS facility' premises may disclose information about the suspect to law enforcement official provided that:

      1. The information disclosed is about the suspect who committed the criminal act.

      2. The information disclosed is limited to identifying and locating the suspect.

Any other uses and disclosures will be made only with your written authorization, which you may later revoke in writing at any time.  (Such revocation would not apply where the health information already has been disclosed or used or in circumstances where the IHS has taken action in reliance on your authorization or the authorization was obtained as a condition of obtaining insurance coverage and the insurer has a legal right to contest a claim under the policy or the policy itself.)

To exercise your rights under this "Notice", to ask for more information, or to report a problem contact the Chief Executive Officer or the Service Unit Privacy official at:

(Stamped facility name, address and local phone number)

If you believe your privacy rights have been violated, you may file a written complaint with the above individual(s) or the Secretary, Health and Human Services, Washington, D.C. 20201.  There will be no retaliation for filing a complaint.

Effective Date: xxx-xx-xxxx


Acknowledgment of Receipt of IHS "Notice" of Privacy Practices

I hereby acknowledge receipt of the Indian Health Service (IHS) "Notice" of Privacy Practices at:

Stamped facility name and address

__________________________________________________________________
Signature of Patient
Date________________________________________
__________________________________________________________________
Signature of Patient Personal Representative
(State relationship to Patient)
Date________________________________________
__________________________________________________________________
Or Witness (if signature is by thumbprint or mark)
__________________________________________________________________
Signature and Title of IHS Employee
Date________________________________________


For Patients Unable to Acknowledge Receipt

I hereby certify that the patient was unable to acknowledge receipt of the IHS "Notice" of Privacy Practices because:

__________________________________________________________________
Signature of IHS staff
Date________________________________________


Back To Top  |  Previous Page
CPU: 121ms Clock: 0s