Privacy Act of 1974; Report of Modified or Altered System

In accordance with the requirements of the Privacy Act of 1974, we are proposing to modify or alter an SOR, ``Health, Medical and Billing Records (formerly known as the Health and Medical Records Systems),'' System No. 09-17-0001. We propose to include contract health service records, as an additional category of individuals covered by the system, which consists of medical records to eligible American Indians and Alaska Native (AI/AN) people that supplements the health care resources available with the purchase of medical care and services that are not available within the IHS direct care system which may include, but not limited to, basic and specialty health care services from local and community health care providers, including hospital care, physician services, outpatient care, laboratory, dental, radiology, pharmacy, and transportation services. Under the Purpose of the system, we propose to include several new purposes that are in line with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provisions which were incorporated into the published IHS Notice of Privacy Practices (NPP) and to include debt collection activities. We are proposing to modify/alter/delete several published routine uses, as explained, to accommodate for program and statutory changes as indicated: Number 1 is modified/altered by separating the medical treatment, payment and health care operations into two separate routine uses 1 and 2 to include payment, billing, third-party reimbursement and debt collection activities; numbers 3, 4 and 11 are to include business associate agreement language to comply with HIPAA Privacy standards and renumbered as 5, 6 and 12 respectively; number 5 is to include a special requirement notice for sensitive protected health information (PHI) such as alcohol/drug abuse, HIV/AIDS, STD or mental health patient information and renumbered as 7; number 6 is to reflect changes in research disclosures to comply with HIPAA Privacy standards and renumbered as 8; number 7 is to include various cases of abuses, neglect, sexual assault and domestic violence and emphasis on meeting the requirements of 42 CFR part 2 and renumbered as 9; number 8 is to clarify the disclosures regarding suspected cases of child abuse and renumbered as 10; number 9 is modified to include legal proceedings related to administrative claims and the inclusive provision of the Department of Health and Human Services (DHHS)/Office of General Counsel (OGC) representation in litigation matters and renumbered as 11; number 10 is modified to include business associate agreement language to comply with HIPAA Privacy standards and is renumbered as 5; numbers 12 and 16 are modified and incorporated into one proposed routine use 13 with minor edits; number 14 is modified to reflect the permitted use/ disclosure requirements of 45 CFR 164.502(g) and remains as 14; number 15 is modified with some minor edits to reflect current changes to enable efficient administration of health care operations and planning and delivery of patient medical care and renumbered as 18; and number 16 is being deleted and incorporated into the proposed routine use 13. We propose to add 10 new routine uses to provide disclosures of records when all requirements are met: number 2, to provide disclosure for third-part reimbursement, fiscal intermediary functions and debt collection activities; number 3, to provide disclosures to state Medicaid agencies or other entities acting pursuant to a contract with Centers for Medicare & Medicaid Services (CMS) for fraud and abuse control efforts to the extent required by law or under an agreement between IHS and respective state Medicaid agency or other entities; number 16, to an individual having authority to act on behalf of an incompetent individual concerning health care decisions to the extent permitted under 45 CFR 164.502(g); number 17, information may be used or disclosed from an IHS facility directory unless the individual objects to the disclosure and may provide the religious affiliation only to members of the clergy; number 18, information may be disclosed to a relative, a close personal friend, or any other person identified by the individual that is directly relevant to that person's involvement with their care or payment for health care and may be used or disclosed to notify family member, personal representative, or other person responsible for the individual's care, of their location, general condition or death; number 20, to provide records to Federal and non-Federal protection and advocacy organizations for investigating incidents of abuse and neglect of individuals with development disabilities as defined in 42 U.S.C. 10801-10805(a)(4) and 42 CFR 51.41-46 to the extent authorized by law and the conditions of 45 CFR 1386.22(a)(2) are met; number 21, disclosure to a correctional institution or a law enforcement official, during the period of time the individual is either an inmate or is otherwise in lawful custody, for the provision of health care to the individual or for health and safety purposes; number 22, disclosure to the Social Security Administration (SSA) for validation of Social Security Number(s) (SSNs) purposes only; number 23, disclosure of relevant health care information may be made to funeral director or representatives of funeral homes to allow for necessary arrangements; number 24, disclosure to a public or private covered entity that is authorized by law or charter to assist in disaster relief efforts. Routine use previously numbered 13 is deleted as being no longer applicable to the system. Routine uses previously numbered 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, and 15 have been renumbered as 4, 6, 7, 8, 9, 10, 11, 12, 13, 14, and 19 respectively. The security classification previously reported as ``None'' will remain. We have modified the language in the routine uses to provide clarification to IHS' intention to disclose individual-specific information contained in this system. The routine uses will then be prioritized and reordered according to their usage. We will also take the opportunity to update any sections of the system notice to provide clarity on the changing environment to include for digital records and the initiative of transitioning from a paper-based record to a computerized-based or electronic medical record.