|
Is this a new PIA 2008?: No
If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight
1. Date of this Submission: Jul 27, 2006
2. OPDIV Name: IHS
3. Unique Project Identifier (UPI) Number: 009-17-01-06-01-1010--110-031
4. Privacy Act System of Records (SOR) Number: 09-17-0001
5. OMB Information Collection Approval Number: No
6. Other Identifying Number(s): No
7. System Name: Resource and Patient Management System (RPMS)
9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Howard Hays
10. Provide an overview of the system: 1. To provide a description of an individual's diagnosis, treatment and outcome, and to plan for immediate and future care of the individual.
2. To provide statistical data to IHS officials in order to evaluate health care programs and to plan for future needs.
3. To serve as a means of communication among members of the health care team who contribute to the individual's care; e.g., to integrate information from field visits with records of treatment in IHS facilities and with non-IHS health care providers.
4. To serve as the official documentation of an individual's health care.
5. To contribute to continuing education of IHS staff to improve the delivery of health care services.
6. For disease surveillance purposes. For example:
(a) the Centers for Disease Control and Prevention may use these records to monitor various communicable diseases;
(b) the National Institutes of Health may use these records to review the prevalence of particular diseases (e.g., malignant neoplasms, diabetes mellitus, arthritis, metabolism, and digestive diseases) for various ethnic groups of the United States; or
(c) those public health authorities that are authorized by law may use these records to collect or receive such information for purposes of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death and the conduct of public health surveillance, investigations, and interventions.
7. To compile and provide aggregated program statistics. Upon request of other components of DHHS, IHS will provide statistical information, from which individual/personal identifiers have been removed, such as:
(a) to the National Committee on Vital and Health Statistics for its dissemination of aggregated health statistics on various ethnic groups;
(b) to the Assistant Secretary for Planning and Evaluation, Health Policy to keep a record of the number of sterilizations provided by federal funding;
(c) to the Centers for Medicare & Medicaid Services (CMS) to document IHS health care covered by the Medicare and Medicaid programs for third-party reimbursement; or
(d) to the Office of Clinical Standards and Quality, CMS to determine the prevalence of end-stage renal disease among the American Indian and Alaska Native (AI/AN) population and to coordinate individual care.
8. To process and collect third-party claims and facilitate fiscal intermediary functions and to process debt collection activities.
9. To improve the IHS national patient care database by means of obtaining and verifying an individual's SSN with the Social Security Administration (SSA).
10. To provide information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs to facilitate organ, eye, or tissue donation and transplant.
11. To provide information to individuals about treatment alternatives or other types of health-related benefits and services.
12. To provide information to the Food and Drug Administration (FDA) in connection with an FDA-regulated product or activity.
13. To provide information to correctional institutions as necessary for health and safety purposes.
14. To provide information to governmental authorities (e.g., social services or protective services agencies) on victims of abuse, neglect, sexual assault or domestic violence.
15. To provide information to the National Archives and Records Administration in records management inspections conducted under the authority of 44 U.S.C ' 2901, et seq.
16. To provide relevant health care information to funeral directors or representatives of funeral homes to allow necessary arrangements prior to and in anticipation of an individual's impending death.
13. Indicate if the system is new or an existing one being modified: Existing
17. Does/Will the system collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system?: Yes
Note: This question seeks to identify any, and all, personal information associated with the system. This includes any IIF, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation
Note: If no IIF is contained in the system, please answer questions 21, 23, 30, 31, 37, 50 and 54, then promote the PIA to the Sr. Privacy Official who will authorize the PIA.
If this system contains IIF, all remaining questions on the PIA Form Tabs must be completed prior to signature and promotion.
21. Is the system subject to the Privacy Act?: Yes
23. If the system shares or discloses IIF please specify with whom and for what purpose(s): 1. Records may be disclosed to Federal and non-Federal (public or private) health care providers that provide health care services to IHS individuals for purposes of planning for or providing such services, or reporting results of medical examination and treatment.
2. Records may be disclosed to Federal, state, local or other authorized organizations that provide third-party reimbursement or fiscal intermediary functions for the purposes of billing or collecting third-party reimbursements. Relevant records may be disclosed to debt collection agencies under a business associate agreement arrangement directly or through a third party.
3. Records may be disclosed to state agencies or other entities acting pursuant to a contract with CMS, for fraud and abuse control efforts, to the extent required by law or under an agreement between IHS and respective state Medicaid agency or other entities.
4. Records may be disclosed to school health care programs that serve AI/AN for the purpose of student health maintenance.
5. Records may be disclosed to the Bureau of Indian Affairs (BIA) or its contractors under an agreement between IHS and the BIA relating to disabled AI/AN children for the purposes of carrying out its functions under the Individuals with Disabilities Education Act (IDEAS), 20 U.S.C. 1400, et seq.
6. Records may be disclosed to organizations deemed qualified by the Secretary of DHHS and under a business associate agreement to carry out quality assessment/improvement, medical audits, utilization review or to provide accreditation or certification of health care facilities or programs.
7. Records may be disclosed under a business associate agreement to individuals or authorized organizations
sponsored by IHS, such as the National Indian Women=s Resource Center, to conduct analytical and evaluation
studies.
8. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. An authorization, Form IHS 810, is required for the disclosure of sensitive protected health information (PHI) (e.g., alcohol/drug abuse patient information, human immunodeficiency virus (HIV)/AIDS, STD, or mental health) that is maintained in the medical record.
9. Records may be disclosed for research purposes to the extent permitted by:
(a) determining that the use(s) or disclosure(s) are met under 45 CFR ' 164.512(i), or
(b) determining that the use(s) or disclosure(s) are met under 45 CFR ' 164.514(a) through (c) for de-identified PHI, and 5 U.S.C. 552a (b)(5), or
(c) determining that the requirements of 45 CFR ' 164.514 (e) for limited data sets, and 5 U.S.C. 552a (b)(5) are met.
10. Information from records, such as information concerning the commission of crimes, suspected cases of abuse (including child, elder and sexual abuse), neglect, sexual assault or domestic violence, births, deaths, alcohol or drug abuse, immunizations, cancer, or the occurrence of communicable diseases, may be disclosed to public health authorities or other appropriate government authorities, as authorized by Federal, state, Tribal or local law or regulation of the jurisdiction in which the facility is located.
Note: In Federally conducted or assisted alcohol or drug abuse programs, under 42 CFR Part 2, disclosure of patient information for purposes of criminal investigations must be authorized by court order issued under 42 CFR Part 2.65, except that reports of suspected child abuse may be made to the appropriate state or local authorities under state law.
11. Information may be disclosed from these records regarding suspected cases of child abuse to:
(a) Federal, state or Tribal agencies that need to know the information in the performance of their duties, and
(b) members of community child protection teams for the purposes of investigating reports of suspected child abuse, establishing a diagnosis, formulating or monitoring a treatment plan, and making recommendations to the appropriate court. Community child protection teams are comprised of representatives of Tribes, the BIA, child protection service agencies, the judicial system, law enforcement agencies and IHS.
12. IHS may disclose information from these records in litigations and/or proceedings related to an administrative claim when:
(a) IHS has determined that the use of such records is relevant and necessary to the litigation and/or proceedings related to an administrative claim and would help in the effective representation of the affected party listed in subsections (i) through (iv) below, and that such disclosure is compatible with the purpose for which the records were collected. Such disclosure may be made to the DHHS/Office of General Counsel (OGC) and/or Department of Justice (DOJ), pursuant to an agreement between IHS and OGC, when any of the following is a party to litigation and/or proceedings related to an administrative claim or has an interest in the litigation and/or proceedings related to an administrative claim:
(i) DHHS or any component thereof; or
(ii) Any DHHS employee in his or her official capacity; or
(iii) Any DHHS employee in his or her individual capacity where the DOJ (or DHHS, where it is authorized to do so) has agreed to represent the employee; or
(iv) The United States or any agency thereof (other than DHHS) where DHHS/OGC has determined that the litigation and/or proceedings related to an administrative claim is likely to affect DHHS or any of its components.
(b) In the litigation and/or proceedings related to an administrative claim described in subsection (a) above, information from these records may be disclosed to a court or other tribunal, or to another party before such tribunal in response to an order of a court or administrative tribunal, provided that the covered entity discloses only the information expressly authorized by such order.
13. Records may be disclosed under a business associate agreement to an IHS contractor for the purpose of computerized data entry, medical transcription, duplication services, or maintenance of records contained in this system.
14. Records may be disclosed under a personal services contract or other agreement to student volunteers, individuals working for IHS, and other individuals performing functions for IHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
15. Records regarding specific medical services provided to a unemancipated minor individual may be disclosed to the unemancipated minor=s parent or legal guardian who previously consented to those specific medical services, to the extent permitted under 45 CFR ' 164.502(g).
16. Records may be disclosed to an individual having authority to act on behalf of an incompetent individual concerning health care decisions, to the extent permitted under 45 CFR ' 164.502(g).
17. Information may be used or disclosed from an IHS facility directory in response to an inquiry about a named individual from a member of the general public to establish the individual=s presence (and location when needed for visitation purposes) or to report the individual=s condition while hospitalized (e.g., satisfactory or stable), unless the individual objects to disclosure of this information. IHS may provide the religious affiliation only to members of the clergy.
18. Information may be disclosed to a relative, a close personal friend, or any other person identified by the individual that is directly relevant to that person=s involvement with the individual=s care or payment for health care.
Information may also be used or disclosed in order to notify a family member, personal representative, or other person responsible for the individual=s care, of the individual=s location, general condition or death.
If the individual is present for, or otherwise available prior to, a use or disclosure, and is competent to make health care decisions;
(a) may use or disclose after the facility obtains the
individual=s consent,
(b) provides the individual with the opportunity to
object and the individual does not object, or
(c) it could reasonably infer, based on professional
judgment, that the individual does not object.
If the individual is not present, or the opportunity to agree or object cannot practicably be provided due to incapacity or emergent circumstances, an IHS health care provider may determine, based on professional judgment, whether disclosure is in the individual=s best interest, and if so, may disclose only what is directly relevant to the individual=s health care.
19. Information concerning exposure to the HIV may be disclosed, to the extent authorized by Federal, state or Tribal law, to the sexual and/or needle-sharing partner(s) of a subject individual who is infected with HIV under the following circumstances:
(a) the information has been obtained in the course of clinical activities at IHS facilities;
(b) IHS has made reasonable efforts to counsel and encourage the subject individual to provide information to the individual=s sexual or needle-sharing partner(s);
(c) IHS determines that the subject individual is unlikely to provide the information to the sexual or needle-sharing partner(s) or that the provision of such information cannot reasonably be verified; and
(d) the notification of the partner(s) is made, whenever possible, by the subject individual=s physician or by a professional counselor and shall follow standard counseling practices.
(e) IHS has advised the partner(s) to whom information is disclosed that they shall not re-disclose or use such information for a purpose other than that for which the disclosure was made.
20. Records may be disclosed to Federal and non-Federal protection and advocacy organizations that serve AI/AN for the purpose of investigating incidents of abuse and neglect of individuals with developmental disabilities (including mental disabilities), as defined in 42 U.S.C. '' 10801-10805(a)(4) and 42 CFR '' 51.41-46, to the extent that such disclosure is authorized by law and the conditions of 45 CFR ' 1386.22(a)(2) are met.
21. Records of an individual may be disclosed to a correctional institution or a law enforcement official, during the period of time the individual is either an inmate or is otherwise in lawful custody, for the provision of health care to the individual or for health and safety purposes. Disclosure may be made upon the representation of either the institution or a law enforcement official that disclosure is necessary for the provision of health care to the individual, for the health and safety of the individual and others (e.g., other inmates, employees of the correctional facility, transport officers), and for facility administration and operations. This routine use applies only for as long as the individual remains in lawful custody, and does not apply once the individual is released on parole or placed on either probation or on supervised release, or is otherwise no longer in lawful custody.
22. Records including patient name, date of birth, SSN, gender and other identifying information may be disclosed to the SSA as is reasonably necessary for the purpose of conducting an electronic validation of the SSN(s) maintained in the record to the extent required under an agreement between IHS and SSA.
23. Disclosure of relevant health care information may be made to funeral directors or representatives of funeral homes in order to allow them to make necessary arrangements prior to and in anticipation of an individual=s impending death.
24. Records may be disclosed to a public or private covered entity that is authorized by law or charter to assist in disaster relief efforts (e.g., the Red Cross and the Federal Emergency Management Administration), for purposes of coordinating information with other similar entities concerning an individual=s health care, payment for health care, notification of the individual=s whereabouts and his or her health status or death.
1. Records may be disclosed to Federal and non-Federal (public or private) health care providers that provide health care services to IHS individuals for purposes of planning for or providing such services, or reporting results of medical examination and treatment.
2. Records may be disclosed to Federal, state, local or other authorized organizations that provide third-party reimbursement or fiscal intermediary functions for the purposes of billing or collecting third-party reimbursements. Relevant records may be disclosed to debt collection agencies under a business associate agreement arrangement directly or through a third party.
3. Records may be disclosed to state agencies or other entities acting pursuant to a contract with CMS, for fraud and abuse control efforts, to the extent required by law or under an agreement between IHS and respective state Medicaid agency or other entities.
4. Records may be disclosed to school health care programs that serve AI/AN for the purpose of student health maintenance.
5. Records may be disclosed to the Bureau of Indian Affairs (BIA) or its contractors under an agreement between IHS and the BIA relating to disabled AI/AN children for the purposes of carrying out its functions under the Individuals with Disabilities Education Act (IDEAS), 20 U.S.C. 1400, et seq.
6. Records may be disclosed to organizations deemed qualified by the Secretary of DHHS and under a business associate agreement to carry out quality assessment/improvement, medical audits, utilization review or to provide accreditation or certification of health care facilities or programs.
7. Records may be disclosed under a business associate agreement to individuals or authorized organizations
sponsored by IHS, such as the National Indian Women=s Resource Center, to conduct analytical and evaluation
studies.
8. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. An authorization, Form IHS 810, is required for the disclosure of sensitive protected health information (PHI) (e.g., alcohol/drug abuse patient information, human immunodeficiency virus (HIV)/AIDS, STD, or mental health) that is maintained in the medical record.
9. Records may be disclosed for research purposes to the extent permitted by:
(a) determining that the use(s) or disclosure(s) are met under 45 CFR ' 164.512(i), or
(b) determining that the use(s) or disclosure(s) are met under 45 CFR ' 164.514(a) through (c) for de-identified PHI, and 5 U.S.C. 552a (b)(5), or
(c) determining that the requirements of 45 CFR ' 164.514 (e) for limited data sets, and 5 U.S.C. 552a (b)(5) are met.
10. Information from records, such as information concerning the commission of crimes, suspected cases of abuse (including child, elder and sexual abuse), neglect, sexual assault or domestic violence, births, deaths, alcohol or drug abuse, immunizations, cancer, or the occurrence of communicable diseases, may be disclosed to public health authorities or other appropriate government authorities, as authorized by Federal, state, Tribal or local law or regulation of the jurisdiction in which the facility is located.
Note: In Federally conducted or assisted alcohol or drug abuse programs, under 42 CFR Part 2, disclosure of patient information for purposes of criminal investigations must be authorized by court order issued under 42 CFR Part 2.65, except that reports of suspected child abuse may be made to the appropriate state or local authorities under state law.
11. Information may be disclosed from these records regarding suspected cases of child abuse to:
(a) Federal, state or Tribal agencies that need to know the information in the performance of their duties, and
(b) members of community child protection teams for the purposes of investigating reports of suspected child abuse, establishing a diagnosis, formulating or monitoring a treatment plan, and making recommendations to the appropriate court. Community child protection teams are comprised of representatives of Tribes, the BIA, child protection service agencies, the judicial system, law enforcement agencies and IHS.
12. IHS may disclose information from these records in litigations and/or proceedings related to an administrative claim when:
(a) IHS has determined that the use of such records is relevant and necessary to the litigation and/or proceedings related to an administrative claim and would help in the effective representation of the affected party listed in subsections (i) through (iv) below, and that such disclosure is compatible with the purpose for which the records were collected. Such disclosure may be made to the DHHS/Office of General Counsel (OGC) and/or Department of Justice (DOJ), pursuant to an agreement between IHS and OGC, when any of the following is a party to litigation and/or proceedings related to an administrative claim or has an interest in the litigation and/or proceedings related to an administrative claim:
(i) DHHS or any component thereof; or
(ii) Any DHHS employee in his or her official capacity; or
(iii) Any DHHS employee in his or her individual capacity where the DOJ (or DHHS, where it is authorized to do so) has agreed to represent the employee; or
(iv) The United States or any agency thereof (other than DHHS) where DHHS/OGC has determined that the litigation and/or proceedings related to an administrative claim is likely to affect DHHS or any of its components.
(b) In the litigation and/or proceedings related to an administrative claim described in subsection (a) above, information from these records may be disclosed to a court or other tribunal, or to another party before such tribunal in response to an order of a court or administrative tribunal, provided that the covered entity discloses only the information expressly authorized by such order.
13. Records may be disclosed under a business associate agreement to an IHS contractor for the purpose of computerized data entry, medical transcription, duplication services, or maintenance of records contained in this system.
14. Records may be disclosed under a personal services contract or other agreement to student volunteers, individuals working for IHS, and other individuals performing functions for IHS who do not technically have the status of agency employees, if they need the records in the performance of their agency functions.
15. Records regarding specific medical services provided to a unemancipated minor individual may be disclosed to the unemancipated minor=s parent or legal guardian who previously consented to those specific medical services, to the extent permitted under 45 CFR ' 164.502(g).
16. Records may be disclosed to an individual having authority to act on behalf of an incompetent individual concerning health care decisions, to the extent permitted under 45 CFR ' 164.502(g).
17. Information may be used or disclosed from an IHS facility directory in response to an inquiry about a named individual from a member of the general public to establish the individual=s presence (and location when needed for visitation purposes) or to report the individual=s condition while hospitalized (e.g., satisfactory or stable), unless the individual objects to disclosure of this information. IHS may provide the religious affiliation only to members of the clergy.
18. Information may be disclosed to a relative, a close personal friend, or any other person identified by the individual that is directly relevant to that person=s involvement with the individual=s care or payment for health care.
Information may also be used or disclosed in order to notify a family member, personal representative, or other person responsible for the individual=s care, of the individual=s location, general condition or death.
If the individual is present for, or otherwise available prior to, a use or disclosure, and is competent to make health care decisions;
(a) may use or disclose after the facility obtains the
individual=s consent,
(b) provides the individual with the opportunity to
object and the individual does not object, or
(c) it could reasonably infer, based on professional
judgment, that the individual does not object.
If the individual is not present, or the opportunity to agree or object cannot practicably be provided due to incapacity or emergent circumstances, an IHS health care provider may determine, based on professional judgment, whether disclosure is in the individual=s best interest, and if so, may disclose only what is directly relevant to the individual=s health care.
19. Information concerning exposure to the HIV may be disclosed, to the extent authorized by Federal, state or Tribal law, to the sexual and/or needle-sharing partner(s) of a subject individual who is infected with HIV under the following circumstances:
(a) the information has been obtained in the course of clinical activities at IHS facilities;
(b) IHS has made reasonable efforts to counsel and encourage the subject individual to provide information to the individual=s sexual or needle-sharing partner(s);
(c) IHS determines that the subject individual is unlikely to provide the information to the sexual or needle-sharing partner(s) or that the provision of such information cannot reasonably be verified; and
(d) the notification of the partner(s) is made, whenever possible, by the subject individual=s physician or by a professional counselor and shall follow standard counseling practices.
(e) IHS has advised the partner(s) to whom information is disclosed that they shall not re-disclose or use such information for a purpose other than that for which the disclosure was made.
20. Records may be disclosed to Federal and non-Federal protection and advocacy organizations that serve AI/AN for the purpose of investigating incidents of abuse and neglect of individuals with developmental disabilities (including mental disabilities), as defined in 42 U.S.C. '' 10801-10805(a)(4) and 42 CFR '' 51.41-46, to the extent that such disclosure is authorized by law and the conditions of 45 CFR ' 1386.22(a)(2) are met.
21. Records of an individual may be disclosed to a correctional institution or a law enforcement official, during the period of time the individual is either an inmate or is otherwise in lawful custody, for the provision of health care to the individual or for health and safety purposes. Disclosure may be made upon the representation of either the institution or a law enforcement official that disclosure is necessary for the provision of health care to the individual, for the health and safety of the individual and others (e.g., other inmates, employees of the correctional facility, transport officers), and for facility administration and operations. This routine use applies only for as long as the individual remains in lawful custody, and does not apply once the individual is released on parole or placed on either probation or on supervised release, or is otherwise no longer in lawful custody.
22. Records including patient name, date of birth, SSN, gender and other identifying information may be disclosed to the SSA as is reasonably necessary for the purpose of conducting an electronic validation of the SSN(s) maintained in the record to the extent required under an agreement between IHS and SSA.
23. Disclosure of relevant health care information may be made to funeral directors or representatives of funeral homes in order to allow them to make necessary arrangements prior to and in anticipation of an individual=s impending death.
Rederal/non-federal health care providers; Fed/State/local or other authorized org. that provide 3rd party reimbursements, etc.; State agencies/etc., pursuant to contract w/CMS, for fraud/abuse control efforts in accord with regs; school health programs that serve AI/AN; BIA of its contractors re: disabled children under IDEAS; organizations deemed qualified by Secretary of HHS; under Bus. Assoc. Agreements for analytical/eval studies; Congressional offices; for research purposes per regs; criminal and social situations per regulations; Child abuse cases; litigations/proceedings in accordance with regs; BAA to IHS contractors for data entry, med. transcriptions, etc.; under personal services contract with IHS; regarding medical services provided to unemancipated minor individuals to the parents or legal guardian of individ; IHS facility directory if approved by individual; to relatives, etc., if individual permits; HIV information in accordance with regs; Federal and non-federal protection and advocacy orgs. for abuse/neglect in accordance with regs; to correctional or law enforcement in accordance with regs; Social Security Admin. under agreement between SSA/IHS; to funeral directors/reps in accord. with regs.; to public or private covered entity authorized by charter/law to assist in disaster relief efforts (such as Red Cross) pertaining to health issues, payment of services, notification of whereabouts and health/death status.
30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) In this description, indicate whether the information contains IIF; and (4) whether submission of personal information is voluntary or mandatory: 1) Health and medical records containing examination, diagnostic and treatment data, proof of HIS eligibility, social data (such as name, address, date of birth, Social Security Number (SSN), tribe), laboratory test results, and dental, social service, domestic violence, sexual abuse and/or assault, mental health, and nursing information.
2) Follow-up registers of individuals with a specific health condition or a particular health status such as cancer, diabetes, communicable diseases, suspected and confirmed abuse and neglect, immunizations, suicidal behavior, or disabilities.
3) Logs of individuals provided health care by staff of specific hospital or clinic departments such as surgery, emergency, obstetric delivery, medical imaging, and laboratory.
4) Surgery and/or disease indices for individual facilities that list each relevant individual by the surgery or disease.
5) Monitoring strips and tapes such as fetal monitoring strips and EEG and EKG tapes.
6) Third-party reimbursement and billing records containing name, address, date of birth, dates of service, third party insurer claim numbers, SSN, health plan name, insurance number, employment status, and other relevant claim information necessary to process and validate third-party reimbursement claims.
7. Contract Health Service (CHS) records containing name, address, date of birth, dates of care, Medicare or Medicaid claim numbers, SSN, health plan name, insurance number, employment status, and other relevant claim information necessary to determine CHS eligibility and to process CHS claims.
8. Yes, contains IIF.
9. Mandatory submission of personal information.
31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose IIF is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); and (2) notify and obtain consent from individuals regarding what IIF is being collected from them and how the information will be used or shared: A. New patients must be registered in the IHS facility data base prior to being provided health care services; however, emergency services should not be delayed. Information on patients who present a critical emergency that requires immediate medical attention must be obtained from the patient's relative or other accompanying individual. Each patient's IHS registration information is updated on each subsequent visit to the facility by personal interview conducted by a designated IHS facility staff member. The patient registration process at each IHS facility is accomplished by using the IHS Patient Registration System (PRS) software and the technical guidelines in Chapter 2, "Patient Registration" of the IHS Business Office Manual. B. The service unit has the responsibility to encourage all patients who are registered to present any documentation they might have relative to their eligibility-for IHS health care services and alternate resources. These documents will greatly assist in maintaining accurate patient information in the PRS data base. C. Patients are requested to bring their Social Security card, private insurance identification, and other information (such as proof of tribal affiliation and blood quantum) to initial or subsequent patient registration interviews. Registration staff explains to the patients that such information will expedite the patient registration and eligibility determination process. Patients' mailing addresses and personal information files are kept updated so that all health care benefits can be identified and expedited, and be utilized by the health care provider. D. All IHS staff are sensitive to IHS patients cultural values and concerns for privacy. Patient registration is a vital part of each IHS facility's public relations program and patient registration staff receive continuous management support for maintaining skills in communicating with the patients and assuring the patients' comfort during the interview process. E. Confidentiality of patient information collected is maintained at all times in accordance with the Privacy Act of 1974. The registration staff periodically reviews the Privacy Act. The registration staff informs the patient of the requirements of the Privacy Act, and the date is entered into the PRS. F. The patient must authorize release of Medicare/Railroad Insurance information, and the date the authorization was obtained is entered into the PRS by registration staff.
32. Does the system host a website?: Yes
37. Does the website have any information or pages directed at children under the age of thirteen?: No
50. Are there policies or guidelines in place with regard to the retention and destruction of IIF?: Yes
54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:
Storage: File folders, ledgers, card files, microfiche, microfilm, computer tapes, disk packs, digital photo discs, and automated, computer-based or electronic files.
Retrievability: Indexed by name, record number, and SSN and cross-indexed.
Safeguards: Safeguards apply to records stored on-site and off-site.
1. Authorized Users: Access is limited to authorized IHS personnel, volunteers, IHS contractors, subcontractors, and other business associates in the performance of their duties. Examples of authorized personnel include: Medical records personnel, business office personnel, contract health staff, health care providers, authorized researchers, medical audit personnel, health care team members, and legal and administrative personnel on a need to know basis.
2. Physical Safeguards: Records are kept in locked metal filing cabinets or in a secured room or in other monitored areas accessible to authorized users at all times when not actually in use during working hours and at all times during non-working hours. Magnetic tapes, disks, other computer equipment (e.g., pc workstations) and other forms of personal data are stored in areas where fire and life safety codes are strictly enforced. Telecommunication equipment (e.g., computer terminal, servers, modems and disks) of the Resource and Patient Management System (RPMS) are maintained in locked rooms during non-working hours. Network (Internet or Intranet) access of authorized individual(s) to various automated and/or electronic programs or computers (e.g., desktop, laptop, handheld or other computer types) containing protected personal identifiers or personal health information (PHI) is reviewed periodically and controlled for authorizations, accessibility levels, expirations or denials, including passwords, encryptions or other devices to gain access. Combinations and/or electronic passcards on door locks are changed periodically and whenever an IHS employee resigns, retires or is reassigned.
3. Procedural Safeguards: Within each facility a list of personnel or categories of personnel having a demonstrable need for the records in the performance of their duties has been developed and is maintained. Procedures have been developed and implemented to review one-time requests for disclosure to personnel who may not be on the authorized user list. Proper charge-out procedures are followed for the removal of all records from the area in which they are maintained. Records may not be removed from the facility except in certain circumstances, such as compliance with a valid court order or shipment to the Federal Records Center(s). Persons who have a need to know are entrusted with records from this system of records and are instructed to safeguard the confidentiality of these records. These individuals are to make no further disclosure of the records except as authorized by the system manager and permitted by the Privacy Act and the HIPAA Privacy Rule as adopted, and to destroy all copies or to return such records when the need to know has expired. Procedural instructions include the statutory penalties for noncompliance.
The following automated information systems (AIS) security procedural safeguards are in place for automated health and medical records maintained in the RPMS. A profile of automated systems security is maintained. Security clearance procedures for screening individuals, both Government and contractor personnel, prior to their participation in the design, operation, use or maintenance of IHS AIS are implemented. The use of current passwords and log-on codes are required to protect sensitive automated data from unauthorized access. Such passwords and codes are changed periodically. An automated or electronic audit trail is maintained and reviewed periodically. Only authorized IHS Division of Information Resources staff may modify automated files in batch mode. Personnel at remote terminal sites may only retrieve automated or electronic data. Such retrievals are password protected. Privacy Act requirements, HIPAA Privacy Rule and Security requirements and specified AIS security provisions are specifically included in contracts and agreements and the system manager or his/her designee oversee compliance with these contract requirements.
4. Implementing Guidelines: DHHS Chapter 45-10 and supplementary Chapter PHS.hf: 45-10 of the General Administration Manual; DHHS, AAutomated Information Systems Security Program Handbook,@ as amended; DHHS IRM Policy HHS-IRM-2000-0005, AIRM Policy for IT Security for Remote Access@; OMB Circular A-130 AManagement of Federal Information Resources@; HIPAA Security Standards for the Protection of Electronic Protected Health Information, 45 CFR '' 164.302 through 164.318; and E-Government Act of 2002 (Public Law 107-347, 44 U.S.C. Ch 36).
Retention and disposal: Patient listings which may identify individuals are maintained in IHS Area and Program Offices permanently. Inactive records are held at the facility that provided health and billing services from three to seven years and then are transferred to the appropriate Federal Records Center. Monitoring strips and tapes (e.g., fetal monitoring strips, EEG and EKG tapes) that are not stored in the individual's official medical record are stored at the health facility for one year and are then transferred to the appropriate Federal Records Center. (See Appendix 2 for Federal Records Center addresses). In accordance with the records disposition authority approved by the Archivist of the United States, paper records are maintained for 75 years after the last episode of individual care except for billing records. The retention and disposal methods for billing records will be in accordance with the approved IHS Records Schedule. The disposal methods of paper medical and health records will be in accordance with the approved IHS Records Schedule. The electronic data consisting of the individual personal identifiers and PHI maintained in the RPMS or any subsequent revised IHS database system should be inactivated once the paper record is forwarded to the appropriate Federal Records Center.
System manager(s) and address: Policy Coordinating Official: Director, Office of Clinical and Preventive Services, Indian Health Service, Reyes Building, 801 Thompson Avenue, Suite 300, Rockville, Maryland, 20852-1627. See Appendix 1. The IHS Area Office Directors, Service Unit Directors/Chief Executive Officers and Facility Directors listed in Appendix 1 are System Managers.
PIA Reviewer Approval: Promote
Comments:
PIA Reviewer Name: Kathleen Federico
Sr. Official for Privacy Approval: Promote
Comments:
Sr. Official for Privacy Name: Richard G. Price
Sign-off Date: Jul 31, 2006
Date Published: Jun 26, 2008
|
Print
Download Reader
HHS Home|HHS News|About HHS
