OMB_No _0917-0030_Supporting_Statement_Final 9.20.23

Supporting Statement for Indian Health Service

Forms to Implement the Privacy Rule (OMB No. 0917-0030)

(45 C.F.R Parts 160 & 164)

Background

This is a request for an extension of the previously approved information collection, Indian Health Service (IHS) Forms to Implement the Privacy Rule (OMB No. 0917-0030) (45 C.F.R. Parts 160 & 164).

1. Justification

1. Circumstances Making the Collection of Information Necessary:

This is a request for an extension of a previously approved collection with updates to the collection. This collection of information is made necessary by the Department of Health and Human Services’ rule entitled “Standards for Privacy of Individually Identifiable Health Information” (Privacy Rule) (45 C.F.R. Parts 160 and 164). The Privacy Rule implements the privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act (HIPAA) of 1996, creates national standards that protect patient health information, and allows our patients access to their health information. Title Privacy Rule, 45 C.F.R. §§ 164.508, 164.520, 164.522, 164.526 and 164.528, requires the collection of information to implement these protection standards and access requirements.

Under the Privacy Rule, IHS is considered a covered entity and is subject to the Rule. Therefore, IHS has developed and implemented methods to meet the information collection requirements.

2. Purpose and Use of the Information Collection:

The following (A. 2) provides a description of the data collection forms IHS currently uses to implement the Rule.

1. 45 C.F.R. § 164.508 - Authorization for Use or Disclosure of Protected Health Information (IHS‑810)

45 C.F.R. § 164.508 requires covered entities to obtain or receive a valid authorization for its use or disclosure of protected health information for purposes that are not otherwise authorized or required by HIPAA (e.g., treatment, payment and healthcare operations). Under this provision, individuals may initiate a written authorization permitting covered entities to release their protected health information to entities of their choosing. The form IHS-810 “Authorization for Use or Disclosure of Protected Health Information” is used by patients at IHS facilities to document and authorize the use, disclosure or release of their protected health information from their medical record to anyone they specify.

(b) 45 C.F.R. § 164.522(a)(1) ‑ Request For Restriction(s) (IHS-912‑1)

Under the Privacy Rule, an individual can request to restrict the use of their information with some exceptions. Section 164.522(a)(1) requires a covered entity to permit individuals to request that the covered entity restrict certain uses and disclosures of their protected health information. The covered entity may or may not agree to the restriction, and it is only required to agree in certain limited situations. The form IHS-912-1 “Request for Restrictions(s)” is used to document an individual’s request for restriction of their protected health information and whether IHS agreed or disagreed with the requested restriction.

(c) 45 C.F.R. §164.522(a)(2) - Request For Revocation of Restriction(s)

(IHS- 912‑2)

Section 164.522(a)(2) permits a covered entity to terminate its agreement to a restriction when the individual agrees to or requests the termination in writing. The form IHS-912-2 “Request for Revocation of Restriction(s)” is used to document the agency or individual request to terminate a formerly agreed to restriction regarding the use and disclosure of protected health information. A previous request to restrict information may be revoked by the individual or IHS, subject to the limitations set forth in 164.522(a)(2).

(d) 45 C.F.R. § 164.528 and HHS Privacy Act regulations, 45 C.F.R. § 5b.9(c) - Request for an Accounting of Disclosures (IHS-913)

These provisions require the IHS, as a covered entity and an agency within HHS, to permit individuals to request that the IHS provide an accounting of disclosures of the individual’s protected health information and/or record made by the covered entity. The form IHS-913 “Request for an Accounting of Disclosures” is used for the collection of information for the purpose of processing, an accounting of disclosures requested by the patient and/or personal representative, and to document that request.

(e) 45 C.F.R. § 164.526 - Request for Correction/Amendment of

Protected Health Information (IHS-917)

This provision requires covered entities to permit an individual to request that the covered entity amend protected health information. If the covered entity accepts the requested amendment, in whole or in part, the covered entity must inform the individual that the request for an amendment is accepted. If the covered entity denies the requested amendment, in whole or in part, the covered entity must provide the individual with a written denial. The IHS developed the form (IHS 917) to permit individuals to submit their request and to document IHS’s acceptance or denial of a patient’s request to correct or amend their protected health information.

(f) 45 C.F.R. § 164.520 – Acknowledgement of Receipt of the IHS Notice of Privacy Practices (IHS-982)

This provision requires covered entities to provide a Notice of Privacy Practices to patients and to document compliance with the notice requirements by retaining copies of written acknowledgments of the receipt of the notice or documentation of good faith efforts to obtain written acknowledgment. The IHS developed the form (IHS-982) to obtain the written acknowledgment of the receipt of the IHS Notice of Privacy Practices.

(g) 45 C.F.R. § 164.522 – Request for Confidential Communication by Alternative Means or Alternate Location (IHS-963)

This provision requires covered entities to permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alterative locations. The IHS developed the form (IHS-963) to permit individuals to request communications by alternative means or locations.

3. Use of Improved Technology and Burden Reduction:

IHS has made these forms available for staff, patients, and others via the internet in PDF format, and they are fillable, as well. These forms are available online at the following Website addresses: https://www.ihs.gov/forpatients/patientforms and http://www.hhs.gov/forms/publicuse.html. Currently, IHS is only authorized to use facsimile and the secured mail to receive/submit completed forms which contain PHI. In the future, the forms may be made available for online completion and submission, as IHS’ increases its ability to adequately safeguard electronic PHI and offer patient electronic signatures, (i.e., encryption, secure website, etc.).

4. Efforts to Identify Duplication and Use of Similar Information:

Similar health data collection information may be collected by the public and/or private sector entities in response to implementation of the Privacy Rule. However, the data collection instruments being submitted for approval are for IHS health programs.

5. Impact on Small Businesses or Other Small Entities:

This collection of information will not impact small business or other small entities. The information being requested or required has been held to the absolute minimum required for the intended use.

6. Consequences of Collecting the Information Less Frequently:

If the collection is not conducted or is conducted less frequently, IHS would be unable to properly implement the data collection requirements contained in the Privacy Rule. This on‑going collection of information is only collected when respondents choose to complete and submit data collection instruments. There are no technical or legal obstacles to reducing the burden.

7. Special Circumstances Relating to the Guidelines within 5 C.F.R. § 1320.5:

There may be special circumstances, such as HHS Office for Civil Rights requesting documentation during a HIPAA Privacy investigation, that require exceptions to 5 C.F.R. § 1320.5(d)(2).

8. Comment in Response to the Federal Register Notice/Outside Consultation:

In accordance with 5 C.F.R. 1320.8(d), a 60-day notice to solicit public comment was published in the Federal Register (88 FR 42726) on July 3, 2023. No comments were received. A 30-day notice for public comment published on September 20, 2023 (88 FR 64915) allowing for public comment to be submitted directly to OMB, as required by 5 C.F.R. § 1320.10(a).

9. Explanation of any Payment/Gifts to Respondents:

The respondents do not receive any payment or gifts for providing the information.

10. Assurance of Confidentiality Provided to Respondents:

The information collected is subject to the Privacy Act of 1974 and the HIPAA regulations and will be collected and maintained in accordance with IHS Privacy Act System of Records Notice 09‑17‑0001, IHS “Medical, Health and Billing Records”. The information collected will be kept private to the extent allowed by law.

11. Justification for Sensitive Questions:

There are no questions of a sensitive nature solicited in this information collection.

12. Estimates of Annualized Burden Hours (Total Hours & Wages):



1. The table below provides estimated annual burden hour for this collection.

Table - Estimated Annual Burden Hours
Data Collection Instruments	Estimated Number of Respondents	Responses per Respondent	Average Burden Hour per Response*	Total Annual Burden Hours
 “Authorization for Use or Disclosure of Protected Health Information” (OMB No. 0917-0030, IHS-810)	210,954	1	10/60	35,159
 “Request for Restriction(s)” (OMB No. 0917-0030, IHS-912-1)	214	1	10/60	36
“Request for Revocation of Restriction(s)” (OMB No. 0917-0030, IHS-912-2)	3	1	10/60	1
“Request for Accounting of Disclosures”(OMB No. 0917-0030, IHS-913)	39	1	10/60	7
“Request for Correction/Amendment of Protected Health Information” (OMB No. 0917-0030, IHS-917)	54	1	10/60	9
Acknowledgement of Receipt of the Notice of Privacy Practices Protected Health Information (IHS-982)	39	1	10/60	7
“Request for Confidential Communication by Alternative Means or Alternate Location” (IHS-963)	214	1	10/60	36
 Total Annual Burden	211,517			35,255

*For ease of understanding, burden hours are provided in actual minutes.

The total estimated burden for this collection of information is 35,255 hours.

2. Estimate of annualized costs to respondents for the hour burdens for collections of information is estimated to be zero.



This information collection places no additional computer or record keeping requirements upon the respondents. Therefore, the estimated total annual cost burden to respondents or record keepers for capital and start-up costs components (annualized over the expected useful life) for this information is zero.

The information collection will not require the purchase of any capital equipment nor create any startup costs. This process allows respondents to choose the type of collection, voluntarily.

13. Estimates of other Total Annual Cost Burden to Respondents or Record-keepers/Capital Costs:

There are no direct costs to respondents other than the time it takes to voluntarily provide the information for consideration.

There are no capital or start‑up costs to respondents for this information collection. Nor are there costs for the operation and maintenance, and purchase of services components for this information collection.

14. Annualized Cost to Federal Government:

The annual cost to the Federal Government for this information collection is the cost of maintaining capital associated with this information collection which is based on (1) the annual equipment, overhead, and printing expenses; and (2) the staff time to perform the services required for the Information Collection (i.e., the actual data collection, processing of forms, and any other administrative process). The estimated annual cost to the government for the information collection is $1,260,000.

ITEM COST____

Healthcare Professional/Staff

200 staff x $30/hr. x 2 hrs.

x 5 days x 12 months) $ 720,000

Other expenses: equipment, overhead,

and printing $ 300,000

Estimated total annual capital cost $1,020,000

15. Explanation for Program Changes or Adjustments:

There was a change in IHS-810 Form to include an option for the respondents to release substance use disorder information. This change is due to regulatory changes and to update notices.

The program also made a change in the burden estimate; increasing hours to accommodate two forms. The IHS developed the form (IHS-982) to obtain the written acknowledgment of the receipt of the IHS Notice of Privacy Practices. The form IHS-963 (Request for Confidential Communication by Alternative Means or Alternate Location) is to request an alternative means of communication of patient health information (e.g., regular mail, telephone, facsimile) or communication of patient health information to an alternate location.

16. Plans for Tabulation and Publication and Project Time Schedule:

There is no intention to publish this information collection.

17. Reason(s) Display of OMB Expiration Data is Inappropriate:

The OMB expiration date will be displayed on the data collection instruments.

18. Exceptions to Certification for Paperwork Reduction Act Submission:

There are no exceptions to the certification.

B. COLLECTION OF INFORMATION EMPLOYING STATISTICAL METHODS

Statistical methods are not used in this collection.