HIPAA and Patient Privacy: Tribal Policies as Added Means for Addressing Indian Health Disparities

Introduction

[T]he HIPAA privacy rule will improve the quality of care and access to care by fostering patient trust and confidence in the health care system. People will be encouraged to more fully participate in their own care, and . . . [o]nce fully. . . implemented, we believe the HIPAA privacy regulation will improve the quality of health care and broaden access to health care services.

The Department of Health and Human Services (DHHS) published final privacy standards for the protection of individually-identifiable health information on August 14, 2002. The privacy standards are part of the regulations promulgated under the administrative simplification provisions of the Health Insurance Portability and Accountability Act (HIPAA) of 1996. The HIPAA regulations set forth standards and administrative requirements that must be in place to protect the confidentiality of medical records and to limit disclosures of such protected information. These HIPAA privacy protections raise some interesting questions for Indian health care programs regarding privacy and tribal governmental provision of health care, disclosures related to cultural differences or varied governmental structures, and the health and safety of Indian people.

This article explores the emerging importance of health care privacy in tribal health care facilities. Part I presents a brief background of Indian health care and the need to address health disparities. Part II provides an overview of the Indian Self-Determination and Education Assistance Act (ISDEAA) and tribal agreements with the Indian Health Service (IHS) for operating programs, functions, services and activities of the IHS and providing health care to tribal people. Part III discusses the applicability or inapplicability of HIPAA to Indian tribes and tribal organizations that provide health care to Indians under the ISDEAA and also provides a basic background on the HIPAA privacy regulations. Part IV examines tribal authority to develop and implement privacy requirements suited to the particular needs of Indian communities. Finally, Part V concludes that tribes can use their governmental authority to develop their own privacy policies and laws for increased flexibility to best meet the health needs of their respective tribal communities, and thereby provide another critical layer of self-governance in tribal health care as tribes continue to strive to erase health disparities between the tribes and the general population.