Part 8, Chapter 23: Manual Exhibit 8-23-B

ALL Users of the Indian Health Service (IHS) Personal Health Record (PHR) must agree to the following terms and conditions for participation:

1. Summary.  The IHS created an online website called the PHR.  The PHR website is where you can view your health information.  You can use it to send secure email messages to your health care team.
   1. To access the PHR, you will need to create a username and password.  You will enter your username and password every time you want to look at your PHR.  You will have five chances to enter the correct username and password or you will be locked out.  When you are done using the PHR you must log out.  This prevents someone from getting into your account.  You will be logged out of the PHR after 10 minutes of no activity.
   2. The information in the PHR is to help you make better healthcare decisions.  It is NOT intended to replace the advice of your doctor. Contact your medical facility if you see errors in your PHR.
   3. The PHR account may be made on a patient's behalf (such as by a parent or guardian).  You must read and click "accept" for the patient.
   4. The IHS makes every effort to protect your privacy.  Anyone who misuses your information may face criminal and civil penalties.  he IHS does not sell or trade your personal information.  The IHS may contact you regarding surveys, questionnaires, and polls, however you can choose not to participate and still use the PHR.  You can also to close your PHR account at any time.
2. Indian Health Service Privacy Policy.  The PHR application is a computer system of the IHS.  The computer system, including all related equipment, networks, and network devices (specifically including Internet access) are provided only for authorized uses.  The IHS computer systems may be monitored for all lawful purposes, such as ensuring that their use is authorized; managing the system; protecting against unauthorized access; and verifying security procedures; survivability; and operational security.  During monitoring, information may be examined, recorded, copied, and used for authorized purposes.
3. Privacy Act Warning.
   1. You do not have to provide the personal information requested for IHS PHR registration, but if you do not, IHS will be unable to establish a PHR account for you.  Your decision not to provide this information will not have any effect on any other benefits to which you may be entitled.
   2. The IHS makes every effort to protect your privacy.  Certain demographic information, such as your name, PHR username, date of birth, health record number or "Chart Number," gender, and zip code are collected to provide you access to the IHS PHR and is subject to the Privacy Act of 1974, as amended [5 United States Code (U.S.C.) § 552a].  Only authorized persons may use your information contained in the IHS PHR.  Any unauthorized disclosure or misuse of your information may result in criminal and/or civil penalties.  Any individual may file a civil action in a Federal District Court against IHS if the individual believes that IHS violated the Privacy Act.
   3. For site management, information is collected for statistical and management purposes.  The IHS PHR uses software programs to create anonymous, summary statistics, which are used for such purposes as assessing what IHS PHR information and services are useful to you and other users, determining technical design specifications, and identifying system performance or problem areas.  For security purposes and to ensure that this service remains available to all users, IHS PHR employs software programs to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage.  Except for authorized law enforcement requests or investigations, no attempts are made to identify individual users, to link an individual user to data entered in IHS PHR, or to track an individual user's usage habits.  Unauthorized attempts to upload information or change information on this service are strictly prohibited and may be punishable under Federal law.
4. The Use of Cookies.  The IHS PHR application does not use "persistent cookies" to retain information about users of the IHS PHR.  The IHS prohibits the use of "persistent cookies," a type of web technology that collects user-identifying information over time and across different websites.
5. Personal Health Records My Messaging.  You may send and receive secure messages within your PHR.  This account can only be used to communicate with your Indian Health System health care team through the My Messaging Menu.  You can download a log that has your message activity with your health care team through My Messaging.
6. Personal E-mail Address.  The IHS reserves the right to contact you via the e-mail address you provide regarding important system or account information, major changes planned for the IHS PHR or for other system-related needs.  The IHS will only use your e-mail address to forward you materials on the information in which you have indicated interest.  Your e-mail address may also be used to send you reminders for forgotten usernames.  If you no longer wish to receive these emails you always have the ability at any time to opt out of the IHS PHR.
7. Security of Information.  At all times, security maintenance and administration is an essential element of website operation and maintenance.  The IHS PHR has several levels of security to protect your information.  When you type in your personal information, IHS PHR establishes a secure connection with your browser so your information is encrypted or scrambled for transmission and storage.  In addition, these security levels comply with the Privacy Act of 1974 as amended (5 U.S.C. § 552a); the Health Insurance Portability and Accountability Act of 1996 Public Law (Pub. L.) 104-191, Aug 21, 1996,110 Stat.1936, 45 Code of Federal Regulations (CFR), Parts 160 and 164; and the Health Information Technology for Economic and Clinical Health Act (Pub. L. 111-5, Feb 17, 2009).
8. Secure Socket Layer/Transport Layer Security.  The Secure Socket Layer/Transport Layer Security (SSL/TLS) is a security protocol which provides a transmission level of encryption between the user's browser and the IHS PHR server machines.  The SSL/TLS is a method for protecting an IHS PHR user's identification and password.
9. Personal Responsibility for Personal Information.  You have access to the information contained in your IHS PHR account and as such, have the ability to disclose information in this account to other individuals.
10. Registration and Log In.  To provide certain services such as enabling you to enter personal information, The IHS will require your username and password for identification.  To view any medical information you have in the IHS system, the IHS will require verification of your identity.
11. Password Protection.  Your PHR account is password protected.  You will have five chances to enter the correct password before you are locked out of the system.  We strongly recommend that you do not share your password with anyone and that you change your password on a regular basis.  Exercise caution by securing your password.  The IHS will never ask for your password in an unsolicited phone call, unsolicited e-mail, or by any other means.
12. Logging Out.  You must log out when you are finished accessing the password protected PHR.  This prevents someone else from accessing your account if you leave or share the computer.  If ten minutes of non-activity pass, the session will expire.
13. Exit Site Notice.  The IHS PHR has links to other organization's websites such as the National Library of Medicine to provide you with additional health information.  Once you link to another site, you are subject to the privacy and security policy of the new site.  The IHS is not responsible for content on other websites.
14. Saving of Passwords by Browser on Public Computers.  Many Internet browsers (such as Internet Explorer, Apple Safari, or Google Chrome) allow users to save username and passwords.  When prompted by a browser to save your IHS PHR username and password, it is recommended that you decline this option.  Saving username and passwords could potentially enable persons to gain access to your personal information.
15. Surveys, Questionnaires, and Polls.  The IHS PHR may use surveys, questionnaires and polls to facilitate feedback and input from our users.  When you respond to surveys, questionnaires or polls related to our site, this information is collected only as anonymous, aggregated information and is used for statistical purposes.  No survey, questionnaire or poll will ever ask you for your social security number or PHR password.
16. Agreement and Disclaimers.
    1. General Disclaimer.
       1. The IHS provides this web portal subject to the following Terms and Conditions.  You must agree to these Terms and Conditions to access the IHS PHR.
       2. The IHS PHR is an IHS web portal intended for use by the Indian Health System patients for viewing, retrieving, and storing personal health records. Establishing an IHS PHR account is intended for eligible Indian Health System beneficiaries, including American Indians and Alaskan Natives of the United States and their advocates.  All site information resides on and transmits through protected Federal computer systems and networks.  The IHS PHR has links to other organization's' websites to provide you with additional health information or information services.  Once you link to another site, you are subject to the privacy and security policy of the new site.  The IHS is not responsible for content on other websites.
       3. IHS use and disclosure of your health information is limited as required by Federal law.  The IHS only uses the specified information you provide as agreed to in these Terms and Conditions.  The IHS does not sell, trade, or rent users' personal information.  The IHS reserves the right to perform statistical analyses of user behavior and characteristics to measure interest in and use of the various areas of the site.  The IHS may at times share aggregate information (i.e., anonymous, statistical data) about our users within the IHS for quality assurance audits and IHS PHR program administrative needs.
       4. The IHS acknowledges that privacy and security of your information matter to you.  The IHS respects your privacy and has taken measures to provide appropriate levels of security to protect your personal information.  Certain information about your account may be shared with authorized personnel to administer the IHS PHR program.  The IHS protects the information you provide with security technology based on current computer industry standards, and applicable Federal guidelines.
    2. Indian Health Service PHR and Your IHS Health Records.  Any address or contact information you enter is used for system troubleshooting and related correspondence. Any updates you make to your contact information on the IHS PHR will not be submitted to IHS or updated in your IHS health records.  To make corrections in your health record, you must contact the medical facility where you receive care to update your official health record.  The IHS health record displayed in your PHR is an electronic copy of your official health record.  Your health record that is stored at IHS health facilities remains the official, legal, and authoritative IHS health record.
    3. The IHS PHR and Any Claim for Payment with the IHS.  The PHR may not be used to notify IHS for purposes of Purchased and Referred Care (formerly Contract Health Service) eligibility, referrals, or questions.  If you wish to file a claim or change your information for any reason, you must contact your local IHS health care facility.
    4. Medical Disclaimer.
       1. The information provided by the IHS PHR is based on your official health record at the time it was last updated from the facility.  The health-related information and resources available through the IHS PHR are NOT intended to be used for or replace the advice of your doctor, your current medical diagnosis, or your current treatment.  Seek advice from your physician or other qualified health care provider before starting new treatment, modifying your current treatment, or to ask questions about a medical condition or disease.  The information provided by the IHS PHR is intended to help you and others make better healthcare decisions and take greater responsibility for your own health.
       2. Health care recommendations may change over time.  Therefore, resources contained on the IHS PHR may become outdated and not current with accepted medical standards.  Always consult a qualified healthcare professional with any questions or concerns you may have regarding your medical condition.
    5. Your Obligations.
       1. The IHS PHR is an IHS web portal intended for use by the Indian Health System patients to allow for the creation of accounts for viewing, retrieving, and storing information only, except as otherwise explicitly authorized.  Your health information resides on and transmits through protected Federal computer systems and networks.
       2. Your use of the IHS PHR means you understand, accept and grant your unconditional consent for authorized IHS personnel to review and take action including, but not limited to, monitoring, auditing, inspecting, investigating, restricting access, tracking, sharing with authorized personnel, or any other authorized actions by authorized IHS and law enforcement personnel.
       3. If your PHR account reflects incorrect patient information you must contact your local facility.
       4. Threats, attempts, or actions to modify this system, deny access to the system, gain unauthorized access to data, breach system security or otherwise damage the system or data contained within is strictly prohibited.  These actions may result in criminal, civil, or administrative penalties resulting from violations of Federal laws including, but not limited to, 18 U.S.C. § 1030 (Fraud and Related Activity in Connection with Computers) and 18 U.S.C.§ 2701 (Unlawful Access to Stored Communications).
    6. Printing.  You may choose to print information from your PHR.  If you do, you are advised to take actions to protect your health information.  Once you print your personal information, the security of that information is your responsibility.  Remember to check for documents on printers and destroy all health information you do not need.
    7. Inactivating Your Account.  You may choose to inactivate your IHS PHR account at any time.  To do so you may send a secure PHR message or go to your local Indian Health System facility to inactivate your account.  If you go to an IHS facility you will be asked to put your request in writing.  Be aware that once inactivated, information from the account becomes immediately inaccessible and cannot be retrieved.
    8. Agreement.  By clicking "Accept" below, you acknowledge that you have read and agree to all of the terms and conditions above.  If the PHR account is being created for an unemancipated minor, a parent, guardian, or individual acting in loco parentis must read and click "accept" on behalf of the unemancipated minor.  You expressly acknowledge and agree that neither IHS or their suppliers are responsible for the results of your decisions resulting from the use of the service, including, but not limited to, your choosing to seek or not to seek professional medical care, or your choosing or not choosing to modify or terminate specific treatment based on the information provided by this online service.  Further, you expressly acknowledge and agree that representatives from the IHS PHR program and the IHS may contact you regarding surveys, questionnaires, and polls.  Your participation in questionnaires and polls is voluntary and not required in order for you to participate in IHS PHR.
    9. Changes to PHR Terms and Conditions.  The PHR Terms and Conditions may be revised.  When IHS makes a change that affects the collection and use of your personal information, IHS will update and post the revised Terms and Conditions on the IHS PHR home page.  Upon log-in you will be prompted to read and accept the new Terms and Conditions.  You must accept the revised Terms and Conditions to continue using your IHS PHR account.  With regard to the PHR account of an unemancipated minor, a parent, guardian, or individual acting in loco parentis must accept the revised Terms and Conditions on behalf of the unemancipated minor.  If you choose not to accept the Terms and Conditions you will not be allowed to complete your login.