A Tribal organization or Hawaiian Native grantee shall develop and maintain confidentiality and disclosure procedures as follows:

(a) A Tribal organization or Hawaiian Native grantee shall have procedures to ensure that no information about an older Native American or obtained from an older Native American by any provider of services is disclosed by the provider of such services in a form that identifies the person without the informed consent of the person or their legal representative, unless the disclosure is required by court order, or for program monitoring by authorized Federal or Tribal monitoring agencies.

(b) A Tribal organization or Hawaiian Native grantee is not required to disclose those types of information or documents that are exempt from disclosure by a Federal agency under the Federal Freedom of Information Act (5 U.S.C. 552).

(c) A Tribal organization or Hawaiian Native grantee shall not require a provider of legal assistance under this part to reveal any information that is protected by attorney client privilege.

(d) The Tribal organization or Hawaiian Native grantee must have policies and procedures that ensure that entities providing services under this title promote the rights of each older Native American who receives such services. Such rights include the right to confidentiality of records relating to such Native American.

(e) A Tribal organization's or Hawaiian Native grantee's policies and procedures may explain that individual information and records may be shared with other State and local agencies, community-based organizations, and health care providers and payers, as appropriate, in order to provide services.

(f) A Tribal organization's or Hawaiian Native grantee's policies and procedures must comply with all applicable Federal laws, codes, rules, and regulations, including the Health Insurance Portability and Accountability Act (HIPAA) (42 U.S.C. 1301 et seq.), as well as guidance as the Tribal organization or Hawaiian Native grantee determines, for the collection, use, and exchange of both Personal Identifiable Information (PII) and personal health information in the provision of Title VI services under the Act.