ISDEAA 638 Compliance & Monitoring

The ISDEAA Compliance Framework

638 contracts operate under a compliance framework that is distinct from the Uniform Guidance (2 CFR 200) that governs competitive federal grants. This distinction is not academic — it has daily practical consequences for how tribal health programs manage finances, procure goods and services, report to the federal government, and respond to oversight.

The compliance framework for a 638 contract derives from three sources:

• ISDEAA itself (25 U.S.C. §§ 5301–5423) — The statute establishes the overarching legal framework, including the tribe's right to contract, the government's obligation to fund, limitations on federal oversight, and the reassumption process.
• ISDEAA regulations (25 CFR Part 900) — The implementing regulations, developed through negotiated rulemaking with tribal representatives, provide operational detail on the contracting process, declinations, reassumption, property management, and other administrative matters.
• The AFA — The specific terms negotiated between the tribe and IHS in the Annual Funding Agreement, including reporting requirements, performance standards, and any additional conditions. Because the AFA is negotiated, compliance requirements vary by contract.

How 638 Compliance Differs from 2 CFR 200

For tribal organizations that manage both 638 contracts and competitive grants, the compliance differences are significant and must be managed carefully. Applying grant compliance rules to 638 contracts can be as problematic as ignoring them for grants.

The practical implication: if your finance team applies 2 CFR 200 procurement rules to 638 contract purchases, you may be unnecessarily constraining your operations. If your grants manager uses 638 carryover flexibility on a competitive grant, you may have an audit finding. Separate compliance tracking for each funding type is essential.

Tribal Reporting Requirements to IHS

Reporting under a 638 contract is governed by the terms negotiated in the AFA — not by a standard set of forms imposed on all contractors. That said, most AFAs include some combination of the following reporting obligations:

• Program reports. Narrative reports on services delivered, patient counts, program activities, and progress toward performance objectives. Frequency varies: quarterly for newer contractors, annually for mature contractors.
• Financial reports. SF-425 Federal Financial Reports showing expenditures against the contract amount. Typically required quarterly or semi-annually.
• GPRA reports. Government Performance and Results Act data on IHS clinical measures. Typically extracted from RPMS or the tribe's health information system.
• Annual report. A comprehensive end-of-year report summarizing program accomplishments, challenges, financial status, and plans for the coming year.

For detailed guidance on each reporting type, including specific form requirements, submission portals, and timelines, see the Reporting Requirements guide.

IHS Oversight Boundaries

One of ISDEAA's most important provisions is the limitation on federal oversight of tribally-operated programs. IHS retains a trust responsibility to ensure that contracted programs serve the Indian population — but this responsibility does not translate into the kind of granular management oversight that federal agencies exercise over competitive grant recipients.

What IHS Can Do

• Review reports submitted under the AFA and request clarification on reported data
• Conduct periodic monitoring visits as specified in the AFA (with reasonable advance notice and coordination with the tribe)
• Provide technical assistance when requested by the tribe or when monitoring identifies areas of concern
• Review Single Audit reports and follow up on findings related to the 638 contract
• Initiate reassumption proceedings if specific statutory criteria are met (discussed below)

What IHS Cannot Do

• Direct tribal employees or manage day-to-day program operations
• Impose reporting requirements not negotiated in the AFA
• Require the tribe to follow federal personnel, procurement, or administrative policies (unless the tribe has adopted them)
• Withhold funds for non-compliance with requirements not in the AFA or ISDEAA
• Conduct surprise inspections or audits without reasonable notice and tribal consent (beyond what the AFA provides)

These boundaries exist because ISDEAA is fundamentally about tribal self-determination. The tribe is not a subcontractor carrying out IHS's instructions — it is a sovereign government operating programs that the federal government is obligated to provide. IHS's role shifts from operator to trust responsibility partner.

Reassumption: Criteria and Process

Reassumption is the process by which IHS takes back operation of a contracted program from a tribe. It is the most serious compliance action under ISDEAA and is governed by strict statutory and regulatory requirements (25 U.S.C. § 5324(m); 25 CFR §§ 900.246–900.256). There are two types:

Non-Emergency Reassumption

IHS can initiate non-emergency reassumption when it determines that there has been a “violation of the rights or endangerment of the health, safety, or welfare of the Indians served by the contract” and the tribe has failed to take corrective action after receiving notice. The process requires:

• Written notice to the tribe specifying the deficiencies and providing at least 30 days for corrective action
• Technical assistance offered to help the tribe address the identified deficiencies
• If the tribe fails to take adequate corrective action, a formal hearing before the tribe can contest the reassumption
• The tribe has the right to appeal to IBIA or federal court

Emergency Reassumption

Emergency reassumption is available only when IHS determines that there is an “immediate threat of imminent harm to the safety of any person” served by the contract. The threshold is significantly higher than for non-emergency reassumption:

• The threat must be imminent and specific, not hypothetical or generalized
• IHS must exhaust all other remedies, including offering technical assistance
• IHS must provide immediate written notice to the tribe and a hearing within 10 days
• The scope of reassumption must be limited to the specific programs where the threat exists — IHS cannot reassume the entire contract if the problem is confined to one PFSA

In practice, reassumption is rare. IHS initiates reassumption proceedings in only a handful of cases each year, and many are resolved through corrective action before reaching a final determination. The threat of reassumption, however, is a powerful motivator for maintaining compliance.

Record-Keeping Requirements

While 638 contracts do not impose the same documentation standards as 2 CFR 200, tribal organizations must maintain records sufficient to demonstrate proper stewardship of contracted funds and effective program delivery. Essential record-keeping practices:

• Financial records. General ledger, accounts payable/receivable, payroll records, bank statements, and reconciliations. Maintain segregation of 638 funds from other revenue sources (competitive grants, Medicaid collections, tribal general funds).
• Personnel records. Position descriptions, qualifications documentation (especially clinical licenses and certifications), time and effort records for staff allocated across multiple programs, and Indian preference documentation.
• Program records. Service delivery data, patient encounter records, program activity logs, community engagement documentation, and any data reported to IHS under the AFA.
• Procurement records. Purchase orders, contracts with vendors, documentation of procurement decisions, and records sufficient to demonstrate that purchases were reasonable and related to contracted PFSAs.
• Property records. Inventory of equipment and property acquired with 638 funds, as well as any federal property made available under the contract.
• Governance records. Tribal resolutions, health board minutes, organizational policies, and documentation of major decisions affecting the contracted programs.

ISDEAA does not specify a retention period for 638 contract records, but best practice — and the Single Audit requirement — dictates retaining records for at least three years after the submission of the final financial report for each contract period, or longer if audit findings remain unresolved.

Audit Requirements

Tribal organizations that expend $750,000 or more in federal awards during a fiscal year are subject to the Single Audit requirement under 2 CFR 200 Subpart F. Yes, this is the one area where 2 CFR 200 does apply to 638 contractors. The Single Audit Act (31 U.S.C. §§ 7501–7507) applies to all non-federal entities expending federal awards, including tribal governments and tribal organizations.

Tribal-Specific Audit Considerations

While the Single Audit framework applies, there are tribal-specific considerations that auditors and tribal organizations should be aware of:

• ISDEAA compliance supplement. The OMB Compliance Supplement (Appendix VII for Department of the Interior; Appendix X for DHHS) includes specific compliance requirements for ISDEAA contracts that auditors must test. These are different from the compliance requirements for competitive grants.
• Cost principles. Auditors should apply the cost principles negotiated in the AFA, not 2 CFR 200 Subpart E cost principles. This is a common auditor error — tribal organizations should ensure their audit firm understands the distinction.
• Procurement testing. Similarly, auditors should test procurement against tribal procurement policies, not 2 CFR 200 procurement standards, for 638 contract expenditures.
• CSC reconciliation. Auditors will typically review the indirect cost rate calculation and reconcile indirect costs charged against the rate negotiated with the Interior Business Center (IBC).

Single Audits must be completed within 9 months of the end of the audit period and submitted to the Federal Audit Clearinghouse (FAC). Late submissions or audit findings can affect the tribe's mature contractor status and may trigger IHS monitoring actions.

Trust Responsibility and the Federal-Tribal Relationship

Understanding compliance under ISDEAA requires understanding the trust responsibility that underpins the entire framework. The federal government's trust responsibility to tribal nations — grounded in treaties, statutes, executive orders, and judicial decisions — does not diminish when a tribe assumes operation of federal programs. If anything, the trust responsibility becomes more specific:

• Duty to fund. The government must provide the Secretarial amount and fully fund CSC. Failure to do so is a breach of the trust responsibility and the contract.
• Duty to assist. IHS must provide technical assistance when tribes encounter operational challenges. Compliance issues should be met first with offers of help, not punitive actions.
• Duty to protect sovereignty. IHS cannot use the compliance process to undermine tribal self-determination. Oversight must be consistent with the tribe's status as a sovereign government, not a subordinate entity.

When compliance disputes arise, tribal administrators should frame them within this trust responsibility context. IHS actions that are inconsistent with the trust responsibility can be challenged through the Contract Disputes Act, IBIA, or federal court.

Managing Dual Compliance Frameworks

Most tribal health organizations manage multiple funding streams simultaneously. A tribal health center might operate under a 638 contract for IHS programs, hold an HRSA 330 grant for health center operations, receive SAMHSA funding for behavioral health, and bill Medicaid for clinical services. Each stream has its own compliance framework.

Practical strategies for managing dual compliance:

• Separate cost centers. Maintain distinct cost centers in your accounting system for each funding stream. This enables accurate financial reporting and ensures costs are charged to the appropriate source.
• Compliance matrices. Create a matrix showing which compliance rules apply to which funding stream. When staff have questions about what's allowed, the matrix provides a quick reference.
• Staff training. Ensure that finance, procurement, and program staff understand which rules apply to which funds. Cross-contamination of compliance frameworks is one of the most common audit triggers.
• Unified calendar. Maintain a single compliance calendar showing all reporting deadlines across all funding streams. Many tribal health programs discover deadline conflicts only when it's too late to address them.

The Tribal Healthcare Funding Guide provides a broader view of managing concurrent funding streams, while the 2 CFR 200 guide covers the competitive grant compliance framework in detail.