Tribal Health and Braided Compliance: ISDEAA, 2 CFR 200, and Everything In Between

Tribal health programs manage funding under fundamentally different compliance frameworks simultaneously. This guide covers the operational reality of braided compliance for tribal nations — from CSC reconciliation to multi-agency reporting.

Tribal health programs operate in a compliance environment that no other type of healthcare organization faces. Not because the work is more complex — community behavioral health, primary care, and wellness programming look similar regardless of who operates them. The compliance environment is different because tribal nations hold a unique legal and political status in the American system, and that status creates a funding landscape where fundamentally incompatible compliance frameworks must coexist inside the same organization.

A tribal health program managing an IHS 638 contract, a competitive SAMHSA grant, a state behavioral health contract, and Medicaid reimbursement is not managing four variations of the same compliance regime. It's managing four distinct legal frameworks — ISDEAA (25 CFR Part 900), 2 CFR 200 (Uniform Guidance), state contract law, and CMS cost principles — each rooted in a different source of authority, each with its own definitions of allowable costs, and each expecting financial data formatted and reported on a different schedule through a different portal.

This guide is about the operational reality of that intersection. Not the policy rationale for self-determination. Not the history of ISDEAA. The day-to-day compliance work of allocating costs, documenting effort, reconciling Contract Support Costs, and producing audit-ready documentation when your funding portfolio crosses framework boundaries that most compliance software doesn't even acknowledge.

The Foundational Distinction: Government-to-Government vs. Grantor-Grantee

Before any discussion of specific compliance requirements, the structural distinction must be clear, because it shapes everything else.

When a tribal nation operates programs under ISDEAA — whether through a Title I contract (Section 638) or a Title IV compact — the legal relationship with the federal government is government-to-government. The tribe is exercising its sovereign right to operate programs that the federal government would otherwise operate through IHS. This is not a grant. The tribe is not a grantee. The funding is not discretionary. The legal framework is 25 CFR Part 900 (for contracts) or 25 CFR Part 1000 (for compacts), not 2 CFR 200.

When the same tribal health program receives a competitive SAMHSA grant — say, a Tribal Behavioral Health grant (ALN 93.243) — the relationship shifts. The tribe is now a grantee under 2 CFR 200. The award is competitive and discretionary. The compliance framework is the Uniform Guidance. The reporting requirements, cost principles, and audit expectations are those of any federal grantee.

When that same program operates under a Washington State behavioral health contract, it operates under state contract terms — different again from either federal framework.

And when it bills Medicaid for eligible services, CMS cost principles apply — yet another framework.

The compliance challenge is not that any one of these frameworks is unreasonable. It's that the same organization — often the same staff, the same facilities, the same costs — must satisfy all of them simultaneously, and they were not designed to be compatible.

Most compliance software, most grant management platforms, and most accounting system configurations assume that an organization operates under one primary framework. Tribal health programs don't have that luxury.

The ISDEAA Compliance Framework

What 638 Contracts and Compacts Actually Require

Under ISDEAA Title I, a tribal nation contracts with the federal government (through IHS) to operate specific programs. The 638 contract specifies the programs, the funding amount, and the terms. Under Title IV, a tribal nation compacts with the federal government for a broader set of programs with greater operational flexibility.

The compliance requirements for 638 contracts include:

Program-specific deliverables. The contract specifies what services will be provided, to what population, with what expected outcomes. Reporting is to the IHS Area Office, typically on a schedule defined in the contract.

Financial accountability. The tribe must maintain financial records that demonstrate funds were used for the contracted programs. However, the cost principles that govern this accountability are rooted in the contract terms and ISDEAA, not in 2 CFR 200. This distinction matters — some costs that are unallowable under 2 CFR 200 may be allowable under a 638 contract, and vice versa.

Single Audit. Tribal organizations expending $750,000 or more in federal awards are subject to Single Audit under 2 CFR 200 Subpart F. However, 638 contracts are audited under the compliance supplement specific to ISDEAA — not the same compliance supplement used for competitive grants. Auditors who don't understand this distinction create findings that shouldn't exist.

A-133 compliance supplement for ISDEAA. The audit tests for 638 contracts differ from those for 2 CFR 200 grants. Specific attention areas include CSC calculation and reconciliation, indirect cost rate application, and contract modification/amendment documentation.

What 638 Compliance Is Not

638 compliance is not a subset or variation of 2 CFR 200. It's tempting — especially for auditors and software platforms that know 2 CFR 200 well — to treat ISDEAA compliance as "basically the same but with some tribal-specific additions." This is wrong, and this misconception causes real harm.

2 CFR 200 defines "allowable costs" through Subpart E (Cost Principles). ISDEAA defines allowable costs through the contract terms and the law itself (25 U.S.C. 5325).
2 CFR 200 provides for a negotiated indirect cost rate. ISDEAA provides for Contract Support Costs — a fundamentally different mechanism (see below).
2 CFR 200 grants are discretionary. 638 contracts are an exercise of tribal sovereignty — the tribe has a legal right to operate these programs.

Treating ISDEAA like 2 CFR 200 leads to incorrect cost disallowances, improper audit findings, and underrecovery of CSC. It's the compliance equivalent of applying the wrong country's tax code.

Contract Support Costs: The Entitlement Nobody Tracks Well

CSC is the single most important — and most frequently mismanaged — element of tribal health program finance. It is also the area where braided funding compliance creates the most acute operational pain.

What CSC Is

When a tribal nation contracts with the federal government to operate a program that IHS would otherwise operate, the tribe incurs overhead costs that IHS doesn't face. IHS has shared administrative infrastructure — HR, finance, IT, legal — funded by its overall appropriation. The tribe must fund these functions itself. Contract Support Costs are the mechanism through which the federal government reimburses these overhead costs.

CSC is not a negotiated rate. It is not a discretionary add-on. Under ISDEAA (as reinforced by the Supreme Court in Salazar v. Ramah Navajo Chapter, 2012), CSC is a legal entitlement. If a tribal nation operates a 638 contract with $780,000 in direct program costs and a CSC rate of 19.7%, the federal government owes the tribe $153,660 in Contract Support Costs. This is not optional. It is not subject to available appropriations in the same way that discretionary grants are.

The Reconciliation Problem

CSC is typically estimated at the start of the contract year based on projected direct program costs. But actual direct costs may differ from the estimate — programs may spend more or less than projected, staff positions may be vacant for part of the year, unexpected costs may arise.

At year-end, the tribe must reconcile estimated CSC against actual direct program costs to determine whether the CSC received was accurate. If actual direct costs were higher than estimated, the tribe is owed additional CSC. If lower, the tribe may need to return the overpayment (though the mechanics of this are often negotiated).

This reconciliation process is where most tribal health programs lose money. Not because the law is unclear, but because tracking actual direct costs throughout the year — in a way that accurately calculates CSC entitlement — requires a level of operational tracking that most organizations manage in spreadsheets, if they manage it at all.

For a program with $780,000 in direct costs and a 19.7% CSC rate:

If actual direct costs are 5% higher than estimated ($819,000), the tribe is owed an additional $7,683 in CSC.
If actual direct costs are 10% higher ($858,000), the additional CSC entitlement is $15,366.
Across multiple 638 contracts, the annual underrecovery can range from $5,000 to $80,000 or more.

This is real money — money that tribal health programs are legally entitled to, that supports the administrative infrastructure necessary to operate federal programs, and that frequently goes unrecovered because the reconciliation process is too operationally complex to manage without dedicated systems.

How Braided Funding Complicates CSC

The CSC reconciliation challenge intensifies when the 638 contract shares costs with other funding streams. If the community wellness coordinator described earlier spends 25% of her time on 638-contracted activities, that 25% of her salary is a direct program cost that contributes to the CSC calculation. But accurately tracking that 25% — in a way that's defensible to IHS during reconciliation — requires the same cost allocation methodology that feeds the SAMHSA reporting, the state contract reporting, and the Medicaid cost report.

The allocation methodology must be consistent across all frameworks. You cannot tell SAMHSA that the coordinator spends 40% of her time on their grant, tell IHS that she spends 25% on the 638 contract, and tell the state that she spends 20% on their contract, unless those percentages add up and are supported by the same underlying effort documentation. If they total more than 100%, you have a compliance problem. If they total less, you have unreported effort that should be allocated somewhere.

CSC reconciliation, in other words, is not a standalone tribal compliance task. It's embedded in the broader cost allocation methodology that governs the entire braided funding portfolio. Get the allocation right, and CSC reconciliation flows from it. Get the allocation wrong — or don't have a systematic allocation process at all — and CSC underrecovery is almost guaranteed.

The DOI-IBIA Indirect Cost Rate

Separate from CSC (which applies to 638 contracts), tribal organizations that receive competitive federal grants need a negotiated indirect cost rate to recover overhead costs on those awards. For tribal organizations, this rate is typically negotiated with the Department of Interior's Interior Board of Indian Appeals (DOI-IBIA) — not with the organization's cognizant federal agency as is the case for most nonprofits.

Why the Rate Matters for Braided Compliance

The DOI-IBIA indirect cost rate applies to competitive federal grants (SAMHSA, CDC, HRSA awards under 2 CFR 200). It does not apply to 638 contracts (which use CSC) or to state contracts (which often cap indirect costs at their own rate, typically 10-15%).

This means a tribal health program with a DOI-IBIA rate of 24.1% applies that rate to its SAMHSA and CDC grants, applies a 10% cap to its state contracts, uses CSC for its 638 contract, and uses CMS methodology for Medicaid. Four different overhead recovery mechanisms for four funding streams, all drawing from the same pool of overhead costs.

The allocation methodology must account for this. Overhead costs recovered through the 24.1% indirect rate on the SAMHSA grant cannot also be recovered through CSC on the 638 contract. The cost allocation plan must clearly delineate which overhead costs are recovered through which mechanism, and the total recovery cannot exceed actual overhead.

The Expiration Cliff

DOI-IBIA indirect cost rate agreements have defined effective periods — typically one to three years. When the rate expires, the organization cannot charge indirect costs to federal awards at the previously negotiated rate until a new rate is negotiated.

Rate negotiation is not instantaneous. It requires preparing an indirect cost rate proposal (documentation of the cost base, the pool of indirect costs, the allocation methodology), submitting it to DOI-IBIA, and waiting for review and approval. This process can take three to twelve months.

An organization that lets its rate lapse — because the finance director who managed the renewal left, or because the renewal deadline fell during a particularly heavy compliance month — faces a real financial crisis. It cannot charge indirect costs to active federal grants, which means those overhead costs are either absorbed by unrestricted funds (if any exist) or simply unfunded.

For braided-funded organizations, the expiration cliff is amplified. The DOI-IBIA rate affects every competitive federal grant in the portfolio simultaneously. A lapsed rate doesn't impact one grant — it impacts all of them.

Multi-Agency Reporting: Five Portals, Five Formats, Five Fiscal Years

A tribal health program with the funding mix described above reports to five different agencies through five different systems:

Agency	Portal/System	Fiscal Year	Key Reports
IHS	IHS Portal	Contract year (varies)	638 contract deliverables, CSC reconciliation, program narratives
SAMHSA	SPARS (SAMHSA Performance Accountability and Reporting System)	Federal (Oct-Sep)	GPRA measures, NOMs (National Outcome Measures), programmatic data
HHS/PMS	Payment Management System	Federal (Oct-Sep)	SF-425 Federal Financial Report, drawdown reconciliation
WA HCA	State Medicaid portal	State (Jul-Jun)	Medicaid cost report, claims data reconciliation, rate-setting documentation
WA DOH	State contract portal	State (Jul-Jun)	Deliverable reports, financial status reports, state-specific templates

In January, three of these five reporting cycles have deadlines. In April, four of them do. There is no month of the year where fewer than two reporting obligations are active.

The data underlying these reports overlaps substantially — the same costs, the same staff, the same programs. But each report requires the data formatted differently, aggregated to different periods, and presented through different frameworks. The SAMHSA report needs GPRA measures and federal financial data for October-September. The Medicaid cost report needs CMS-formatted cost data for January-December. The state contract needs deliverable-based reporting for July-June. The IHS report needs program-specific deliverables and CSC documentation.

A unified cost allocation methodology — one that allocates shared costs across all streams and produces framework-specific outputs — would reduce this reporting burden dramatically. Without one, each report is a separate exercise in data extraction, reformatting, and reconciliation.

Tribal Data Sovereignty in Compliance Reporting

A compliance discussion for tribal health programs must address data sovereignty — not as an afterthought, but as an operational requirement that shapes how compliance systems work.

Tribal nations have the inherent right to control data about their communities, programs, and operations. This right is not academic. It has concrete implications for compliance infrastructure:

Data residency. Where does compliance data live? For a cloud-based compliance system, tribal health programs need assurance that their data is not comingled with other organizations' data in ways that compromise tribal control.

Data access. Who can see the tribe's financial data, allocation methodologies, and compliance documentation? Federal and state agencies have specific, limited rights to this data — defined by the contract/grant terms. A compliance system should enforce those boundaries, not override them.

Data use. Can data entered into a compliance system be aggregated, anonymized, and used for product development, benchmarking, or research without the tribe's explicit consent? For many SaaS platforms, the answer buried in the Terms of Service is yes. For tribal nations, that answer is unacceptable.

Reporting control. The tribe decides what data is shared with which agency, when, and in what format. A compliance system that auto-reports to federal agencies without tribal review and approval violates the government-to-government relationship.

These are not edge cases. They are fundamental requirements. A compliance platform that handles tribal health programs must treat data sovereignty as a first-class design constraint — not as a feature request.

The Practical Framework: Managing Braided Compliance in Tribal Health

Given the framework complexity described above, tribal health programs need an operational approach that accomplishes five things:

1. Unified Cost Allocation Methodology

A single, documented methodology that allocates every shared cost across all funding streams according to each stream's applicable framework. The methodology must:

Allocate personnel costs based on documented effort (not guesswork)
Apply the correct cost principles per framework (ISDEAA for 638, 2 CFR 200 for competitive federal, CMS for Medicaid, state terms for state contracts)
Distinguish between direct costs (which feed CSC calculations) and indirect costs (which are recovered through the DOI-IBIA rate or state-capped rates)
Produce allocations that are consistent across all reporting — the percentages reported to SAMHSA, IHS, the state, and CMS must reconcile

2. CSC Tracking as a Continuous Process

CSC reconciliation cannot be a year-end exercise. Actual direct costs must be tracked throughout the year so that the CSC entitlement can be calculated in real time (or at least monthly). This requires:

A clear definition of which costs are direct program costs for CSC purposes
Monthly or quarterly tracking of actual direct costs against the estimate
Variance reporting that surfaces over- or underrecovery trends before year-end
Settlement documentation preparation as an ongoing process, not a scramble

3. Fiscal Calendar Coordination

With three or more fiscal years in play, the compliance calendar must map every reporting deadline across every funding stream onto a single timeline. Cross-calendar conflicts — months where multiple frameworks have overlapping deadlines — must be identified in advance so that finance staff can prepare.

4. Framework-Specific Outputs from Shared Data

The underlying financial data is shared across all funding streams. The compliance system must produce framework-specific outputs from that shared data:

SF-425 for competitive federal grants (October-September)
IHS contract deliverables and CSC documentation (contract year)
CMS cost report data (January-December)
State financial and deliverable reports (July-June)
Allocation schedules and methodology documentation for audit

5. Audit Readiness Across Frameworks

Tribal health programs subject to Single Audit must prepare for audit tests under both the ISDEAA compliance supplement and the 2 CFR 200 compliance supplement — sometimes in the same audit. Audit readiness requires:

Cost allocation schedules showing allocations to each funding stream
Effort certification documentation for multi-funded staff
CSC reconciliation documentation
Indirect cost rate proposal and negotiation documentation
Methodology documentation that explains why costs were allocated as they were — not just the numbers, but the rationale

What Doesn't Exist Yet

The tribal health compliance landscape is defined by what's missing. No compliance software on the market treats ISDEAA as a first-class framework. The major grant management platforms (Fluxx, Submittable, Blackbaud) serve funders, not tribal grantee operations. The accounting platforms (QBO, Sage Intacct) track transactions but don't model funding rules or generate allocations. The compliance consulting firms do the work manually — and they know the domain, but at $150-300/hour, they're a solution that most tribal health budgets can't sustain year-round.

The infrastructure that tribal health programs need is an operational layer that sits between program delivery and fund accounting — one that models the full funding portfolio (638 contracts, competitive federal grants, state contracts, Medicaid), applies the correct compliance framework to each stream, generates allocations that satisfy all frameworks simultaneously, tracks CSC continuously, and produces the reporting outputs that each agency requires.

That infrastructure doesn't require EHR integration or clinical system connectivity. Tribal health compliance operates at the grant and financial level. The EHR handles clinical data. The accounting system handles transaction recording. The missing piece is the compliance orchestration between them.

For the approximately 350 tribal health programs in the United States managing braided funding, the gap between what exists and what's needed is not a feature request. It is the defining operational challenge of running programs that serve tribal communities under a funding model that was designed without their compliance reality in mind.

This guide is part of GrantBridges's braided funding compliance series. See also: Braided Funding Is an Operations Problem, the Compliance Framework Comparison Chart, and the CSC Reconciliation Guide.