ALHHS - Archivists and Librarians in the History of the Health Sciences

From the Newsletter of the Archivist and Librarians in the History of the Health Sciences
Winter, 2003-2004, Volume XXVII, Number 1

Letter from SAA to HHS Secretary Tommy Thompson Regarding HIPAA
By Timothy L Ericson and Jodi Koste

October 22, 2003

Secretary Tommy Thompson
US Department of Health and Human Services
200 Independence Avenue, SW
Washington, DC 20201

Dear Secretary Thompson:

We, the presidents of the Society of American Archivists (SAA) and the Archivists and Librarians in the History of the Health Sciences (ALHHS), are writing to you to seek clarification about the implications of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for archival and historical repositories.

SAA is the oldest and largest association of archivists in the United States, representing more than 3,100 individuals and 500 institutions. It is the authoritative voice in the United States on issues that affect identification, preservation, and use of historical records. ALHHS is an educational association of archivists, librarians, and other specialists, primarily from the United States, who work with historical records and resources related to the history of the health sciences.

Most members of ALHHS have records in their collections that contain Protected Health Information (PHI). SAA members working in a wide variety of archives, including those of local governments, churches and religious orders, universities, hospitals, and historical societies, often find themselves dealing with records containing PHI.

Members of both organizations have been dealing with the implications of the HIPAA Privacy Rule. Archivists and librarians are particularly sensitive to the issues this Act addresses, and have long been aware of the need to balance access to research collections containing individually identifiable information with the need to protect personal privacy.

The ambiguities and lack of clarity in some parts of the HIPAA Privacy Rule have caused institutions to interpret the rule in widely disparate ways, resulting in different rules of access to the same types of records in different repositories. We fear that, for some institutions, confusion about certain aspects of the Privacy Rule will lead to simply denying access to any records that might contain PHI.

Therefore, we would like HHS to clarify, if possible, some questions about the Privacy Rule that have arisen among our members since the rule went into effect in April 2003.

Some of these questions are:

Does the Privacy Rule apply retroactively? If so, how far back does it extend?
Explanation: Archives and libraries have medical records dating back in some cases to the Revolutionary War and earlier. Although we understand that research in the PHI of deceased patients is allowed under the privacy rule, as it stands now researchers seeking to use the casebook of a 19th century physician or the records of state asylums would have to fulfill the provisions of the rule in the same way as those seeking to use early 20th century hospital patient records. Is it possible to establish a date before which records with PHI could be made available without researchers having to go through a privacy or institutional review board?
If a “non-covered” part of a hybrid institution receives records with PHI from a “covered” part of the institution, must it create a business associate agreement?
Explanation: Must a university library have an agreement with its university hospital before accepting records with PHI? Must state archives have agreements with all those branches of state government that generate records with PHI?
Do the guidelines for research in the PHI of deceased patients allow the researcher to use actual patient names? If not, is there a chronological point at which the names can be used?
Explanation: The rule for research use of PHI of deceased patients is currently unclear if access to these records allows researchers to use actual patient names in their finished product. If use of names is not allowed, it would mean that certain historical and genealogical works could not be written.
Physicians and other health care providers often mention names of patients they are treating in their correspondence—sometimes casually, sometimes in more detail. At what point does this correspondence become PHI?
Explanation: The papers of physicians, nurses, and biomedical scientists are filled with correspondence, outside of formal patient records, in which the names of patients are mentioned. So are records, such as constituent mail written to Senators and Representatives as well as old church and school records. Often this is done in the most casual way, but occasionally it is more detailed. As the Privacy Rule stands now, archivists will have to examine every document to make sure no patient names are mentioned – an impossible task for most of the profession. It may lead to closing many collections in which the amount of PHI is minimal.
If photographs of patients were taken for publicity, fundraising, or clinical purposes, and these images appeared in published form in the past, can we assume that the patients depicted gave their consent to be published, even if the actual consent forms no longer exist?
Explanation: Scientific articles, hospital newsletters, medical school alumni magazines, and fundraising publications are just a few of the many forms of printed matter that have long used photos of patients. We know that at many institutions some kind of permission was asked of the subject(s) of the photos before publication, but in most cases these forms no longer exist. Can we allow examination and publication of these images if they have previously been made public? If not, the bulk of the photograph collections held in biomedical libraries and archives will have to be closed.

We hope you can give us guidance in these matters. Because of the general uncertainty about the meaning of the Privacy Rule provisions, many of our most important sources in the history of medicine and the allied sciences may be closed for research use.

We understand that these concerns are somewhat out of the normal sphere of HHS expertise. We are available to answer any questions you may have, and both organizations would welcome the opportunity to work with HHS representatives to attempt to resolve these issues. We hope to hear from you.

Sincerely,

Timothy L Ericson
President, Society of American Archivists
527 S Wells St, Fifth Floor
Chicago, IL 60606
312-922-0140
ericson@sois.uwm.edu

Jodi Koste
President, Archivists and Librarians in the History of the Health Sciences
Virginia Commonwealth University
Special Collections and Archives
Tompkins-McCaw Library
Box 980582
Richmond, VA 23298
jlkoste@vcu.edu

cc: Nancy Perkin Beaumont, SAA Executive Director