How Privacy-Aware Descriptive
Practices Can Promote Access and
Use of Protected Information
Presentation to Society of American Archivists
August 14, 2014
Phoebe Evans Letocha
Alan Mason Chesney Medical Archives
Johns Hopkins Medical Institutions
pletocha@jhmi.edu
SAA HIPAA Issue Brief
The Public’s Right to Personal Privacy in Certain Categories of Records
An individual’s right to privacy with regard to certain information—such as records
mandated by government, attorney-client records, and medical records—
historically has been weighed against the public’s right to information. Personal
privacy should be respected throughout an individual’s lifetime in appropriate
ways. Documents recording private information about living Americans should be
disclosed involuntarily only when disclosure accomplishes a greater public purpose.
At the same time access to documents that contain private health information may
be necessary for historians and other researchers who create significant and
sometimes policy-shaping work based on these primary sources, and therefore a
balance must be struck between privacy concerns and access to such records.
http://www2.archivists.org/sites/all/files/0814-1-III-A-IssueBrief-HIPAA.pdf
Definition: Protected Health Information
• PHI is individually identifiable health information
transmitted or maintained in any form or medium
(electronic, oral, or paper) by a covered entity or its
business associates, excluding certain educational and
employment records and excluding information on
those individuals who have been deceased for longer
than 50 years.
Other protections for health information
Repositories within HIPAA covered and non-covered entities must also:
• Comply with state laws applying to medical records and health
information in holdings
• Comply with the Federal Common Rule for Protection of Human
Subjects
• Adhere to institutional requirements for protection of health
information
• Observe donor agreements for protecting health privacy
• Even if not subject to HIPAA, examine the ethical considerations
related to the access and use of health information
Information may still be protected
by State Medical Records Statutes
HIPAA does not define the term “Medical Record”
Medical records traditionally include:
• Unit medical record, whether paper or electronic, usually held by hospital medical
records office or other provider based centralized filing systems
• Other records used to make health care decisions about the individual patient
Determining if information came from a medical record
Medical Records could also include:
• Correspondence (including email) containing patient-provider or provider-provider
communications regarding care or treatment of specific patients
• Research notes regarding treatment for specific patients
• Patient diagnostic images
Gray areas may include:
• Patient Logbooks
• Patient Diagnostic Indices
• Research records that include health information but were not used to make health
care decisions about individuals
Patient Records as Hidden Collections
Primary holders of health information
• Health care providers
Health systems, hospitals, clinics, group practices, individual
providers
• Health care clearinghouses
Billing services, community health information systems
• Health plans
Group, individual health insurance, Medicare, Medicaid
Secondary holders of health information
• Hospital archives
• Archives of academic health centers
• College and university archives
• Corporate archives
• Research libraries
• Federal repositories
• State and local repositories
Patient Related Materials = Hidden Collections
• Fewer resources devoted to processing
• Hidden to archivists as well as researchers because
not in catalogs
• Lack of adequate description
Adolf Meyer Collection: Series XV
Series XV
• Extent: 70 cubic feet (100 boxes)
• Sub-Series include:
• Patient Correspondence
• Patient Index Cards
• Medical Records and other
documents related to Special
Research Topics
• Consultations on Legal Cases
http://www.medicalarchives.jhmi.edu/
sgml/amg-d.htm
Pediatric Diagnostic Index
Key tool for identifying relevant
Pediatric Medical Records by
diagnosis.
http://www.medicalarchives.jhmi.edu
/finding_aids/edwards_park/edwards
_parkd.html
Victor McKusick Collection
Scope and Content:
The Victor McKusick Collection spans his entire
career at Johns Hopkins. It documents his
various activities as clinician, researcher,
teacher, and administrator. The collection
includes professional correspondence, research
data, photographs, lecture notes, financial
records, student records, reprints, manuscripts,
audio tapes, committee minutes, patient
records, slides, diplomas, and awards. Also
included are family papers, including
biographical information, undergraduate notes,
and transcripts of interviews with McKusick and
family members.
http://www.medicalarchives.jhmi.edu
/papers/mckusick.html
Records of the Brady Urological Institute
Entire Collection consists of
Medical Records.
Description prepared by Julie
Adamo, National Library of
Medicine Associate Fellow in
2012.
http://www.medicalarchives.jhmi.edu
/finding_aids/brady_institute/brady_i
nstituted.html
Hugh Hampton Young Collection
http://www.medicalarchives.jhmi.edu/finding_aids
/hugh_young/hugh_youngd.html
William Osler Collection: Notes on Medical
Conditions
http://www.medicalarchives.jhmi.edu
/finding_aids/william_osler/william_o
slerd.html
Access Anxiety as a barrier to research
What is Research?
Definition of Research under the HIPAA Privacy Rule and the Federal Common Rule
• A systematic investigation, including research development, testing, and evaluation,
designed to develop or contribute to generalizable knowledge.
Authorizations for access under the HIPAA Privacy Rule
• Individual authorizations
– Subject of health information
– Legal representative of subject of health information
• Institutional authorizations for research
–
–
–
–
Waivers issued by Privacy Board or IRB for research involving living individuals
Research on decedents
Review preparatory to research
Data use agreement for limited data sets
• Other allowable institutional uses or disclosures
– Treatment, payment, and health care operations
– Health care emergencies, law enforcement and government oversight
Privacy Board at JHMI
• Joint institutional board of The Johns Hopkins Hospital and the Johns Hopkins
University schools of Medicine, Nursing, and Public Health for access to records,
data, and information held by:
– Alan Mason Chesney Medical Archives of the Johns Hopkins Medical Institutions
– Health Information Management Division of The Johns Hopkins Hospital (for access to medical
records created more than 50 years ago)
– Department of Art as Applied to Medicine
• Allows research using these institutional materials when it is legally and ethically
responsible to do so
• Administered by the Medical Archives
• Individuals both affiliated and not affiliated with Johns Hopkins are eligible to submit
applications.
Analysis of Privacy Board applications at Johns Hopkins
April 2003- July 2014
30
25
20
total number of
cases
15
number
approved
10
number
declined/on
hold
5
0
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
• 243 numbered cases
• 210 approved (86% of all
cases, 96% of reviewed
cases)
• 8 not approved
• 24 application incomplete
and not submitted for
review (10%)
Analysis of Privacy Board applications at Johns Hopkins
April 2003- July 2014
Rank
Researcher Profile
• Mostly outside researchers
– 26% Hopkins Researchers
– 74% Outside Hopkins (includes
international researchers)
Faculty
20%
Student: Undergraduate
47%
Students: Graduate and
Postdoc
Independent and others
25%
8%
Analysis of Privacy Board applications at Johns Hopkins
April 2003- July 2014
• 86 cases requested
access to patient
related materials (35%)
120
100
– Requests for patient
materials have increased
since 2011 to 49% of all
cases
80
• Privacy board waivers
have enabled the
Medical Archives to
provide access to
unprocessed collections
40
60
Patient Related Materials
Not Patient Related
20
0
Adolf Meyer Halsted, Cardiology
(Psychiatry) Kelly, Osler, (Blalock,
Welch
Taussig,
(Founding 4) Thomas)
Victor
McKusick
(Medical
Genetics)
Pediatric
Diagnostic
Index
Brady
Urological
Institute
Other
Presenter
Phoebe Evans Letocha
Collections Management Archivist
pletocha@jhmi.edu
Alan Mason Chesney Medical Archives
of the Johns Hopkins Medical Institutions
ALHHS/SAA HIPAA resource page
www.alhhs.org/hipaa_sthc_alhhs.html