The following text is based on the presentation “Hiding Information or Providing Access in Archives (HIPAA): Protected Health Information in University Archives” delivered at the Midwest Archives Conference, Columbus, OH, May 2-5, 2007.

In 2006 the Academic Health Center (AHC) at the University of Minnesota began a collaborative effort with the University Libraries to document the institutional history of the AHC. Composed of six schools and colleges, interprofessional research centers, and affiliate institutions, the Academic Health Center was organized in 1970 as a means to promote cross-professional cooperation and encourage imaginative approaches to health care delivery. The goal of the project is to identify, collect, and make available the institutional and historical documentation of the AHC, ensure that this documentation is preserved, and follow all applicable professional standards and local, state, and federal policies. One federal policy identified as being relevant to the project materials is the “Standards for Privacy of Individually Identifiable Health Information,” or the “Privacy Rule” for short, which acts as the companion piece to the Health Insurance Portability and Accountability Act (HIPAA) of 1996.(1)

Current State at the University of Minnesota
Like most comparable academic institutions, the University of Minnesota is a hybrid entity according to the Privacy Rule. It performs functions that are both covered and not covered by the Privacy Rule within the institution and can draw a distinction between health care units of the University and those unrelated to health care. The Academic Health Center is designated as a covered component of the University of Minnesota and is charged to oversee HIPAA compliance throughout the University. According to the Privacy Rule, the non-covered components of the University are not subject to the Rule. At the University of Minnesota, this includes the University Archives, a unit of the University Libraries, where all AHC archival material will be stored and managed. With this cursory understanding, it seems that the material located at the University Archives is not subject to the conditions set forth in the Privacy Rule governing research use and access.

However, a university-wide policy on the protection of individual health information quickly derailed this simplistic interpretation. The Privacy Rule defaults to state or local policies when those procedures are deemed to be more stringent than those set forth in the Rule. In this case, the University’s policy does not differentiate between covered and non-covered components within the entity. Instead, the policy asserts that it is the responsibility of all units of the University to appropriately safeguard protected health information (PHI) within their custody according to federal regulations.(2) 

Although the University Archives does not collect traditional medical or patient records, the Archives does collect the papers of administrators and selected faculty papers within the health sciences. It is within these collections that an undetermined amount of protected health information exists in the correspondence, notes, research materials for grants, and the occasional medical record or logbook from a clinic or surgical department that is tucked away in the personal papers. The application of the Privacy Rule to these ‘incidental disclosures’ of protected health information is not well understood.(3)

Approaches to the Privacy Rule
In order to apply appropriate safeguards for any protected health information located in the collections at the University Archives, it is necessary to understand how the Privacy Rule can be applied to archival management and to review practices in place at archival programs covered by the Privacy Rule.

Several key points from the Privacy Rule are applicable to the acquisition and management of archival materials considered to contain protected health information. First, the Privacy Rule applies only to covered entities; it does not apply to all persons or institutions that collect individually identifiable health information. Although certain non-covered archival programs may be exempt from the Privacy Rule, some institutional policies may enforce the regulation’s safeguards as a precaution.(4)  Second, the Privacy Rule pertains only to protected health information created or collected by a covered entity. Personal health information created or collected by a non-covered entity does not necessarily need to comply with the Privacy Rule. Correspondence from a patient to a doctor or correspondence between two non-covered individuals discussing a person’s health are not covered items. Another point to consider is that the Privacy Rule does not pass through its requirements to business associates, which are separate entities contracted to provide some of the functions of the covered entity. A business associate may be required to provide assurances to the safeguarding of protected health information but is only subject to the contract, not the Privacy Rule.(5)  Providing open access to documents that have been redacted or de-identified of all protected health information is not in violation of the Privacy Rule. Finally, enforcement of the Privacy Rule is complaint-driven. Working with collections that contain protected health information involves a level of risk management for the institution.

During a review of the archival literature on protected medical information and access policies in place or being drafted, it became apparent that the difficulty of applying the Privacy Rule to archival programs resulted in a range of responses. A strict interpretation of the Privacy Rule limits access to material only to the original covered entity and its business associates. Further access would only be available through an application process to an institutional review board (IRB) or privacy board as provided in the Privacy Rule. A conservative approach is to conduct an item-by-item review during the course of processing to identify and redact any protected health information found in the collections.(6)  Other institutions are exploring methods to offer tiered access to documents containing protected health information depending on whether the individual is living or deceased while still operating within the parameters of the Privacy Rule. At the Archives and Special Collections at the Columbia University Medical Center, the process for granting researcher access to a living person’s protected health information is allowed only by permission of the individual. Access to protected health information of a deceased individual is granted by the Privacy Officer after the review of a written request.(7)  At the Alan Mason Chesney Medical Archives at Johns Hopkins, the duty to safeguard protected health information is passed on to the researcher during the application process to access the materials. In much the same way a covered entity can require a business associate to guarantee the protection of private data through a contractual agreement, the Chesney Medical Archives requires researchers to maintain the confidentiality of any protected health information encountered during the research process.(8)

Looking for Precedents
After reviewing the Privacy Rule guidelines and the interpretations of those guidelines in access policies at other archival institutions, it is clear that archivists and their institutional legal counsels are still building consensus in the Rule’s application to archives. Yet the anxiety over compliance is overshadowing our opportunities to advocate for the records in our charge. Nancy McCall and Stephen Novak are to be commended for their own advocacy work in this area, but more is needed to assure that health related records continually move toward long-term preservation and open access while providing protections for privacy rather than automatic destruction of protected health information or sweeping restrictions imposed on collections.(9)

As part of the process to establish professional guidelines, archivists should look at models found in other federal precedents and encourage their incorporation into the Privacy Rule. One such precedent is the interpretive practice surrounding the “Fair Use” provision in the U.S. Copyright Law when working with copyright protected materials and managing use and access.(10)  Another precedent is the federal definition of “research” and its application to historical research and oral histories.

In regard to copyright, archivists are aware of the balance between the protection of an individual’s rights and the application of fair use; however, many archivists routinely enforce copyright protections over public domain materials or create unnecessary barriers to access.(11)  The lesson learned from this behavior is that claims to copyright cannot always be taken at face value. As a profession, we have become better at questioning the authority to which copyright is claimed and at using the fair use provisions offered to us by law. We have also educated the users of copyrighted materials that they play a role in compliance. Copyright notices are on our registration forms, call slips, and copy machines. It is well understood that archivists provide access; we do not patrol for federal law violations. Archivists are also partnering with a growing number of librarians active in the scholarly communication arena to help educate content creators about their options and roles in setting the stage for fair use.

Many of these same techniques can be applied to the Privacy Rule and access to archival materials. First, archivists must become more familiarized with the principles of the Privacy Rule and its applications. Not all institutions or medical information is protected by the regulation. We must learn to differentiate the covered from the non-covered entities in order to determine appropriate safeguards for private information. We must also learn to question under whose authority are privacy protections enacted and for whose benefit. Second, inserting a fair use provision into the Privacy Rule allowing for access to collections with an undeterminable amount of private information that may or may not result in incidental disclosures of protected health information would continue to protect individual privacy and re-release many of the collections that were already open to research prior to 2003. Finally, we can share the burden of compliance with the researcher through registration and request forms. This approach uses the business associate agreement provided in the Privacy Rule by applying it to our users. Similar to the way researchers are made aware of copyright, those wanting access to collections with protected health information could sign a contract agreeing to certain conditions of use. This is already employed at Johns Hopkins as mentioned above and is being discussed at other institutions with their legal counsel.(12) 

The ongoing debate regarding oral histories for scholarly research and the need for human subject protection placed many such projects in the hands of university institutional review boards. Considered to be the subject of research, some participants in oral histories were provided many of the same protections given to individuals involved in medical research. In 2003, a joint statement by the Oral History Association, the American Historical Association, and the U.S. Department of Health and Human Services Office for Human Research Protection (OHRP) provided some clarity on this debate by explaining that “oral history interviewing projects in general do not involve the type of research defined by HHS regulations and are therefore excluded from Institutional Review Board oversight.”(13)  The U.S. Department of Health and Human Services defines research according to the Common Rule as a “systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.”(14)  Although easily interpreted by institutional review boards and historians alike to include historical research, the OHRP clarified its position by explaining that

Although the HHS regulations do not define “generalizable knowledge,” it is reasonable to assume that the term does not simply mean knowledge that lends itself to generalizations, which characterizes every form of scholarly inquiry and human communication. While historians reach for meaning that goes beyond the specific subject of their inquiry, unlike researchers in the biomedical and behavioral sciences they do not reach for generalizable principles of historical or social development, nor do they seek underlying principles or laws of nature that have predictive value and can be applied to other circumstances for the purpose of controlling outcomes. Historians explain a particular past; they do not create general explanations about all that has happened in the past, nor do they predict the future.(15)

While some historians may bristle at this description of their work, the OHRP is specific in what it does and does not deem research in need of institutional oversight.

The definition of research in the Privacy Rule is the same definition used in the Common Rule. With the precedent set by the OHRP, it is logical to assume that the majority of historical research use of archival collections that contain protected health information falls outside the purview of the OHRP and subsequent university institutional review boards. If that is the case, then the Privacy Rule’s guidelines on research access are not written for the types of use commonly associated with materials located in libraries and archives. Here again is an opportunity for the regulation to be amended to include a fair use provision that provides access while also implements appropriate safeguards for individual privacy.

It is clear that archivists and archival work were not considered during the writing of the Privacy Rule. Be that as it may, we are not powerless in the future direction of the regulation. Archivists have the opportunity to raise awareness about these issues with those who make policy at their institutions. Individual interpretations and responses to the perceived application of the Privacy Rule to archives will continue until clear professional and legal guidelines are established. At the University of Minnesota, with our understanding of the particular needs for the materials collected, the methods employed at other institutions, and the possible precedents for action, the AHC archives project will move forward to collect materials and provide access based on our own interpretations, the advice of our colleagues and legal counsel, and applicable models until the time that a consensus is met and the best practices for applying the Privacy Rule to archives are established.

1.  See “Standards for Privacy of Individually Identifiable Health Information.” Code of Federal Regulations, Title 45, Pt. 160 & 164, 2005 ed., and the Health Insurance Portability and Accountability Act of 1996. Public Law 104-191. 104 Cong., 21 August 1996.

2.  University of Minnesota, “Academic/Administrative Policy 2.10.1.: Administration & Oversight for Protection of Individual Health Information (HIPAA).” Accessed 30 March 2007. http://www.fpd.finop.umn.edu/groups/ppd/documents/policy/hippaindinfopol.cfm.

3.  See: National Committee on Vital and Health Statistics. Subcommittee on Privacy and Confidentiality, “Testimony of Stephen Novak, Panel 3--Decedent Health Information.” Washington, D.C., 2005. Accessed 13 March 2007. http://www.ncvhs.hhs.gov/050111p5.htm. For more information in incidental disclosures see Code of Federal Regulations, Title 45, Pt. 164.502, 2005 ed., and U.S. Department of Health & Human Services. Office for Civil Rights, Incidental Uses and Disclosures. Washington, D.C., 2003. Accessed 30 March 2007. http://www.hhs.gov/ocr/hipaa/guidelines/incidentalud.pdf.

4.  For an understanding how an archival program may or may not be considered covered by the Privacy Rule see: Stephen E. Novak, “The Health Insurance Portability and Accountability Act of 1996: Its Implications for History of Medicine Collections,” The Watermark 26 (Summer 2003). Accessed 30 March 2007. http://www.library.ucla.edu/libraries/biomed/alhhs/articlehealthinsuranceportability.html.

5.  U.S. Department of Health & Human Services. Office for Civil Rights, Standards for Privacy of Individually Identifiable Health Information. Washington, D.C., 2002. Accessed 30 March 2007. http://www.hhs.gov/ocr/hipaa/finalmaster.html.

6.  For an account of this type of approach see Lesley W. Brunet, “Documenting Cancer Medicine and Science at The University of Texas M.D. Anderson Cancer Center,” Archival Elements (2006). Accessed 3 April 2007. http://www.archivists.org/saagroups/sthc/aelements2006.html.

7. Columbia University Health Sciences Library Archives & Special Collections “Access to Records Containing PHI.” Accessed 13 March 2007. http://library.cpmc.columbia.edu/hsl/archives/accesspatient.html.

8.  National Committee on Vital and Health Statistics. Subcommittee on Privacy and Confidentiality, “The Impact of the HIPAA Privacy Rule on the Ability to Access and Utilize Archives: Testimony of Nancy McCall, Panel 3--Decedent Health Information.” Washington, D.C., 2005. Accessed 13 March 2007. http://www.ncvhs.hhs.gov/050111p6.pdf. See also: The Alan Mason Chesney Medical Archives, Johns Hopkins Medical Institutions, “Access and Services: Registration and Agreement.” Accessed 13 March 2007. http://www.medicalarchives.jhmi.edu/forms/Registration%20and%20Agreement.pdf.

9.   Both Nancy McCall and Stephen Novak have written and presented on the subject as well as provided testimony to the National Committee on Vital and Health Statistics.
 
10. U.S. Code, Title 17, Sec. 107, 2003 ed. Accessed 16 April 2007. http://www.copyright.gov/title17/92chap1.html.

11.  See: Peter Hirtle, “Archives or Assets?” American Archivist 66 (Fall/Winter 2003): 235-247.

12. Alan January discussed the possibility of the Indiana State Archives granting access to protected materials via a business associate agreement with their patrons during his presentation “Managing and Accessing State Hospital Records: The Indiana Experience” (paper presented at the Midwest Archives Conference, Columbus, OH, 4 May 2007).

13. Oral History Association, “Oral History Excluded from IRB Review.” Accessed 16 April 2007. http://omega.dickinson.edu/organizations/oha/org_irb.html.
 
14.“Protection of Human Subject,” Code of Federal Regulations, Title 45, Pt. 46.102, 2005 ed. Accessed 16 April 2007. http://www.hhs.gov/ohrp/humansubjects/guidance/45cfr46.htm.
 
15.  Oral History Association, “Oral History Excluded from IRB Review.” Accessed 16 April 2007. http://omega.dickinson.edu/organizations/oha/org_irb.html.

R. Joseph (Joe) Anderson has been with the American Institute of Physics since 1993.  He is currently Director of the Niels Bohr Library & Archives and Associate Director of the Center for History of Physics.  He helped to design the Project to Document the History of Physicists in Industry and is currently serving as its director.
 
Orville Butler, Ph.D., has been the historian of the Project to Document the History of Physicists in Industry since 2005.  His publications include Manufacturing the Future: A History of Western Electric (Cambridge University Press, 1999, with Steven B. Adams) and A History of the Kennedy Space Center (Florida University Press, 2007, with Kenneth Lipartito).

Suzanna Long received a Ph.D. and an M.S. in engineering management, B.S. in physics and a B.A. in history from the University of Missouri-Rolla (UMR) and an M.A. in history from the University of Missouri-St. Louis.  She has post-graduate certification in archives administration and worked as an archives consultant and as a scientific and electronic records archivist for the National Archives and Records Administration.  Currently, she is an assistant professor with the Department of Management and Marketing at Missouri Southern State University.  Her research interests include logistics and technology-driven change management, and the application of systems engineering to records management systems.

Erik Moore is the archivist for the Academic Health Center History Project at the University of Minnesota. Previously, he oversaw digital projects as an assistant curator at the Immigration History Research Center. He is an active member of the Society of American Archivists and the Midwest Archives Conference and currently serves as the president of the Twin Cities Archives Roundtable.