Resources

Changes in HIPAA Regulations

Members of the Society of American Archivists’ Science, Technology & Health Care Roundtable (STHC) and Archivists and Librarians in the History of the Health Sciences (ALHHS) compiled the information below to provide information on the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its impact on historical research in libraries, archives, or other records repositories. The information provided here is not intended to be legal advice. Please contact your institution’s legal counsel for clarification on HIPAA and access to records in your repository.

—

On January 25, 2013, the Department of Health and Human Services issued major changes in the HIPAA Privacy Regulations. HHS has issued a press release regarding these changes: http://www.hhs.gov/news/press/2013pres/01/20130117b.html

The final rule is available in full in the Federal Register: http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf

These changes include a modification to the definition of Protected Health Information whereby “individually identifiable health information of a person who has been deceased for more than 50 years is not protected health information under the Privacy Rule.”

The most relevant section in the Federal Register regarding the change in the Period of Protection for Decedent Information can be found on p. 5613-5614 or here: https://www.federalregister.gov/articles/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the#h-203

Archivists with responsibility for records subject to HIPAA are urged to consult with legal counsel regarding the implications of all of the changes.

Additional Reading:

• “Recent Changes to the HIPAA Privacy Rule” by Phoebe Evans Letocha in The Watermark, Spring 2013, Vol. 36 no. 2: 10-19
• “Changes to the Privacy Rule of HIPAA” Update for Society of American Archivists presented by Phoebe Evans Letocha at the Privacy and Confidentialty Roundtable (August 14, 2013) and the Science, Technology and Heath Care Roundtable (August 16, 2013)

Advocacy

“Issue Brief: Health Information Portability and Accountability Act”
Issue Brief approved by SAA Council in August 2014; first issued on the SAA website in August 2014 and announced through a notice in the bi-weekly SAA In the Loop newsletter. The brief was drafted by Phoebe Evans Letocha and Lisa Mix of the STHC Roundtable and submitted to Council by the Committee on Advocacy and Public Policy. [Posted to HIPAA Resource Page on 27 August 2014]

“The Impact of the HIPAA Privacy Rule on the Ability to Access and Utilize Archives”
Testimony of Nancy McCall before Panel 3—Decedent Health Information, Subcommittee on Privacy and Confidentiality, National Committee on Vital and Health Statistics

Testimony of Stephen Novak
Panel 3—Decedent Health Information, Subcommittee on Privacy and Confidentiality, National Committee on Vital and Health Statistics

Background Articles

“Balancing between two goods: Health Insurance Portability and Accountability Act and ethical compliancy considerations for privacy-sensitive materials in health sciences archival and historical special collections.” by Judtih A. Wiener and Anne T. Gilliland in Journal of the Medical Library Association 99(1):15-22 January 2011

“The Health Insurance Portability and Accountability Act of 1996: Its Implications for History of Medicine Collections” Article by Stephen E. Novak originally published in The Watermark Summer, 2003, Volume XXVI, Number 3

“Access Anxiety: HIPAA and Historical Research” by Susan Lawrence in Journal of the History of Medicine and Allied Sciences, Vol. 62, No. 4. (2007): 422-460.

“Dead or Alive: HIPAA’s Impact on Nursing Historical Research.” by Brigid Lusk and Susan Sacharski in Nursing History Review, vol. 13 (2005): 189-197

“HIPAA, Health Thyself” by Maria Blackburn in Johns Hopkins Magazine vol. 56 no. 5 (November 2004)

“Interpreting Privacy: A Survey of the HIPAA Privacy Rule’s Application in Archives and Precedents for Future Directions” by Erik Moore in Archival Elements Summer 2007

Official Resources

Summary of HIPAA Privacy Rule
Summary prepared by the Office for Civil Rights on the privacy rule of HIPAA. Document is in pdf format

Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule
Detailed information about the “Privacy Rule,” a federal regulation under HIPAA. Document is in pdf format

Medical Privacy – National Standards to Protect the Privacy of Personal Health Information
Information compiled by the Office for Civil Rights. Includes links to the full-text of the HIPAA statute

HIPAA Privacy Rule: Information for Researchers

This web site, compiled by the National Institutes of Health, provides information on the Privacy Rule for the research community. NIH’s Research Repositories, Databases, and the HIPAA Privacy Rule offers useful information for archival repositories

HIPAA Privacy Rule and Public Health
Guidance from CDC and theDepartment of Health and Human Services

National Committee on Vital and Health Statistics Subcommittee on Privacy and Confidentiality
Web site of subcommittee that assist the Department of Health and Human Services on implementation of the health information privacy provisions of HIPAA

Other Resources and Tools for Archivists

Access to Health Information of Individuals
Access Policy of the National Library of Medicine adopted after the implimentation of the HIPAA Privacy Rule in April of 2003.The National Library of Medicine is not a covered entity and their policy may be helpful to other repositories who hold personal health information and are not covered entities

Contextual Integrity and Informed Consent: Providing Web Access to Images of Health and Medicine
A presentation by Phoebe Evans Letocha at the 2009 annual meeting of the Society of American Archivists

Developing the HIPAA-Aware Finding Aid
Poster produced by Nancy McCall and Catherine Arnott Smith and presented at the 2006 annual meeting of the Society of American Archivists. Authors presented findings from their NHPRC Electronic Records Research Fellowship where they examined examined options for archival reference and research that are HIPAA compliant and illustrated how the Clinical Document Architecture (CDA) and EAD might be incorporated to develop a HIPAA-award finding aid

Implications of HIPAA for Archives
Resources maintained by the Alan Mason Chesney Medical Archives of The Johns Hopkins Medical Institutions including their reigstration form, terms of access, and privacy forms for HIPAA.

Are you a Covered Entity?
Charts developed by the Center for Medicare & Medicaid Services to assist you in determining covered entities.

FERPA/HIPAA
Information provided by the University of Miami on the Family Education Rights and Privacy Act (FERPA) and HIPAA