How should IRBs approach privacy in medical archives?
Archivist recommends focusing on the living
In the absence of changes to HIPAA that would clarify the use of the privacy rule in historical medical archives, institutions, archivists and IRBs are left to sort through the complicated issues themselves.
While much of the decision-making may be in the hands of an institution's lawyers, Cornell University Medical Center Head Archivist Jim Gehrlich says there are some practical points that IRBs should consider when faced with this issue.
"My suggestion is that the IRB not be involved with anything that involves decedents and HIPAA," he says. "The privacy rule allows for that. It specifically says that if a researcher is dealing exclusively with PHI (protected health information) of decedents, it doesn't have to go to the IRB."
Gehrlich says that at some institutions, IRBs have insisted on taking responsibility for these requests, without proper background in historical research.
"It would be better if they let go of it — that would be the best of all worlds," he says.
If an IRB is put in a situation of reviewing such privacy waiver requests, Gehrlich says the board needs to seek out the necessary expertise, ideally from the institution's archivist, but also in allowing historians on the IRB who can offer the perspective of those conducting research in medical archives.
At Johns Hopkins Medical Institutions in Baltimore, MD, head archivist Nancy McCall says she's trying to figure out new ways of accommodating research requests while holding strictly to HIPAA's privacy requirements.
McCall says colleagues in medical informatics have found that historical case files and operative notes that used some kind of standardized form can be de-identified in a similar way to contemporary electronic files.
"The identifiers can be stripped without diminishing the intellectual content of the body of the document," she says. "That's what we found very exciting." She says this type of technology could make it possible for an archive to put up older, de-identified case files on the Internet for scholars to study.
For biographical and personal papers that would be more difficult to redact, McCall says she's considering offering a paid service to researchers, in which her staff could comb through the necessary documents, remove the information a researcher needs and prepare a report for the researcher.
"Our staff are all HIPAA certified — we've taken courses, passed exams, and are in a category to be working with this kind of information," she says. "When somebody is really interested in some intellectual dialogue in the correspondence of [eminent physicians], then we could go into that series and quote all the material that has nothing to do with PHI. The onus would be on our staff to demonstrate that we just provide the researcher with the [proper] information."
Archivists at many institutions are also having serious discussions with those intending to donate collections, to explain the HIPAA implications of their gift.
"Quite often, the children turn over the materials," McCall says. "We have to ask them whether they want their parents' health information, or their own health information, revealed. And they are startled that we would even be thinking about this. We have to show them, here is where [the documents show] you broke your leg at this age."
Because HIPAA's privacy protections apply only to covered entities such as hospitals and medical schools, some archivists have even suggested to donors that their collections may be better off in the hands of a non-covered entity such as a state historical society.
"If it's an individual physician who wants to donate his office records, which include patient case records to an institution, I've explained the implications — that the records would be handled differently if they came to us than if they went to a historical society, because the historical society is not covered," Gehrlich says.
Members of the Society of American Archivists Science, Technology and Health Care Roundtable and the Archivists and Librarians in the History of the Health Sciences have compiled a Web site to address the impact of HIPAA on medical archives. Access the site at: http://www.library.vcu.edu/tml/speccoll/hipaa.html
In the absence of changes to HIPAA that would clarify the use of the privacy rule in historical medical archives, institutions, archivists and IRBs are left to sort through the complicated issues themselves.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content