Rule creates headaches for historical medical archives
Archivists and IRBs deal with the fallout
The archives of medical colleges and hospitals can be a rich source of information for historians interested in how health care has been delivered throughout our nation's history. Old case files, collections of physicians' personal papers, even old photographs were donated to archives so that others could learn from them decades later.
But historians have run into a roadblock at some archives, as archivists, lawyers and IRBs apply the privacy rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The documents so full of fascinating details about health care in the past century are also scattered with individuals' protected health information (PHI) — sometimes in unanticipated places.
As a result, institutions that hold archival documents face difficult decisions. Do they close the files to researchers, or spend valuable staff time redacting them so that they pass HIPAA muster? Or do they allow access, gambling that any disclosures are for people long dead and unlikely to complain?
For now, institutions are taking different approaches — some restricting access, some involving IRBs or privacy boards in decisions about waivers of authorization to disclose PHI. Some are allowing access to parts of their archives, but not to other sections.
"It's about the interpretation of the lawyers, and lawyers think differently," says Jim Gehrlich, head archivist for Cornell University Medical Center in Ithaca, NY. "There's no case law out there [on this topic], and so some institutions will say since there is no case law, we'll be strict constructionists and hold to HIPAA exactly as it is. Others will be loose constructionists."
While institutions appear to be making these differing interpretations of HIPAA work, the inconsistencies in access are frustrating some researchers who complain that records available at one medical archive might be closed at another.
Karin Rosemblatt, PhD, an associate professor of history at Syracuse University, Syracuse, NY, described her difficulty in gaining access to records of psychological and educational tests conducted on American Indian children during World War II. The records were held at the Smithsonian Institution, which withheld the records, citing HIPAA concerns.
"I should say that I have worked with similar, if not exactly the same type of documents at other archives that handle it differently," she says.
Rosemblatt, who was researching the anthropologist who conducted the tests, offered to sign a confidentiality statement, and asked to see only the questionnaire involved in the testing but still was denied access.
She says the refusal to allow researchers access to these types of collections ignores the wishes of the scientists who donated them to the institutions. And she worries that closing historical medical records can keep important issues from coming to light.
"For example, would we ever know, under the HIPAA regulations, about Tuskegee?" Rosemblatt says, of the infamous Tuskegee Syphilis Study. "The researchers who uncovered that did so by having access to those records."
Stephen Novak, head of archives and special collections for the Augustus C. Long Health Sciences Library at Columbia University, New York City, has a different fear.
Novak notes that larger institutions such as his own have the money, staff and expertise to deal with HIPAA.
"But a lot of smaller places are holding records that, in some ways, may be much more representative of the type of medical care that was administered in late 20th and early 21st century United States," he says. "Those [documents] could be destroyed because these places don't have that kind of infrastructure, and they just don't want to have to deal with it. Patient records don't need to be kept permanently and they are a pain in the neck to keep. This may be just one more reason to get rid of them."
In 2005, Novak testified before a privacy subcommittee of the U.S. Department of Health and Human Services, asking for more clarity in the HIPAA ruling regarding historical medical records. Among his requests was an expiration date that would clearly identify when older records would no longer fall under HIPAA's privacy requirements.
"It looks as if that's not going to go anywhere," he says. "HHS does not seem to be interested in modifying HIPAA on those lines, and I'm not sure it ever will be."
PHI hiding in old files
To get an idea of why the issue of PHI in historical records can be so thorny, consider some of the types of documents held by the archives of the Johns Hopkins Medical Institutions, in Baltimore, MD:
- Log books dating back to the very first admissions to and discharges from the hospital. Entries ordinarily would include names, addresses, birthdates, and diagnoses.
- A collection of more than 80,000 photographic images, including formal portraits of physicians and students, photos taken on the wards, and a large number of individual patient photos, linked to patient records. These photos may illustrate injuries or genetic anomalies.
- Personal paper collections donated by faculty and staff, often physicians who have been eminent in their fields. The papers normally would include case files, research files, and correspondence files.
Nancy McCall, director of Hopkins' Alan Mason Chesney Medical Archives, says these personal papers can be important tools for physicians and researchers.
McCall says that while PHI can be found throughout much of the personal papers donated by physicians, it's the correspondence files that can be the most troublesome when it comes to the privacy rule.
"Whatever the reason for the letter, health professionals writing to each other seem inevitably to talk about their health, the health of their families, as well as discuss a patient. It's all over the place," McCall says.
She says some of the information can be extremely personal.
"We find things like euphemisms for abortion from the 1930s that students studying the documents may not always recognize," McCall says. "And some of these people are still living."
Novak agrees, saying problematic information can turn up in unexpected places.
"You're processing these papers and, in the middle of it, the doctor will write: 'I have seen Mrs. So-and-so, whom you referred to me, and she's suffering from paranoid schizophrenia.'
"The researcher using those papers is not looking for Mrs. So-and-so, almost certainly. They're looking because they're interested in the doctor."
Novak asks researchers using the collections to sign a form agreeing not to identify people whose information they run across in this way.
"If they want to use a pseudonym, it's fine," he says. "Usually most researchers don't have a problem with that. Does it satisfy HIPAA? Well, we're not absolutely sure, but it's the best we can do. Otherwise, we couldn't use any of these things."
Novak notes that in many cases, the people described in the archive documents are almost certainly dead, and HIPAA does have provisions for dealing with PHI from deceased subjects.
"What most archives have generally done is set an arbitrary date," he says. "We assume people to be deceased if it's 100 years after date of birth, if that's included in the record, or the date of record creation, whichever occurs first. Records of people who received care 100 years ago or more we consider dead, and they have a different procedure to follow than those whom are considered to be living.
"That still doesn't mean that the researcher can use the name, it just means that the access is different, the procedure, the forms are different."
To IRB or not to IRB?
Novak says his archive currently does not involve the IRB in decisions about what to release to researchers.
"When HIPAA first came up, we did talk about that and, at one point, there was some discussion about having a historian on the IRB in case these requests came up," he says. "Eventually, it was decided that this was not a problem dangerous or sensitive enough that the IRB had to be involved. That was a possibility I was completely comfortable with, but the lawyer decided it wasn't necessary."
At Cornell, researchers seeking to do work involving individuals who are deceased (or whose records are 100 years old or more) must simply sign a form, Gehrlich says. Anyone with a proposal to investigate files of people who are still living must go through the IRB.
Gehrlich says that HIPAA actually has made such requests at his institution less complicated.
"I have the simple form, the person signs the form, says that they're doing research on decedents and, once they sign that form, I don't have any other worries," he says.
At Hopkins, the institution's lawyer determined that it would be best for a privacy board to review any requests for research that would require access to documents containing PHI.
"The applicant fills out a form that requires an abstract of the research protocol and their [curriculum vitae] and that is reviewed by the privacy board and a decision is made about whether to issue a waiver of authorization to conduct research," McCall says. "An institutional body (an IRB or a privacy board) would have to issue the waiver — the archives itself could not issue the waiver."
That interpretation of HIPAA has not been universally popular, she says.
"A number of historians have essentially blamed us, the archives, for this, because we did the interpretation at Hopkins," McCall says. "We've had to take a lot of grief that it's all our fault, that it's our screwy interpretation."
She says the experience implementing HIPAA in the archives has been educational, both for her and for the privacy board.
"I would say that each case brings up different issues that we had not anticipated," she says. "We have some really good people on the privacy board, but they don't know much about the older documentation and how this applies.
"It's a very good group — we learn a lot from each other," McCall says. "But this is the kind of thing that could never be put into a cookie-cutter process. That's what's so difficult with privacy issues because they're seldom issues that are simply black and white. We've never had a ho-hum meeting."
Novak points out that institutions such as his at least have the infrastructure to deal with these complicated issues. At a smaller institution, which may be served by a single reference librarian and an IRB unfamiliar with historical medical documents, things could be more difficult.
"If an historian or biographer or sociologist comes to them, they're going to say, 'What are we going to do with this?'"
The archives of medical colleges and hospitals can be a rich source of information for historians interested in how health care has been delivered throughout our nation's history. Old case files, collections of physicians' personal papers, even old photographs were donated to archives so that others could learn from them decades later.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content