5. The Center: A Non-HIPAA Covered EntityHopkins: HIPAA-covered Entity Health information is access-protected per institutional policy and is dependent on the risk tolerance of the institution. Records are restricted 80 years from the date of record creation. Health information about individuals containing specific identifiers is access protected; applies to any institution that is deemed a HIPAA-covered entity or Business Associate. Records open after 50 years from the date of death of the individual. Must adhere to state medical records laws depending on the provenance of records or whether records are on deposit Must adhere to state medical records laws; the more restrictive law applies Other restrictions may apply: Institutional mandate (50 or 80 years) FERPA (for academic institutions) Donor/Depositor (Variable) United States government records found in manuscript collections (Variable) Local policy (50 or 80 years) Personally identifying information that could enable identity theft or fraud “Like records” restrictions Other restrictions may apply: Institutional mandate FERPA (for academic institutions) Donor/Depositor United States government records found in manuscript collections Local policy

11. 1.Patient histories (91.67%) 2.Case files 3.Correspondence 4.Patient questionnaires 5.Patient summaries 6.Consultation files 7.Family medical histories 8.Admission/registration record 9.Diagnostic indices 10.Photographs/medical imaging 11.Informed consent records (43.75%) 12. Autopsy records (40.43%) 13.Lab notebooks 14.Prescription books/logs 15.Research protocols 16.Hospital policies 17. Graphs and charts 18. Surgical logbooks 19. Microscope slides/specimens 20. Billing information 21. Genetic testing records 22. Immunization records 23. Insurance records (12.5%)

15. Center for the History of Medicine, Countway Library emily_gustainis@hms.harvard.edu Alan Mason Chesney Medical Archives of the Johns Hopkins Medical Institutions pletocha@jhmi.edu