1. Presentation to Society of American Archivists
How Privacy-Aware Descriptive Practices Can Promote Access and Use of Protected Information
Presentation to Society of American Archivists
August 14, 2014
Phoebe Evans Letocha
Alan Mason Chesney Medical Archives Johns Hopkins Medical Institutions

2. SAA HIPAA Issue Brief
The Public’s Right to Personal Privacy in Certain Categories of Records
An individual’s right to privacy with regard to certain information—such as records mandated by government, attorney-client records, and medical records— historically has been weighed against the public’s right to information. Personal privacy should be respected throughout an individual’s lifetime in appropriate ways. Documents recording private information about living Americans should be disclosed involuntarily only when disclosure accomplishes a greater public purpose. At the same time access to documents that contain private health information may be necessary for historians and other researchers who create significant and sometimes policy-shaping work based on these primary sources, and therefore a balance must be struck between privacy concerns and access to such records.

3. Definition: Protected Health Information
PHI is individually identifiable health information transmitted or maintained in any form or medium (electronic, oral, or paper) by a covered entity or its business associates, excluding certain educational and employment records and excluding information on those individuals who have been deceased for longer than 50 years.

4. Other protections for health information
Repositories within HIPAA covered and non-covered entities must also:
Comply with state laws applying to medical records and health information in holdings
Comply with the Federal Common Rule for Protection of Human Subjects
Adhere to institutional requirements for protection of health information
Observe donor agreements for protecting health privacy
Even if not subject to HIPAA, examine the ethical considerations related to the access and use of health information

5. Information may still be protected by State Medical Records Statutes
HIPAA does not define the term “Medical Record”
Medical records traditionally include:
Unit medical record, whether paper or electronic, usually held by hospital medical records office or other provider based centralized filing systems
Other records used to make health care decisions about the individual patient

6. Determining if information came from a medical record
Medical Records could also include:
Correspondence (including ) containing patient-provider or provider-provider communications regarding care or treatment of specific patients
Research notes regarding treatment for specific patients
Patient diagnostic images
Gray areas may include:
Patient Logbooks
Patient Diagnostic Indices
Research records that include health information but were not used to make health care decisions about individuals

7. Patient Records as Hidden Collections

8. Primary holders of health information
Health care providers
Health systems, hospitals, clinics, group practices, individual providers
Health care clearinghouses
Billing services, community health information systems
Health plans
Group, individual health insurance, Medicare, Medicaid

9. Secondary holders of health information
Hospital archives
Archives of academic health centers
College and university archives
Corporate archives
Research libraries
Federal repositories
State and local repositories

10. Patient Related Materials = Hidden Collections
Fewer resources devoted to processing
Hidden to archivists as well as researchers because not in catalogs
Lack of adequate description

11. Adolf Meyer Collection: Series XV
Extent: 70 cubic feet (100 boxes)
Sub-Series include:
Patient Correspondence
Patient Index Cards
Medical Records and other documents related to Special Research Topics
Consultations on Legal Cases

12. Pediatric Diagnostic Index
Key tool for identifying relevant Pediatric Medical Records by diagnosis.

13. Victor McKusick Collection
Scope and Content:
The Victor McKusick Collection spans his entire career at Johns Hopkins. It documents his various activities as clinician, researcher, teacher, and administrator. The collection includes professional correspondence, research data, photographs, lecture notes, financial records, student records, reprints, manuscripts, audio tapes, committee minutes, patient records, slides, diplomas, and awards. Also included are family papers, including biographical information, undergraduate notes, and transcripts of interviews with McKusick and family members.

15. Records of the Brady Urological Institute
Entire Collection consists of Medical Records.
Description prepared by Julie Adamo, National Library of Medicine Associate Fellow in 2012.

16. Hugh Hampton Young Collection

17. William Osler Collection: Notes on Medical Conditions

18. Access Anxiety as a barrier to research

19. What is Research?
Definition of Research under the HIPAA Privacy Rule and the Federal Common Rule
A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.

20. Authorizations for access under the HIPAA Privacy Rule
Individual authorizations
Subject of health information
Legal representative of subject of health information
Institutional authorizations for research
Waivers issued by Privacy Board or IRB for research involving living individuals
Research on decedents
Review preparatory to research
Data use agreement for limited data sets
Other allowable institutional uses or disclosures
Treatment, payment, and health care operations
Health care emergencies, law enforcement and government oversight

22. Privacy Board at JHMI
Joint institutional board of The Johns Hopkins Hospital and the Johns Hopkins University schools of Medicine, Nursing, and Public Health for access to records, data, and information held by:
Alan Mason Chesney Medical Archives of the Johns Hopkins Medical Institutions
Health Information Management Division of The Johns Hopkins Hospital (for access to medical records created more than 50 years ago)
Department of Art as Applied to Medicine
Allows research using these institutional materials when it is legally and ethically responsible to do so
Administered by the Medical Archives
Individuals both affiliated and not affiliated with Johns Hopkins are eligible to submit applications.

23. Analysis of Privacy Board applications at Johns Hopkins April 2003- July 2014
243 numbered cases
210 approved (86% of all cases, 96% of reviewed cases)
8 not approved
24 application incomplete and not submitted for review (10%)

24. Analysis of Privacy Board applications at Johns Hopkins April 2003- July 2014
Researcher Profile
Mostly outside researchers
26% Hopkins Researchers
74% Outside Hopkins (includes international researchers)

25. Analysis of Privacy Board applications at Johns Hopkins April 2003- July 2014
86 cases requested access to patient related materials (35%)
Requests for patient materials have increased since 2011 to 49% of all cases
Privacy board waivers have enabled the Medical Archives to provide access to unprocessed collections

26. Phoebe Evans Letocha Presenter ALHHS/SAA HIPAA resource page
Collections Management Archivist
Alan Mason Chesney Medical Archives
of the Johns Hopkins Medical Institutions
ALHHS/SAA HIPAA resource page