HIPAA Resource Page STHC-ALHHS

STHC

a society of american archivists roundtable

HIPAA Resource Page

Members of the Society of American Archivists Science, Technology & Health Care Roundtable (STHC) and the Archivists and Librarians in the History of the Health Sciences (ALHHS) have compiled this web site to provide information on the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its impact on historical research in libraries, archives, or other records repositories. The information provided here is not intended to be legal advice. Please contact your institution's legal counsel for clarification on HIPAA and access to records in your repository.

Changes in HIPAA Regulations

On January 25, 2013, the Department of Health and Human Services issued major changes in the HIPAA Privacy Regulations. HHS has issued a press release regarding these changes: http://www.hhs.gov/news/press/2013pres/01/20130117b.html

The final rule is available in full in the Federal Register: http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf

These changes include a modification to the definition of Protected Health Information whereby "individually identifiable health information of a person who has been deceased for more than 50 years is not protected health information under the Privacy Rule."

The most relevant section in the Federal Register regarding the change in the Period of Protection for Decedent Information can be found on p. 5613-5614 or here: https://www.federalregister.gov/articles/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the#h-203

Effective date: This final rule is effective on March 26, 2013. Compliance date: Covered entities and business associates must comply with the applicable requirements of this final rule by September 23, 2013.

Archivists with responsibility for records subject to HIPAA are urged to consult with legal counsel regarding the implications of all of the changes. Analysis of these changes will be posted to the HIPAA resource page as it becomes available.

Advocacy

"The Impact of the HIPAA Privacy Rule on the Ability to Access and Utilize Archives": Testimony of Nancy McCall before Panel 3--Decedent Health Information, Subcommittee on Privacy and Confidentiality, National Committee on Vital and Health Statistics
Testimony of Stephen Novak: Panel 3--Decedent Health Information, Subcommittee on Privacy and Confidentiality, National Committee on Vital and Health Statistics

Background Articles

"The Health Insurance Portability and Accountability Act of 1996: Its Implications for History of Medicine Collections" Article by Stephen E. Novak originally published in The Watermark Summer, 2003, Volume XXVI, Number 3; "Dead or Alive: HIPAA's Impact on Nursing Historical Research." by Brigid Lusk and Susan Sacharski in Nursing History Review, vol. 13 (2005): 189-197
"HIPAA, Health Thyself" by Maria Blackburn in Johns Hopkins Magazine vol. 56 no. 5 (November 2004)

"Interpreting Privacy: A Survey of the HIPAA Privacy Rule's Application in Archives and Precedents for Future Directions" by Erik Moore in Archival Elements Summer 2007

Official Resources

Summary of HIPAA Privacy Rule: Summary prepared by the Office for Civil Rights on the privacy rule of HIPAA. Document is in pdf format
Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule: Detailed information about the "Privacy Rule," a federal regulation under HIPAA. Document is in pdf format
Medical Privacy - National Standards to Protect the Privacy of Personal Health Information: Information compiled by the Office for Civil Rights. Includes links to the full-text of the HIPAA statute
HIPAA Privacy Rule: Information for Researchers: This web site, compiled by the National Institutes of Health, provides information on the Privacy Rule for the research community. NIH's Research Repositories, Databases, and the HIPAA Privacy Rule offers useful information for archival repositories
HIPAA Privacy Rule and Public Health: Guidance from CDC and theDepartment of Health and Human Services
National Committee on Vital and health Statistics Subcommittee on Privacy and Confidentiality: Web site of subcommittee that assist the Department of Health and Human Services on implementation of the health information privacy provisions of HIPAA

Other Resources and Tools for Archivists

Access to Health Information of Individuals: Access Policy of the National Library of Medicine adopted after the implimentation of the HIPAA Privacy Rule in April of 2003.The National Library of Medicine is not a covered entity and their policy may be helpful to other repositories who hold personal health information and are not covered entities
Contextual Integrity and Informed Consent: Providing Web Access to Images of Health and Medicine: A presentation by Phoebe Evans Letocha at the 2009 annual meeting of the Society of American Archivists
Developing the HIPAA-Aware Finding Aid: Poster produced by Nancy McCall and Catherine Arnott Smith and presented at the 2006 annual meeting of the Society of American Archivists. Authors presented findings from their NHPRC Electronic Records Research Fellowship where they examined examined options for archival reference and research that are HIPAA compliant and illustrated how the Clinical Document Architecture (CDA) and EAD might be incorporated to develop a HIPAA-award finding aid
Implications of HIPAA for Archives: Resources maintained by the Alan Mason Chesney Medical Archives of The Johns Hopkins Medical Institutions including their

reigstration form, terms of access, and privacy forms for HIPAA.
Are you a Covered Entity?: Charts developed by the Center for Medicare & Medicaid Services to assist you in determining covered entities.
FERPA/HIPAA: Information provided by the University of Miami on the Family Education Rights and Privacy Act (FERPA) and HIPAA

Updated 6 February 2013