In compliance with the HIPAA Privacy and Information Security rules enacted in 2003, access to records containing protected health information (PHI) held by Archives & Special Collections is regulated by the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The Privacy Rule [45 CFR Parts 160 & 164] establishes the conditions under which records containing PHI may be used or disclosed for research purposes [45 CFR §164.512 (i)].
All researchers seeking to use records that may be presumed to contain PHI must follow the following procedures to gain access to these materials.
Protected Health Information (PHI) is individually identifiable health information created or transmitted in any form by a covered entity. A covered entity is a health care provider, health care plan, or health care clearinghouse which transmits health information. Any records which Archives & Special Collections staff identifies as containing PHI are subject to the provisions of the HIPAA Privacy Rule.
Access to records held by Archives & Special Collections not created by covered entities, but still containing personally identifiable health information, may be restricted to protect patient privacy.
I. De-identified Access to Archives
All access to records containing PHI of deceased or living individuals should first proceed as de-identified research whereby the Head, Archives & Special Collections, or in his/her absence, the Archivist (Head/Archivist), will permit access upon the submission of Form G: “Investigator’s Certification for Research with De-identified Data”.
In addition to Form G, the Confidentiality Agreement for Access to Records Containing Protected Health Information, must also by completed by the researcher. Both forms may be obtained upon arrival at Archives & Special Collections.
The de-identified exception contemplates the removal of 18 different identifiers which removes any potential of re-identification. No publication or removal of identified data is permitted under this exception. In cases where the researcher needs to publish any of these identifiers, access can only be granted pursuant to procedures outlined in II or III below.
II. Research Access to the Protected Health Information of Living Individuals
Permission to access the PHI of individuals presumed to be living for research purposes where the procedures outlined in I. above cannot be used is only permitted where the subject of the research has authorized such access and use of their PHI.
Researcher requests made in this manner must submit Form A to the Privacy Officer at HIPPA@columbia.edu or to the Head/Archivist at firstname.lastname@example.org. No access will allowed until the Privacy Officer of the Columbia University Medical Center has approved the request. For those without a Columbia University or New York-Presbyterian Hospital affiliation, access to Form A must be obtained through either the Privacy Officer or the Head/Archivist.
III. Research Access to Decedents' Protected Health Information
For access to the records containing the PHI of individuals deceased for less than 50 years where the procedures outlined in I. above cannot be used, the Privacy Officer will review requests for identified decedent data as an exception to the policies outlined above on a case-by-case basis. It is unlikely that permission to publish the PHI of a decedent who has been deceased for less than 50 years will be granted without documented legal permission from a legal representative of the decedent’s estate.
Provisions of the HITECH Act of 2013 lift the HIPAA protection for individually identifiable health information of those known to be deceased for 50 years or more. However, Archives & Special Collections reserves the right in certain cases to restrict access in part or in whole to individual health information found in its collections.
Approved by Office of HIPAA Compliance, Columbia University Medical Center, Sept. 10, 2003; revision approved, Oct. 27, 2005; updated May 14, 2014.
IV. Further Reading
The Archivists and Librarians in the History of the Health Sciences and the Science, Technology & Health Care Section of the Society of American Archivists maintain a "HIPAA Resource Page" on the website of the ALHHS (see link in left-hand column on the site). It contains links to Dept. of Health & Human Services official publications regarding HIPAA and articles by archivists and historians on the impact of the HIPAA Privacy Rule on archives and historical research.