how privacy-aware descriptive practices can promote access and use of protected information

26
How Privacy-Aware Descriptive Practices Can Promote Access and Use of Protected Information Presentation to Society of American Archivists August 14, 2014 Phoebe Evans Letocha Alan Mason Chesney Medical Archives Johns Hopkins Medical Institutions [email protected]

Upload: larissa-mcintosh

Post on 30-Dec-2015

22 views

Category:

Documents


0 download

DESCRIPTION

How Privacy-Aware Descriptive Practices Can Promote Access and Use of Protected Information. Presentation to Society of American Archivists August 14, 2014 Phoebe Evans Letocha Alan Mason Chesney Medical Archives Johns Hopkins Medical Institutions [email protected]. SAA HIPAA Issue Brief. - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

How Privacy-Aware Descriptive Practices Can

Promote Access and Use of Protected Information

Presentation to Society of American ArchivistsAugust 14, 2014

Phoebe Evans LetochaAlan Mason Chesney Medical Archives

Johns Hopkins Medical [email protected]

Page 2: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

SAA HIPAA Issue BriefThe Public’s Right to Personal Privacy in Certain Categories of Records

An individual’s right to privacy with regard to certain information—such as records mandated by government, attorney-client records, and medical records—historically has been weighed against the public’s right to information. Personal privacy should be respected throughout an individual’s lifetime in appropriate ways. Documents recording private information about living Americans should be disclosed involuntarily only when disclosure accomplishes a greater public purpose. At the same time access to documents that contain private health information may be necessary for historians and other researchers who create significant and sometimes policy-shaping work based on these primary sources, and therefore a balance must be struck between privacy concerns and access to such records. http://www2.archivists.org/sites/all/files/0814-1-III-A-IssueBrief-HIPAA.pdf

Page 3: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Definition: Protected Health Information •PHI is individually identifiable health information

transmitted or maintained in any form or medium (electronic, oral, or paper) by a covered entity or its business associates, excluding certain educational and employment records and excluding information on those individuals who have been deceased for longer than 50 years.

Page 4: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Other protections for health information

Repositories within HIPAA covered and non-covered entities must also:• Comply with state laws applying to medical records and health

information in holdings• Comply with the Federal Common Rule for Protection of Human

Subjects• Adhere to institutional requirements for protection of health

information• Observe donor agreements for protecting health privacy• Even if not subject to HIPAA, examine the ethical considerations related

to the access and use of health information

Page 5: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Information may still be protected by State Medical Records Statutes

HIPAA does not define the term “Medical Record”

Medical records traditionally include:• Unit medical record, whether paper or electronic, usually held by hospital medical

records office or other provider based centralized filing systems• Other records used to make health care decisions about the individual patient

Page 6: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Determining if information came from a medical record

Medical Records could also include:• Correspondence (including email) containing patient-provider or provider-provider

communications regarding care or treatment of specific patients• Research notes regarding treatment for specific patients• Patient diagnostic imagesGray areas may include:• Patient Logbooks• Patient Diagnostic Indices• Research records that include health information but were not used to make health

care decisions about individuals

Page 7: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Patient Records as Hidden Collections

Page 8: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Primary holders of health information

• Health care providersHealth systems, hospitals, clinics, group practices, individual providers

• Health care clearinghousesBilling services, community health information systems

• Health plansGroup, individual health insurance, Medicare, Medicaid

Page 9: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Secondary holders of health information

• Hospital archives

• Archives of academic health centers

• College and university archives

• Corporate archives

• Research libraries

• Federal repositories

• State and local repositories

Page 10: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Patient Related Materials = Hidden Collections

• Fewer resources devoted to processing•Hidden to archivists as well as researchers because

not in catalogs• Lack of adequate description

Page 11: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Adolf Meyer Collection: Series XVSeries XV• Extent: 70 cubic feet (100 boxes)• Sub-Series include:

• Patient Correspondence • Patient Index Cards • Medical Records and other

documents related to Special Research Topics

• Consultations on Legal Cases

http://www.medicalarchives.jhmi.edu/sgml/amg-d.htm

Page 13: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Victor McKusick CollectionScope and Content:The Victor McKusick Collection spans his entire career at Johns Hopkins. It documents his various activities as clinician, researcher, teacher, and administrator. The collection includes professional correspondence, research data, photographs, lecture notes, financial records, student records, reprints, manuscripts, audio tapes, committee minutes, patient records, slides, diplomas, and awards. Also included are family papers, including biographical information, undergraduate notes, and transcripts of interviews with McKusick and family members.

http://www.medicalarchives.jhmi.edu/papers/mckusick.html

Page 14: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information
Page 15: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Records of the Brady Urological Institute

Entire Collection consists of Medical Records.

Description prepared by Julie Adamo, National Library of Medicine Associate Fellow in 2012.

http://www.medicalarchives.jhmi.edu/finding_aids/brady_institute/brady_instituted.html

Page 18: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Access Anxiety as a barrier to research

Page 19: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

What is Research?

Definition of Research under the HIPAA Privacy Rule and the Federal Common Rule

• A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.

Page 20: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Authorizations for access under the HIPAA Privacy Rule

• Individual authorizations – Subject of health information– Legal representative of subject of health information

• Institutional authorizations for research– Waivers issued by Privacy Board or IRB for research involving living individuals– Research on decedents– Review preparatory to research– Data use agreement for limited data sets

• Other allowable institutional uses or disclosures– Treatment, payment, and health care operations– Health care emergencies, law enforcement and government oversight

Page 21: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information
Page 22: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Privacy Board at JHMI

• Joint institutional board of The Johns Hopkins Hospital and the Johns Hopkins University schools of Medicine, Nursing, and Public Health for access to records, data, and information held by:– Alan Mason Chesney Medical Archives of the Johns Hopkins Medical Institutions– Health Information Management Division of The Johns Hopkins Hospital (for access to medical

records created more than 50 years ago)– Department of Art as Applied to Medicine

• Allows research using these institutional materials when it is legally and ethically responsible to do so

• Administered by the Medical Archives• Individuals both affiliated and not affiliated with Johns Hopkins are eligible to submit

applications.

Page 23: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Analysis of Privacy Board applications at Johns HopkinsApril 2003- July 2014

• 243 numbered cases • 210 approved (86% of all

cases, 96% of reviewed cases)

• 8 not approved • 24 application incomplete

and not submitted for review (10%)

20032004

20052006

20072008

20092010

20112012

20132014

0

5

10

15

20

25

30

total number of cases

number approved

number de-clined/on hold

Page 24: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Analysis of Privacy Board applications at Johns HopkinsApril 2003- July 2014

Researcher Profile• Mostly outside researchers – 26% Hopkins Researchers– 74% Outside Hopkins (includes

international researchers)47%

8%

25%

20%

Rank

Faculty

Student: Undergraduate

Students: Graduate and Postdoc

Independent and others

Page 25: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Analysis of Privacy Board applications at Johns HopkinsApril 2003- July 2014

• 86 cases requested access to patient related materials (35%)– Requests for patient

materials have increased since 2011 to 49% of all cases

• Privacy board waivers have enabled the Medical Archives to provide access to unprocessed collections

0

20

40

60

80

100

120

Patient Related MaterialsNot Patient Related

Page 26: How Privacy-Aware  Descriptive Practices Can Promote Access and Use of Protected Information

Presenter

Phoebe Evans LetochaCollections Management [email protected]

Alan Mason Chesney Medical Archives of the Johns Hopkins Medical Institutions

ALHHS/SAA HIPAA resource pagewww.alhhs.org/hipaa_sthc_alhhs.html