Since April 2003, access to records containing protected health information (PHI) held by Archives & Special Collections is regulated by the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The Privacy Rule [45 CFR Parts 160 & 164] establishes the conditions under which records containing PHI may be used or disclosed for research purposes [45 CFR §164.512 (i)].
All researchers seeking to use records that may be presumed to contain PHI must follow the following procedures to gain access to these materials.
Definition
Protected health information (PHI) is individually identifiable health information created or transmitted in any form by a covered entity. A covered entity is a health care provider, health care plan, or health care clearinghouse which transmits health information. Any records which Archives & Special Collections staff identifies as containing PHI are subject to the provisions of the HIPAA Privacy Rule.
Access to records not created by covered entities, but still containing personally identifiable health information, may be restricted to protect patient privacy.
I. De-identified Access to Archives
All access to records containing PHI of deceased or living individuals should first proceed as de-identified research whereby the Head, Archives & Special Collections, or in his/her absence, the Archivist (Head/Archivist), will permit access upon the submission to the Head/Archivist of Form G: “Investigator’s Certification for Research with De-identified Data”.
Form G may be found at: https://www.rascal.columbia.edu/comply/hipaa.html.
In addition to Form G, the Confidentiality Agreement for Access to Records Containing
Protected Health Information must also be signed.
The de-identified exception contemplates the removal of 18 different identifiers which removes any potential of re-identification. No publication or removal of identified data is permitted under this exception. In cases where the researcher needs to publish any of these identifiers, access can only be granted pursuant to procedures outlined in II or III below.
II. Research Access to the Protected Health Information of Living Individuals
Permission to access the PHI of individuals presumed to be living for research purposes where the procedures outlined in I. above cannot be used, is only permitted where the subject of the research has authorized such access and use of their PHI.
Researcher requests made in this manner must submit Form A to the Privacy Officer at jd2086@columbia.edu or to the Head/Archivist. No access will allowed until the Privacy Officer of the Columbia University Medical Center has approved the request.
Form A may be found at: https://www.rascal.columbia.edu/comply/hipaa.html
III. Research Access to Decedents' Protected Health Information
For access to the records containing the PHI of deceased individuals where the procedures outlined in I. above cannot be used, the Privacy Officer will review requests for identified decedent data as an exception to the policies outlined above on a case-by-case basis. It is unlikely that permission to publish the PHI of a decedent will be granted without documented legal permission from a legal representative of the decedent’s estate.
Individuals will be presumed to be deceased 100 years after date of birth or date of record creation, whichever occurs first.
Approved by Vice President for HIPAA Compliance, Columbia University Medical Center, Sept. 10, 2003; revision approved, Oct. 27, 2005
| Library Home |
 |
| Archives Home | |
| About | |
| Collections | |
| Finding Aids | |
| Columbia University Medical Center History |
|
| Databases | |
| Gallery & Online Exhibits | |
