Letter Urges Reconsideration of HIPSA’s Perpetual Privacy Restrictions

The following letter was sent to individual members of the Senate’s Health, Education, Labor, and Pensions (HELP) Committee in response to introduction of S. 1814, The Health Information Privacy and Security Act of 2007, authored by Senators Kennedy and Leahy.

November 27, 2007

Dear Senator:

As the presidents of the Society of American Archivists (SAA), the American Association for the History of Medicine (AAHM), and Archivists and Librarians in the History of the Health Sciences (ALHHS), we are writing to express the concern of our combined 6,500 members about certain provisions of S. 1814, The Health Information Privacy and Security Act of 2007 (HIPSA), recently referred to the Health, Education, Labor, and Pensions Committee.  America’s archivists are professionals – working in institutions as disparate as hospitals and governments, churches and historical societies, businesses and universities – who daily practice on the line between reasonable access to historical documentation and necessary protections of individual privacy.  We serve historians and other researchers who create significant and sometimes policy-shaping work based on inactive primary sources as well as the creators of those sources (including the consumers whose health information comprises basic medical records). 

We are aware of and concerned about the unprecedented risks to individual privacy that exist in the digital era.  Never before have so many had access to such an extensive amount of information, nor have they had the ability to reproduce and instantaneously disseminate it on such a large scale without the benefit of peer review.  But we have strong reservations about the degree to which HIPSA’s provisions will remedy what its authors view as weaknesses in HIPAA’s privacy provisions by throwing a universal and perpetual blanket of secrecy over identifiable health information of any kind, past or present.

In particular we are alarmed by Section 3, Definitions, (25)(A):

In general.—The term ‘protected health information’ means any information, including genetic information, biometric information, demographic information, and tissue samples collected from an individual, whether oral or recorded in any form or medium, that—(i) is created or received by a health care provider, health researcher, health plan, health or life insurer, medical or health savings plan administrator, school or university, health care clearinghouse, health oversight agency, public health authority, employer, data broker, or other person or such person’s agent, officer, or employee; and (ii)(I) relates to the past, present, or future physical or mental health or condition of an individual (including individual cells and their components), the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and (II)(aa) identifies an individual; or (bb) with respect to which there is a reasonable basis to believe that the information can be used to identify and individual.

To cite but a few examples, this definition – and those other portions of the Act that impose penalties – will make it a punishable offense for 1) a university special collections department to make available to researchers the records of a Revolutionary War field hospital, a 19th century pharmacy register, or the diary of a rural doctor from 1911; 2) the archives of a hospital to make available its 18th and 19th century patient and diagnostic records to those researchers wishing to examine patterns of illness linked to race or socio-economic status; or 3) the archives of a 300-year-old insurance corporation to open its oldest records for study by historians, sociologists, or economists. 

It is impractical for the staff of such repositories to “de-identify” health information in all types of documents so that it may not be used to identify an individual.  Further, for many types of studies the removal of identifiers devalues the usefulness of the information and compromises the scope of research.  Researchers have matched treatment records to patients’ addresses to identify the origin and spread of infectious diseases; have studied the wounds received and treatment given to soldiers on either side of the Civil War; have analyzed the social relationships that – as much as medical ones – formed the health network of pre-industrial America.  All of this would be made impossible by the terms of the Act. (Although the examples cited above are generalized, we would be happy to provide the Committee with many specific examples.)

We implore the authors of HIPSA and the members of the HELP Committee to consider seriously whether it is necessary to place perpetual privacy restrictions on medical information.  Simple approaches are available to mitigate this inappropriate level of secrecy, a level of secrecy that is not applied even to the highly sensitive information collected in the U.S. Census.  One approach is as straightforward as limiting protected health information to those records that are less than 100 (or 125) years old.  Or health information might become unprotected once the patient is deceased (or 25 years after death).  Certainly extended protection – requiring review by Institutional Review Boards (IRBs) – might be warranted for specific subsets of information, such as genetic code information.

Another option (although not one that we favor) is simply not to apply the provisions of the Act to health information that is already more than 50 years old, but to continue to protect more recent information perpetually into the future.  More appropriate protection for current protected health information would be to adopt HIPAA’s fair and reasonable model for adjudicating research requests through IRBs.  It is important to note that such provisions would not prevent archivists from applying their own restrictions on certain records that they believed were sensitive.  Certainly it is unreasonable and unnecessary to prevent general research on WWI casualties or epidemics during the Dust Bowl or doctor-patient relationships in the Gilded Age.

We hope that the authors and Committee members will reconsider the severe privacy provisions currently defined in the Act, as well as the fact that it would make punishable substantial amounts of research that currently is conducted routinely by historians and other scholars to the benefit of the common good. 

SAA, ALHHS, and AAHM are available to provide evidence and discussion points as to the deleterious effects that HIPSA restrictions would have on perfectly reasonable and productive studies.  We stand ready to inform and collaborate with legislators and the research community to define new standards and best practices for facilitating archival research while protecting individual privacy rights in a digital environment. 

Thank you for your consideration of our concerns.

Sincerely,

Mark A. Greene
President, Society of American Archivists
mgreene [@] uwyo.edu

Micaela Sullivan-Fowler
President, Archivists and Librarians in the History of the Health Sciences
msullivan [@] library.wisc.edu

John Parascandola
President, American Association for the History of Medicine
jparascandola [@] verizon.net