![Page 1: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/1.jpg)
Privacy Issues in Archives Access
Anne Gilliland, MA, MLISUniversity of North Carolina—Chapel Hill
And
Judith A. Wiener, MA, MLISThe Ohio State University
![Page 2: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/2.jpg)
Introduction
Our background
How we got interested
The questions we were asked
![Page 3: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/3.jpg)
What methods or policies can librarians and archivists put into place that balance both the interests of scholars and families that desire access to historical mental health records and maintain privacy as
required by either federal or state laws?
![Page 4: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/4.jpg)
Widely-Available Digitization
Controlled environment of reading room vs. open access of the open web
Risk lessened in reading room environment even if protected information is made available by error.
![Page 5: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/5.jpg)
Digitize But Restrict Access
Preservationally-sound optionSaves staff time of scanning on demand
Controlled access that allows for greater sharing off-site
Records not as accessible as they would be on the open Internet
![Page 6: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/6.jpg)
Privacy Boards
Another option to longer process of IRB
Allows institution to set up appropriate membership to fit needs of varied interested parties (patients, families, scholars)
Creates wait for materials and may be deterrent to access by some
![Page 7: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/7.jpg)
Selective Redaction
Required when dealing with PHI and a covered entity under HIPAA or other legislation. 18 Protected Health Information (PHI) fields.
May be an option that is elected, even if not required by law.
Need not redact originals
![Page 8: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/8.jpg)
Redaction and Digitization
Proactive redaction can be very time and cost intensive.
Can make digitized materials useless, depending on level of protected information available.
Access is the key in the need for redaction.
![Page 9: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/9.jpg)
Careful Selection of Materials
Analyze reason for digitization-preservation or access or both?
Analyze typical researcher needs. What information is most likely needed and wanted on a widely-accessible basis.
Look for the win-win. What can we make as openly available as possible without a lot of access control or redaction needed annual reports instead of individual cases. published reports with PHI already removed
![Page 10: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/10.jpg)
Have these examples increased the financial or staffing costs to libraries that maintain such archival records?
![Page 11: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/11.jpg)
Redaction
• Up front or proactive redaction may be expensive & time-consuming
• By request redaction less costly and time-consuming but response time can be slow.
• Technology may soon be available to help redact standardized data
Many historical records will still need to be redacted by hand
Redaction for digitization can make records almost useless.
![Page 12: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/12.jpg)
Open Access Online
Higher risk option.
Consumes staff time with selection and up-front privacy sensitivity audits.
May be an option for some record types but not recommended for entire collections with significant privacy concerns.
Need to create policy and proceedure for redaction requests.
![Page 13: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/13.jpg)
Closed Access System
Lower risk, in general, because access is internal and controlled.
Allows for less-costly mass digitization solution.
Need to invest in security solutions.
Ongoing costs need to be considered Maintenance, trouble shooting, migration of
files, quality control.
![Page 14: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/14.jpg)
Closed Access Systems
Process and logistics for collection access need to be addressed.
Encumbers staff time for very hands-on requests.
Privacy Board can be costly, dependent on location of members, time needed to meet, meeting frequency.
![Page 15: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/15.jpg)
Cost vs. Risk
• Risk is high for unselective open access system. Liability is far greater than initial costs of time or systems.
• Financial penalties in legislation
Risk in reputation, lives, public opinion
But embargoing records incurs other costs Risk is high to the historical record,
heritage, decedents.
![Page 16: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/16.jpg)
How have scholars and families responded to these methods and policies instituted to both increase access
yet maintain privacy of these records?
![Page 17: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/17.jpg)
Families and Patients
Securing permission after the fact—Digital Library of Georgia
Genealogists’ keen interest
Family members—what happened to them?
Access Anxiety—the historian’s perspective
![Page 18: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/18.jpg)
What is Consent? What is Anonymity?
The Lacks Family
Patients Like Me and other sites
Rare Diseases and unusual situations
![Page 19: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/19.jpg)
What examples exist of how such a balance has been developed and maintained in other states? Identify the
states
![Page 20: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/20.jpg)
The Ceiling and the Floor
Most restrictive law will usually control. For example, in a HIPAA situation, HIPAA
preempts unless state law is more restrictive. State laws—choice of law problems and
conflicts Privacy laws not written with the historian or
archivist in mind but rather toward contemporary identity theft
![Page 21: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/21.jpg)
Four Approaches to Health Information
The Cigarette Papers—handled through takedown notices
Johns Hopkins (all considered covered entity—IRB/Privacy Board)
Columbia—75 year rule (not a covered entity)
University of Minnesota—use stringent HIPAA rules even for non-covered entity
![Page 22: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/22.jpg)
Ohio State University Medical Heritage Center
Privacy Board in development
Selective digitization
Description of patient records series only on-line
![Page 23: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/23.jpg)
North Carolina Supreme Court Briefs Digitization
• Digitization of briefs submitted in NC Supreme Court cases from the late 19th century through 2000
• Project funded and work plan in development• Will be online and exposed to Google• Will use software for redacting SSNs and driver’s license
numbers• Open public records law in NC is very broad, but briefs
have been obscure• Are we a publisher when we put them online and does
our liability change?• More recent judicial opinions are often written more
circumspectly
![Page 24: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/24.jpg)
State Approaches: Mental Hospital Records Indiana State Archives mental hospital
records
Lincoln Hospital Records—Duke University
Illinois mental hospital records at State Archives
Athens Asylum records at Ohio University
![Page 25: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/25.jpg)
Are there examples where there have been violations that compromised privacy rights; and how have they been handled?
![Page 26: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/26.jpg)
Redaction and Breaches
Cigarette Papers
Tentative plans in North Carolina
An Industry example—Epic
Wall of Shame—Breaches affecting 500 or more individuals
![Page 27: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/27.jpg)
Data Breaches
On the rise
State breach notification law
Most suits within the academic/research community are settled or controversies never reach the point of litigation
![Page 28: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/28.jpg)
Re-identification
Experts differ on the extent and scope of this problem
The William Weld example
May not be able to completely control
![Page 29: Introduction Our background How we got interested The questions we were asked](https://reader036.vdocuments.us/reader036/viewer/2022062423/56649e525503460f94b47c0d/html5/thumbnails/29.jpg)
Conclusion