This policy was adopted by Stanford University Libraries, Department of Special Collections and University Archives, on October 1, 2009 and revised with approval of the University Privacy Office on April 24, 2020; based in part on the National Library of Medicine’s History of Medicine Division’s policy adopted February 17, 2004 and revised May 10, 2004.
Scope
This policy establishes rules for access to health information of individuals found in archival, manuscript, and image collections in Stanford University’s Special Collections and University Archives. The purpose of the policy is to safeguard the health privacy of individuals, while making these holdings available for research to the greatest possible extent. This policy is based on the National Library of Medicine’s History of Medicine Division’s policy.
The creation of this policy was motivated by the implementation in April 2003 of the Privacy Rule [45 CFR 160; 140] of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). While the Library is not a covered entity under HIPAA and therefore not subject to its regulations, the Library nonetheless wishes to establish a policy that reflects the principles of HIPAA's Privacy Rule.
This policy applies to collections that Special Collections and University Archives have specifically identified as containing health information of individuals. In addition, access to archives and manuscripts may be further restricted by the donors of the materials. Irrespective of this policy, Special Collections and University Archives reserves the right, at its discretion, to restrict access in part or in whole to individual health information found in its collections. To determine whether a collection falls under this policy, please consult the bibliographic record for the collection. For further clarification, please contact Special Collections Public Services or the Department Head.
Access to archival materials
Under certain conditions, Special Collections may authorize access to archival and manuscript materials that contain health information of individuals:
- Materials more than 100 years old are available to all researchers.
- Individually identifiable health information of those known to be deceased for 50 years or more is available to all researchers, in keeping with provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2013.
- Where Special Collections is able to make a copy of materials with all personal identifiers masked or deleted, the copies are available to all researchers.
- If a researcher obtains written authorization for access from the individual of interest, from their legal guardian, from the administrator of their estate, or from the next of kin, the records will be available to that researcher. Please note that Stanford Libraries do not maintain a listing of subjects or their contact information.
Where none of these circumstances pertains, researchers may apply to Special Collections and University Archives for access to such records, in accordance with the following general guidelines:
- Access will be granted to qualified persons doing historical and other research, using statistical or quantitative methods, or methods ensuring that no individual shall be able to be identified from the results of the research.
- Researchers who are granted access to restricted records shall agree in writing to maintain the confidentiality of the information and to adhere to the conditions of access imposed by Special Collections and University Archives.
- In addition, all other persons associated with the research project who will have access to personally identifiable information from the records shall agree in writing to maintain confidentiality of the information.
The remainder of this document provides guidance in implementing these guidelines.
Conditions of access
Special Collections and University Archives may impose some or all of the following conditions of access on any project, while additional conditions may be imposed on the use of specific records or on specific projects, at Special Collections and University Archives’ discretion.
- The records may be used only for the purpose of statistical research, the reporting of aggregate research findings, or in such a way that no individual may be identified using the results of the research. The information may not be used for any other purpose without Special Collections and University Archives approval.
- The records and copies of any data elements which permit the identification of an individual or which can be identified with an individual may not be transferred to any person or institution not directly involved with the approved research project.
- Reasonable administrative, technical, and physical safeguards, as approved by Special Collections and University Archives, to prevent unauthorized use or disclosure of the information shall be established by the researcher and followed by all persons associated with the research project.
- Collections shall be consulted only at the Special Collections and University Archives reading room in Green Library on Stanford’s campus located in Palo Alto, California, and not at any other site.
- During the course of the research project, any individually identifiable information in the researcher's notes or in authorized copies of the materials shall be rendered anonymous by the researcher at the earliest possible time consistent with the purpose of the research project.
- Persons who are identified in the materials in the course of research may not be contacted by or on behalf of the researcher. (However, this does not preclude the researcher from contacting a person in advance of gaining access, for the purpose of obtaining access.)
- Prior to publication or public presentation of the data, the final research product(s) shall be provided to Special Collections and University Archives for review. Special Collections and University Archives’ review shall be limited to ensuring that there is no possible identification of individuals in the research findings. Special Collections and University Archives’ will not evaluate the validity of the research findings.
- Upon completion of the project, all research notes containing health information of individuals derived from Special Collections and University Archives’ archival materials, and/or copies of such materials shall, upon completion of the project, be destroyed or returned to Special Collections and University Archives, whichever condition Special Collections and University Archives has imposed as a condition of access. If the notes and/or copies are destroyed, the researcher shall verify in writing to Special Collections and University Archives that the research notes and/or copies have been destroyed.
Request for access
To obtain access to health information of individuals, researchers must submit and mail a written request to the Department of Special Collections and University Archives, Attn: Department Head, Green Library, Stanford University Libraries, 557 Escondido Mall, Stanford, CA 94305-6064. Requests that are submitted via email or fax will not be considered. Researchers are encouraged to consult with Special Collections and University Archives prior to submitting the request. The request must include the following information; a form is provided in Appendix A (attached hereto):
- Name and mailing address.
- Institutional affiliation and position, if applicable.
- List of publications pertinent to the topic of the research project.
- References from two persons who have first-hand knowledge of the requester's qualifications to perform the research.
- A statement of the nature of the research to be conducted and any plans for publication or presentation of the research findings.
- A statement of the methodology to be used.
- A listing of all sources of grant funds supporting the research project or its publication.
- A statement of the administrative, technical, and physical safeguards to be employed by the researcher to prevent unauthorized use or disclosure of the records.
- A listing of the collections and/or items and series titles to be used.
- A statement that the researcher will abide by the conditions of access to be prescribed by Special Collections and University Archives and that the researcher will assume responsibility for the action of all persons working with the researcher on the project.
The researcher should sign the form and obtain the signatures of all other persons associated with the research project who will have access to personally identifiable information from the records.
Access review committee
Requests for access to health information of individuals will be reviewed by Special Collections and University Archives’ Access Review Committee, which is composed of the Department Head for Special Collections and University Archives, the Associate University Librarian for Public Services, and the University Archivist. The Committee may consult other persons within and outside of Stanford University who are knowledgeable in the research field for assistance in evaluating a request.
The Committee will examine the request to determine:
- Whether the requested information is of such a highly sensitive personal nature that disclosure should not be permitted even for statistical or quantitative research.
- Whether the methodology proposed by the requester will permit the researcher to obtain the projected research results without revealing personally identifying information.
- Whether the research results will be published or presented at an academic or research conference, or a similar venue.
- Whether the requester is a researcher who has experience in conducting statistical research projects and publishing articles or books on such research; or a researcher whose presentations and publications demonstrate the ability to protect the privacy of individuals.
- Whether the safeguards proposed by the requester will adequately protect the personal information.
- Whether Special Collections and University Archives has sufficient staff and space available to safeguard privacy as it accommodates the research project.
The decision of the Committee will be made in writing to the requester within 30 workdays after receipt of a completed request. At the discretion of the Committee, the researcher may meet with the Committee to discuss the project and may be asked to revise it to meet the concerns of the Committee.
Appeal process
Any decision to deny access to requested records may be appealed to the University Librarian. Appeals must be made in writing and shall be received within two weeks of notification of the denial.
Noncompliance with conditions of access
If the Department of Special Collections and University Archives discovers that a researcher has violated the confidentiality of information or the conditions of access, the Department shall take steps to revoke the research privileges of the researcher and shall consult with the University legal counsel to prevent further disclosure of the health information. The Department may also inform the following persons and organizations of the researcher’s failure to follow the conditions of use:
- The institution with which the researcher is affiliated, if applicable.
- Persons who served as references in the application for access.
- Organizations which provided grant funds for the project.
- The sponsor of the publication or public presentation.
- Appropriate professional organizations.