Medical Records and HIPPA laws

Viewing 3 reply threads
  • Author
    • #132967

      When talking to folks from another local museum, we came across an interesting question… What process should be followed when receiving medical records? In this case, boxes of medical records from the 20s to the 40s have been donated to the museum but there are people mentioned who are either still alive or their descendents are living. Obviously, no sensitive information would be shared, but we were wondering about the legality of collection.

    • #132970

      In my day job I am the HIPAA Privacy and Security office for a small medical billing company. The Office of Civil Rights (OCR) recently made changes to the HIPAA laws via the Omnibus Rule that classifies records of persons who have been deceased for more than 50 years as not protected under HIPAA. You may wish to review the Final Rule, available at

      If you have records for folks who are still alive then things could get interesting. It all depends on who the donor is and whether they were considered a “covered entity” subject to HIPAA. In other words, if they were practicing medicine when HIPAA came into being, they could be subject to fines. Even if they were practicing pre-HIPAA, there are certainly morale issues.
      And as far as your “no sensitive information would be shared,” even that could get someone in trouble. By today’s HIPAA standards, for a doctor even to admit to anyone that he is seeing a person as a patient is consider a possible unauthorised disclosure. But once the records are outside the medical community, I’m not sure what the legalities are.
      It’s a tricky situation and has legal ramifications that you should investigate. If our museum were asked to take medical records that are after 1903, I would advise the curator to say no. (I say 1903 because there are very few +110 year olds still alive.) There are too many pitfalls.

    • #132969

      Thanks Patrick! We received a huge donation that included records from a local pharmacist who recently retired. We have been more focused on ensuring that we were handling containers properly and have been in contact with local agencies to ensure we didn’t have picric acid or other volatile substances, but this recent discussion alerted us to another potential concern. We are planning to have a medical exhibit in the next five years so this certainly would have come up. We’ve had pharmaceutical containers donated in the past that had personal information as to whom it was prescribed, dosage, and for what malady. Some of the names are very recognizable within the community and in most cases were donated by the individual or one of their family. We were already concerned about whether or not we should exhibit these things even though some of them are truly fascinating examples. Thank you for your insight. We are already sensitive to our ethical and moral responsibility to the individuals who have entrusted us with this information and we will certainly speak with our attorney concerning legal responsibility.

    • #132968

      Individuals that donate any medically related items (records, pill bottles, etc.) to a museum are giving up their right to privacy, unless they specify some disclosure clause during the acquisition process.

      This would be similar to someone posting their medical history with pictures of pill bottles on Facebook.
      Just be certain that the (patient) donors understand the consequences. However, doctors, pharmacists, psychologist all have obligations to protect health information. Not only is it a privacy issue, but disclosures could lead to medical fraud, with serious health or financial consequences to the individual.
      I know this sounds dire, but cracking down on medical fraud is a very high priority of the OCR, as is HIPAA violations.

Viewing 3 reply threads
  • The forum ‘C2C Community Archives – 2012 through 2014’ is closed to new topics and replies.