What Does that Archival Restriction Really Mean? Demystifying HIPAA, Part 4

This is the fourth blog post in a four part series about the Department of Neurosurgery Records and issues archivists confront when accessioning collections. See the following links for Part 1, Part 2, and Part 3.

Researchers use archives to discover information when they have a research need, and to a researcher the words “restricted” and “unrestricted” are two of the most important words in a finding aid. It can be the difference between having access to the materials they want and not having access to those materials. Restricted materials are common in archives as archival collections, comprised of personal papers and intuitional records, almost always contain sensitive and confidential materials that need to be restricted. It is the job of the archivist to weigh the risks of making personal information or confidential institutional records accessible in their processed collections. There are many ways to go about handling sensitive materials: redacting the sensitive information in the document, restricting the entire document, or not accepting those types of documents from donors. Historically, archival repositories carried out those actions to maintain good donor relations and because it is the ethical thing to do.

Health Insurance Portability and Accountability ActIn the legal sense, this all changed for medical archives with the 1996 enactment of the Health Insurance Portability and Accountability Act (HIPAA) and the subsequent added provision of the Privacy Rule in December 2000 (modified in August 2002). HIPAA, originally enacted to improve the efficiency and effectiveness of the health care system, amended by the Privacy Rule, established, for the first time, a set of national standards for the protection of individually identifiable health information by three types of “covered entities”: health plans, health clearing houses, and health care providers. The Privacy Rule gives patients’ rights with respect to their own health information. You can read more about the HIPPA Privacy Rule here.

Compliance of this rule was required in April 2003 by individuals, organizations, and agencies that meet the definition of covered entity. You can read more about covered entities and what they are here.

The Duke Medical Center Archives is a covered entity because it is part of the Duke University Health System and our collections house materials that are medical in nature. This means that personal health information (PHI) such as names, dates of birth, medical records, diagnosis, and images of patients cannot be made public without violating the law. This does not mean we cannot collect these types of records; it does mean that we cannot make these types of records publically available until 50 years after a patient’s death. Making records available 50 years after a patient’s death is part of the final Omnibus rule that implements a number of provisions of the HITECH Act. You can read more about the Omnibus rule here. What it does mean is in order to make records with PHI accessible, archives that are covered entities must know the death date for each individual for which it holds that PHI. This is not an easy endeavor, which is why unless the death date is easily accessible to the archivist, materials containing PHI remain restricted.

While processing the Department of Neurosurgery Records, we encountered a lot of PHI in both the patient records and the 16mm films, but their overall research value outweighs the fact that these materials are restricted. These patient files and 16mm films document the work of the Department of Neurosurgery at Duke Health from the 1950s to the 1970s. Not taking the materials because of PHI would have meant their destruction, but if we took them and did not describe them on the finding aid, no researchers would ever know these records exist.

Are you confused? Ask us!

Right now, you might be wondering why it is important to let researchers know this content exists when it is restricted. It is important because there is a way to let researchers view materials restricted per HIPAA. The process is through the Institutional Review Board (IRB). Rebecca Williams, the Archives Librarian for Research, Outreach, and Education is going to explain the process of IRB access below.

An Institutional Review Board (IRB) is a committee that ensures the protection of human research subjects by conducting scientific and ethical review of research studies. In the United States, IRBs are regulated by the Office for Human Research Protections within the U.S. Department of Health and Human Services. If you are affiliated with a college or university, your institution almost certainly has their own institutional review board or research ethics board. While you will need approval from the Duke IRB to gain access to our materials, I would always suggest contacting your home IRB first.


At Duke, research study protocols or applications to the IRB can all be submitted through their online system. Every research study is slightly different, but most study protocols will require a research summary, abstract, and a completed Waiver of Consent and HIPAA Authorization form. Researchers also have to consider how they plan to protect privacy and confidentiality as well as provide a Research Data Security Plan. Additional information about the process at Duke can be found here.


The process can be time consuming, but it does not have to be stressful. My best recommendation is to always ask for help! Contact your local IRB staff members. In my experience, they are exceptional and will help you immensely. Duke IRB staff are also available to meet with you one-on-one. Also please reach out to the Archives staff with any questions and we will also do our best to walk you through the process.


Thanks Rebecca! With this is mind, as the processing archivist, I decided to go for the middle ground when processing these items. I wanted to make them discoverable, but I also had to ensure no PHI was published on the finding aid. In order to accomplish this, we carefully redacted all PHI. This included not publishing any names from the patient index cards, as well as redacting all PHI from the film titles. Additionally, no one can watch the films without prior IRB approval because it shows the faces of patients. I also added collection and series level access restrictions notes to make it evident there is restricted material in this collection, as well as making it clear which series the restricted materials are located.

It is true that acquiring and processing materials with PHI requires more effort, but the end result is this content is now discoverable and available—with proper IRB approval—for future research. Which brings me back to the concept of restricted and unrestricted. Just because a researcher sees materials are restricted on a finding aid does not mean all is lost. The researcher should contact the archives that holds the materials and ask why the materials they want to use are restricted, if they will either ever be unrestricted, and if there is a way to view restricted materials. Sometimes the answer will be a straight “No, these materials will never be accessible.” But sometimes the answer will be “Yes, you can see the materials but first you have to….” Asking is the first step to determining if you can gain access to restricted materials, but if you don’t ask, you will never know.

To learn more about these materials, visit the Department of Neurosurgery finding aid or contact the Duke Medical Center Archives staff.