In accordance with Columbia University (the “University”) policies governing data security and privacy, the University is providing access to records for research only in compliance with safeguards for the privacy of confidential health information (CHI) of individuals. All researchers seeking to use records that may be presumed to contain CHI must adhere to the following procedures to gain access to these materials.
Definition
Confidential Health Information (CHI) is individually identifiable health information. Any records which Archives & Special Collections staff identify as containing CHI are subject to the restrictions and provisions of the University's privacy policies in order protect individual’s confidential health information.
I. De-identified Access to Archives
All access to records containing CHI of deceased or living individuals should first proceed as de-identified research whereby the Head, Archives & Special Collections, or in his/her absence, the Technical Services Archivist (Head/Archivist), will permit access upon the submission of a Certification to Permit Access to Archival Information (De-Identified Data).
In addition, the Agreement for Researcher Access to Records Containing Confidential Health Information, must also be completed by the researcher. Both are linked here.
The de-identified exception contemplates the removal of 18 different identifiers which removes any potential of re-identification. No publication or removal of identified data is permitted under this exception. In cases where the researcher needs to publish any of these identifiers, access can only be granted pursuant to procedures outlined in II or III below.
II. Research Access to the Protected Health Information of Living Individuals
Permission to access the confidential health information of individuals presumed to be living for research purposes where the procedures outlined in Section I above cannot be used is only permitted where the subject of the research has authorized such access and use of their CHI.
Researcher requests made in this manner must submit Form A to the Privacy Officer at privacy@cumc.columbia.edu or to the Head/Archivist. No access will be allowed until the Privacy Officer of the Columbia University Medical Center has approved the request. For those without a Columbia University or New York-Presbyterian Hospital affiliation, access to Form A must be obtained through either the Privacy Officer or the Head/Archivist.
III. Research Access to Decedents' Protected Health Information
For access to the records containing the CHI of individuals deceased for less than 50 years where the procedures outlined in Section I above cannot be used, the Privacy Officer will review requests for identified decedent data as an exception to the policies outlined above on a case-by-case basis. It is unlikely that permission to publish the CHI of a decedent who has been deceased for less than 50 years will be granted without documented legal permission from a legal representative of the decedent’s estate.
Archives & Special Collections reserves the right in certain cases to restrict access in part or in whole to individual health information found in its collections.
Approved by Office of HIPAA Compliance, Columbia University Medical Center, Sept. 10, 2003; revision approved, Oct. 27, 2005; updated May 14, 2014; approved and updated by the Office of the General Counsel January 29, 2021.