This section of the Investigator Manual discusses program evaluation and quality improvement projects, case reports, oral history projects, and publicly available data.


The IRB reviews all activities that meet the federal definitions of human research and federal guidelines for engagement. Some activities involving human subjects or their data may not fall under these definitions and do not require IRB review. This section provides you with more details about these activities and when IRB input may be needed to assess whether IRB oversight is required. If you are unsure whether your project engages you in human subjects research or meets the criteria for not requiring IRB review, please contact the IRB office for assistance.

Note that even if your study does not constitute human research, you must still comply with relevant regulatory (e.g., HIPAA) and institutional requirements. For more information, see HRP 309-WORKSHEET-Ancillary Review Matrix.


Program Evaluation/Quality Improvement or Assurance Projects

Determining whether a project constitutes human subjects research rather than quality improvement or program evaluation involves multiple factors. The federal definition of research is “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program which is considered research for other purposes.” This is an important distinction to make because it determines whether IRB review and oversight of a project is needed.

Often, determining whether a project constitutes research under federal and institutional regulations can be a complex process that involves assessing the project intent, design, mandates, expected outcomes, and dissemination of results. The QI/Program Evaluation Self-Certification Tool is designed to assist study teams in determining whether a project requires submission to the IRB. If the project involves some characteristics of a research project, the Tool will let you know that IRB review is required. If the project does qualify as program evaluation/QI, the Tool will provide you with a certification confirming this. This certification can be printed off and used as documentation that the project does not constitute research and further IRB review is not required.

NOTE: This tool is not designed to determine all cases when a project falls outside of the IRB’s purview. This tool is only for determining if a project is QI/Program Evaluation, rather than research. The tool should not be used for public health surveillance projects.

A journal or conference may not accept the certification as proof your project does not require IRB approval. In such cases, you will need to submit an application in ARROW to obtain a formal IRB determination.

Case Reports

Case reports of 3 or fewer individuals generally do not meet the regulatory definition of research because they would not qualify as a systematic investigation that contributes to generalizable knowledge. Medical case reports are done to highlight a unique treatment, a unique case, or a unique outcome. Case reports are generally done by retrospective review of the medical record. Nothing is done to the patient for a “research” purpose. Statistics are not used and the case report generally only describes existing clinical data or procedures. IRB review of such case reports is therefore not required. Some journal editors do require documentation from the IRB indicating that IRB review is not necessary to publish the case report. In such cases, you may submit an IRB application requesting a not research determination.

Even if IRB review is not required, case reports for publication must be prepared in accordance with the requirements of the HIPAA privacy regulations. This means that the case reports must be de-identified, i.e., the presentation or article must not contain any of the 18 identifiers for an individual that are described in the HIPAA Privacy Rule. For case reports that disclose PHI or where the health information described in conjunction with other characteristics could reasonably be used to identify the patient (e.g., a rare injury, disease or diagnosis in combination with age, gender, geographic region), patients (or their legally authorized representatives, e.g., parents, guardians, etc.) will need to sign a HIPAA-compliant authorization form. See the Office of Compliance Authorization for Disclosure of Medical Information for Publication or Conference Presentation form.

Case reports involving more than three patients are more likely to meet the criteria for research and require IRB Review. In addition, testing of a patient’s biospecimen (e.g., special stain, immunohistochemistry, molecular studies) is not typically permissible as part of a case report.

Oral History

While oral history is typically not considered human research, the prospective intent of the investigator and the definition of “research” under the federal regulations needs to be taken into account. Per federal regulation, research is defined as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.”

Specifically, the consideration of human research and the requirement for IRB review hinges upon whether:

  • The activity involves a prospective research plan which incorporates data collection, including qualitative data, and data analysis to answer a research question; AND
  • The activity is designed to draw general conclusions (i.e., knowledge gained from a study may be applied to populations outside of the specific study population), inform policy, or generalize findings.

General principles for evaluating whether oral history type activities are human research and require IRB review:

  • Oral history activities, such as open-ended interviews, that ONLY document a specific historical event or the experiences of individuals without intent to draw conclusions or generalize findings would NOT constitute “research” as defined by federal regulation.
  • Systematic investigations involving open-ended interviews that are designed to develop or contribute to generalizable knowledge (e.g., designed to draw conclusions, inform policy, or generalize findings) WOULD constitute “research” as defined by federal regulation.
  • Oral historians and qualitative investigators may want to create archives for the purpose of providing a resource for others to do research. Since the intent of the archive is to create a repository of information for other investigators to conduct research as defined by 45 CFR part 46, the creation of such an archive WOULD constitute research under federal regulation.

Analysis of Publicly Available Datasets

Research projects involving analysis of secondary data will NOT require prior IRB approval in the following situations:

  • The data set(s) is (are) published and publicly available without restriction (e.g., data are published by a reputable source in a publicly-available journal, textbook or web-site) and neither the UW researcher nor any collaborating researcher on the project(s) has access to links that would connect the data to the individuals from whom they were derived.
  • The data set(s) are publicly available to researchers and others, but the data holder requires a “responsible use statement” or similar attestation to ensure appropriate use and protection of the data. Such an agreement or attestation may be automated. In this case, neither the UW researcher nor any collaborating researcher on the project can have access to any links that would connect the data to the individuals from whom they were derived, nor may any researcher on the project attempt to re-identify any person from whom the data were derived.
  • The researcher will obtain a data set available from a Federal or State agency and will enter into an agreement with the data provider that includes language that: a) the data provided to the researcher does not contain any identifiers, including those specified under the HIPAA Privacy Rule; b) if the data are coded, the data provider will not release a link to the code to the researcher; and c) the researcher receiving the data set must agree to not attempt to re-identify any person from whom the data were derived.
  • In all cases, the IRB expects that investigators have reviewed the data sources’ terms of service, responsible use statements, and data access agreements, if any. Questions about compliance with such terms should be directed to the UW Office of Legal Affairs.