Case reports of 3 or fewer individuals generally do not meet the regulatory definition of research because they would not qualify as a systematic investigation that contributes to generalizable knowledge. Medical case reports are done to highlight a unique treatment, a unique case, or a unique outcome. Case reports are generally done by retrospective review of the medical record. Nothing is done to the patient for a “research” purpose. Statistics are not used and the case report generally only describes existing clinical data or procedures. IRB review of such case reports is therefore not required. Some journal editors do require documentation from the IRB indicating that IRB review is not necessary to publish the case report. In such cases, you may submit an IRB application requesting a not research determination.

Even if IRB review is not required, case reports for publication must be prepared in accordance with the requirements of the HIPAA privacy regulations. This means that the case reports must be de-identified, i.e., the presentation or article must not contain any of the 18 identifiers for an individual that are described in the HIPAA Privacy Rule. For case reports that disclose PHI or where the health information described in conjunction with other characteristics could reasonably be used to identify the patient (e.g., a rare injury, disease or diagnosis in combination with age, gender, geographic region), patients (or their legally authorized representatives, e.g., parents, guardians, etc.) will need to sign a HIPAA-compliant authorization form. See the Office of Compliance Authorization for Disclosure of Medical Information for Publication or Conference Presentation form.

Case reports involving more than three patients are more likely to meet the criteria for research and require IRB Review. In addition, testing of a patient’s biospecimen (e.g., special stain, immunohistochemistry, molecular studies) is not typically permissible as part of a case report.