UNIVERSITY OF TENNESSEE HEALTH SCIENCE CENTER INSTITUTIONAL REVIEW BOARD

CASE STUDIES/REPORTS

1. PURPOSE
   
   To document the procedures used by University of Tennessee Health Science Center Institutional Review Board to review and evaluate submissions for the use of case studies/reports.
2. SCOPE
   
   This SOP applies to the IRB administrative staff, Board members, and investigators.
3. BACKGROUND

Federal regulations for the protection of human subjects define “research” as a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. A case study/report or the retrospective review of medical/dental records involving data from five or less patients does not involve a “systematic investigation” or contribute to “generalizable knowledge.” Therefore, this activity does not constitute “research” under the federal regulations for the protection of human subjects, does not require IRB review and approval, and has been given “not human subjects research” (NHSR) status by the IRB. However, the review of medical/dental records involving six or more patients is considered a systematic investigation designed to develop generalizable knowledge and does require IRB review and approval.

Although IRB review and approval is not required for case reports as described above, certain HIPPA Privacy Rule requirements may apply. Provided that case reports do not contain protected health information (PHI), they may be presented or published for educational purposes without specific authorization from the patient. However, the material presented or published must be completely de- identified according to the HIPAA standards by removal of the 18 categories of identifiers described in the HIPAA regulations. In addition, the presentation or publication must not contain any “unique characteristic” that would make it identifiable to the patient, and the author must not have any actual knowledge that the information about the patient could be used alone or in combination with other information to identify the patient.

When case reports involving five or fewer patients do contain PHI, different rules apply. If these case reports are presented as part of local educational programs conducted within UTHSC or affiliated institutions, then the activities are considered part of standard health care operations under HIPAA and case reports that contain PHI may be presented without specific patient authorization. On the other hand, if these case presentations are made for educational purposes outside of UTHSC and its affiliated institutions, they are not part of standard health care operations and require the specific authorization of the patient or, if the patient is deceased or otherwise unable to consent, the specific authorization of the patient’s legally authorized representative. Similarly, if the case reports containing PHI will be published, these activities are not part of standard health care operations and require the specific authorization of the patient or, if the patient is deceased or otherwise unable to consent, the specific authorization of the patient’s legally authorized representative, before submission for publication. Because case reports involving five or fewer patients presented outside the institution or submitted for publication are considered educational activities rather than research activities, they do not qualify for waiver of the HIPAA authorization as might occur when records containing PHI are used for research purposes.

In Accordance With:

For studies approved under the revised Common Rule:

45 CFR 46.102(l); and

For studies approved under the Pre-2018 Common Rule:

45 CFR 46.102(d); and

For all studies:

45 CFR 164; http://www.hhs.gov/ocr/hipaa

Compliance with this policy also requires compliance with state or local laws or regulations that provide additional protections for human subjects.

IV. PROCEDURES

UTHSC investigators who prepare a case report/study or who review medical/dental records involving five (5) or fewer patients do not need to undertake any interaction with the IRB, as this activity has been given “not human subjects research” (NHSR) status by the IRB.

If a case report involving five or fewer patients is prepared for presentation or publication and does not contain one or more of the 18 identifiers enumerated in the HIPAA Privacy Rule, and does not reveal “unique characteristics” or otherwise allow for identification of the patient, then specific authorization of the patient is not required.

1. If a case report involving five or fewer patients containing PHI is presented as part of local educational programs conducted within UTHSC or affiliated institutions, then the activity is considered part of standard health care operations under HIPAA and may be presented without specific patient authorization.
2. If a case report involving five or fewer patients containing PHI is presented as part of an educational program conducted outside of UTHSC or affiliated institutions, then the activity is not considered part of standard health care operations under HIPAA and may be presented only with a HIPAA- compliant, specific authorization of the patient or, if the patient is deceased or otherwise unable to consent, the specific authorization of the patient’s legally authorized representative.
3. If a case report involving five or fewer patients containing PHI will be submitted for publication, this activity is not part of standard health care operations and requires the specific authorization of the patient or, if the patient is deceased or otherwise unable to consent, the specific authorization of the patient’s legally authorized representative before submission for publication.
4. A case report involving five or fewer patients containing PHI that is presented outside the institution or submitted for publication does not constitute “research” under the HIPAA Privacy Rule and therefore does not qualify for a waiver of the HIPAA requirement for specific authorization of the patient.
5. The review of medical/dental records involving six (6) or more patients constitutes “research” and requires IRB review and approval. See SOP: UTHSC IRB NHSR or Exempt Status: Determination, and SOP: UTHSC IRB Expedited Review.