Federal regulation (45 CFR 46.102) defines research as “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.”
UAB has determined, based on review of the regulations, that a case report of three (3) or fewer cases (with an n ≤ 3) does not constitute human subjects research and does not require review by the UAB IRB. A case report of one to three cases would likely not contribute or produce “generalizable knowledge” and therefore does not meet OHRP’s definition of human subjects research.
A case report or retrospective medical record review with greater than three (3) patients (an n > 3) would represent research and require IRB review.
Patients’ confidentiality must always be respected when using their personal or medical information. The 18 HIPAA identifiers noted in the HIPAA regulations or other combinations of identifiers, which might easily allow someone to identify a patient, should never be used in a publication or presentation without approval. It is required that patients provide HIPAA authorization to allow information on their case to be published if it is not de-identified in accordance with 45 CFR 164.514(a). In the case of patients who are deceased, HIPAA authorization is required from the patients’ family (See UAB HIPAA web site www.hipaa.uab.edu for more information), with the exception of persons who have been deceased for more than 50 years.
