Medical Case Report Policy


This policy refers only to medical case reports shared outside this university and establishes when a case report requires Institutional Review Board (IRB) review and when HIPAA authorization is needed.

For case reports, HIPAA requires that the disclosure of an individual’s protected health information must be authorized by that individual.  If a case report contains any of the 18 protected health information identifiers as defined by the HIPAA regulations, a signed authorization (using the authorization form from the entity that holds the record) to disclose this information must be obtained from the individual(s) whose information is being disclosed.  If the patient is deceased, authorization should be obtained from the personal representative of the estate.


Case report - Case reports by University of Louisville definition are medical information collected and presented on three or fewer patients to highlight an interesting treatment, presentation, or outcome.    They generally result from retrospective review of the medical record.  In this regard, case reports differ from research in which data are collected with intent to evaluate a specific hypothesis.

Generalizable Knowledge—Knowledge "expressed in theories, principles, and statements of relationships" that can be widely applied to our experiences. The term "generalizable knowledge" is used to distinguish the results of research from the results of non-research activities such as clinical practice or teaching activities. "For the most part, the terms clinical practice or teaching refer to interventions that are designed solely to enhance the well-being or knowledge of an individual.

Human Subject - a living individual about whom an investigator (whether professional or student) conducting research obtains (1) data through intervention or interaction with the individual, or (2) identifiable private information (45 CFR 46.102).

Research - a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge (45 CFR 46.102).   The term "research" designates an activity designed to test a hypothesis, permit conclusions to be drawn, and thereby to develop or contribute to generalizable knowledge.


If an author develops a case report, with no prior research intent, IRB review is still required.  University of Louisville research policy requires review, if the report is presented, published, or used to fulfill the requirement for scholarly activity outside this university.

In addition, when one of the following occurs, the IRB considers this research.  IRB review, written informed consent, and HIPAA Authorization may be required if the review

  1. is accepted as a fulfillment of a “research requirement” or,
  2. acknowledges in the report that it is “research” or,
  3. attempts to answer a question, or
  4. uses an intervention to prove/disprove a hypothesis, or
  5. requires treatment or record keeping modification for research rather than clinical purposes or,
  6. becomes a case series greater than three (3) cases, with no prior research intent.

In many instances, case reports do involve a human subject(s) by definition, and may contribute to generalizable knowledge by presentation or publication.  A case report (3 or fewer patients) generally does not meet the definition of a systematic investigation and thus does not meet the definition of research either in 45 CFR 46.102(f) or 21 CFR 56.102(e).  A case report describes an interesting treatment, presentation or outcome.  A critical component is that nothing was done to the patient(s) with prior “research” intent.  Even though this may be the case, University of Louisville research policy requires submission to and approval from the IRB prior to submission for publication.



The author of a case report is required to enter the report through the iRIS software following the instructions in the software.

Author(s) must ensure that the article does not contain any of the 18 protected health information identifiers noted in the HIPAA regulations unless authorization from the individual(s) has been obtained.  If the individual(s) is/are deceased, and no information is obtained from living individuals (e.g. relatives) HIPAA authorization is still required from the personal representative of the individual’s estate, in order to include protected health information in the report.  In rare cases, the author(s) may apply for a waiver of authorization to the privacy board, but it is generally felt that an “n” of one, two, or three allows authorization to be obtained.

The IRB Chair or designee will review the request of an author who submits a case report to the IRB or, who has been asked by a journal to provide documentation of IRB approval prior to publication of a submitted case report.  If the report is about three (3) or fewer individuals, meets the definition of a case report, and does not meet the definition of human research, the IRB will provide a form letter that states:

"The University of Louisville Biomedical IRB received your request (dated X), concerning a case report you wish to publish.  The U of L Biomedical IRB has determined that this case report of three (3) or fewer patients does not meet the definition of human research and IRB review is not required for this activity."

If it is the conclusion of the IRB Chair or designee that the submitted proposal is research, the IRB will not provide “after the fact” approval of the research as this is prohibited by federal regulation.  Authors are encouraged to seek advice from the IRB or the Human Subjects Protection Program Office prior to developing a case report when difficult questions arise about whether IRB review may be required.

Failure to follow this policy could result in disciplinary action.  Disciplinary recommendations, if any, will be based on penalties similar to those outlined in the University’s Administrative Sanctions for Violations of University of Louisville Research Policies.  This policy is located on the Research Integrity Program website under research policies and procedures.

Violations of this policy will be reported following the procedures in the University of Louisville IRB Report of Findings policy.  This policy is located on the HSPPO website under Research Related Policies.


  1. 45 CFR 46 – The “Common Rule,”
  2. 21 CFR 50 & 56 – FDA Regulations,
  3. 45 CFR 160 & 164 – Health Insurance Portability and Accountability Act of 1996.
  4. The Belmont report: ethical principles and guidelines for the protections of human subjects. Bethesda (MD): U.S. National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research; 1978. 8 p.
  5. Communication from Michael Carome, Associate Director - Regulatory Affairs, OHRP dated 10-08-2004.

Subject: Medical Case Report Policy  |  Policy and Procedure | Author: Institutional Review Board  |   Original Effective Date: 1-1-2005  |   Last Revised Date: 6-11-2010