Examples
Worked examples
- Is an instance
A physician documents an unusual adverse drug interaction observed in one patient receiving standard-of-care treatment, written up after the fact with no advance data-collection plan and no intent to test a hypothesis across a series — typically not IRB-required, though a not-human-subjects-research determination and documented patient consent for publication are usually still needed.
- Is an instance
A clinician plans in advance to pull records from every patient treated with a novel off-label protocol over two years, extract standardized data points across those records, and describe the resulting pattern to support a general clinical conclusion — the advance planning and generalizable-knowledge intent typically meet the 46.102(l) research definition and trigger IRB review, even if the write-up is still called a case series.
Counter-examples
Looks similar, but isn't
- Not an instance
A single-patient outcome summary prepared solely for internal hospital quality-improvement purposes, with no intent to publish or present it externally, is not IRB research — but for a different reason than a publishable case report: there is no intent to disseminate it as generalizable knowledge at all, so the analysis above (which concerns publishable case reports) does not even apply.
Editorial commentary
Whether a case report needs Institutional Review Board (IRB) review is a determination, not a default. It turns on whether the write-up meets the Common Rule’s definition of research at 45 CFR 46.102(l) — “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge” — and whether it involves a “human subject” under 46.102(e). Most single case reports describing routine clinical care, written up after the fact with no predefined data-collection protocol and no intent to test a hypothesis, fail the “systematic investigation … generalizable knowledge” test even though the patient is clearly a human subject. That combination is why case reports are commonly described as falling outside IRB jurisdiction. But “commonly” is not “always”: institutions differ on where the line sits, many still require a documented not-human-subjects-research determination before publication, and HIPAA/consent obligations apply regardless of the Common Rule answer. Treat any blanket claim — including this one — as a starting point for checking your own institution’s policy, not a substitute for it.
The regulatory test: is it “research,” not just about a “human subject”
The Common Rule/IRB jurisdiction question is a two-part test, and both parts must be met:
- Is it research? 45 CFR 46.102(l): a systematic investigation designed to develop or contribute to generalizable knowledge. A retrospective narrative describing one patient’s unusual presentation, treatment, and outcome — assembled after the clinical encounter, with no prospective protocol, standardized data-collection instrument, or comparison group — typically does not meet this test.
- Does it involve a human subject? 45 CFR 46.102(e): a living individual about whom an investigator obtains data or identifiable private information through intervention or interaction. A patient described in a case report almost always meets this half of the test.
Meeting only one half is not enough to trigger IRB jurisdiction. A case report typically clears the “human subject” bar but not the “research” bar, which is the actual mechanism behind the common shorthand that case reports are “not research.”
What actually distinguishes a case report from something that needs review
The determining factors are intent and design, not the word “case report” in the title:
- No predefined protocol. The write-up documents what already happened during routine clinical care, rather than following a data-collection plan set up in advance.
- No hypothesis being tested. The author is describing an observation, not testing whether an intervention works across a defined population.
- Not designed to be generalizable at the time of care. The clinical decisions were made to treat the individual patient, not as part of a study intended from the outset to produce a general conclusion.
If any of these flips — a chart review is planned in advance and applied to a defined patient cohort, a standardized data-extraction form is used across multiple charts, or the explicit purpose is to draw a conclusion that applies beyond the individual patient — the activity starts to look like the kind of systematic investigation described in the IRB/REC approval determination, and IRB review (often expedited, sometimes exempt-category review, still IRB-adjudicated) is typically required.
Case report vs. case series: where the line usually moves
A related but separate publication-type distinction compounds this: a case report describes a single patient, while a case series aggregates a small number of patients with a common feature. Institutions frequently (not universally) treat the shift from “one clinician documenting one unusual outcome” to “a defined set of patients pulled together and analyzed for a pattern” as the point where systematic-investigation intent becomes harder to deny — regardless of exactly how many patients are involved, since there is no single regulatory patient-count threshold in the Common Rule itself. Some institutional policies do publish their own numeric guidance (for example, treating a review of more than a handful of charts, extracted via a standardized process, as presumptively research); where they exist, those thresholds are institution-specific, not a national rule, and should be confirmed with your own IRB or research office rather than assumed from another institution’s policy.
What still applies even when IRB review isn’t required
A “not human subjects research” or “not research” determination does not clear every compliance obligation:
- HIPAA. Using or disclosing protected health information for a publication or presentation still implicates HIPAA even when the Common Rule doesn’t apply; a HIPAA authorization from the patient, a waiver from the IRB or Privacy Board, or a properly executed de-identification of the write-up is typically still required.
- Patient consent for publication. ICMJE recommendations and most clinical journals, following structures like the CARE guidelines, require documented patient consent for identifiable case report details independent of whether an IRB determination was ever sought — a publication-ethics requirement, not a Common Rule one.
- Institutional documentation. Many institutions require authors to obtain a formal “not human subjects research” letter, complete a self-certification form, or register the intent to publish with the IRB office before submission, precisely so the determination is made by the office responsible for it rather than assumed by the author. Journals increasingly ask for this documentation as part of submission.
These are the three most common reasons an author is told “you don’t need IRB approval, but you still need to do X” — each is a separate legal or editorial requirement layered on top of, not replacing, the Common Rule analysis above.
Who actually makes the determination
The author does not get to make this call unilaterally, even when the answer seems obvious. The IRB, a delegated IRB coordinator or research-compliance office, typically issues the actual not-human-subjects-research or exempt determination, usually through a short self-certification or pre-review request rather than a full IRB application. Submitting that request, and keeping the resulting letter on file, is the practical way authors document that the determination was made by the right party — which matters if a journal, funder, or institutional audit later asks how the case report’s regulatory status was decided.
Examples
Typically outside IRB jurisdiction: A physician documents an unusual adverse drug interaction observed in one patient receiving standard-of-care treatment, written up retrospectively with no data-collection protocol set up in advance and no intent to test a hypothesis across a series of patients. At most institutions this would not require full IRB review, though the author would still likely need a not-human-subjects-research determination on file and documented patient consent for publication.
Typically requires IRB review: A clinician plans, in advance, to pull records from every patient treated with a novel off-label protocol over the past two years, extract a standardized set of data points across those records, and describe the pattern to support a general clinical conclusion for the literature. Even though the resulting manuscript may be labeled a “case series,” the advance planning, standardized data extraction, and generalizable-knowledge intent typically meet the 46.102(l) research definition, triggering IRB review (commonly at the exempt or expedited level, depending on identifiability and risk).
Frequently asked questions
Does a case series need IRB approval even if a single case report from the same clinician wouldn’t?
Often, yes — not purely because of patient count, but because assembling multiple cases typically involves the advance planning and standardized data collection that pushes an activity into “systematic investigation designed to develop generalizable knowledge.” Confirm with your institution’s IRB rather than relying on a specific number.
Do I need a HIPAA waiver or authorization to publish a case report?
Frequently, yes, independent of the Common Rule/IRB answer. Using protected health information in a submitted manuscript or presentation is a HIPAA question; a not-human-subjects-research determination does not by itself satisfy HIPAA, which is why proper de-identification, a signed patient authorization, or an IRB/Privacy Board waiver is usually still needed.
Who decides whether a case report is exempt from IRB review?
The institution’s IRB or delegated research-compliance office, not the author. Most institutions provide a short self-certification or pre-review process specifically for this determination, distinct from a full IRB application.
Does journal policy matter if my institution says IRB review isn’t required?
Yes — the two are separate requirements. A journal following ICMJE recommendations will typically still require documented patient consent for identifiable case-report details, and some journals require evidence of an institutional determination (even a “not required” letter) before considering the manuscript, regardless of what the Common Rule requires.
This page describes the general Common Rule (45 CFR 46) framework and common institutional practice as background, not institution-specific policy or legal advice. Definitions and thresholds vary by institution, and some non-US jurisdictions apply different research-ethics frameworks entirely; confirm the applicable rule with your own IRB or research ethics committee before relying on any determination described here.
Machine-readable encodings
Use in your systems
<role vocab="credit"
vocab-identifier="https://casrai.org/dictionary/"
vocab-term="Case Report IRB Exemption"
vocab-term-identifier="https://casrai.org/dictionary/term/case-report-irb-exemption" />{
"@context": "https://schema.org",
"@type": "DefinedTerm",
"@id": "https://casrai.org/dictionary/term/case-report-irb-exemption",
"name": "Case Report IRB Exemption",
"identifier": "https://casrai.org/dictionary/term/case-report-irb-exemption",
"description": "A case report is generally treated as exempt from IRB (Common Rule) jurisdiction when it describes routine clinical care of one patient (or a small, non-systematically-assembled number), written up retrospectively with no predefined data-collection protocol and no intent to test a hypothesis or produce a generalizable conclusion — i.e., it fails the 45 CFR 46.102(l) definition of 'research' even though the patient meets the 46.102(e) 'human subject' definition. The determination is made by the IRB or a delegated research-compliance office, not by the author; institutional thresholds and required documentation vary, and HIPAA authorization/waiver plus patient consent for publication remain separately required regardless of Common Rule status.",
"inDefinedTermSet": "https://casrai.org/dictionary/domain/clinical-research#set",
"url": "https://casrai.org/dictionary/term/case-report-irb-exemption",
"sameAs": [],
"license": "https://creativecommons.org/licenses/by/4.0/",
"publisher": {
"@id": "https://casrai.org/#organization"
},
"dateModified": "2026-07-23T06:00:06",
"inLanguage": "en"
}
