A retrospective chart review is a study that answers a research question using health records, lab results, or other clinical data — most often pulled from a single institution’s electronic medical record (EMR) system — that were already generated during routine care, before the study was designed. Because the data already exist, researchers sometimes assume review by an Institutional Review Board (IRB) is unnecessary, or that any level of review that is needed will automatically be the lightest one available. Neither assumption is safe. Whether a chart review is exempt, qualifies for expedited review, or needs full-board review depends on specific, checkable criteria under the Common Rule (45 CFR 46) and, separately, under HIPAA — and getting the determination wrong, or skipping it entirely, is one of the more common compliance problems institutions see with this study design.
This guide walks through how the review-level determination actually works, how consent and HIPAA authorization requirements apply (or are waived) for a study where subjects generally are not contacted, and the practical workflow steps that keep a chart review defensible. For the distinct question of what “retrospective” means as a study design versus a prospective one, see Retrospective Study and Prospective vs. Retrospective Study.
Step one: is it human subjects research at all?
Before asking which review level applies, confirm the activity meets the Common Rule’s definition of human subjects research in the first place — a systematic investigation designed to develop or contribute to generalizable knowledge, involving a living individual about whom an investigator obtains identifiable private information. A chart review that only uses fully de-identified, aggregate, or already-public data may fall outside this definition entirely, or may be better classified as a quality improvement or operational activity rather than research. That threshold question is covered in depth in Is My Project Human Subjects Research? A Step-by-Step Determination Process and, for the specific QI-versus-research distinction that comes up constantly with chart-review-style projects, Quality Improvement vs. Human Subjects Research. Assume the rest of this guide applies once the activity has been confirmed to be human subjects research using identifiable data.
Step two: exempt, expedited, or full board — the actual decision structure
A retrospective chart review lands in one of three review tracks, and the determination has to be made by someone with delegated authority to make it (an IRB office, exemption official, or the IRB itself) — a researcher cannot self-declare a project exempt.
Exempt review — secondary research use of identifiable data (45 CFR 46.104(d)(4))
Under the 2018 Revised Common Rule, secondary research use of identifiable private information or identifiable biospecimens — exactly the situation in most chart reviews — is exempt if at least one of the following is true:
- The information is already publicly available; or
- The information is recorded by the investigator in a way that subjects’ identities cannot readily be ascertained — no direct or indirect identifiers linked to the data the investigator works with, no contact with subjects, and no attempt to re-identify them; or
- The research use is solely of identifiable health information already regulated under HIPAA (45 CFR Parts 160 and 164, Subparts A and E), for health care operations, research, or public health purposes.
This is frequently called Exempt Category 4. In practice, a chart review qualifies here when the study team works from a coded or de-identified dataset pulled by someone else (an honest broker), or when the entire data-use falls squarely within HIPAA’s own research-use permissions. A chart review where the investigator has ongoing access to identifiers and is not operating solely under a HIPAA-regulated use generally does not qualify for this exemption and moves to the next track.
Expedited review — existing data, records, or specimens (45 CFR 46.110)
If the study does not meet the exemption criteria above, it may still qualify for expedited (rather than full-board) review if it is no more than minimal risk and fits one of OHRP’s enumerated expedited-review categories. Most identifiable retrospective chart reviews fall under the category covering research involving materials (data, documents, records, or specimens) that were collected, or will be collected, solely for nonresearch purposes — the classic description of a chart review pulling from records generated for clinical care. Expedited review can be conducted by the IRB Chair or an experienced reviewer the Chair designates, and that reviewer can exercise every authority of the full board except disapproval; a project cannot be disapproved outside a convened full-board meeting.
Full-board review — when it’s still needed
Full-board review remains necessary when a chart review does not meet minimal-risk criteria — for example, records covering especially sensitive categories (psychiatric treatment, substance use disorder records subject to 42 CFR Part 2, HIV status, reproductive health) where a confidentiality breach could carry real consequences for subjects, or when the design combines retrospective record review with a prospective, higher-risk component (contacting former patients, obtaining new specimens). “Retrospective” describes where the data came from, not automatically how much risk the study carries.
Consent: why chart reviews usually rely on a waiver
Most chart reviews proceed without obtaining new informed consent from each individual whose records are used, under a waiver of informed consent granted by the IRB per 45 CFR 46.116(f). The IRB must find that: the research involves no more than minimal risk; the waiver will not adversely affect subjects’ rights and welfare; the research could not practicably be carried out without the waiver; and, where appropriate, subjects will be provided pertinent information after participation. Retrospective chart reviews are the textbook case for this waiver — many individuals were treated years earlier, are no longer patients of the institution, or are too numerous to practicably re-contact and consent. See Waiver of Informed Consent: When an IRB Can Approve Research Without It for the full four-part test, and Waiver of Documentation of Informed Consent for the related but distinct question of waiving only the signed form (46.117(c)) while still requiring some form of the consent process — a scenario that doesn’t typically apply to record-only chart reviews but matters for hybrid designs.
HIPAA runs on a separate track from the Common Rule
If the records contain protected health information (PHI) and the institution is a HIPAA covered entity, HIPAA imposes its own, independent requirement — separate from, and not satisfied merely by, IRB approval or a Common Rule consent waiver. HIPAA’s default mechanism for research use of PHI is a signed Authorization (45 CFR 164.508), which is impractical for the same reason re-consent is impractical in a chart review. HIPAA instead allows an IRB or a separately constituted Privacy Board to grant a waiver of authorization under 45 CFR 164.512(i), evaluated against its own criteria that overlap with, but are not identical to, the Common Rule’s 46.116(f) consent-waiver criteria — the two determinations can diverge and generally need to be documented separately. This HIPAA-specific mechanism, including the “review preparatory to research” and decedent-research pathways some chart reviews use before a full study is even designed, is covered in detail in HIPAA and Retrospective Research and HIPAA Waiver or Alteration of Authorization for Research Use of PHI. If a chart review instead uses data that has been fully de-identified per HIPAA’s Safe Harbor or Expert Determination methods, it falls outside HIPAA’s scope entirely, independent of whatever Common Rule review track applies.
Workflow practices that keep a chart review defensible
- Get review before you start. “Retrospective” describes the data, not the timeline of IRB approval. Pulling and analyzing chart data before an exemption determination or IRB approval is in place — even informally, to see if a project looks promising — is a common and avoidable compliance failure. Preliminary data pulls to assess feasibility should go through the same determination process, often as a limited preparatory-to-research request rather than skipping review altogether.
- Use a standardized abstraction form. A pre-specified data collection instrument, listing exactly which variables will be extracted from each chart, reduces reviewer bias, limits scope creep in what identifiers get touched, and is frequently something IRBs ask to see before approving the protocol.
- Consider an honest broker model. Where feasible, having someone outside the study team pull and code or de-identify records before the analytic team receives them can shift a project from the expedited track onto the stronger exempt-category-4 footing described above.
- Plan for multi-site designs separately. A chart review spanning more than one institution raises engagement and reliance questions — each participating site generally needs its own IRB oversight or a documented reliance arrangement — that are distinct from the single-site review-level analysis in this guide.
- Document the determination, not just the outcome. Journals and funders increasingly expect a citable IRB determination (exemption letter, expedited approval, or waiver documentation) at submission, not just an assertion that “no IRB approval was required.”
Chart review versus a case report
A small chart review that describes a handful of unusual cases can shade into a case report or case series, which some institutions treat differently for IRB purposes because the intent is descriptive rather than generalizable-knowledge-generating. That boundary, and when a case report can be handled without full research review, is covered separately in Case Report IRB Exemption. Don’t assume a small sample size alone moves a project out of the research definition — the generalizable-knowledge intent, not the number of records, is the deciding factor.
How this differs from a broader secondary-use or secondary-analysis project
A retrospective chart review is one common form of secondary data use, but the two aren’t identical in scope. For the fuller regulatory landscape covering secondary use of identifiable data and biospecimens more broadly — including registries, repositories, and biobanked specimens beyond a single chart-pull project — see Secondary Use of Identifiable Data and Biospecimens: The Regulatory Pathways. For the research-methods side of working with data someone else already collected — study design and analytic considerations rather than the IRB/consent mechanics covered here — see Secondary Data Analysis Explained.
Frequently asked questions
Does a retrospective chart review always need IRB approval?
It needs an IRB determination — which may result in an exemption, not full review. The determination itself (exempt, expedited, or full board) has to come from someone with delegated authority to make it, not from the researcher’s own judgment, and it has to happen before data collection begins.
Can a retrospective chart review be exempt from IRB review?
Yes, under 45 CFR 46.104(d)(4), if the data is already public, is recorded so identities cannot readily be ascertained (no re-identification, no subject contact), or the use is solely of PHI already regulated under HIPAA for health care operations, research, or public health purposes. An exemption still requires an official determination — it is not self-executing.
Does a retrospective chart review require informed consent?
Usually not from each individual, because most chart reviews qualify for an IRB-granted waiver of informed consent under 45 CFR 46.116(f) — the research is minimal risk, the waiver won’t adversely affect subjects, and re-consenting everyone typically isn’t practicable.
Do I need HIPAA authorization for a chart review?
If the records contain PHI and the institution is a HIPAA covered entity, yes, unless an IRB or Privacy Board grants a separate waiver of authorization under 45 CFR 164.512(i), or the data has been de-identified per HIPAA’s Safe Harbor or Expert Determination methods. This is a separate determination from the Common Rule consent waiver, evaluated on its own criteria.
What’s the difference between exempt and expedited review for a chart review?
Exempt means the study meets specific criteria (45 CFR 46.104) that remove it from most of the Common Rule’s ongoing requirements after the determination is made. Expedited means the study still requires Common Rule oversight — including continuing review in some cases — but can be reviewed by a single experienced reviewer rather than the convened full board, because it’s minimal risk and fits an enumerated category.
