Frequently Asked Questions - Clinical Case Reports

A clinical case report does not meet the Common Rule definition of research because it is not a systematic investigation designed to develop or contribute to generalizable knowledge (45 CFR 164.501). A clinical case report is considered an educational process. Therefore, a clinical case report is generally not reviewed by the IRB for approval. At Sentara, a report of two or more individuals is not considered a clinical case report but is considered a case series that requires IRB approval. Studies of a larger number of cases could be considered as a retrospective chart review that would require IRB approval. The IRB should be contacted before beginning the clinical case report activity, as the EVMS IRB does not make retroactive determinations.

Generally, patients for clinical case reports are identified during usual patient care activities. Any activity to search medical records for potential clinical case reports would be considered human subjects research and would require prior IRB approval.

Direct patient consent is strongly advised for all clinical case reports. Most journals require a statement confirming that patient consent has been obtained.

Clinical case reports must comply with HIPAA Privacy Rule requirements regarding Protected Health Information (PHI). Compliance with the Privacy Rule can be accomplished by obtaining HIPAA authorization from the patient or patient's representative (in the case of a deceased or incapacitated patient). Sentara's consent and authorization form is available here.

A copy of the signed authorization form should be entered into Epic for permanent storage, filed under the Media tab, and labelled as "Case Report Consent." A copy should be kept in a secure place by the author. A copy of the authorization should not be sent to a publisher because of privacy considerations.

Although consent is not legally required if the clinical case report is completely de-identified and does not contain protected health information, an author should consider the ethical responsibility of adequately informing a patient before publishing a clinical case report.

If a patient is identified outside of normal healthcare operations and is to be approached solely to obtain information for a clinical case report, IRB should be contacted, and IRB approval may be required. Clinical case reports with more than one patient will require prospective IRB approval before proceeding with the activity. Expedited IRB approval can be sought by sending the IRB a brief memo describing the planned clinical case report activity. Authors seeking a review of a prepared de-identified clinical case report (if direct patient consent is not obtained) to assure that the information in the clinical case report has been properly de-identified and does not contain Protected Health Information (PHI) should contact the EVMS Privacy Officer and not the IRB.

If a clinical case report does not contain identifying information, it is not PHI and therefore is not regulated under HIPAA and consent is not legally required, although an author should consider the ethical obligation of informing a patient before publishing a clinical case report.

The most common way of de-identifying medical data is the “safe harbor” method of deleting 18 identifying elements from a report. It should be noted that element #18 is “Any other unique identifying number, characteristic, or code that could identify an individual.” This identifier could apply to patients with rare conditions where the condition itself is a characteristic that could potentially identify the individual. For patients with rare conditions and unique characteristics, the author of a clinical case report is required to obtain a signed direct consent from the patient.

According to the Privacy Rule (45 CFR 164.514(b)(2)(i)), the 18 identifiers are:

1. Name
2. Address (all geographic subdivisions smaller than a state, including street address, city,
   county and zip code)
3. All elements of dates (except year) for dates that are directly related to an individual,
   including birth date, admission date, discharge date, death date, and all ages over 89 and all
   elements of dates (including year) indicative of such age, except that such ages and elements
   may be aggregated into a single category of age 90 or older
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/License numbers
12. Vehicle identifiers and serial numbers including license plate numbers
13. Device identifiers and serial numbers
14. Web universal resource locators (URLs)
15. Internet protocol (IP) address
16. Biometric identifiers, including fingerprints and voiceprints
17. Photographic images - including full facial photographs and other comparable image
18. Any other unique identifying number, characteristic, or code that could identify an individual.

Yes, but the images cannot include any identifying information. Use of full-face photos, tattoos or other identifying characteristics is not allowed. Direct patient consent must be obtained for all clinical case reports that include pictures or images.