Case Reports Need to Comply with HIPAA Rules

For clinicians seeking to share information about their patients, there are important distinctions between a “case report” and a “case series.” A case report is a short description of a patient’s illness or treatment that is conveyed to colleagues at a meeting or published in a medical journal or on a professional website. Reporting on three or more patients in one such article on the same topic is considered a case series rather than a case report and is an instance of human subjects research that requires Institutional Review Board (IRB) approval (see the Health Sciences IRB website for information on human subjects research). Although reporting on one or two patients is not considered research by the Health Sciences IRB, the author is still subject to the Health Insurance Portability and Accountability Act (HIPAA). The Health Sciences IRB also serves as the Research Privacy Board and oversees HIPAA compliance for case reports.
 
Before preparing a case report that contains protected health information about one or two patients, authors should ensure they’ve cleared one of the following three pathways:

• If the subject is deceased, HIPAA does not apply. The author should send a letter to the IRB office stating his intent to publish a case report on a deceased individual. The Research Privacy Board will provide the author with a letter of acknowledgment.
• If the subject is living, the author may obtain authorization from the subject. A Template for HIPAA Case Report Authorization Form is available on the IRB website. Upon receipt of documentation of authorization, the Research Privacy Board will issue a letter to the author acknowledging the patient's authorization.
• If authorization from the subject cannot practicably be obtained, the author may apply for a HIPAA waiver by submitting IRB/HIPAA Form VII, a HIPAA waiver request form, or a cover letter to the IRB office that establishes all three of the following elements:
  
  • The proposed use of the patient’s data/documents/records presents no more than minimal risk to the privacy of the individual. Please contact the IRB office for questions on "minimal risk."
  • The case report could not practicably be published/presented without the waiver.
  • The case report could not practicably be published/presented without access to and use of protected health information.

Review of the submitted material will occur in the IRB office by the chair or a vice chair. Please note that if a waiver is granted, it is the author’s responsibility to comply with HIPAA accounting requirements. A Template for Waiver of Research Authorization Tracking Form can be downloaded from the IRB website.

For more information, please see Health Sciences IRB and HIPAA Privacy Rules.