A case report on one or two patients is generally not considered research. However, any PHI disclosed in case reports is subject to the Privacy Rule. Therefore, if a unique case is described that may identify an individual to the general public simply by describing the disease or the unique treatment received, authorization from the patient is required prior to disclosing the information as part of a published article, meeting abstract, or any other form of public presentation.
IRB-approved recruitment practices should be followed in order to contact a patient or patients to acquire their authorization for disclosure of information for a case report. For example, if the case is being researched or presented by someone other than the treating physician, then the initial contact should be made by, or at least in collaboration with, the clinical department that treated the patient and with whom the patient is familiar. For further guidance on recruitment practices, see the LLU Investigator's Guide to HIPAA.
If patient authorization is not possible, a waiver of authorization may be submitted to the IRB/Privacy Board.