Nobody is recruited, but the records still came from patients. Institutions need a clear route for deciding, documenting and policing chart reviews before data are extracted.
Why a chart review still needs a decision
Retrospective chart reviews are among the most common studies a hospital research office sees. Nobody is recruited, nobody is contacted, and the data already sit in the electronic record, so it is easy for a team to conclude that no ethics review is needed.
The records still came from patients, and using them for research is a different purpose from the care they were collected for. The Declaration of Helsinki, last revised in October 2024, says that where consent is impossible or impracticable to obtain, secondary research on stored data may be done only after a research ethics committee has considered and approved it. National rules then decide which route applies: full review, expedited review, exemption, a consent waiver, or a finding that the activity is not research at all.
Each of those outcomes is a decision someone with authority makes, records and dates before data are extracted. Our guide to writing ethics approval statements editors accept covers the author's side: turning your determination letter into a statement a journal accepts.
Step one: research, audit or quality improvement?
Before choosing a review route, decide whether the project is research.
- US. The Common Rule defines research as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge" (45 CFR 46.102(l)). Guidance from the Office for Human Research Protections (OHRP) says the intent to publish is an insufficient criterion for deciding whether a quality improvement activity involves research.
- UK. The UK Research Ethics Committee Policy Document, which replaced the Governance Arrangements for Research Ethics Committees (GAfREC) from 28 April 2026, states that clinical audit, service evaluation and public health surveillance are not research, and that RECs are not expected to consider them. The HRA's online decision tools help classify a project.
- Canada. TCPS 2 Article 2.5 places quality assurance, quality improvement and program evaluation outside the scope of REB review when used exclusively for assessment, management or improvement purposes.
The hard cases start as audit and drift. Measuring one ward's care against a standard is audit; comparing two treatment strategies across several hospitals to inform practice elsewhere looks like research. Ask what question the project answers and who the answer is for, and record the classification with a reference the team can cite if a journal queries it.
The US routes: exempt, expedited, or full review with a waiver
For chart reviews subject to the Common Rule, the revised regulations at 45 CFR 46 offer three common routes.
| Route | When it fits a chart review | What the file should record |
|---|---|---|
| Exempt, category (d)(4) | Secondary use of identifiable private information where, for example, the investigator records data so subjects cannot readily be identified, does not contact them and will not re-identify them | The category and sub-criterion relied on, who decided, date, reference |
| Expedited review | Minimal-risk research on records collected solely for nonresearch purposes such as treatment or diagnosis (expedited category 5) | Reviewer, category, approval date, any waiver granted |
| Convened review | Higher-risk designs, sensitive data, or anything outside the categories above | Full approval record and any waiver findings |
Three details in exemption (d)(4) catch teams out.
- Recording, not viewing. The (d)(4)(ii) criterion turns on how the investigator records information. A clinician may see names while abstracting, but the study dataset must not let subjects be readily identified, and the investigator must not contact or re-identify them. A spreadsheet with medical record numbers in column A does not meet that test.
- HIPAA-regulated uses. Sub-criterion (d)(4)(iii) covers uses regulated under the HIPAA Privacy Rule for health care operations, research, or public health activities. That exemption does not remove the HIPAA requirements; it relies on them.
- Who decides. The regulations do not specify who at an institution makes exemption determinations. OHRP recommends, because of the potential for conflict of interest, that investigators not be given authority to make an independent determination that their own research is exempt. Designate the office or reviewer in writing.
When identifiable data are recorded and the study is not exempt, consent is usually waived. Under 45 CFR 46.116(f)(3), the IRB must find and document that:
- the research involves no more than minimal risk
- it could not practicably be carried out without the waiver
- if it uses identifiable information, it could not practicably be carried out without using that information in identifiable form
- the waiver will not adversely affect subjects' rights and welfare
- whenever appropriate, subjects will be given additional pertinent information after participation
"Impracticable" should be argued, not asserted: thousands of records over a decade, many patients deceased, is an argument; "contacting patients would be inconvenient" is not. Note also that the regulations bar an IRB from waiving consent for secondary use where a person was asked for broad consent under the Common Rule and refused.
HIPAA is a separate permission
The Common Rule decides whether the research is ethically acceptable. The HIPAA Privacy Rule decides whether a covered entity may use or disclose protected health information for it, and under 45 CFR 164.512(i) it applies regardless of the source of funding. A chart review at a US hospital usually needs both answers.
The Privacy Rule offers several routes without individual authorization:
- Waiver of authorization by an IRB or privacy board, which must find minimal risk to privacy, including adequate plans to protect identifiers and destroy them at the earliest opportunity, and written assurances against reuse, and that the research could not practicably be done without the waiver or without the protected health information.
- Reviews preparatory to research, which let a researcher look at records to design a protocol or assess feasibility, provided no protected health information leaves the covered entity. This is a feasibility check, not permission to start building the study dataset.
- Research on decedents' information, with the representations the rule requires.
- A limited data set under a data use agreement. It strips direct identifiers such as names, medical record numbers and street addresses but may retain dates, which many chart reviews need.
- De-identified data, by expert determination or the safe harbor method. Safe harbor removes all elements of dates except year, so a study built on admission-to-event intervals may not survive it.
The Privacy Rule also specifies what a waiver document must contain: the board and date of approval, a statement that the criteria are met, a brief description of the information approved as necessary, the review procedure used, and the signature of the chair or a designee. Build those elements into your standard letter template so they are never missing.
UK and Canada: where the lines fall
UK. Under the new UK REC Policy Document, NHS or HSC REC review is required for research using health or care records where identifiable confidential patient information is accessed at any stage for research, including where it is de-identified specifically for the research. Research using only effectively anonymised information, including data rendered anonymous by an intermediary with a legal basis to do so, does not need REC review under that policy, although a university committee may still review it. Separately, in England and Wales, using confidential patient information for research without consent needs a lawful basis to set aside the common law duty of confidentiality, typically support under section 251 of the NHS Act 2006, advised on by the HRA's Confidentiality Advisory Group. The HRA's REC policy page links to the full document.
Canada. TCPS 2 distinguishes anonymous information, which never had identifiers, from information that has been coded or anonymised. Article 2.4 exempts research relying exclusively on secondary use of anonymous information, which a chart review drawn from named records will rarely be. Article 5.5B requires REB review, but not consent, for research using only non-identifiable information. Article 5.5A lets an REB approve secondary use of identifiable information without consent only when researchers satisfy it on six conditions, including that identifiable information is essential and that seeking consent is impossible or impracticable.
Other jurisdictions have their own rules. If your institution hosts multinational chart reviews, map each site's requirement before extraction starts.
Building an intake process that holds up later
A chart review can reach a journal years after the determination, and your process is what lets the author answer an editor's query then. A workable pathway includes:
- One front door. All chart reviews go to the same office, which classifies them (not research, exempt, expedited, convened) and decides the privacy route at the same time.
- A short, specific form. Data source and date range, variables to be recorded, whether identifiers or dates will be kept, who extracts, where data are stored, and whether any patient will be contacted.
- A dated, numbered determination for every outcome, including "not research" and "exempt". An email reply from a colleague is not a determination.
- Scope control. Extending the date range, adding a site, linking to another dataset or keeping identifiers longer should come back as an amendment or a new determination.
- Retention of the paper trail for as long as the publication may be questioned.
Our checklist for research integrity offices covers where this fits among an office's wider responsibilities, and our guide to sharing clinical data openly without breaching privacy covers what happens when the dataset itself is to be shared.
What journals will check
Editors are not re-running your review. The ICMJE Recommendations ask authors to seek approval from an independent review body and to be prepared to provide documentation when editors request it, and state that approval does not preclude editors from forming their own judgment. They also say that if doubt exists whether research was conducted in accordance with the Declaration of Helsinki, authors must show the review body explicitly approved the doubtful aspects.
For a chart review, that means the paper should name the body that decided, give the reference, and say how consent was handled: waived, by whom, and on what basis. Directive Publications' policies follow the COPE Core Practices and the ICMJE Recommendations; its For Authors page brings the research ethics and integrity requirements together.
A checklist for research offices
- Every chart review is classified by a designated office, not by the project team
- Research versus audit or quality improvement is decided and recorded with a reference
- The exemption category, or the waiver findings, are written into the determination
- The privacy route (waiver, limited data set, de-identification) is decided at the same time
- Preparatory reviews are not used to build study datasets
- Changes in scope come back for a new decision
- Determination letters carry a name, date and reference an editor can check
Frequently asked questions
Does a retrospective chart review need IRB or ethics committee approval?
It needs some form of ethics decision, although the outcome is often an exemption or a consent waiver rather than full committee review. The Declaration of Helsinki says secondary research on stored data without consent may be done only after a research ethics committee has considered and approved it, and national rules then decide which route applies. Ask your institution's ethics office before any data are extracted for the study.
Can a researcher decide that their own chart review is exempt?
The US Common Rule does not say who at an institution makes exemption determinations, but federal guidance from the Office for Human Research Protections recommends that investigators not be given authority to decide that their own research is exempt, because of the conflict of interest. Most institutions route the question to the IRB office or a designated reviewer. A written determination with a reference number is also what a journal editor can check.
What are the criteria for a waiver of consent in a retrospective study?
Under the US Common Rule the IRB must find and document that the research is no more than minimal risk, could not practicably be carried out without the waiver, could not practicably use non-identifiable data if it uses identifiable information, will not adversely affect participants' rights and welfare, and that participants will receive pertinent information afterwards where appropriate. Other countries use similar but not identical tests, such as Canada's TCPS 2 Article 5.5A.
Is a HIPAA waiver the same as an IRB waiver of consent?
No. The IRB waiver of consent comes from human subjects regulations, while a HIPAA waiver of authorization is a separate permission under the Privacy Rule that lets a covered entity use or disclose protected health information for research. An IRB or privacy board can grant both, often in the same letter, but the criteria and documentation requirements are different and both need to be met.
Is a chart review for quality improvement exempt from ethics review?
Activities that are genuinely quality improvement, audit or service evaluation often fall outside the definition of research, and in the UK and Canada they are outside the scope of research ethics committee review. Planning to publish does not by itself turn quality improvement into research, but a project designed to produce generalisable knowledge is research. Have the classification made and recorded by the office your institution designates, not by the project team.