IRBs And Real-World Evidence Registries
June 30, 2025
IRBs And Real-World Evidence Registries
Overview
When physicians collect HIPAA-compliant real-world clinical data during the course of regular medical care to evaluate and improve established treatment protocols — without introducing novel interventions or intending to produce generalizable scientific knowledge — IRB review is not legally or ethically required. This is consistent with both the Common Rule and HIPAA, as well as best practices across academic and clinical institutions.
IRB review is not necessary for the HIPAA-compliant collection of real-world clinical data by physicians acting within the scope of their regular practice of medicine, when the primary aim is quality improvement of established treatment protocols.
Applicable Definition of “Research”
Research v. Quality Improvement
Federal regulations and ethical frameworks governing human subjects research distinguish between activities that qualify as “research” and those that are considered Quality Improvement (QI).
Physicians collecting real-world data in the course of standard patient care for the purpose of evaluating or improving existing treatment protocols — without introducing untested interventions, without a plan to contribute to generalizable knowledge, and in compliance with HIPAA — do not meet the regulatory definition of “human subjects research” requiring Institutional Review Board (IRB) review. This conclusion is supported by guidance from the Office for Human Research Protections (OHRP), HHS regulations, and detailed analysis of the Common Rule and HIPAA regulations.
Under 45 CFR 46.102(l), "research" is defined as a systematic investigation designed to develop or contribute to generalizable knowledge. If an activity does not meet both components of this definition, it is not considered research and therefore not subject to IRB review.
QI activities typically aim to assess or improve internal processes or outcomes and do not intend to generalize findings outside the institution or clinical setting in which they are conducted. The HHS explicitly states that activities conducted to enhance patient care, collect data for administrative purposes, or evaluate provider performance generally do not meet the definition of research and thus do not require IRB review.
Even if results are published, QI initiatives do not become “research” unless their design and intent were to develop generalizable knowledge:
“The mere intent to publish an account of a QI project does not automatically classify it as research.” (OHRP Guidance.)
The HIPAA Privacy Rule (45 CFR 164.501) expressly permits the use and disclosure of Protected Health Information (PHI) without patient authorization when used for health care operations, which include quality assessment and improvement activities, case management, and outcomes evaluation.
When physicians collect real-world clinical data solely to improve existing treatment protocols for their own practice, this constitutes a health care operation, not research. If the data are de-identified or handled in accordance with HIPAA’s limited data set provisions, and used within the scope of operations, this does not trigger research regulations.
Even if a QI project is borderline, federal guidance offers exemptions under the Common Rule. Category 4 exemption covers secondary research using identifiable private information or biospecimens, when such use is regulated under HIPAA for healthcare operations. No IRB review is needed if the physician is not intervening beyond routine care, not randomizing patients, and is using existing data for internal analysis.
What Is Exempt Research
Even for exempt research formal IRB approval is not required, only a determination that the activity qualifies as exempt. According to the Common Rule, research activities posing no more than “minimal risk” may qualify for expedited or exempt IRB review. Real-world data collected during routine care inherently involves no added risk, as it arises from normal clinical operations.
The physician's collection of data without altering standard care, and without interacting with patients for research-specific purposes, reinforces that the activity remains non-research.
“QI/QA activities… collecting data solely for clinical, practical, or administrative purposes… do not meet the definition of ‘research’.” — HHS/OHRP.
The U.S. Department of Health and Human Services (HHS) and the Office for Human Research Protections (OHRP) provide that QI initiatives do not require IRB review unless they introduce untested clinical interventions intended to produce scientific evidence.
The University of Southern California, Boston University, and the Minnesota Department of Health affirm that internal QI efforts carried out as part of normal practice without intent to generalize do not fall under IRB oversight. 1
Conclusion
Circles represent clinically and financially valuable datasets relevant to licensees for a broad variety of uses. When they are licensed to conduct or support research, it will be the responsibility of the licensee to seek IRB approval when appropriate.
In addition, Sponsors are able to establish “Private Circles” where IRB approval may be appropriate. It then is the Sponsor’s responsibility to organize such approvals. RegenMed regularly assists in coordinating with the IRB in such instances.
Circles typically involve real-world data collection from multiple sites, making commercial IRBs a practical option when IRB involvement is appropriate. This will also comply with approaches taken by most academic medical centers for multi-site trials. See the SMART IRB Network.
IRBs And Real-World Evidence Registries
June 30, 2025
Overview
When physicians collect HIPAA-compliant real-world clinical data during the course of regular medical care to evaluate and improve established treatment protocols — without introducing novel interventions or intending to produce generalizable scientific knowledge — IRB review is not legally or ethically required. This is consistent with both the Common Rule and HIPAA, as well as best practices across academic and clinical institutions.
IRB review is not necessary for the HIPAA-compliant collection of real-world clinical data by physicians acting within the scope of their regular practice of medicine, when the primary aim is quality improvement of established treatment protocols.
Applicable Definition of “Research”
Research v. Quality Improvement
Federal regulations and ethical frameworks governing human subjects research distinguish between activities that qualify as “research” and those that are considered Quality Improvement (QI).
Physicians collecting real-world data in the course of standard patient care for the purpose of evaluating or improving existing treatment protocols — without introducing untested interventions, without a plan to contribute to generalizable knowledge, and in compliance with HIPAA — do not meet the regulatory definition of “human subjects research” requiring Institutional Review Board (IRB) review. This conclusion is supported by guidance from the Office for Human Research Protections (OHRP), HHS regulations, and detailed analysis of the Common Rule and HIPAA regulations.
Under 45 CFR 46.102(l), "research" is defined as a systematic investigation designed to develop or contribute to generalizable knowledge. If an activity does not meet both components of this definition, it is not considered research and therefore not subject to IRB review.
QI activities typically aim to assess or improve internal processes or outcomes and do not intend to generalize findings outside the institution or clinical setting in which they are conducted. The HHS explicitly states that activities conducted to enhance patient care, collect data for administrative purposes, or evaluate provider performance generally do not meet the definition of research and thus do not require IRB review.
Even if results are published, QI initiatives do not become “research” unless their design and intent were to develop generalizable knowledge:
“The mere intent to publish an account of a QI project does not automatically classify it as research.” (OHRP Guidance.)
The HIPAA Privacy Rule (45 CFR 164.501) expressly permits the use and disclosure of Protected Health Information (PHI) without patient authorization when used for health care operations, which include quality assessment and improvement activities, case management, and outcomes evaluation.
When physicians collect real-world clinical data solely to improve existing treatment protocols for their own practice, this constitutes a health care operation, not research. If the data are de-identified or handled in accordance with HIPAA’s limited data set provisions, and used within the scope of operations, this does not trigger research regulations.
Even if a QI project is borderline, federal guidance offers exemptions under the Common Rule. Category 4 exemption covers secondary research using identifiable private information or biospecimens, when such use is regulated under HIPAA for healthcare operations. No IRB review is needed if the physician is not intervening beyond routine care, not randomizing patients, and is using existing data for internal analysis.
What Is Exempt Research
Even for exempt research formal IRB approval is not required, only a determination that the activity qualifies as exempt. According to the Common Rule, research activities posing no more than “minimal risk” may qualify for expedited or exempt IRB review. Real-world data collected during routine care inherently involves no added risk, as it arises from normal clinical operations.
The physician's collection of data without altering standard care, and without interacting with patients for research-specific purposes, reinforces that the activity remains non-research.
“QI/QA activities… collecting data solely for clinical, practical, or administrative purposes… do not meet the definition of ‘research’.” — HHS/OHRP.
The U.S. Department of Health and Human Services (HHS) and the Office for Human Research Protections (OHRP) provide that QI initiatives do not require IRB review unless they introduce untested clinical interventions intended to produce scientific evidence.
The University of Southern California, Boston University, and the Minnesota Department of Health affirm that internal QI efforts carried out as part of normal practice without intent to generalize do not fall under IRB oversight. 1
Conclusion
Circles represent clinically and financially valuable datasets relevant to licensees for a broad variety of uses. When they are licensed to conduct or support research, it will be the responsibility of the licensee to seek IRB approval when appropriate.
In addition, Sponsors are able to establish “Private Circles” where IRB approval may be appropriate. It then is the Sponsor’s responsibility to organize such approvals. RegenMed regularly assists in coordinating with the IRB in such instances.
Circles typically involve real-world data collection from multiple sites, making commercial IRBs a practical option when IRB involvement is appropriate. This will also comply with approaches taken by most academic medical centers for multi-site trials. See the SMART IRB Network.
