Does Your Retrospective Chart Review or Secondary Data Study Need IRB Approval?

You have a dataset you want to analyze. Electronic health records from a prior clinical program, or a claims database you licensed, or a registry you contributed to years ago. No new interventions, no patient contact, no prospective enrollment. Just data that already exists. Do you need IRB approval for that?

Probably, yes. But the answer depends on a few things, and the decision tree is more navigable than you might expect.

Retrospective chart review vs. secondary data analysis

These terms get used interchangeably, but they're slightly different. Here's how we're defining them. A retrospective chart review means extracting information about patients from historical medical records. A secondary data analysis is broader: taking any dataset originally collected for another purpose (clinical care, QI, public health surveillance, a prior study) and analyzing it to answer a new research question.

Either way, the regulatory question is the same: does this constitute human subjects research?

When it counts as human subjects research

Under the Common Rule (45 CFR 46.102), "human subjects research" requires two things: it has to be "research" (a systematic investigation designed to produce generalizable knowledge), and it has to involve "human subjects" (living individuals about whom you obtain data through intervention or interaction, or identifiable private information).

For retrospective studies, the first part is usually straightforward. If you're planning to publish, you're producing generalizable knowledge. The second part is where it gets interesting. You're not interacting with anyone. You're not intervening. So it all comes down to identifiability. If the records include names, medical record numbers, dates of birth, or any combination of data points that could reasonably identify someone, that's identifiable private information, and your study is human subjects research. If the data has been fully stripped of identifiers and there's no code key linking it back to individuals, it likely falls outside the definition. (We covered the broader question of when IRB approval is required in a prior post.)

The exempt pathway: Category 4

Even if your retrospective study qualifies as human subjects research, it may be eligible for an exempt determination rather than full or expedited review. The relevant category is Category 4 under 45 CFR 46.104(d)(4), which covers secondary research uses of identifiable private information or biospecimens. It applies when, among other conditions, the data is recorded so that subjects cannot be identified (directly or through linked identifiers) and the investigator does not contact or re-identify them.

That's the scenario for most retrospective chart reviews. If you're working with a coded or de-identified dataset, you don't hold the key, and you won't try to re-identify anyone, Category 4 exempt is likely your pathway. We wrote a more detailed walkthrough of all the exempt categories if you want the full picture. One important thing: you cannot self-determine exemption. An IRB has to review your study and confirm it.

"Not human subjects research" determinations

Sometimes a retrospective study doesn't meet the threshold for human subjects research at all. If the data has been stripped of all 18 HIPAA identifiers per the Safe Harbor method (or a statistician has certified low re-identification risk under Expert Determination), and you have no code key linking back to individuals, your analysis doesn't involve human subjects.

An IRB can issue a formal "not human subjects research" (NHSR) determination confirming that (see our post about NHSR determinations). It's not an approval or an exemption, just a statement that the regulations don't apply. You'd be surprised how often that letter comes in handy anyway (more on that below).

HIPAA considerations

This is the part that catches people off guard. Even if your study is exempt or falls outside the Common Rule entirely, HIPAA may still apply if you're working with protected health information (PHI) from a covered entity.

If the data has been de-identified per the HIPAA Privacy Rule's standards (Safe Harbor or Expert Determination), HIPAA restrictions on use and disclosure don't apply. That's the cleanest path.

A limited data set removes direct identifiers but can retain dates and geographic information. Using one requires a data use agreement between you and the data holder.

And if you need identifiable data but it's impractical to get consent from every patient whose records you're reviewing, an IRB can grant a waiver of HIPAA authorization under 45 CFR 164.512(i). The IRB has to find that the research couldn't practicably be done without the waiver and that there's an adequate plan to protect identifiers.

The thing people miss: a study can be exempt under 45 CFR 46 and still violate HIPAA if you haven't addressed how you obtained and handle the data. These are separate regulatory frameworks.

Why you should get a determination letter even when it's not technically required

We've seen this before: a team does a retrospective analysis, skips the IRB, and then a journal asks for a determination letter at submission. Or a data partner wants one before sharing a dataset. Or a collaborating institution's compliance office flags it.

A formal letter from an IRB removes that ambiguity before it becomes a bottleneck. It also protects you if questions come up later, because a good-faith determination from a registered IRB carries weight that your own internal assessment does not.

Getting this done

Retrospective and secondary data reviews are a type of submission we see at Tempus IRB. Exempt determinations are a flat $1,300, NHSR determinations are the same, and we typically turn them around within a day. If you're not sure which category your study falls into, email us! We're happy to help you sort it out before you submit.

This post is for informational purposes only and does not constitute legal advice.