Do Case Reports Need Ethics Approval in the UK? HRA Rules, GMC Confidentiality Guidance and Patient Consent Explained

Not necessarily. A report of one patient’s presentation and management is often a clinical case report rather than a research project, but neither the label nor the number of patients settles it. Ask two separate questions: is the activity research, and if so, does that research need NHS REC review? The Health Research Authority (HRA) offers a decision tool for each, Is my study research? [1] and Do I need NHS REC review? [2]. Neither settles institutional, legal or publication requirements.

A clinician describing an unusual adverse reaction seen in routine care is usually writing a clinical case report. A team systematically analysing records to find transferable patterns is doing research that needs its own classification and review decision, whatever the patient count.

The four nations share a research policy framework, but legislation and approval arrangements differ. HRA and Health and Care Research Wales (HCRW) Approval covers project-based research in the NHS in England and Wales [3]; research led from Scotland or Northern Ireland follows national arrangements, and multi-nation studies need extra care. Identify the national and organisational pathway that applies rather than assuming one process.

When deciding whether HRA ethics approval for a case report is needed, keep three areas apart. This is the core of case report ethics approval in the UK:

• Research classification: purpose, methods and intended contribution to knowledge.
• REC review: whether the applicable rules require it for that research.
• Other requirements: local governance, data protection, confidentiality and journal policy.

A finding that an activity is not research does not remove the other obligations, and research that does not need REC review may still need other permissions. If unsure, ask the research office or sponsor and keep written confirmation.

The General Medical Council’s Confidentiality: good practice in handling patient information sets out doctors’ duties when disclosing patient information, and warns that removing a name, age or address alone is unlikely to anonymise it [4]. Publishing differs from sharing within a care team: even without direct identifiers, a rare diagnosis, a distinctive image, a precise timeline or an unusual family history may identify a patient.

The Information Commissioner’s Office (ICO) explains that identifiability depends on context and the means reasonably likely to be used, so stripping direct identifiers does not make data anonymous [5]; that guidance is under review following the Data (Use and Access) Act. Assess text, images, timelines and supplementary files together, generalising unnecessary detail without distorting clinical meaning. Confidentiality, data protection and publication consent overlap but are not the same.

Consent to treatment, consent to research and consent to publish serve different purposes; agreeing to treatment is not permission to publish [6]. Requirements come from professional standards (GMC confidentiality guidance expects explicit consent for disclosures beyond care [4]), the law (confidentiality and data-protection duties) and journal and institutional policies, which may demand a specific medical case report consent form even when REC review is not needed.

Obtain specific, informed consent for publication as the default, especially where details or photographs could identify the patient. The CARE checklist, among the main case report publication guidelines, treats informed consent as a core element of responsible reporting [7], although it creates no UK legal rule. Explain in plain language what will be published, for whom, and that anonymity cannot be guaranteed. Do not assume a general clinical consent form meets publication requirements. Practice is uneven: in 2,053 case reports and case series published in 2021, 79% reported consent and 46% included an ethics committee statement [8]. See our case report submission package guide for the documents journals expect.

Death, incapacity or difficulty contacting a patient does not by itself permit publication without consent. The GMC states that the duty of confidentiality continues after death [4]. If a patient lacks capacity, establish whether anyone holds legal authority covering the disclosure; for a deceased patient, weigh known wishes, identifiability and institutional and journal requirements. CARE advises seeking institutional committee permission only when neither patient nor relative can give consent, after proxy-consent attempts fail [7], but that is reporting guidance, not legal authorisation. If uncertain, seek information-governance, legal or medical-defence advice.

The two processes are complementary, not interchangeable. A classification decision does not settle REC review, and a decision that REC review is unnecessary does not remove consent, confidentiality or journal obligations.

Use these checks to organise decisions; they do not replace formal institutional determinations or professional advice.

• Changing clinical details carelessly: vague dates can corrupt the clinical timeline.
• Overlooking supplementary material: identifiers survive in image annotations, file metadata and screenshots.
• Using a generic ethics declaration: answer the journal’s question exactly: review obtained, why it was not required, or an institutional determination.
• Assuming the four nations are identical: confirm national and institutional arrangements,.
• Treating consent and anonymisation as interchangeable: removing identifiers does not settle confidentiality, data-protection or journal requirements.

Record the classification, review, consent and confidentiality decisions.