Patient Consent for Case Report Publication

Patient consent for case report publication is the written authorization a patient — or a parent, guardian, or legally authorized representative — gives before a clinical case report describing their presentation, treatment, images, or outcome is submitted to a journal. It is a publication permission, not a research-ethics approval, and it is required whenever the report contains information that could identify the person, however small the readership of the journal.

What ICMJE actually requires

The controlling text for most medical journals is section II.E of the ICMJE Recommendations, “Protection of Research Participants.” Its requirements are narrower and more specific than the general instruction to “get consent,” and each clause does real work:

• Identifying information must not be published without written consent. ICMJE names names, initials, and hospital numbers explicitly, and applies the rule to written descriptions, photographs and pedigrees. The only exception is where the identifying information is essential for scientific purposes — and even then written consent is still required.
• The patient must be shown the manuscript. ICMJE states that informed consent for this purpose “requires that an identifiable patient be shown the manuscript to be published.” Consent obtained on a blank form before the case was written up does not meet this standard.
• The patient must be told about online availability. Authors are to disclose whether potentially identifiable material may be available via the internet as well as in print after publication — a materially different exposure from a print-only journal.
• Nonessential identifying details must be omitted regardless of consent.

Where the signed consent is archived

ICMJE says patient consent “should be written and archived with the journal, the authors, or both, as dictated by local regulations or laws,” and expressly notes that applicable law varies by locale, so journals must set their own policy with legal guidance. It also records the reasoning behind the two models: because a journal that archives the consent form necessarily learns the patient’s identity, some journals conclude that confidentiality is better protected by having the author archive the form and supply the journal with a written attestation that signed consent was obtained and is held. Neither model is universal, so the operative question for an author is always what the target journal’s instructions say, not what the last journal required.

De-identification is not a substitute

The most commonly misapplied part of the guidance is the anonymisation carve-out. ICMJE’s position is that consent should be obtained if there is any doubt that anonymity can be maintained, and it gives one worked example of an inadequate measure: “masking the eye region in photographs of patients is inadequate protection of anonymity.” A black bar across the eyes does not remove the consent requirement.

Where identifying characteristics genuinely are altered, ICMJE adds a second obligation that is easy to miss: authors must provide assurance — and editors should note — that the changes do not distort scientific meaning. Changing a patient’s stated age or occupation to protect them is only acceptable if the change is disclosed and does not mislead the reader about the case.

The CARE Guidelines requirement

The CARE (CAse REport) Guidelines, the reporting checklist most case-report journals ask authors to complete, carry the same obligation as the final checklist item: Informed Consent — “The patient should give informed consent. (Provide if requested.)” The immediately preceding item, Patient Perspective, asks that the patient share their perspective on the treatment they received. Read together, the two items assume the patient has seen and engaged with the report — which is the same assumption behind ICMJE’s show-the-manuscript rule.

Publication consent versus IRB review

These are separate determinations and neither one discharges the other:

• IRB review asks whether the activity is human-subjects research requiring oversight. Many institutions treat a single-patient case report as not meeting the regulatory definition of research (it is not designed to produce generalizable knowledge) and issue a “not human subjects research” determination or an exemption.
• Publication consent asks whether this identifiable person has authorized this description of themselves to be made public. That question survives regardless of how the IRB characterised the activity.

An IRB determination letter is therefore not an answer to an editor asking for the consent form, and a signed consent form is not an answer to an institution asking whether the activity needed review. In the United States a third question can also arise separately: whether disclosure of the underlying clinical information to the authors or the journal is permitted under HIPAA, which is governed by its own rules including 45 CFR 164.512(i).

Practical points for authors

• Obtain consent on the target journal’s own form where one exists; many journals (BMJ Case Reports among the best known) will not begin review without the completed form uploaded as a supplementary file.
• Obtain it after the manuscript is drafted, and show the patient the draft, including any images.
• Where the patient lacks capacity or is a child, consent comes from the parent, guardian, or legally authorized representative — and a child who reaches capacity before publication should generally be asked directly.
• If the patient has died, journal policy and local law govern; several journals require consent from the next of kin, and a death does not automatically remove the confidentiality obligation.
• Retain the signed form. Where the author archives it rather than the journal, the retention obligation is the author’s and their institution’s.

Frequently Asked Questions

Do I need patient consent if the case report is fully anonymised?

ICMJE’s test is not whether you intended to anonymise but whether any doubt remains that anonymity can be maintained — if doubt exists, consent should be obtained. Removing the name is rarely sufficient on its own, because a rare diagnosis, a named treating institution, an unusual timeline, or a clinical photograph can each re-identify a patient to people who know them.

Does masking the eyes in a clinical photograph remove the consent requirement?

No. ICMJE states directly that masking the eye region in photographs of patients is inadequate protection of anonymity. A photograph with an eye bar still requires signed consent authorizing the identifiable image.

Is IRB approval enough?

No. IRB review and publication consent answer different questions — whether the activity required research oversight, and whether this identifiable person authorized publication. ICMJE also notes that approval by a review body does not preclude editors from forming their own judgment about whether the conduct of the work was appropriate.

Who keeps the signed consent form?

The journal, the author, or both, depending on the journal’s policy and on local law. Some journals deliberately choose not to hold the form, so that they never learn the patient’s identity, and instead require the author to attest in writing that consent was obtained and archived.

Can consent be withdrawn?

Before publication, a withdrawal should be honoured and the manuscript withdrawn or the identifying material removed. After publication the position is governed by journal policy and applicable law; this is one reason ICMJE requires that patients be told in advance whether the material will be available on the internet, since online publication is far harder to unwind than print.

References

• ICMJE, Recommendations for the Conduct, Reporting, Editing, and Publication of Scholarly Work in Medical Journals, section II.E “Protection of Research Participants,” icmje.org
• CARE Case Report Guidelines, 2013 CARE Checklist (item 13, Informed Consent), care-statement.org
• World Medical Association, Declaration of Helsinki, as revised in 2024 (referenced by ICMJE II.E)