Can Researchers Use Administrative, Clinical, Educational, or Government Records Without Individual Consent?

Can Records Created for Services or Administration Later Be Used for Research?

Hospitals accumulate clinical records. Schools maintain enrollment and academic information. Government agencies hold administrative databases. Employers, public programs, and other organizations generate records while carrying out their ordinary functions.

These records can be extraordinarily valuable for research because they describe real populations over long periods without requiring researchers to collect the same information again. But the people represented in them may never have been asked whether their records could be used for research. Does that make research use impossible?

Some Records Research Can Proceed Without Individual Consent

Existing Records Were Usually Created for a Different Relationship

Records research is secondary research

When researchers analyze records that were originally created for clinical care, education, public administration, service delivery, or another nonresearch activity, they are conducting a form of secondary research. The researcher is using existing information for a purpose different from the activity that generated it.

The U.S. Common Rule expressly recognizes secondary research using identifiable private information that was collected for nonresearch purposes or for research studies other than the proposed secondary study. It provides several regulatory pathways under which such research may proceed, depending on the circumstances.

Lawful possession of a record does not automatically authorize research use

A hospital may legitimately possess a patient's medical record because it provided clinical care. A university may legitimately maintain a student's academic record because it administers education. A government agency may lawfully collect information to operate a public program.

Those original purposes do not necessarily give every researcher within or outside the organization unrestricted access to the records.

Identifiability can substantially change the analysis

Whether researchers receive identifiable information is often important. Under the U.S. Common Rule, research involving identifiable private information can constitute human-subjects research. Secondary research involving information from which investigators cannot readily ascertain participants' identities may be treated differently.

The Common Rule exemption at 45 CFR 46.104(d)(4), for example, covers certain secondary research uses of identifiable private information or identifiable biospecimens when specified conditions are satisfied. One pathway applies when investigators record information so that subjects' identities cannot readily be ascertained directly or through linked identifiers, do not contact subjects, and will not re-identify them.

This does not mean that researchers should personally decide that their records study is exempt. OHRP recommends institutional policies designating an appropriate person or entity to determine whether secondary research involving coded private information constitutes exempt or nonexempt human-subjects research.

Consent can sometimes be waived for identifiable records research

When a records study is nonexempt human-subjects research, individual informed consent may still not always be required. Under the U.S. Common Rule, an IRB may waive or alter consent when the criteria in 45 CFR 46.116(f) are satisfied.

Among other requirements, the research must involve no more than minimal risk, the research could not practicably be carried out without the waiver or alteration, and the waiver must not adversely affect participants' rights and welfare. Where identifiable private information or identifiable biospecimens are involved, the regulations also address whether the research could practicably be carried out without using the information or biospecimens in an identifiable format.

A waiver is therefore a reviewed determination, not a conclusion researchers reach merely because contacting everyone in a database would be difficult.

Clinical records can be governed by overlapping rules

Clinical records illustrate why there is rarely a single consent question. Research involving medical records may be subject to human-subjects regulations, health-information privacy rules, professional confidentiality duties, institutional policies, and other national or local laws.

Under the U.S. Common Rule, one provision of the secondary-research exemption specifically addresses investigators' use of identifiable health information when that use is regulated under the HIPAA Privacy Rule for qualifying purposes. This pathway exists because a separate regulatory privacy framework applies to the information.

Accordingly, “the IRB waived consent” should not be interpreted as “every privacy requirement has disappeared.” Different frameworks may require different authorizations or waivers.

Educational records can have their own confidentiality regime

Educational records may contain grades, attendance, disability information, disciplinary records, demographic characteristics, financial information, and other sensitive material. Access for ordinary educational administration does not necessarily authorize research use.

Researchers should identify the laws and institutional policies governing the particular records and institution. Requirements can differ by jurisdiction, educational level, funding arrangement, record type, and whether information has been appropriately de-identified.

The same principle applies to other sector-specific records. “Administrative data” is a description of how information originated, not a universal legal category with one research rule.

Government records are not automatically public records

Government agencies hold both public information and highly confidential records. The fact that information is maintained by a government body does not mean that anyone may obtain person-level records for research.

Access may depend on legislation, agency authority, confidentiality provisions, data-sharing agreements, ethics review, security requirements, or formal application procedures. Researchers should distinguish genuinely public records from restricted administrative microdata.

Philippine privacy law does not reduce research to a simple consent-or-no-consent rule

The Philippine Data Privacy Act requires personal information to be processed fairly and lawfully and for declared, specified, and legitimate purposes. It also provides several possible criteria for lawful processing rather than treating consent as the only possible basis.

The Act further recognizes historical, statistical, and scientific purposes in its general data-privacy principles while requiring appropriate safeguards. Sensitive personal information receives additional protection under the Act.

Researchers working with Philippine records therefore need to identify the applicable lawful basis, purpose, proportionality, security, confidentiality, and institutional requirements rather than assuming either that research always requires consent or that the word “research” creates a blanket exception.

Research should use only the information it actually needs

Administrative databases can contain hundreds of variables because they were built to operate services rather than answer one research question. Researchers should resist requesting the entire database simply because it is easier for the custodian to export it.

Where feasible, define the necessary population, time period, variables, level of detail, and identifiers before records are released. Data minimization can reduce privacy exposure without sacrificing the research question.

Linkage requires additional consideration

A records study may begin with one administrative database and later propose combining it with another. That step can materially change the privacy and consent analysis because linkage can create information that neither source revealed alone.

Whether researchers can link different datasets without recontacting participants should therefore be evaluated explicitly rather than assumed from permission to use the original records.

Not contacting people does not mean the study cannot affect them

Records research can expose sensitive patterns, generate classifications, stigmatize groups, or support decisions affecting populations even when researchers never communicate with an individual participant.

The absence of direct interaction often reduces burden, but it does not make records research ethically trivial. Privacy, confidentiality, scientific validity, fairness, and responsible reporting remain relevant.

Using Hospital Records Without Contacting Every Patient

Common Misunderstandings About Research Using Existing Records

Identify the Authority for Research Use Before Requesting the Records

If your study relies on records created outside your project, begin by identifying why those records exist, who controls them, which rules protect them, and what legal or ethical mechanism would permit your research access.

If your study relies on records originally collected for another purpose, the ethical question is therefore broader than whether secondary research requires new consent. You also need authority to obtain, process, protect, and report the particular records involved.

Before Using Existing Records Without Individual Consent

Frequently Asked Questions About Research Using Existing Records

Existing Records Can Support Research Without Consent in Some Circumstances, but Not Without Authority

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.