Get Started

Starting a registry can seem like a huge undertaking, but you don’t have to tackle all the steps at once. This page provides an overview about registries and the major milestones that you help you build a successful registry. 

Registries Come in a Variety of Shapes and Sizes

Registries can collect different types of information, depending on the registry’s goals. For example, a registry might only collect participant contact information.  


Organize and grow your community.

  • Collects only contact and some demographic information such as participant age, sex, and ethnicity. 
  • Often created and operated by one or more patients or parents.
  • No approvals needed to collect data (e.g., may only require a simple disclaimer).


Learn about experiences, perspectives, needs and priorities of patients.

  • Collects patient-reported health and medical information.
  • Often created and operated by patient advocacy groups (PAGs) or researchers.
  • Has stricter data collection requirements for research use and publication (e.g., likely requires institutional review board (IRB) approval).


Observe clinical practice.

Roadmap for Building a Successful Registry

Organize and Grow Your Community

Create a contact registry to find participants living with your rare disease, learn how many people have the disease, build trust, and organize and grow your participant community to support research. Encourage research by promoting your contact registry as a way to recruit participants for new studies and reach out to patients on behalf of researchers.

Learn about Patient Experiences

Collect more detailed participant health and medical information to learn more about people living with your rare disease. Share the information with researchers to help them better understand the experiences, perspectives, needs, and priorities of people living with your rare disease and focus their research efforts.

Collect Clinical Data and Partner for Natural History Studies

Collect clinical information and outcomes and develop partnerships with clinicians, researchers, and industry to facilitate and encourage natural history studies to track the course of the disease over time. Natural history studies provide a greater understanding of how the disease develops and how it can most effectively be treated.

Ethical and Legal Requirements

As soon as you decide to create a registry, become familiar with the ethical and legal responsibilities of running a registry. If you don’t follow the laws and rules from the beginning of your registry, your registry might not be usable for research or the treatment approval process.

Make sure that your registry follows local, state, and federal laws and rules that cover the collection of personal and health information. In some cases, you need to follow international laws and rules as well.

Read about the research requirements and regulations listed below. Whether your registry has to follow each one depends on the type of information the registry collects, how the registry will be used, and who gives and uses the information. The requirements also cover how you share the information and how you maintain and protect the information.

It might be a good idea to talk to a lawyer or ethics expert. These experts can help make sure that your registry follows the relevant laws and rules.

Research Requirements

What is an IRB?
An IRB is a group of people with different backgrounds. This group is responsible for protecting the rights and welfare of people who participate in research studies.

The IRB will review studies, including clinical trials that use registries, before the studies begin recruiting participants. Based on its review, the IRB either approves or does not approve each study.

The IRB can require changes to the study plans. These changes typically ensure that risks to participants are limited and the study collects informed consent. The IRB might also require changes to protect participants’ privacy and make sure that the study follows all relevant laws and rules. The IRB also has the authority to monitor the research once it starts.

How does the IRB apply to registries?
If you plan to share participant information from your registry with researchers, an IRB must first review the clinical trial that your participants are being asked to join.

Where can I learn more?
Video: Institutional Review Boards (IRBs)
Information Sheet: FDA Institutional Review Boards Frequently Asked Questions
45 CFR 46 FAQs
Human Subject Regulations Decision Charts

What is The Federal Policy for the Protection of Human Subjects (‘Common Rule’)?
The Federal Policy for the Protection of Human Subjects is also known as the ‘Common Rule’. This policy protects personally identifiable information of participants in federally funded research studies. Personally identifiable information is information that other people could use to figure out who a participant is.

How does the Federal Policy for the Protection of Human Subjects apply to registries?
If a researcher invites your registry members to participate in a federally funded study, the researcher has to follow the Common Rule.

Where can I learn more?
Registries for Evaluating Patient Outcomes: A User’s Guide
Federal Policy for the Protection of Human Subjects (‘Common Rule’)
Revised Common Rule Videos

U.S. Laws and Regulations

What is HIPAA?
HIPAA prevents improper sharing of sensitive patient information.  Sensitive patient information is also known as protected health information (PHI). Any health information that can be tied to a person is PHI. Examples of PHI the 18 identifiers (e.g., name, address, birth date, and Social Security number). A full list of PHI types is available on the National Institutes of Health website.

HIPAA protects patient privacy and their data from theft and fraud. Personally identifiable information is information that other people could use to figure out who a participant is. Patients who want to share their health data with health care professionals must give permission to release their PHI.

This table compares the HIPAA rules that protect the privacy and security of PHI.

 Patient Privacy
Data Security
What is it?Protects the use of patient
information and puts policies
in place to ensure that patient information is being collected,
shared, and used in appropriate
Focuses on protecting patient
information from malicious
computer attacks and the
stealing of patient information
for profit.
RuleHIPAA Privacy Rule
HIPAA Security Rule
How can I apply the rule?

Your registry can:

  • De-identify patient information.
  • Use patient information for purposes only mentioned in the informed consent.
  • Share patient information only with those mentioned in the informed consent.

Your registry can:

  • Convert the data into special codes
    that hide the information from people who don’t have permission to see the data.
  • Control who has access to the data.
  • Give people with different needs access to different types of information (such as more detailed or less detailed information).

How does HIPAA apply to registries?
If you plan to share PHI from your registry with researchers, you need to follow HIPAA. HIPAA can help you protect the information in your registry from hackers and other people who could change or use the data without your permission or the permission of patients in the registry.

Where can I learn more? Health Information Privacy
HIPAA Basics – Privacy and Security
Privacy, Security, and HIPAA
Registries for Evaluating Patient Outcomes: A User’s Guide. Chapter 7: Principles of Registry Ethics, Data Ownership, and Privacy
Registries for Evaluating Patient Outcomes: A User’s Guide. Chapter 9: Protecting Data: Confidentiality and Legal Concerns of Providers, Manufacturers, and Health Plans
Healthcare Data Security
Recommendations for Improving the Quality of Rare Disease Registries
Privacy Frequently Asked Questions (FAQs)

What are the FDA regulations?
FDA rules protect people who participate in research studies that FDA regulates. FDA rules protect research participants’ privacy and the confidentiality of their information used in research.

FDA publishes its rules in Title 21 of the Code of Federal Regulations (CFR) (also known as 21 CFR). The Federal Register is the official daily publication of U.S. government rules, proposed rules, and notices. The federal government updates the CFR once a year.

How do FDA regulation apply to registries?
If the participant information collected in your rare disease patient registry will be used in research involving an FDA-regulated food or drug and requires an informed consent, you must follow the regulations outlined in 21 CFR. If your registry’s participant information will be used in a U.S. Department of Health and Human Services (HHS) study, the regulations in 21 CFR part 50 and 45 CFR part 46 must be followed. Where the regulations differ, those that offer the greater protection to participants should be followed.

Where can I learn more?
Code of Federal Regulations Title 21 – Food and Drugs
Regulations: Good Clinical Practice and Clinical Trials
Information Sheet: Informed Consent: Guidance for IRBs, Clinical Investigators, and Sponsors
Comparison of FDA and HHS Human Subject Protection Regulations

What is FISMA?
FISMA protects the unauthorized use of electronic and paper information which contain Federal data. This also applies to information associated with National Institutes of Health grants and contracts.  FISMA prevents people who don’t have permission from having access to protected information in data systems, such as registries, that have funding from the federal government.

How does it apply to registries?
The law covers registries that collect, store, use, or send patient data on behalf of a federal agency. The law also covers registries that have money through a federal grant or contract.

Where can I learn more?
1.9 Federal Information Security Management Act
Federal Information Security Modernization Act

European Union Regulations​

What is the GDPR?
The GDPR protects citizens of the European Union (EU) and the European Economic Area from privacy and data violations. The 28 member countries of the EU share a set of economic and political policies. Three other countries (Iceland, Liechtenstein, and Norway) are part of the European Economic Area, which allows these countries to be part of the single EU market.

The GDPR also regulates the release of personal information outside the EU and European Economic Area. The GDPR simplifies regulations that give individuals control over their personal information, regardless of where in the world that information is used.

How does the GDPR apply to registries?
If your registry includes participants from the EU or European Economic Area, it must comply with the GDPR. These regulations apply to the personally identifiable information of people in the registry, regardless of the location of the registry.

Where can I learn more?
EU General Data Protection Regulation (GDPR) education portal
General Data Protection Regulation (GDPR)
Data Protection – Rules for the protection of personal data inside and outside the EU

Does a registry already exist for your rare disease?

The first step is to find out whether your rare disease already has a registry by searching the internet, reaching out to existing patient advocacy groups, and contacting rare diseases “umbrella” organizations. Umbrella organizations refer to nonprofit patient advocacy groups that cover the entire rare diseases community. Having one registry for a rare disease allows for the pooling of resources, reduces duplication of efforts, and avoids sources of competition. When you are certain that a registry for your rare disease doesn’t exist, you can use the information, tools, and resources provides on this website to create one. 

Need help with this step?
The Genetic and Rare Diseases Information Center (GARD) can help you with your search. 

Create your registry!

RaDaR gives you step-by-step guidance and tools to create a registry for your rare disease. It is important to use registry standards so that the information you collect can be used by the medical and research communities to find treatments and cures for your rare disease.

Already have a registry?

RaDaR offers ideas on how to engage with your participants and find researchers to use your data. Our Manage Your Registry steps provide information, resources, and tools to continuously update, assess, and improve your registry using best practices.