Additional commenters who argued that the definition was too narrow raised the following concerns: the difference between «research» and «health care operations» is irrelevant
from the patients» perspective, and therefore, the proposed rule should have required documentation of approval by an IRB or privacy board before protected health
information could be used or disclosed for either of these purposes, and the proposed definition was too limited because it did not
capture research conducted by non-profit entities to ensure public health goals, such as disease - specific registries.