Disease Charities and AI: Patient Registries and Research Grants
Rare disease foundations and patient advocacy organizations do more than raise awareness and money. Many of them run patient registries and natural history studies, and many fund research directly through competitive grant programs with scientific peer review. Both functions are heavy on documents, data, and coordination, which makes them natural candidates for AI assistance. Both also sit inside a web of US law and research ethics: HIPAA in the situations where it actually applies, the Common Rule and IRB oversight, the 21st Century Cures Act, FDA guidance on real-world data, and a growing set of state health privacy laws. This guide explains where AI genuinely helps a disease charity's research operations, from abstracting medical records and monitoring the literature to matching reviewers and summarizing progress reports, and where it must never stand in for scientific judgment or a patient's informed choice.
For a family facing a rare diagnosis, the disease charity is often the first place that makes the condition feel knowable. It connects them with other families, points them to specialists, and, increasingly, invites them to contribute their own experience to research. Behind that invitation sits real infrastructure. A foundation for a rare neuromuscular disease may maintain a registry of several hundred participants, each with years of survey responses, uploaded clinic notes, and genetic test reports. A larger organization working on a more common condition may run a grant program that funds dozens of laboratories at once, with an annual request for proposals, a scientific advisory board, and a portfolio that stretches back decades.
These are serious research operations, and they are usually staffed lean. A registry coordinator might handle enrollment questions, data cleaning, and researcher data requests in the same afternoon. A research director might be the only person responsible for recruiting fifty peer reviewers, screening each for conflicts of interest, and reading every progress report the foundation receives. The workload grows faster than the staff, and the work itself is exactly the kind of document-heavy, pattern-heavy labor that modern AI tools handle well.
That is the opportunity. The risk is equally specific. Registry data is some of the most sensitive information a nonprofit can hold, and in a small disease population it can identify a person even after names are removed. Research grantmaking depends on confidential review and on scientific judgment that the foundation's community trusts. An AI tool that leaks a draft proposal, nudges a funding decision without anyone noticing, or quietly changes what participants agreed to can damage the charity's credibility with patients, researchers, and industry partners all at once.
This article covers both functions. It begins with the US legal map, because the rules that apply to a charity-run registry are often not the ones people assume. It then walks through practical AI uses in registry operations, the consent and de-identification boundaries that AI must not cross, and the full research grant cycle from RFP through portfolio analysis. It closes with a governance approach that a small team can actually maintain. This is educational material, not legal advice. Registry structures, funding sources, and state of operation all change the analysis, so confirm your approach with counsel and with the IRB that oversees your studies.
The Two Research Engines Inside a Disease Charity
Disease-specific charities tend to drive research in two complementary ways. The first is generating data. Because rare and under-studied conditions often lack the large datasets that drug developers and academic researchers need, patient organizations step in to collect it themselves. A registry gathers structured information about people living with the condition, such as diagnosis details, genetic variants, symptoms, treatments, and quality of life. A natural history study goes further, following participants over time to document how the disease progresses without a particular intervention. FDA's draft guidance on rare disease natural history studies describes how such studies can help identify the patient population, develop clinical outcome assessments, find biomarkers, and support the design of externally controlled trials.
Shared platforms have made this far more accessible for small organizations. The National Organization for Rare Disorders runs the IAMRARE registry program, which lets individual patient groups sponsor customized natural history registries on a common platform. According to NORD, the platform has enrolled more than 18,000 participants across more than 50 natural history studies. Other charities build registries with academic partners, contract research organizations, or commercial registry vendors. Whatever the platform, the charity usually carries the relationship with participants and the responsibility for governance.
The second engine is funding research. Many disease charities operate grant programs that support basic science, translational work, clinical research, and early-career investigators. Some run these like a small federal agency, with formal RFPs, letters of intent, external peer review, and a scientific advisory board that makes funding recommendations to the board of directors. Others use a venture philanthropy model, investing in companies or milestone-based projects and sometimes sharing in downstream returns. Both models generate a steady stream of applications, reviews, budgets, progress reports, and publications that someone has to track.
The two engines feed each other. Registry data helps the charity understand where research gaps are, which in turn shapes its RFPs. Grantees often request registry data or ask the charity to help recruit participants for trials. That interconnection is why AI governance should cover both functions together rather than treating the registry and the grants program as separate silos with separate rules.
Registry and Natural History Work
Generating data the field does not yet have
- Enrollment, consent, and participant communications
- Surveys, uploaded records, and genetic reports
- Data curation, quality checks, and coding
- Data requests from academic and industry researchers
Research Grantmaking
Directing money toward the most promising science
- RFP design informed by research gaps
- Reviewer recruitment and conflict-of-interest screening
- Scoring, discussion, and funding recommendations
- Progress reports, milestones, and portfolio tracking
The US Legal Map: Which Rules Actually Apply to Your Registry
Before deciding where AI belongs, a disease charity needs a clear picture of which rules govern its data. The answer is frequently surprising, because the most famous health privacy law is often not the one in charge.
HIPAA usually does not apply directly, and that is not good news
HIPAA's Privacy Rule applies to covered entities, which are health plans, health care clearinghouses, and health care providers that conduct certain electronic transactions, and to their business associates. A patient advocacy foundation that collects information directly from participants usually is none of these. The NIH's registry toolkit for patient groups walks through which US laws apply to a registry and when HIPAA comes into play. A registry that a family joins online, filling in surveys and uploading their own records, is therefore generally outside HIPAA.
That situation changes when the charity's registry is operated by or for a covered entity, such as a registry hosted at an academic medical center, or when the charity performs a function for a hospital that makes it a business associate. It also matters on the way in: when a clinic sends records to the registry, the clinic is the covered entity and needs a HIPAA basis to disclose, typically the patient's signed authorization or an IRB-approved waiver. Many registries sidestep this by having participants exercise their HIPAA right of access and obtain or direct their own records, which they then contribute.
Being outside HIPAA is not a free pass. It means participants lack some protections they may assume they have, and it shifts the burden onto the charity's own promises, its consent documents, state law, and research ethics oversight. Be cautious with marketing language like "HIPAA compliant" for a registry that is not subject to HIPAA. Saying that you follow HIPAA-style safeguards voluntarily is accurate; implying that federal law protects the data when it does not is misleading. Our guide to HIPAA-compliant databases is still a useful reference for the technical safeguards worth adopting either way.
The Common Rule, FDA regulations, and IRB oversight
The federal human subjects regulation known as the Common Rule, codified for HHS at 45 CFR Part 46, applies to research that is conducted or supported by a federal agency that follows it. A registry funded entirely by private donations may not be covered by the Common Rule on its own terms. In practice, though, most credible registries and natural history studies operate under IRB review anyway. Academic partners require it under their own institutional policies, journals expect it, and data intended to support FDA submissions is held to research standards. Research that falls under FDA jurisdiction is governed by FDA's own human subject protection rules in 21 CFR Parts 50 and 56. If your organization is new to this territory, our article on IRBs and research ethics for nonprofits explains how review works and how to choose an IRB.
The 21st Century Cures Act and FDA real-world evidence guidance
The 21st Century Cures Act of 2016 matters to disease charities in several ways. Section 3001 directed FDA to incorporate patient experience data into its work, which raised the value of the structured patient-reported information registries collect. Section 3022 directed FDA to create a program for evaluating real-world evidence, meaning evidence derived from sources other than traditional randomized trials, for new indications and post-approval studies. Section 2012 changed the rules for Certificates of Confidentiality, which we return to below.
Under the real-world evidence program, FDA issued final guidance in December 2023 titled Real-World Data: Assessing Registries to Support Regulatory Decision-Making for Drug and Biological Products. Its central concept is fitness for use: whether a registry's design, data collection, and quality processes produce relevant and reliable data. It also addresses linking registry data with other sources and notes that participants' informed consent should allow for those linkages. A companion final guidance from July 2024 on electronic health records and medical claims data emphasizes documenting how study variables were extracted and validated. Both are directly relevant to AI, because any automated step that touches registry data becomes part of the provenance that a sponsor, and ultimately FDA, may need to understand.
Certificates of Confidentiality and state law
A Certificate of Confidentiality protects identifiable, sensitive research information from compelled disclosure, for example in a civil lawsuit. Under the Cures Act, NIH now issues certificates automatically for NIH-funded research that collects identifiable, sensitive information, as described in the NIH Grants Policy Statement. A privately funded registry can apply for one. For a charity whose registry holds genetic data and detailed health histories, it is worth discussing with counsel and your IRB.
State law fills many of the gaps HIPAA leaves. Washington's My Health My Data Act, fully effective in 2024, regulates consumer health data held by entities including nonprofits, requires consent for collection and sharing, and includes a private right of action. Several comprehensive state privacy laws, such as Colorado's and Oregon's, do not exempt nonprofits the way many others do. Many states also have genetic privacy statutes, and the federal Genetic Information Nondiscrimination Act protects against discrimination in health insurance and employment but not, for example, in life or long-term care insurance. Participants deserve to understand that. Our overview of state privacy laws and AI covers how these frameworks interact.
Quick Reference: What Governs Registry Data
A starting map to review with counsel and your IRB
- HIPAA: applies when the registry is run by or for a covered entity, and to clinics sending records in. Usually not to a charity collecting data directly from participants.
- Common Rule (45 CFR 46): applies to federally conducted or supported research; IRB review is standard practice regardless.
- FDA (21 CFR 50 and 56, RWE guidance): relevant when data supports drug development or regulatory submissions.
- Cures Act: patient experience data, real-world evidence program, and Certificates of Confidentiality.
- State law: consumer health data laws, comprehensive privacy laws without nonprofit exemptions, and genetic privacy statutes.
- Your own consent and privacy promises: often the most binding constraint of all.
Where AI Helps in Registry Operations
Registry work involves a great deal of reading, transcribing, checking, and explaining. AI does not change what the registry is for, but it can change how many hours each step takes. The key design question for every use is the same: what data does the tool touch, where does that data go, and who verifies the output?
Abstracting medical records into structured fields
Many registries invite participants to upload clinic letters, genetic test reports, imaging summaries, and pulmonary function or motor function results. Turning those documents into structured data, such as the specific variant, the date of diagnosis, or the most recent forced vital capacity, has traditionally meant a trained abstractor reading every page. Language models are now capable of drafting that abstraction quickly, pulling candidate values and pointing to where in the document each value came from.
The right pattern is human-verified abstraction, not automated entry. The model proposes, a trained person confirms against the source, and the system records both the AI suggestion and the human decision. That audit trail is what FDA's real-world data guidance has in mind when it emphasizes documenting how variables were derived. It also lets you measure the model's accuracy over time on your specific disease, which matters because general-purpose models can be confidently wrong about rare variant nomenclature or disease-specific scales. Run abstraction only inside a tool covered by a contract that prohibits training on your data and specifies retention, and treat consumer chatbots as off limits for any participant document.
Data curation and quality checks
AI is useful for finding the problems that make registry data hard to use: a birth date after a diagnosis date, a medication listed under three different spellings, free-text symptom descriptions that should map to a standard vocabulary, or duplicate enrollments from the same family. Rule-based checks catch many of these, and language models can help with the messier work of suggesting mappings from free text to controlled terminologies. As with abstraction, the output should be a queue of suggested corrections for a curator, never silent changes to the dataset. Every edit to research data should be attributable and reversible.
Participant communications and retention
Natural history studies live or die on retention, because their value comes from following the same people over years. AI can help draft plain-language newsletters that report back aggregate findings, reminders for annual survey updates, and translated versions of study materials for families who prefer another language. These are high-value, low-risk uses as long as prompts contain no participant data and any IRB-approved materials go back through the IRB when they change. A registry that tells participants what their data has made possible tends to keep them engaged.
Handling researcher data requests
As a registry matures, researchers and companies begin asking for data. AI can help a coordinator organize these requests: summarizing each proposal, checking whether the requested variables fall within what participants consented to share, and drafting the data use agreement from an approved template. The decision about whether to release data belongs to the registry's data access committee or governance board. If you partner with universities on these requests, our guide to university research partnerships covers how to structure the relationship.
Controls for AI-Assisted Registry Work
Build these in before the first document is processed
- A contract with every AI vendor covering confidentiality, retention, subprocessors, and no training on your data
- Human verification of every abstracted value against the source document
- An audit trail that records the AI suggestion, the reviewer, and the final value
- Periodic accuracy checks on a sample, reported to your scientific advisors
- IRB notification or amendment when AI changes how data is collected or processed
Consent and De-Identification: Lines AI Must Not Cross
Two parts of registry work are fundamentally about trust, and AI should support them without ever substituting for the human obligations involved.
Consent belongs to the participant
Informed consent is the participant's decision, made with an understanding of what will happen to their data. AI can help make consent documents more readable, generate a plain-language summary for the IRB to review, produce translations for certified review, or power a question-answering tool that draws only on approved study materials. What it cannot do is decide that a new use falls within an old consent. If a participant agreed to share data with academic researchers studying disease progression, a model that reads the consent form and concludes that a commercial partner's AI training project is "close enough" is not a valid basis for sharing. That interpretation belongs to the IRB, the data access committee, and, when in doubt, the participant through re-consent.
Consent also needs to address AI directly. If your registry will use AI to process records, or if you anticipate sharing data with partners who will train models on it, say so in the consent materials in language participants can understand. Our article on AI and informed consent explores how to explain these uses honestly without overwhelming people.
Small populations break simple de-identification
HIPAA defines two methods of de-identification, the Safe Harbor method of removing eighteen categories of identifiers and the Expert Determination method in which a qualified expert concludes the risk of re-identification is very small. HHS guidance explains both. Even when HIPAA does not technically apply to your registry, these methods are the vocabulary your partners will use.
For rare diseases, Safe Harbor alone is often not enough. When a condition affects only a few hundred people nationally, a combination of state, birth year, a specific genetic variant, and age at onset can point to one family, especially if that family has shared its story publicly to raise awareness. AI raises the stakes in both directions. It can help by flagging rare combinations of attributes in a dataset before release. It can also hurt, because a model given a "de-identified" extract plus public social media posts may be able to match records to people. For any release outside your organization, especially to industry, an expert determination tailored to your disease population is the safer standard. Techniques such as synthetic data can let partners explore a dataset's structure before receiving real records, though synthetic data has its own re-identification considerations in small populations.
Industry partnerships need explicit terms
Pharmaceutical and biotech partners increasingly want registry data, and many disease charities welcome the partnership because it brings treatments closer. Data agreements should now address AI explicitly: whether the partner may use data to train models, whether trained models may be shared or commercialized, how re-identification attempts are prohibited and enforced, and what happens to data and derived models when the agreement ends. These are governance decisions for the charity's board and scientific leadership, informed by participant input, not terms to accept by default.
Decisions That Stay With People
AI can inform these, but must not make them
- Whether a proposed data use is covered by participants' existing consent
- Whether a dataset is sufficiently de-identified for a given recipient
- Approval of researcher and industry data access requests
- Changes to consent forms, study protocols, or participant materials requiring IRB review
- Responses to participants asking medical questions, which belong with their clinicians
Research Grantmaking: RFPs, Literature, and Reviewer Matching
A disease charity's research grants program is its most direct lever on the science. The front half of the cycle, from deciding what to fund to assembling a review panel, is where AI can save the most staff time with the least risk.
Monitoring the literature and the field
Research directors need to know what has been published, what trials are registered, and where the gaps are. For a condition with an active research community, that means hundreds of papers a year plus preprints, conference abstracts, and trial registry updates. AI tools can run standing searches, cluster new publications by theme, and draft short weekly digests that summarize what each paper found and how it relates to the charity's research priorities. This is a strong use case because the inputs are public. The limitation is accuracy: models can misstate findings, overstate significance, or invent citations. Every summary should link to the original source, and any claim that informs a funding priority should be checked against the paper itself. Our guide to summarizing documents with AI covers techniques for keeping summaries faithful.
Drafting and refining RFPs
A well-written RFP attracts the right applicants and saves reviewers from reading proposals that never fit. AI can help translate the scientific advisory board's priorities into clear language, compare a draft against past RFPs for consistency, check that eligibility rules, budget limits, and deadlines are stated unambiguously, and produce a plain-language version for the charity's community. The scientific content of the priorities, such as which mechanisms are promising and which outcome measures matter to patients, should come from scientists and from patient input, not from a model's synthesis of the literature.
Matching reviewers to applications
Finding the right reviewers is one of the hardest parts of running peer review in a small field. AI can compare application abstracts against public publication records to suggest reviewers with relevant expertise, identify gaps where no current advisor covers a technique, and suggest balanced panel compositions. Use only the non-confidential parts of applications, such as titles and public abstracts if applicants agreed to share them, for any matching that runs through an external tool. Final assignments belong to the research staff, who know things the model does not, such as which reviewers are overloaded or have a history of thin critiques.
Conflict-of-interest screening
In a small rare disease field, nearly everyone has collaborated with everyone. Conflicts of interest are unavoidable and must be managed carefully. AI can help flag potential conflicts by checking co-authorship history, shared institutions, past grant collaborations, and industry relationships disclosed in publications. This turns a tedious manual search into a list that staff can verify. The flags are leads, not determinations. Some real conflicts will not appear in public data, such as personal relationships or confidential consulting, which is why signed disclosures from reviewers remain essential. Our article on conflict-of-interest disclosures and AI describes how to pair automated screening with human review.
Literature Digests
Public inputs, high time savings. Always link to the source and verify claims that shape priorities.
Reviewer Matching
Suggestions from public publication records. Staff make final assignments and balance panels.
Conflict Flags
Co-authorship and affiliation checks generate leads. Signed disclosures and staff judgment decide.
Protecting Peer Review: Confidentiality and Scientific Judgment
Peer review is the heart of a credible research grants program. Applicants share unpublished ideas and preliminary data on the understanding that reviewers will keep them confidential and judge them on scientific merit. Both of those expectations are directly challenged by generative AI.
The federal benchmark
NIH set a clear standard in June 2023. Its notice NOT-OD-23-149 prohibits NIH peer reviewers from using generative AI tools to analyze applications or write critiques, on the grounds that uploading application content to online AI tools breaches the confidentiality of peer review. Reviewers now certify that they understand and will comply with this. Private foundations are not bound by NIH policy, but many of your reviewers also review for NIH, and your applicants are used to the protections that policy provides. Adopting a comparable rule is the simplest way to keep your program's reputation intact.
A practical policy should say plainly that reviewers may not paste, upload, or summarize application content in any AI tool unless the foundation has specifically provided and approved that tool for review use. Put the rule in the reviewer agreement, repeat it in the review instructions, and explain why. If the foundation wants to offer AI assistance to reviewers, for example for checking the formatting of a critique, that should be a contracted, confidential tool with terms the foundation controls, and applicants should be told it exists.
Why AI should not score science
It is tempting to use AI to pre-score applications, rank them for discussion, or generate a "consensus" summary that drives funding decisions. Resist that. Scientific merit review requires judgment about feasibility, novelty, and the quality of preliminary data that models cannot reliably provide, especially in narrow fields where training data is thin. Models also tend to reward polished writing and familiar approaches, which can disadvantage early-career investigators, applicants writing in a second language, and genuinely novel ideas. The research community that relies on your program trusts that experts read and debated each proposal.
There is a legitimate supporting role. After reviewers have submitted their own critiques, staff can use an approved, confidential tool to compile a summary statement draft, organize strengths and weaknesses by criterion, or check that every critique addresses the required criteria. The scientific advisory board should still read the critiques themselves, and the summary should be reviewed by the panel chair before it goes to applicants. For a broader view of how funders are approaching this, see our article on AI-assisted grantmaking.
Supporting Roles for AI
- Checking applications for completeness and eligibility before review
- Scheduling panels and tracking reviewer assignments
- Compiling summary statement drafts from submitted critiques in a confidential tool
- Drafting decline letters and award notices from approved templates
Roles AI Should Not Play
- Reviewers uploading applications to consumer chatbots
- Generating merit scores or rankings that drive funding
- Writing reviewer critiques in place of the reviewer
- Replacing the scientific advisory board's discussion with a model summary
After the Award: Progress Reports and Portfolio Analysis
Once grants are made, the charity's job shifts to stewardship of the science: knowing what each project has accomplished, whether milestones are on track, and what the portfolio as a whole is achieving. This is where many research programs struggle most, because progress reports pile up faster than anyone can read them carefully.
Summarizing progress reports
A grantee's annual progress report might run ten to thirty pages, with aims, results, publications, changes in personnel, and requests to modify the scope. AI can produce a structured one-page summary for each report: progress against each aim, milestones met or missed, publications and data shared, budget concerns, and anything that needs a decision. Staff and scientific advisors then read the summary first and the full report where it matters. Progress reports often contain unpublished data, so this should happen in a confidential, contracted tool, and your grant agreements should tell grantees how their reports will be processed. Our guide to grant reporting and funder communication looks at the same process from the grantee side.
Milestone tracking for venture philanthropy
Charities that fund companies or milestone-based programs need to track deliverables tied to payments. AI can extract milestone language from agreements, map reported results to those milestones, and flag where a report seems to claim completion without the evidence the agreement requires. A scientist still decides whether a milestone was met. The value is that nothing slips past unnoticed in a busy quarter.
Seeing the whole portfolio
Boards and donors ask what decades of research funding have produced. AI can help classify past and current grants by research area, stage of development, and mechanism, link them to resulting publications and patents, and highlight areas where the charity has invested heavily or not at all. This kind of portfolio map supports strategic planning, informs the next RFP, and gives development staff accurate material for impact reporting. Classification should be validated by scientific staff, because a model that mislabels a gene therapy project as basic science can distort the strategic picture.
Portfolio analysis also creates an opportunity to connect the two engines. When registry data shows that a symptom matters greatly to patients, the portfolio map can reveal whether any funded research addresses it. That is exactly the type of insight that justifies investing in good data infrastructure.
A Progress Report Summary Template
Fields to ask an approved AI tool to produce for every report
- Progress on each specific aim, with page references to the full report
- Milestones met, delayed, or changed, and the stated reasons
- Publications, preprints, datasets, and tools shared
- Personnel, budget, or scope changes requiring approval
- Items for scientific advisor attention, flagged but not judged
Building Governance a Small Research Team Can Sustain
Most disease charities do not have a chief data officer or a compliance department. Governance therefore has to be simple enough that a research director and a registry coordinator can actually follow it, and clear enough that the board, the IRB, and partners can see it working.
Start with a written AI use policy specific to research operations. It should list the approved tools for registry data and for confidential grant materials, the data each tool may receive, the tasks it may perform, and the decisions it may not make. It should incorporate the peer review confidentiality rule for reviewers and the human verification rule for registry abstraction. Keep it to a few pages and review it at least annually, or whenever you add a new tool.
Involve the people who oversee your research. Tell your IRB how AI is used in data processing and ask whether amendments are needed. Brief your scientific advisory board on the reviewer policy and on how progress report summaries are produced. Include patient representatives in decisions about data sharing with partners who will use AI, because participants' trust is the registry's foundation. Many patient organizations already have patient advisory councils, and AI governance is a natural agenda item for them.
Vet vendors carefully. Registry platforms, grant management systems, and reference managers are adding AI features, often powered by third-party models. Ask each vendor which models process your data, where, under what retention terms, and whether AI features can be turned off for sensitive records. Our AI vendor security evaluation guide offers a structured set of questions. Finally, be transparent externally. A short public statement explaining how the charity uses AI in its registry and grants program, and what it does not do, tends to build confidence among participants and researchers alike.
Seven Steps to Responsible AI in Research Operations
A starting sequence to adapt with counsel and your IRB
- 1. Map your legal footing. Determine whether HIPAA, the Common Rule, FDA rules, and which state laws apply to each dataset.
- 2. Read your consents. Confirm what participants agreed to, and plan re-consent where AI uses go beyond it.
- 3. Approve specific tools. Contract for confidentiality, retention, and no training on your data before any sensitive use.
- 4. Keep humans on decisions. Data access, consent interpretation, de-identification, merit review, and milestone judgments stay with people.
- 5. Protect peer review. Adopt a reviewer rule comparable to NIH's and put it in every reviewer agreement.
- 6. Document provenance. Record every AI-assisted step that touches registry data so partners and regulators can evaluate it.
- 7. Tell your community. Explain your AI practices to participants, applicants, and reviewers in plain language.
Confirm with counsel and your IRB. Whether HIPAA, the Common Rule, FDA regulations, or specific state laws apply depends on how your registry is structured, who funds it, where participants live, and how the data will be used. Review your data flows and AI tools with qualified counsel and your IRB before implementation and whenever they change. For related background, our article on HIPAA and AI in healthcare nonprofits covers the covered-entity side in more depth.
Conclusion
Disease charities occupy a unique place in American research. They hold the trust of patient communities, they generate data that no one else is collecting, and they fund science that might otherwise go unfunded. Their registries and grant programs are run by small teams carrying a remarkable load, and AI can genuinely lighten it: abstracting records for human verification, cleaning data, keeping participants engaged, monitoring the literature, matching reviewers, flagging conflicts, and turning stacks of progress reports into decisions.
The boundaries are just as clear. HIPAA often does not protect registry data held by a charity, which makes the charity's own consent promises, state law, and IRB oversight all the more important. Consent interpretation, de-identification decisions, data access approvals, scientific merit review, and funding choices must stay with people who can be held accountable for them. Peer review confidentiality deserves a firm rule, and NIH's prohibition on generative AI in review offers a ready model.
The charities that get this right will be the ones that treat AI as a tool for the research team, not a replacement for the research community. Patients and families contribute their data and their hope. Researchers contribute their ideas in confidence. Every AI decision a disease charity makes should honor both.
Strengthen Your Research Operations
We help disease charities and patient advocacy organizations design AI workflows for registries and research grants that respect participant consent, protect peer review, and give small research teams more time for the science.