If a patient history over time yields interesting information, as long as the results would not be tested again subsequently, IRB approval is probably not necessary to write a case report for publication. This, however, is complicated, and not everyone shares the same definition of this distinction. This definition has been in place since 1974, and was codified in 1981. If you get shut down, approval for multiple projects is withdrawn. The MPA is a commitment, and the rules are outlined in 45cfr46.
Assurance comes at the beginning of the process, and takes care of compliance upfront.
Compliance is something that often comes at the end of the process, and may involve negligence along the way. There's a need for education about the distinction between clinical care and research. There's also a need for education of IRB members, the right qualifications of members, and adequate representation of specialist and lay members. The number and type of protocols is growing exponentially. The research enterprise has moved along but the infrastructure of support and compliance does not always follow.