Does the HIPAA Privacy Rule require a covered entity to create an Institutional Review Board (IRB) or Privacy Board before using or disclosing protected health information for research?

Answer:

No. The Institutional Review Board (IRB) or Privacy Board could be created by the covered entity or the recipient researcher, or it could be an independent board.

See our research section and frequently asked questions about the research provisions for more information about Institutional Review and Privacy Boards.