Does the HIPAA Privacy Rule require a covered entity to create an Institutional Review Board (IRB) or Privacy Board before using or disclosing protected health information for research?
No. The Institutional Review Board (IRB) or Privacy Board could be created by the covered entity
or the recipient researcher, or it could be an independent board.
See the fact sheet
and frequently asked questions about the research provisions
for more information about Institutional Review and Privacy Boards.
Date Created: 12/20/2002
Last Updated: 03/14/2006