• Text Resize A A A
  • Print Print
  • Share Share on facebook Share on twitter Share

Does the HIPAA Privacy Rule require a covered entity to create an Institutional Review Board (IRB) or Privacy Board before using or disclosing protected health information for research?


No. The Institutional Review Board (IRB) or Privacy Board could be created by the covered entity or the recipient researcher, or it could be an independent board.

See our research section and frequently asked questions about the research provisions for more information about Institutional Review and Privacy Boards.



Date Created: 12/20/2002
Last Updated: 03/14/2006

Content created by Office for Civil Rights (OCR)
Content last reviewed on July 26, 2013