No. HIPAA does not override IRB requirements. After April 14, 2003 you will need to comply with both the Common Rule and the Privacy Rule. Here is a summary of their requirements.
- The Common Rule requires either an informed consent or a waiver of informed consent for any human subjects research. Records review research is usually approved via an expedited review and a waiver of informed consent. The common rule allows a waiver only if specific criteria are met.
- The Privacy Rule requires a written authorization or waiver of authorization for access to existing protected health information. It is assumed that most records review will be allowed with a waiver of the authorization. The Privacy Rule allows a waiver of authorization if specific criteria are met.