A waiver or alteration was approved at the sponsor protocol level. Can any investigator that is a covered entity rely on this or do individual investigators need to seek their own?

IRBs and Privacy Boards coexist. Therefore, the HIPAA Privacy Rule allows a covered entity to use or disclose PHI based on an authorization or alteration approved by any IRB or Privacy Board, without regard to the location or affiliation of the IRB or Privacy Board. An investigator that is a covered entity has the right to rely on any IRB’s or Privacy Board’s documentation granting a waiver or alteration of the Authorization requirement so long as the documentation is proper. However, please note that if you are an investigation that is affiliated with an institution or hospital, they may require review and approval of any waiver/alteration before allowing the use or disclosure of PHI held by that institution or hospital.