May a covered entity accept documentation of an external Institutional Review Board’s (IRB) waiver of authorization for purposes of reasonably relying on the request as the minimum necessary?
Yes. The HIPAA Privacy Rule explicitly permits a covered entity [...]