The Privacy Rule permits an IRB or a Privacy Board to waive or alter the authorization requirement if the IRB/Privacy Board determines that specific Privacy Rule waiver criteria are met:

• it is impracticable to conduct the research without the waiver
• the waiver poses only minimal risk to the privacy of the subjects
• the research could not practicably be conducted without access to and use of the PHI.

Note that this waiver review is separate from the waiver of consent that an IRB may allow for certain Federal specified conditions performed under the Common Rule.