If you're unsure about the particulars of HIPAA research requirements at your organization or have questions, you can usually consult with: An organizational IRB or Privacy Board, privacy official ("Privacy Officer"), or security official ("Security Officer"), depending on the issue.