Does the HIPAA Privacy Rule require a covered entity to create an Institutional Review Board (IRB) or Privacy Board before using or disclosing protected health information for research?

No. The Institutional Review Board (IRB) or Privacy Board could be created by the covered entity or the recipient researcher, or it could be an independent board.