Can a non-Covered Entity serve as Reviewing IRB for a Covered Entity?

Yes. A Reviewing IRB does not need to be, or belong to, a HIPAA Covered Entity in order to review for a Relying Institution that is one.

Under Version 3.0 the question matters less than it used to. The Relying Institution — the Covered Entity — is responsible for its own HIPAA compliance and may supply its own authorization form and obtain its own waiver or alteration of authorization; under the SMART IRB SOPs that is the default. A Reviewing IRB that is not a Covered Entity simply reviews the research.

If a Reviewing IRB does not, as a matter of policy or practice, provide HIPAA authorization forms or review waiver requests (as may be true of a non-Covered-Entity IRB or certain federal institutions), the Agreement does not require it to; it must tell the Relying Institution, which then satisfies those obligations itself (§4.4.3). Conversely, a Relying Institution that would prefer the Reviewing IRB to provide authorization language or review waivers can arrange that with a willing Reviewing IRB and document it. A Relying Institution that uses its own authorization form is responsible for its compliance with HIPAA and its consistency with the approved consent and protocol.

See also

• How HIPAA works under Version 3.0
• Default vs. flexible implementation