Yeah, the IRB isn't even within spitting distance of a HIPAA issue. They're entirely different things, handled by different regulatory agencies, and administered in different parts of a hospital (if a hospital even has an IRB, as most don't, since most aren't research institutions), overseeing different activities.

If someone called my hospital's IRB to "school them" on a HIPAA violation, I can't even imagine what their response would be. I mean, I'm sure it would be polite, but it's not like they'd start hand-holding the lady on how to file complaints - they wouldn't know, themselves. It's only one step up from calling the cafeteria services people.

Sorry, should have been more clear. The case where she called the IRB was where the office completely messed up the consent process -- told her to disregard the first page of the consent, which was included in the package and included items that were directly relevant, and also didn't include materials referenced in the consent. Note, this was in a research/teaching hospital, where the consent notice includes consent for students to participate in the procedure, so that's why she called the IRB -- and they were very interested to hear what she had to say ...

Hospitals take compliance issues very seriously; the incentives are skewed highly in one direction.

Consider it an extension of "HR is there to protect the company, not you." Compliance is there to protect the hospital, not the individual employee that may have erred.

As long as they make a good faith effort to act on the complaint, they themselves are protected from liability. Whereas if they don't act, they open themselves up to enormous liability, on behalf of a replaceable peon - I mean, on behalf of a highly respected staff member.