The IRB would not be the correct office for a HIPAA violation, unless it was an informed consent form for a research study.
Most hospitals have a compliance office where this type of issue would be handled.
Most hospitals have a compliance office where this type of issue would be handled.
If someone called my hospital's IRB to "school them" on a HIPAA violation, I can't even imagine what their response would be. I mean, I'm sure it would be polite, but it's not like they'd start hand-holding the lady on how to file complaints - they wouldn't know, themselves. It's only one step up from calling the cafeteria services people.
Consider it an extension of "HR is there to protect the company, not you." Compliance is there to protect the hospital, not the individual employee that may have erred.
As long as they make a good faith effort to act on the complaint, they themselves are protected from liability. Whereas if they don't act, they open themselves up to enormous liability, on behalf of a replaceable peon - I mean, on behalf of a highly respected staff member.