It depends. HIPAA only allows Institutional Review Boards (IRBs) and HIPAA Privacy Boards to conduct HIPAA Privacy Rule reviews.  If the Privacy Officer is a member of the IRB or HIPAA Privacy Board, set up in compliance with the HIPAA Privacy Rule 45 C.F.R. section 164.512 (i)(1)(i)(B) and Department of Defense Manual 6025.18 paragraph 4.4.i.(1)(a)2, the Privacy Officer can conduct a HIPAA Privacy Rule review and approve a HIPAA Waiver of Authorization.  Otherwise, the institutional Privacy Officer cannot conduct a HIPAA Privacy Rule review.