A PI testing a hypothesis with de-identified medical records should first:

The correct answer emphasizes the importance of institutional review board (IRB) oversight when conducting research involving de-identified medical records. Submitting to the IRB helps ensure that the study adheres to ethical guidelines and regulatory compliance, even when the data is de-identified. The IRB evaluates the research protocol to confirm that it meets the necessary criteria for exemption from certain federal regulations, which can include studies using de-identified data. This process is critical because it protects the welfare of subjects and ensures that ethical standards are maintained in research practices.

In the context of the other options, while obtaining approval from the privacy officer or asking a Privacy Board for a waiver may be relevant in different scenarios involving protected health information (PHI), they are not typically required when using de-identified data. FDA approval is specifically necessary for certain types of clinical trials and drug research but does not apply to the general use of de-identified medical records for hypothesis testing. Thus, the requirement for IRB review holds greater importance for understanding the ethical implications of conducting research even with de-identified data.