The policy describes IRB requirements when investigators use databases and specimen repositories for research purposes. Databases/specimen repositories require consent and HIPAA authorization by subjects for the storage and potential future research use of their data/specimens, or a waiver of consent and HIPAA authorization by the IRB. Exemption from IRB review is not an option if the data/specimens retain an identifier or a link that would permit anyone to identify, directly or indirectly, the person whose data/specimens are stored.