It depends. If a non-DOD IRB approves a Health Insurance Portability and Accountability Act (HIPAA) Waiver of Authorization, the Defense Health Agency Privacy and Civil Liberties Office (DHA PLCO) will accept the non-DOD IRB Waiver of Authorization. However, there are two cases when the DOD Human Research Protection Official (HRPO) will have to send the study to a DOD IRB for review. First, if the HRPO reviews the study and determines that the study is or may be requesting protected health information (PHI) and the researcher has not submitted a non-DOD IRB Waiver of HIPAA Authorization, then the HRPO must send the study to a DOD IRB to conduct a data determination and, if needed, a HIPAA Privacy Rule compliance review. This review is required even if the study intends to use a non-DOD HIPAA Authorization to obtain data because only DHA Authorization templates may be used to obtain data managed by DHA (DHA data). The second instance when the DOD IRB will have to conduct a HIPAA Privacy Rule review of the study is when the HRPO determines that the researcher intends to put DHA data into a research repository. The HRPO must send all studies reviewed by non-DOD IRBs that intend to put DHA data into a repository to a DOD IRB for a data determination and, if necessary, a HIPAA Privacy Rule compliance review using the Research Repository Template. The DOD IRB will conduct the reviews and provide the researcher with an Institutional Review Board (IRB) HIPAA Compliance Review Findings on Data Requests (IRB Findings Document) to submit to the DHA Privacy Office along with the Data Sharing Agreement Application. Review by a fully convened IRB or HIPAA Privacy Board is not required. The Chair or a designated board member can conduct the necessary review.