From the Office of Human Research Protection (OHRP):

https://www.hhs.gov/ohrp/regulations-and-policy/guidance/research-involving-coded-private-information/index.html

Guidance on the Secondary Analysis of Existing Data Sets:

https://ovpr.uconn.edu/services/rics/irb-2/researcher-guide/secondary-analysis-of-data-sets/