Permitted when the signed consent would be the only record linking the subject to the research and the principal risk would be the breach of confidentiality, or when the research is minimal risk and involves procedures for which written consent is not normally required outside research.