21 C.F.R. Subpart C—Requirements for Specific Categories of Records
Title 21 - Food and Drugs
(a) Systems of records that are required to be operated, or as a matter of practical necessity must be operated, by contractors to accomplish Food and Drug Administration functions, from which information is retrieved by individual names or other personal identifiers, may be subject to the provisions of this part. If the contract is agreed to on or after September 27, 1975, the criminal penalties set forth in 5 U.S.C. 552a(i) are applicable to such contractor, and any employee of such contractor, for disclosures prohibited in §21.71 or for maintenance of a system of records without notice as required in §21.20. (b) A contract is considered to accomplish a Food and Drug Administration function if the proposal or activity it supports is principally operated on behalf of and is under the direct management of the Food and Drug Administration. Systems of records from which information is retrieved by individual names or other personal identifiers and that are operated under contracts to accomplish Food and Drug Administration functions are deemed to be maintained by the agency and shall be subject to the procedures and requirements of this part. (c) A contract is not considered to accomplish a Food and Drug Administration function if the program or activity it supports is not principally operated on behalf of, or is not under the direct management of, the Food and Drug Administration. For example, this part does not apply to systems of records: (1) Operated under contract with the Food and Drug Administration by State or local government agencies, or organizations representing such agencies, when such agencies or organizations are also performing State or local government functions. (2) Operated by contractors with the Food and Drug Administration by individuals or organizations whose primary function is delivery of health services, such as hospitals, physicians, pharmacists, and other health professionals, and that report information concerning products, e.g., injuries or product defects, to the Food and Drug Administration. Before such contractors submit information to the Food and Drug Administration, the names and other personal identifiers of patients or research subjects in any medical or similar report, test, study, or other research project shall be deleted, unless the contract provides otherwise. If the Food and Drug Administration subsequently needs the names of such individuals, a separate request will be made. (3) Relating to individuals whom the contractor employs, or with whom the contractor otherwise deals, in the course of providing goods and services to the Food and Drug Administration. (4) Operated under grants. (d) The requirements of this part shall apply when a contractor who operates a system of records not subject to this part reports to the Food and Drug Administration information that is a system of records about individuals from which personal information is retrieved by names or other personal identifiers. Where the information would be a new Privacy Act Record System, or a change in an existing Privacy Act Record System of a type described in §21.21, the Food and Drug Administration shall comply with the requirements of §21.21. (e) The Food and Drug Administration will review all contracts before award to determine whether operation of a system from which information is retrieved by individual names or other personal identifiers will be required of the contractor, by the terms of the contract or as a matter of practical necessity. If such operation will be required, the solicitation and contract shall include the following clause, or a clause of similar effect:
Whenever the contractor or any of his employees is required by this contract to operate a system of records from which information is retrieved by individual names or other personal identifiers in order to accomplish a Food and Drug Administration function, the contractor and every employee is considered to be an employee of the Food and Drug Administration and shall operate such system of records in accordance with the Privacy Act of 1974 (5 U.S.C. 552a), regulations of the Food and Drug Administration in 21 CFR part 21, and rules of conduct that apply to Food and Drug Administration employees who work with such systems of records. The contractor and his employees are subject to the criminal penalties set forth in 5 U.S.C. 552a(i) for violations of the Privacy Act. (a) Food and Drug Administration records that are stored, processed, and serviced by the National Archives and Records Administration in accordance with 44 U.S.C. 3103 shall be considered to be maintained by the Food and Drug Administration. The National Archives and Records Administration shall not disclose the record except to authorized Food and Drug Administration employees. (b) Each Food and Drug Administration record pertaining to an identifiable individual that was transferred to the National Archives of the United States as a record determined by the National Archives to have sufficient historical or other value to warrant its continued preservation shall be considered to be maintained by the National Archives and shall not be subject to the provisions of this part. [42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985] (a) Present and former Food and Drug Administration employees desiring access to personnel records about themselves should consult system notices applicable to the agency's personnel records that are published by the Office of Personnel Management and the Department as well as any notice issued by the Food and Drug Administration. (b)(1) The procedures of the Office of Personnel Management at 5 CFR parts 293, 294, and 297 rather than the procedures in §21.33 and subparts D through F of this part, govern systems of personnel records about Food and Drug Administration employees that are subject to notice published by the Office of Personnel Management, i.e., systems that: (i) The Office of Personnel Management maintains. (ii) Are maintained by the Division of Human Resources Management, Food and Drug Administration. (iii) Are maintained by Department Regional Offices, concerning field employees. (2) The Office of Personnel Management's procedures may, if necessary, be supplemented in the Food and Drug Administration Staff Manual Guide. Current Food and Drug Administration employees should mail or deliver written requests under the Privacy Act for access to personnel records described in this paragraph to the Office of Personnel Management in accordance with 5 CFR 297.106, the Director, Division of Human Resources Management (HFA–400), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857, or the personnel officer in the servicing HHS Regional Personnel Office. An employee may consult with or direct his or her request to the FDA Privacy Act Coordinator (HFI–30). Requests for access to personnel records of former employees that are located in Federal Records Centers should be directed to the Office of Personnel Management. Requests under the Privacy Act for amendment of personnel records should be directed to these same officials who are responsibile for access to personnel records under this paragraph. (3) With respect to records subject to paragraph (b)(1) of this section: (i) Refusal to grant access to a record, or refusal to amend a record upon request of an employee, shall only be made by the Associate Commissioner for Management and Operations or his or her designate; and (ii) Appeals of refusals under paragraph (b)(3)(i) of this section may be made to the Office of Personnel Management in accordance with 5 CFR 297.108(g)(3) and 297.113(b). (c) Any other Privacy Act Record Systems that contain personnel records, or records that otherwise concern agency employees, that are maintained by offices of the Food and Drug Administration rather than the Division of Human Resources Management but which are not subject to the Department's notice for personnel records in operating offices are subject to this part, except that refusals under this part to grant access to or amend records about present or former employees shall be made by the Associate Commissioner for Management and Operations rather than the Associate Commissioner for Public Affairs. (d) The following procedures shall govern requests under the Privacy Act for personnel records that are maintained by the operating offices of the Food and Drug Administration in which employees work: (1) An employee shall upon request be told whether records about him are maintained. An employee shall be given access to records about himself that are subject to this paragraph in response to an oral or written request and through informal procedures, rather than the procedures specified in §§21.40 through 21.43. (2) Employee identity may be verified, if necessary, by an FDA ID card rather than in accordance with §21.44. (3) Generally no fee shall be charged for records requested under this paragraph. However, in cases where the records requested are voluminous, a fee may be charged in accordance with §21.45. (4) Records that are subject to this paragraph shall be available for access to an individual, except to the extent that access is refused by the Associate Commissioner for Management and Operations or his or her designate on the grounds that the record is subject to an exemption under §21.61 or 5 CFR 297.111. (5) Requests under the Privacy Act for amendment of records subject to this paragraph should be directed to the Director, Division of Human Resources Management (HFA–400). Such requests shall be reviewed in accordance with subpart E of this part. Refusal to amend a record subject to this paragraph (d)(5) shall only be made by the Associate Commissioner for Management and Operations or his or her designate. (6) Appeals of refusals under paragraph (d) (4) or (5) of this section may be made to the Commissioner of Food and Drugs, except where the Associate Commissioner for Management and Operations or his or her designate indicates with his or her refusal that the appeal should be made to the Office of Personnel Management. (7) Disclosures of records subject to this paragraph are subject to subpart G of this part. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985] (a) In general, an individual is entitled to have access to any medical records about himself in Privacy Act Record Systems maintained by the Food and Drug Administration. (b) The Food and Drug Administration may apply the following special procedures in disclosing medical records to an individual: (1) The agency may review the records to determine whether disclosure of the record to the individual who is the subject of the records might have an adverse effect on him. If it is determined that disclosure is not likely to have an adverse effect on the individual, the record shall be disclosed to him. If it is determined that disclosure is very likely to have an adverse effect on the individual, he may be requested to designate, in writing, a representative to whom the record shall be disclosed. Such representative may be a physician, other health professional, or other responsible person who would be willing to review the record and discuss it with the individual. (2) The availability of the record may be subject to any procedures for disclosure to an individual of medical records about himself under part 20 of this chapter, in addition to or in lieu of the procedures in paragraph (b)(1), that are not inconsistent with §21.41(f).
Title 21: Food and Drugs
PART 21—PROTECTION OF PRIVACY
Subpart C—Requirements for Specific Categories of Records
§ 21.30 Records of contractors.
§ 21.31 Records stored by the National Archives and Records Administration.
§ 21.32 Personnel records.
§ 21.33 Medical records.
