[Code of Federal Regulations]
[Title 21, Volume 1]
[Revised as of April 1, 2003]
From the U.S. Government Printing Office via GPO Access
[CITE: 21CFR21.30]

[Page 227-228]
 
                        TITLE 21--FOOD AND DRUGS
 
CHAPTER I--FOOD AND DRUG ADMINISTRATION, DEPARTMENT OF HEALTH AND HUMAN 
                                SERVICES
 
PART 21--PROTECTION OF PRIVACY--Table of Contents
 
       Subpart C--Requirements for Specific Categories of Records
 
Sec. 21.30  Records of contractors.


    (a) Systems of records that are required to be operated, or as a 
matter of practical necessity must be operated, by contractors to 
accomplish Food and Drug Administration functions, from which 
information is retrieved by individual names or other personal 
identifiers, may be subject to the provisions of this part. If the 
contract is agreed to on or after September 27, 1975, the criminal 
penalties set forth in 5 U.S.C. 552a(i) are applicable to such 
contractor, and any employee of such contractor, for disclosures 
prohibited in Sec. 21.71 or for maintenance of a system of records 
without notice as required in Sec. 21.20.
    (b) A contract is considered to accomplish a Food and Drug 
Administration function if the proposal or activity it supports is 
principally operated on behalf of and is under the direct management of 
the Food and Drug Administration. Systems of records from which 
information is retrieved by individual names or other personal 
identifiers and that are operated under contracts to accomplish Food and 
Drug Administration functions are deemed to be maintained by the agency 
and shall be subject to the procedures and requirements of this part.
    (c) A contract is not considered to accomplish a Food and Drug 
Administration function if the program or activity it supports is not 
principally operated on behalf of, or is not under the direct management 
of, the Food and Drug Administration. For example, this part does not 
apply to systems of records:
    (1) Operated under contract with the Food and Drug Administration by 
State or local government agencies, or organizations representing such 
agencies, when such agencies or organizations are also performing State 
or local government functions.

[[Page 228]]

    (2) Operated by contractors with the Food and Drug Administration by 
individuals or organizations whose primary function is delivery of 
health services, such as hospitals, physicians, pharmacists, and other 
health professionals, and that report information concerning products, 
e.g., injuries or product defects, to the Food and Drug Administration. 
Before such contractors submit information to the Food and Drug 
Administration, the names and other personal identifiers of patients or 
research subjects in any medical or similar report, test, study, or 
other research project shall be deleted, unless the contract provides 
otherwise. If the Food and Drug Administration subsequently needs the 
names of such individuals, a separate request will be made.
    (3) Relating to individuals whom the contractor employs, or with 
whom the contractor otherwise deals, in the course of providing goods 
and services to the Food and Drug Administration.
    (4) Operated under grants.
    (d) The requirements of this part shall apply when a contractor who 
operates a system of records not subject to this part reports to the 
Food and Drug Administration information that is a system of records 
about individuals from which personal information is retrieved by names 
or other personal identifiers. Where the information would be a new 
Privacy Act Record System, or a change in an existing Privacy Act Record 
System of a type described in Sec. 21.21, the Food and Drug 
Administration shall comply with the requirements of Sec. 21.21.
    (e) The Food and Drug Administration will review all contracts 
before award to determine whether operation of a system from which 
information is retrieved by individual names or other personal 
identifiers will be required of the contractor, by the terms of the 
contract or as a matter of practical necessity. If such operation will 
be required, the solicitation and contract shall include the following 
clause, or a clause of similar effect:

    Whenever the contractor or any of his employees is required by this 
contract to operate a system of records from which information is 
retrieved by individual names or other personal identifiers in order to 
accomplish a Food and Drug Administration function, the contractor and 
every employee is considered to be an employee of the Food and Drug 
Administration and shall operate such system of records in accordance 
with the Privacy Act of 1974 (5 U.S.C. 552a), regulations of the Food 
and Drug Administration in 21 CFR part 21, and rules of conduct that 
apply to Food and Drug Administration employees who work with such 
systems of records. The contractor and his employees are subject to the 
criminal penalties set forth in 5 U.S.C. 552a(i) for violations of the 
Privacy Act.