[Code of Federal Regulations]
[Title 21, Volume 1]
[Revised as of April 1, 2007]
From the U.S. Government Printing Office via GPO Access
[CITE: 21CFR21.30]
[Page 221-222]
TITLE 21--FOOD AND DRUGS
CHAPTER I--FOOD AND DRUG ADMINISTRATION, DEPARTMENT OF HEALTH AND HUMAN
SERVICES
PART 21 PROTECTION OF PRIVACY--Table of Contents
Subpart C Requirements for Specific Categories of Records
Sec. 21.30 Records of contractors.
(a) Systems of records that are required to be operated, or as a
matter of practical necessity must be operated, by contractors to
accomplish Food and Drug Administration functions, from which
information is retrieved by individual names or other personal
identifiers, may be subject to the provisions of this part. If the
contract is agreed to on or after September 27, 1975, the criminal
penalties set forth in 5 U.S.C. 552a(i) are applicable to such
contractor, and any employee of such contractor, for disclosures
prohibited in Sec. 21.71 or for maintenance of a system of records
without notice as required in Sec. 21.20.
(b) A contract is considered to accomplish a Food and Drug
Administration function if the proposal or activity it supports is
principally operated on behalf of and is under the direct management of
the Food and Drug Administration. Systems of records from which
information is retrieved by individual names or other personal
identifiers and that are operated under contracts to accomplish Food and
Drug Administration functions are deemed to be maintained by the agency
and shall be subject to the procedures and requirements of this part.
[[Page 222]]
(c) A contract is not considered to accomplish a Food and Drug
Administration function if the program or activity it supports is not
principally operated on behalf of, or is not under the direct management
of, the Food and Drug Administration. For example, this part does not
apply to systems of records:
(1) Operated under contract with the Food and Drug Administration by
State or local government agencies, or organizations representing such
agencies, when such agencies or organizations are also performing State
or local government functions.
(2) Operated by contractors with the Food and Drug Administration by
individuals or organizations whose primary function is delivery of
health services, such as hospitals, physicians, pharmacists, and other
health professionals, and that report information concerning products,
e.g., injuries or product defects, to the Food and Drug Administration.
Before such contractors submit information to the Food and Drug
Administration, the names and other personal identifiers of patients or
research subjects in any medical or similar report, test, study, or
other research project shall be deleted, unless the contract provides
otherwise. If the Food and Drug Administration subsequently needs the
names of such individuals, a separate request will be made.
(3) Relating to individuals whom the contractor employs, or with
whom the contractor otherwise deals, in the course of providing goods
and services to the Food and Drug Administration.
(4) Operated under grants.
(d) The requirements of this part shall apply when a contractor who
operates a system of records not subject to this part reports to the
Food and Drug Administration information that is a system of records
about individuals from which personal information is retrieved by names
or other personal identifiers. Where the information would be a new
Privacy Act Record System, or a change in an existing Privacy Act Record
System of a type described in Sec. 21.21, the Food and Drug
Administration shall comply with the requirements of Sec. 21.21.
(e) The Food and Drug Administration will review all contracts
before award to determine whether operation of a system from which
information is retrieved by individual names or other personal
identifiers will be required of the contractor, by the terms of the
contract or as a matter of practical necessity. If such operation will
be required, the solicitation and contract shall include the following
clause, or a clause of similar effect:
Whenever the contractor or any of his employees is required by this
contract to operate a system of records from which information is
retrieved by individual names or other personal identifiers in order to
accomplish a Food and Drug Administration function, the contractor and
every employee is considered to be an employee of the Food and Drug
Administration and shall operate such system of records in accordance
with the Privacy Act of 1974 (5 U.S.C. 552a), regulations of the Food
and Drug Administration in 21 CFR part 21, and rules of conduct that
apply to Food and Drug Administration employees who work with such
systems of records. The contractor and his employees are subject to the
criminal penalties set forth in 5 U.S.C. 552a(i) for violations of the
Privacy Act.
Back to Top
© 2007 Betterchem Corp.
|
