21 CFR § 21.30 - Records of contractors.

(a) Systems of records that are required to be operated, or as a matter of practical necessity must be operated, by contractors to accomplish Food and Drug Administration functions, from which information is retrieved by individual names or other personal identifiers, may be subject to the provisions of this part. If the contract is agreed to on or after September 27, 1975, the criminal penalties set forth in 5 U.S.C. 552a(i) are applicable to such contractor, and any employee of such contractor, for disclosures prohibited in § 21.71 or for maintenance of a system of records without notice as required in § 21.20.

(b) A contract is considered to accomplish a Food and Drug Administration function if the proposal or activity it supports is principally operated on behalf of and is under the direct management of the Food and Drug Administration. Systems of records from which information is retrieved by individual names or other personal identifiers and that are operated under contracts to accomplish Food and Drug Administration functions are deemed to be maintained by the agency and shall be subject to the procedures and requirements of this part.

(c) A contract is not considered to accomplish a Food and Drug Administration function if the program or activity it supports is not principally operated on behalf of, or is not under the direct management of, the Food and Drug Administration. For example, this part does not apply to systems of records:

(1) Operated under contract with the Food and Drug Administration by State or local government agencies, or organizations representing such agencies, when such agencies or organizations are also performing State or local government functions.

(2) Operated by contractors with the Food and Drug Administration by individuals or organizations whose primary function is delivery of health services, such as hospitals, physicians, pharmacists, and other health professionals, and that report information concerning products, e.g., injuries or product defects, to the Food and Drug Administration. Before such contractors submit information to the Food and Drug Administration, the names and other personal identifiers of patients or research subjects in any medical or similar report, test, study, or other research project shall be deleted, unless the contract provides otherwise. If the Food and Drug Administration subsequently needs the names of such individuals, a separate request will be made.

(3) Relating to individuals whom the contractor employs, or with whom the contractor otherwise deals, in the course of providing goods and services to the Food and Drug Administration.

(4) Operated under grants.

(d) The requirements of this part shall apply when a contractor who operates a system of records not subject to this part reports to the Food and Drug Administration information that is a system of records about individuals from which personal information is retrieved by names or other personal identifiers. Where the information would be a new Privacy Act Record System, or a change in an existing Privacy Act Record System of a type described in § 21.21, the Food and Drug Administration shall comply with the requirements of § 21.21.

(e) The Food and Drug Administration will review all contracts before award to determine whether operation of a system from which information is retrieved by individual names or other personal identifiers will be required of the contractor, by the terms of the contract or as a matter of practical necessity. If such operation will be required, the solicitation and contract shall include the following clause, or a clause of similar effect:

Whenever the contractor or any of his employees is required by this contract to operate a system of records from which information is retrieved by individual names or other personal identifiers in order to accomplish a Food and Drug Administration function, the contractor and every employee is considered to be an employee of the Food and Drug Administration and shall operate such system of records in accordance with the Privacy Act of 1974 (5 U.S.C. 552a), regulations of the Food and Drug Administration in 21 CFR part 21, and rules of conduct that apply to Food and Drug Administration employees who work with such systems of records. The contractor and his employees are subject to the criminal penalties set forth in 5 U.S.C. 552a(i) for violations of the Privacy Act.