21 C.F.R. PART 21—PROTECTION OF PRIVACY
Title 21 - Food and Drugs
Authority: 21 U.S.C. 371; 5 U.S.C. 552, 552a.
Source: 42 FR 15626, Mar. 22, 1977, unless otherwise noted.
(a) This part establishes procedures to implement the Privacy Act of 1974 (5 U.S.C. 552a). It applies to records about individuals that are maintained, collected, used, or disclosed by the Food and Drug Administration and contained in Privacy Act Record Systems. (b) This part does not: (1) Apply to Food and Drug Administration record systems that are not Privacy Act Record Systems or make available to an individual records that may include references to him but that are not retrieved by his name or other personal identifier, whether or not contained in a Privacy Act Record System. part 20 of this chapter (the public information regulations) and other regulations referred to therein determine when records are made available in such cases. (2) Make any records available to persons other than (i) individuals who are the subjects of the records, (ii) persons accompanying such individuals under §21.43, (iii) persons provided records pursuant to individual consent under §21.72, or (iv) persons acting on behalf of such individuals as legal guardians under §21.75. Part 20 of this chapter (the public information regulations) and other regulations referred to therein determine when Food and Drug Administration records are disclosable to members of the public generally. Subpart G of this part limits the provisions of part 20 of this chapter with respect to disclosures of records about individuals from Privacy Act Record Systems to persons other than individuals who are the subjects of the records. (3) Make available information compiled by the Food and Drug Administration in reasonable anticipation of court litigation or formal administrative proceedings. The availability of such information to any member of the public, including any subject individual or party to such litigation or proceeding shall be governed by applicable constitutional principles, rules of discovery, and part 20 of this chapter (the public information regulations). (4) Apply to personnel records maintained by the Division of Human Resources Management, Food and Drug Administration, except as provided in §21.32. Such records are subject to regulations of the Office of Personnel Management in 5 CFR parts 293, 294, and 297. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985] As used in this part: (a) Individual means a natural living person who is a citizen of the United States or an alien lawfully admitted for permanent residence. Individual does not include sole proprietorships, partnerships, or corporations engaged in the production or distribution of products regulated by the Food and Drug Administration or with which the Food and Drug Administration has business dealings. Any such business enterprise that is identified by the name of one or more individuals is not an individual within the meaning of this part. Employees of regulated business enterprises are considered individuals. Accordingly, physicians and other health professionals who are engaged in business as proprietors of establishments regulated by the Food and Drug Administration are not considered individuals; however, physicians and other health professionals who are engaged in clinical investigations, employed by regulated enterprises, or the subjects of records concerning their own health, e.g., exposure to excessive radiation, are considered individuals. Food and Drug Administration employees, consultants, and advisory committee members, State and local officials, and consumers are considered individuals. (b) Records about individuals means items, collections, or groupings of information about individuals contained in Privacy Act Record Systems, including, but not limited to education, financial transactions, medical history, criminal history, or employment history, that contain names or personal identifiers. (c) Privacy Act Record System means a system of records about individuals under the control of the Food and Drug Administration from which information is retrieved by individual names or other personal identifiers. The term includes such a system of records whether subject to a notice published by the Food and Drug Administration, the Department, or another agency. Where records are retrieved only by personal identifiers other than individual names, a system of records is not a Privacy Act Record System if the Food and Drug Administration cannot, by reference to information under its control, or by reference to records of contractors that are subject to this part under §21.30, ascertain the identity of individuals who are the subjects of the records. (d) Personal identifiers includes individual names, identifying numbers, symbols, or other identifying designations assigned to individuals. Personal identifiers does not include names, numbers, symbols, or other identifying designations that identify products, establishments, or actions. (e) Personnel records means any personal information maintained in a Privacy Act Record System that is needed for personnel management programs or processes such as staffing, employee development, retirement, and grievances and appeals. (f) Department means Department of Health and Human Services. Information about individuals in Food and Drug Administration records shall be collected, maintained, used, and disseminated so as to protect the right to privacy of the individual to the fullest possible extent consistent with laws relating to disclosure of information to the general public, the law enforcement responsibilities of the agency, and administrative and program management needs. (a) The Food and Drug Administration shall issue in the (b) The notice shall include the following information: (1) The name and location(s) of the system. (2) The categories of individuals about whom records are maintained in the system. (3) The categories of records maintained in the system. (4) The authority for the system. (5) Each routine use of the records contained in the system (i.e., use outside the Department of Health and Human Services that is compatible with the purpose for which the records were collected and described in the notice) including the categories of users and the purposes of such use. (6) The policies and practices of the Food and Drug Administration regarding storage, retrievability (i.e., how the records are indexed and what intra-agency uses are made of the records), access controls, retention, and disposal of the records in that system. (7) The title and business address of the official who is responsible for the system of records. (8) The notification procedure, i.e., the address of the FDA Privacy Act Coordinator, whom any individual can contact to seek notification whether the system contains a record about him/her. (9) The record access and contest procedures, which shall be the same as the notification procedure except that a reference shall be included to any exemption from access and contest. (10) Where any records in the system are subject to an exemption under §21.61, a reference to this exemption. (11) The categories of sources of records in the system. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981] (a) The Food and Drug Administration shall notify the designated Department official, the Office of Management and Budget (Information Systems Division), and the Congress of proposals to change or establish Privacy Act Record Systems in accordance with procedures of the Department and the Office of Management and Budget. (b) The Food and Drug Administration shall issue a notice, in accordance with paragraph (d) of this section and §21.20(b), of any change in a Privacy Act Record System which: (1) Increases the number or types of individuals about whom records are maintained; (2) Expands the type or amount of information about individuals that is maintained; (3) Increases the number of categories of agencies or other persons who may have access to those records; (4) Alters the manner in which the records are organized so as to change the nature or scope of those records, such as the combining of two or more existing systems; (5) Modifies the way in which the system operates or its location(s) in a manner that alters the process by which individuals can exercise their rights under this part, such as the ways in which they seek access or request amendment of a record; or (6) Changes the equipment configuration on which the system is operated so as to create the potential for greater access, such as adding a telecommunications capability. (c) The Food and Drug Administration shall issue a notice of its intention to establish new Privacy Act Record Systems in accordance with paragraph (d) of this section and §21.20(b). (d) Notices under paragraphs (b) and (c) of this section shall be published in the (a) Systems of records that are required to be operated, or as a matter of practical necessity must be operated, by contractors to accomplish Food and Drug Administration functions, from which information is retrieved by individual names or other personal identifiers, may be subject to the provisions of this part. If the contract is agreed to on or after September 27, 1975, the criminal penalties set forth in 5 U.S.C. 552a(i) are applicable to such contractor, and any employee of such contractor, for disclosures prohibited in §21.71 or for maintenance of a system of records without notice as required in §21.20. (b) A contract is considered to accomplish a Food and Drug Administration function if the proposal or activity it supports is principally operated on behalf of and is under the direct management of the Food and Drug Administration. Systems of records from which information is retrieved by individual names or other personal identifiers and that are operated under contracts to accomplish Food and Drug Administration functions are deemed to be maintained by the agency and shall be subject to the procedures and requirements of this part. (c) A contract is not considered to accomplish a Food and Drug Administration function if the program or activity it supports is not principally operated on behalf of, or is not under the direct management of, the Food and Drug Administration. For example, this part does not apply to systems of records: (1) Operated under contract with the Food and Drug Administration by State or local government agencies, or organizations representing such agencies, when such agencies or organizations are also performing State or local government functions. (2) Operated by contractors with the Food and Drug Administration by individuals or organizations whose primary function is delivery of health services, such as hospitals, physicians, pharmacists, and other health professionals, and that report information concerning products, e.g., injuries or product defects, to the Food and Drug Administration. Before such contractors submit information to the Food and Drug Administration, the names and other personal identifiers of patients or research subjects in any medical or similar report, test, study, or other research project shall be deleted, unless the contract provides otherwise. If the Food and Drug Administration subsequently needs the names of such individuals, a separate request will be made. (3) Relating to individuals whom the contractor employs, or with whom the contractor otherwise deals, in the course of providing goods and services to the Food and Drug Administration. (4) Operated under grants. (d) The requirements of this part shall apply when a contractor who operates a system of records not subject to this part reports to the Food and Drug Administration information that is a system of records about individuals from which personal information is retrieved by names or other personal identifiers. Where the information would be a new Privacy Act Record System, or a change in an existing Privacy Act Record System of a type described in §21.21, the Food and Drug Administration shall comply with the requirements of §21.21. (e) The Food and Drug Administration will review all contracts before award to determine whether operation of a system from which information is retrieved by individual names or other personal identifiers will be required of the contractor, by the terms of the contract or as a matter of practical necessity. If such operation will be required, the solicitation and contract shall include the following clause, or a clause of similar effect:
Whenever the contractor or any of his employees is required by this contract to operate a system of records from which information is retrieved by individual names or other personal identifiers in order to accomplish a Food and Drug Administration function, the contractor and every employee is considered to be an employee of the Food and Drug Administration and shall operate such system of records in accordance with the Privacy Act of 1974 (5 U.S.C. 552a), regulations of the Food and Drug Administration in 21 CFR part 21, and rules of conduct that apply to Food and Drug Administration employees who work with such systems of records. The contractor and his employees are subject to the criminal penalties set forth in 5 U.S.C. 552a(i) for violations of the Privacy Act. (a) Food and Drug Administration records that are stored, processed, and serviced by the National Archives and Records Administration in accordance with 44 U.S.C. 3103 shall be considered to be maintained by the Food and Drug Administration. The National Archives and Records Administration shall not disclose the record except to authorized Food and Drug Administration employees. (b) Each Food and Drug Administration record pertaining to an identifiable individual that was transferred to the National Archives of the United States as a record determined by the National Archives to have sufficient historical or other value to warrant its continued preservation shall be considered to be maintained by the National Archives and shall not be subject to the provisions of this part. [42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985] (a) Present and former Food and Drug Administration employees desiring access to personnel records about themselves should consult system notices applicable to the agency's personnel records that are published by the Office of Personnel Management and the Department as well as any notice issued by the Food and Drug Administration. (b)(1) The procedures of the Office of Personnel Management at 5 CFR parts 293, 294, and 297 rather than the procedures in §21.33 and subparts D through F of this part, govern systems of personnel records about Food and Drug Administration employees that are subject to notice published by the Office of Personnel Management, i.e., systems that: (i) The Office of Personnel Management maintains. (ii) Are maintained by the Division of Human Resources Management, Food and Drug Administration. (iii) Are maintained by Department Regional Offices, concerning field employees. (2) The Office of Personnel Management's procedures may, if necessary, be supplemented in the Food and Drug Administration Staff Manual Guide. Current Food and Drug Administration employees should mail or deliver written requests under the Privacy Act for access to personnel records described in this paragraph to the Office of Personnel Management in accordance with 5 CFR 297.106, the Director, Division of Human Resources Management (HFA–400), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857, or the personnel officer in the servicing HHS Regional Personnel Office. An employee may consult with or direct his or her request to the FDA Privacy Act Coordinator (HFI–30). Requests for access to personnel records of former employees that are located in Federal Records Centers should be directed to the Office of Personnel Management. Requests under the Privacy Act for amendment of personnel records should be directed to these same officials who are responsibile for access to personnel records under this paragraph. (3) With respect to records subject to paragraph (b)(1) of this section: (i) Refusal to grant access to a record, or refusal to amend a record upon request of an employee, shall only be made by the Associate Commissioner for Management and Operations or his or her designate; and (ii) Appeals of refusals under paragraph (b)(3)(i) of this section may be made to the Office of Personnel Management in accordance with 5 CFR 297.108(g)(3) and 297.113(b). (c) Any other Privacy Act Record Systems that contain personnel records, or records that otherwise concern agency employees, that are maintained by offices of the Food and Drug Administration rather than the Division of Human Resources Management but which are not subject to the Department's notice for personnel records in operating offices are subject to this part, except that refusals under this part to grant access to or amend records about present or former employees shall be made by the Associate Commissioner for Management and Operations rather than the Associate Commissioner for Public Affairs. (d) The following procedures shall govern requests under the Privacy Act for personnel records that are maintained by the operating offices of the Food and Drug Administration in which employees work: (1) An employee shall upon request be told whether records about him are maintained. An employee shall be given access to records about himself that are subject to this paragraph in response to an oral or written request and through informal procedures, rather than the procedures specified in §§21.40 through 21.43. (2) Employee identity may be verified, if necessary, by an FDA ID card rather than in accordance with §21.44. (3) Generally no fee shall be charged for records requested under this paragraph. However, in cases where the records requested are voluminous, a fee may be charged in accordance with §21.45. (4) Records that are subject to this paragraph shall be available for access to an individual, except to the extent that access is refused by the Associate Commissioner for Management and Operations or his or her designate on the grounds that the record is subject to an exemption under §21.61 or 5 CFR 297.111. (5) Requests under the Privacy Act for amendment of records subject to this paragraph should be directed to the Director, Division of Human Resources Management (HFA–400). Such requests shall be reviewed in accordance with subpart E of this part. Refusal to amend a record subject to this paragraph (d)(5) shall only be made by the Associate Commissioner for Management and Operations or his or her designate. (6) Appeals of refusals under paragraph (d) (4) or (5) of this section may be made to the Commissioner of Food and Drugs, except where the Associate Commissioner for Management and Operations or his or her designate indicates with his or her refusal that the appeal should be made to the Office of Personnel Management. (7) Disclosures of records subject to this paragraph are subject to subpart G of this part. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985] (a) In general, an individual is entitled to have access to any medical records about himself in Privacy Act Record Systems maintained by the Food and Drug Administration. (b) The Food and Drug Administration may apply the following special procedures in disclosing medical records to an individual: (1) The agency may review the records to determine whether disclosure of the record to the individual who is the subject of the records might have an adverse effect on him. If it is determined that disclosure is not likely to have an adverse effect on the individual, the record shall be disclosed to him. If it is determined that disclosure is very likely to have an adverse effect on the individual, he may be requested to designate, in writing, a representative to whom the record shall be disclosed. Such representative may be a physician, other health professional, or other responsible person who would be willing to review the record and discuss it with the individual. (2) The availability of the record may be subject to any procedures for disclosure to an individual of medical records about himself under part 20 of this chapter, in addition to or in lieu of the procedures in paragraph (b)(1), that are not inconsistent with §21.41(f). (a) An individual may request that the Food and Drug Administration notify him whether a Privacy Act Record System contains records about him that are retrieved by reference to his name or other personal identifier. An individual may at the same time, or after receiving notification that such a record about him exists, requests that he be given access to the record. (b) An individual desiring notification or access to records shall mail or deliver a request for records in any Food and Drug Administration Privacy Act Records System to the FDA Privacy Act Coordinator (HFI–30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857. (c) Requests shall be in writing and shall name the Privacy Act Record System or Systems concerning which the individual requests notification of whether there are records about him that are retrieved by reference to his name or other personal identifier. To help assure a prompt response, an individual should indicate that he is making a “Privacy Act Request” on the envelope and in a prominent manner in the letter. (d) An individual who merely wishes to be notified whether a Privacy Act Record System contains a record about him ordinarily need not provide any verification of his identity other than his name. The mere fact that the Food and Drug Administration has a record about an individual in any of its Privacy Act Records Systems would not be likely to constitute a clearly unwarranted invasion of personal privacy. Where mere disclosure of the fact that a record about the individual exists would be a clearly unwarranted invasion of personal privacy, further verification of the identity of the individual shall be required. (e) An individual who requests that he be given access to a copy of records about himself, if any exist, should indicate whether he prefers (1) to have copies of any such records mailed to him in accordance with §21.43(a)(1), which may involve a fee under §21.45, including information to verify his identity under §21.44 or (2) to use the procedures for access in person under §21.43(a)(2). (f) A request for notification and access may be submitted under this subpart concerning any Privacy Act Record System that is exempt under §21.61, as indicated in the notice for the system. An individual seeking access to records under §21.65(b)(2) to investigatory records compiled for law enforcement purposes other than criminal law enforcement purposes should submit a description of the right, benefit, or privilege that he believes he was denied as the result of the Food and Drug Administration's maintenance of the records. Where the system is exempt under §21.61, and access to the requested records is not granted under §21.65, the request shall be handled under the provisions of part 20 of this chapter (the public information regulations). [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985] (a) An individual or his guardian under §21.75 shall not be required to show any justification or need to obtain notification under §21.42 or access to a record under §21.43. (b) The Food and Drug Administration will determine whether a request by an individual for records about himself is appropriately treated as a request under this subpart, or under the provision of part 20 of this chapter (the public information regulations), or both. Where appropriate, the Food and Drug Administration will consult with the individual concerning the appropriate treatment of the request. (c) The FDA Privacy Act Coordinator (HFI–30) in the Freedom of Information Staff shall be responsibile for the handling of Privacy Act requests received by the Food and Drug Administration. Requests mailed or delivered to any other office shall be promptly redirected to the FDA Privacy Act Coordinator. Where this procedure would unduly delay the agency's response, however, the agency employee who received the request should consult with the FDA Privacy Act Coordinator and obtain advice as to whether the employee can respond to the request directly. (d) Upon receipt of a request by the FDA Privacy Act Coordinator, a record shall promptly be made that a request has been received and the date. (e) A letter in accordance with §21.42 responding to the request for notification shall issue as promptly as possible after receipt of the request by the Food and Drug Administration. Upon determination by the Freedom of Information Staff that a request for access to records is appropriately treated as a request under part 20 of this chapter rather than part 21, or under both parts, the time limitations prescribed in §21.41 shall apply. In any case, access to available records shall be provided as promptly as possible. (f) Except as provided in §21.32, an individual's access to records about him/herself that are retrieved by his/her name or other personal identifiers and contained in any Privacy Act Record System may only be denied by the Associate Commissioner for Public Affairs or his or her designate. An individual shall not be denied access to any record that is otherwise available to him/her under this part except on the grounds that it is exempt under §21.65(a)(2), that it was compiled in reasonable anticipation of court litigation of formal administrative proceedings, or to the extent that it is exempt or prohibited from disclosure because it includes a trade secret or commercial or financial information that is privileged or confidential information the disclosure of which would constitute a clearly unwarranted invasion of personal privacy of another individual. (g) The FDA Privacy Act Coordinator shall ensure that records are maintained of the number, status, and disposition of requests under this subpart, including the number of requests for records exempt from access under this subpart and other information required for purposes of the annual report to Congress under the Privacy Act. These temporary administrative management records shall not be considered to be Privacy Act Record Systems. All records required to be kept under this paragraph shall only include requesting individuals' names or personal identifiers for so long as any request for notification, access, or amendment is pending. The identity of individuals making request under this subpart shall be regarded as confidential and shall not be disclosed under part 20 of this chapter (the public information regulations) to any other person or agency except as is necessary for the processing of requests under this subpart. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981] (a) The FDA shall respond to an individual's request for notification as to whether a Privacy Act Record System contains records about him that are retrieved by his name or other personal identifier by sending a letter under this paragraph. (1) If there are no records about the individual that are retrieved by his name or other personal identifier in the named Privacy Act Record System, or the requester is not an “individual” under §21.3(a), the letter shall so state. Where appropriate, the letter shall indicate that the Food and Drug Administration's public information regulations in part 20 of this chapter prescribe general rules governing the availability of information to members of the public, and that a request may be made in accordance with part 20 of this chapter for records that are not retrieved by the requester's name or other personal identifier from a Privacy Act Record System. (2) If there are records about the individual that are retrieved by his name or other personal identifier and the named Privacy Act Record System is not exempt from individual access and contest under §21.61, or the system is exempt but access is allowed or required under §21.65, the letter shall inform him that the records exist and shall either: (i) Enclose a copy of the records under §21.43(a)(1) or indicate that the records will be sent under separate cover, where there has been adequate verification of the identity of the individual under §21.44 and the fees under §21.45 do not exceed $25, or (ii) Inform the individual of the procedures to obtain access to the records by mail or in person under §21.43(a)(2), as well as the approximate dates by which the requested records can be provided (if the records are not then available), the locations at which access in person may be had, and the information needed, if any, to verify the identity of the individual under §21.44. (3) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal identifier, and the system is exempt from individual access and contest under §21.61 and access is not allowed or required under §21.65, the letter should inform him that the records are exempted from access and contest by §21.61. The letter shall also inform him if the records sought are not available because they were compiled in reasonable anticipation of court litigation or formal administrative proceedings or are otherwise not available under §21.41(b). Where appropriate, the letter shall also indicate whether the records are available under part 20 of this chapter (the public information regulations), and it may disclose the records in accordance with part 20. (4) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal identifier, but a final determination has not yet been made with respect to disclosure of all of the records covered by the request, e.g., because it is necessary to consult another person or agency having an interest in the confidentiality of the records, the letter shall explain the circumstances and indicate when a final answer will be given. (b) Except as provided in §21.32, access to a record may only be denied by the Associate Commissioner for Public Affairs or his or her designate. If access to any record is denied wholly or in substantial part, the letter shall state the right of the individual to appeal to the Commissioner of Food and Drugs. (c) If a request for a copy of the records will result in a fee of more than $25, the letter shall specify or estimate the fee involved. Where the individual has requested a copy of any records about him and copying the records would result in a fee of over $50, the Food and Drug Administration shall require advance deposit as well as payment of any amount not yet received as a result of any previous request by the individual for a record about himself, under this subpart or part 20 of this chapter (the public information regulations) before the records are made available. If the fee is less than $50, prepayment shall not be required unless payment has not yet been received for records disclosed as a result of a previous request by the individual for a record about himself under this subpart or part 20 of this chapter. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981] (a) Access may be granted to requested records by: (1) Mailing a copy of the records to the requesting individual, or (2) Permitting the requesting individual to review the records in person between 9 a.m. and 4 p.m. at the office of the FDA Privacy Act Coordinator, at the Freedom of Information Staff public room at the address shown in §20.30 of this chapter, or at any Food and Drug Administration field office, listed in part 5, subpart M of this chapter, or at another location or time upon which the Food and Drug Administration and the individual agree. Arrangement for such review can be made by consultation between the FDA Privacy Act Coordinator and the individual. An individual seeking to review records in person shall generally be permitted access to the file copy, except that where the records include nondisclosable information, a copy shall be made of that portion of the records, with the nondisclosable information blocked out. Where the individual is not given a copy of the record to retain, no charge shall be made for the cost of copying a record to make it available to an individual who reviews a record in person under this paragraph. (b) An individual may request that a record be disclosed to or discussed in the presence of another individual, such as an attorney. The individual may be required to furnish a written statement authorizing the disclosure or discussion in such other individual's presence. (c) The Food and Drug Administration will make every reasonable effort to assure that records made available under this section can be understood by the individual, such as by providing an oral or written explanation of the records. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 69 FR 17290, Apr. 2, 2004] (a) An individual seeking access to records in a Privacy Act Record System may be required to comply with reasonable requirements to enable the Food and Drug Administration to determine his identity. The identification required shall be suitable considering the nature of the records sought. No identification shall be required to receive access to information that is required to be disclosed to any member of the public under part 20 of this chapter (the public information regulations). (b) An individual who appears in person for access to records about himself shall be required to provide at least one document to identify himself, e.g., driver's license, passport, or alien or voter registration card to verify his identity. If an individual does not have any such document or requests access to records about himself without appearing in person under circumstances in which his identity cannot be verified from the request itself, he shall be required to certify in writing that he is the individual he claims to be and that he understands that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine. (c) In making requests under §21.75, a parent of a minor child or legal guardian of an incompetent individual may be required to verify his relationship to the minor child or the incompetent individual, in addition to verifying his own identity, by providing a copy of the minor's birth certificate, a court order, or other evidence of guardianship. (d) Where an individual seeks access to particularly sensitive records, such as medical records, the individual may be required to provide additional information beyond that specified in paragraph (b) or (c) of this section, such as the individual's years of attendance at a particular educational institution, rank attained in the uniformed services, date or place of birth, names of parents, an occupation, or the specific times the individual received medical treatment. (a) Where applicable, fees for copying records shall be charged in accordance with the schedule set forth in this section. Fees may only be charged where an individual has requested that a copy be made of a record to which he is granted access. No fee may be charged for making a search of a Privacy Act Record System whether the search is manual, mechanical, or electronic. Where a copy of the record must be made to provide access to the record, e.g., computer printout where no screen reading is available, the copy shall be made available to the individual without cost. Where a medical record is made available to a representative designated by the individual under §21.33, no fee will be charged. (b) The fee schedule is as follows: (1) Copying of records susceptible to photocopying—$.10 per page. (2) Copying of records not susceptible to photocopying, e.g., punch cards or magnetic tapes—at actual cost to the determined on a case-by-case basis. (3) No charge will be made if the total amount of copying for an individual does not exceed $25. (c) When a fee is to be assessed, the individual shall be notified prior to the processing of the copies, and be given an opportunity to amend his request. Payment shall be made by check or money order made payable to the “Food and Drug Administration,” and shall be sent to the Accounting Branch (HFA–120), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857. Advance deposit shall be required where the total amount exceeds $50. [42 FR 15626, Mar. 22, 1977, as amended at 54 FR 9038, Mar. 3, 1989] (a) An individual who received access to a record about himself under subpart D of this part may request that the record be amended if he believes that the record or an item of information is not accurate, relevant to a Food and Drug Administration purpose, timely, or complete. (b) Amendments under this subpart shall not violate existing statute, regulation, or administrative procedure. (1) This subpart does not permit alteration of evidence presented in the course of judicial proceedings or Food and Drug Administration adjudicatory or rule making proceedings or collateral attack upon that which has already been the subject of any such proceedings. (2) If the accuracy, relevancy, timeliness, or completeness of the records may be contested in any other pending or imminent agency proceeding, the Food and Drug Administration may refer the individual to the other proceeding as the appropriate means to obtain relief. If the accuracy, relevance, timeliness, or completeness of a record is, or has been, an issue in another agency proceeding, the request under this section shall be disposed of in accordance with the decision in the other proceeding, absent unusual circumstances. (c) Requests to amend records shall be submitted, in writing, to the FDA Privacy Act Coordinator in accordance with §21.40(b). Such requests shall include information sufficient to enable the Food and Drug Administration to locate the record, a brief description of the items of information requested to be amended, and the reasons why the record should be amended together with any appropriate documentation or arguments in support of the requested amendment. An edited copy of the record showing the described amendment may be included. Verification of identity should be provided in accordance with §21.44. (d) Written acknowledgement of the receipt of a request to amend a record shall be provided within 10 working days to the individual who requested the amendment. Such acknowledgement may request any additional information needed to verify identity or make a determination. No acknowledgement need be made if the request can be reviewed, processed, and the individual notified of the agency's agreement with the request or refusal within the 10-day period. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981] (a) The Food and Drug Administration shall take one of the following actions on a request for amendment of records as promptly as possible: (1) Amend any portion of the record which the agency has determined, based upon a preponderance of the evidence, is not accurate, relevant to a Food and Drug Administration purpose, timely, or complete, and, in accordance with paragraph (d)(3) of this section, inform the individual and previous recipients of the record that has been amended of the amendment. (2) Inform the individual of its refusal to amend any portion of the record in the manner requested, the reason for the refusal, and the opportunity for administrative appeal to the Commissioner of Food and Drugs. Except as provided in §21.32, such refusal may only be issued by the Associate Commissioner for Public Affairs or his or her designate. (3) Where another agency was the source of and has control of the record, refer the request to that agency. (b) The agency may, for good cause, extend the period for taking action an additional 30 working days if notice is provided to the individual explaining the circumstances of the delay. (c) The officials charged with reviewing a record to determine how to respond to a request to amend it, shall assess its accuracy, relevance to a Food and Drug Administration purpose, timeliness, or completeness. The determination shall be made in the light of the purpose for which the records or system is used, the agency's need for the record, and the possible adverse consequences to the individual from the record if not amended. Whenever the Food and Drug Administration receives a request for deletion of a record, or portions of a record, it shall consider anew whether the contested information in the record is relevant and necessary to a Food and Drug Administration purpose. (d) If the Food and Drug Administration agrees with an individual's request, it shall take the following actions: (1) So inform the individual in writing. (2) In accordance with statute, regulation, or procedure, amend the record to make it accurate, relevant to a Food and Drug Administration purpose, timely, or complete, making note of the date and fact of the amendment. (3) If an accounting was made under §21.71(d) of a disclosure of the record under §21.71(a), provide a copy of the record as amended, to all previous recipients of the record. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981] (a) If an individual disagrees with a refusal under §21.51(a)(2) to amend a record, he or she may appeal that refusal to the Commissioner of Food and Drugs, Rm. 14–71, 5600 Fishers Lane, Rockville, MD 20857. (b) If, upon appeal, the Commissioner upholds the refusal to amend the record as requested, he shall inform the individual: (1) Of his decision and the reasons for it. (2) Of the individual's right to file with the Food and Drug Administration a concise statement of the individual's reasons for disagreeing with the agency's decision not to amend the record as requested. (3) That the statement of disagreement will be made available to all persons listed in an accounting as having previously received the record and any person to whom the record is subsequently disclosed together with, in the discretion of the Food and Drug Administration, a brief statement summarizing its reasons for refusing to amend the record. Any individual who includes false information in the statement of disagreement filed with the Food and Drug Administration may be subject to penalties under 18 U.S.C. 1001, the False Reports to the Government Act. (4) That the individual has a right to seek judicial review of the refusal to amend the record. (c) If the Commissioner on administrative appeal or a court on judicial review determines that the record should be amended in accordance with the individual's request, the Food and Drug Administration shall proceed in accordance with §21.51(d). (d) A final determination on the individual's administrative appeal of the initial refusal to amend the record shall be concluded within 30 working days of the request for such review under paragraph (a) of this section, unless the Commissioner extends such period for good cause and informs the individual in writing of the reasons for the delay and of the approximate date on which a decision of the appeal can be expected. [42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985] When an individual has filed a statement of disagreement under §21.52(b)(2), the Food and Drug Administration shall: (a) Mark any portion of the record that is disputed to assure that the record will clearly show that portion is disputed whenever the record is disclosed. (b) In any subsequent disclosure under §21.70 or §21.71(a), provide a copy of the statement of disagreement and, if the Food and Drug Administration deems it appropriate, a concise statement of the agency's reasons for not making the amendment(s) requested. While the individual shall have access to any such statement, it shall not be subject to a request for amendment under §21.50. (c) If an accounting was made under §21.71(d) and (e) of a disclosure of the record under §21.71(a), provide to all previous recipients of the record a copy of the statement of disagreement and the agency statement, if any. Whenever the Food and Drug Administration is notified that a record that it received from another agency was amended or is the subject of a statement of disagreement, the Food and Drug Administration shall: (a) Discard the record, or clearly note the amendment or the fact of disagreement in its copy of the record, and (b) Refer persons who subsequently request the record to the agency that provided it. (c) If an accounting was made under §21.71 (d) and (e) of the disclosure of the record under §21.71(a), inform all previous recipients of the record about the amendment or provide to them the statement of disagreement and the agency statement, if any. It is the policy of the Food and Drug Administration that record systems should be exempted from the Privacy Act only to the extent essential to the performance of law enforcement functions under the laws that are administered and enforced by the Food and Drug Administration or that govern the agency. (a) Investigatory records compiled for law enforcement purposes, including criminal law enforcement purposes, in the Food and Drug Administration Privacy Act Record Systems listed in paragraph (b) of this section are exempt from the following provisions of the Privacy Act (5 U.S.C. 552a) and of this part: (1) Such records are exempt from 5 U.S.C. 552a(c)(3) and §21.71(e)(4), requiring that an individual be provided with the accounting of disclosures of records about himself from a Privacy Act Record System. (2) Except where access is required under 5 U.S.C. 552a(k)(2) and §21.65(a)(2), (such records are exempt from 5 U.S.C. 552a(d)(1) through (4) and (f)) and §§21.40 through 21.54, requiring procedures for an individual to be given notification of and access to records about himself in a Privacy Act Record System and to be allowed to challenge the accuracy, relevance, timeliness, and completeness of such records. (3) Such records are exempt from 5 U.S.C. 552a(e)(4)(G) and (H) and §21.20(b)(1) requiring inclusion in the notice for the system of information about agency procedures for notification, access, and contest. (4) Such records are exempt from 5 U.S.C. 552a(e)(3) requiring that individuals asked to supply information be provided a form outlining the authority for the request, the purposes for which the information will be used, the routine uses in the notice for the Privacy Act Record System, and the consequences to the individual of not providing the information, but only with respect to records compiled by the Food and Drug Administration in a criminal law enforcement investigation where the conduct of the investigation would be prejudiced by such procedures. (b) Records in the following Food and Drug Administration Privacy Act Record Systems that concern individuals who are subject to Food and Drug Administration enforcement action and consist of investigatory records compiled for law enforcement purposes, including criminal law enforcement purposes, are exempt under 5 U.S.C. 552a(j)(2) and (k)(2) from the provisions enumerated in paragraph (a) of this section: (1) Bio-research Monitoring Information System—HHS/FDA/09–10–0010. (2) Regulated Industry Employee Enforcement Records—HHS/FDA/ACMO/09–10–002. (3) Employee Conduct Investigative Records—HHS/FDA/ACMO/09–10–0013. (c) The system described in paragraph (b)(3) of this section includes investigatory records compiled solely for the purpose of determining suitability, eligibility, or qualification for Federal civilian employment, military service, Federal contracts, and access to classified information. These records are exempt from disclosure under 5 U.S.C. 552a(k)(5) to the extent that the disclosure would reveal the identity of a source who furnished information to the Government under a promise of confidentiality, which must be an express promise if the information was furnished after September 27, 1975. Any individual who is refused access to a record that would reveal a confidential source shall be advised in a general way that the record includes information that would reveal a confidential source. [42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8459, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985] (a) Where a Privacy Act Record System is exempt and the requested records are unavailable under §21.61, an individual may nevertheless make a request under §21.40 for notification concerning whether any records about him exist and request access to such records where they are retrieved by his name or other personal identifier. (b) An individual making a request under paragraph (a) of this section; (1) May be given access to the records where available under part 20 of this chapter (the public information regulations) or the Commissioner may, in his discretion, entertain a request under any or all of the provisions of §§21.40 through 21.54; and (2) Shall be given access upon request if the records requested are subject to 5 U.S.C. 552a(k)(2) and not to 5 U.S.C. 552a(j)(2) (i.e., because they consist of investigatory material compiled for law enforcement purposes other than criminal law enforcement purposes) and maintenance of the records resulted in denial to the individual of any right, benefit, or privilege to which he would otherwise be entitled by Federal law, or for which he would otherwise be eligible. An individual given access to a record under this paragraph (b)(2) is not entitled to seek amendment under subpart E of this part. The FDA may refuse to disclose a record that would reveal the identity of a source who furnished information to the Government under a promise of confidentiality, which must be an express promise if the information was furnished on or after September 27, 1975. Any individual refused access to a record that would reveal a confidential source shall be advised in a general way that the record contains information that would reveal a confidential source. (c) The Commissioner shall not make available any record that is prohibited from public disclosure under §20.82(b) of this chapter. (d) Discretionary disclosure of a record pursuant to paragraph (b)(1) of this section shall not set a precedent for discretionary disclosure of a similar or related record and shall not obligate the Commissioner to exercise his discretion to disclose any other record in a system that is exempt under §21.61. (a) A record about an individual which is contained in a Privacy Act Record System may be disclosed: (1) To the individual who is the subject of the record, or his legal guardian under §21.75; (2) To a third party pursuant to a written request by, or within a written consent of, the individual to whom the record pertains, or his legal guardian under §21.75; (3) To any person: (i) Where the names and other identifying information are first deleted, and under circumstances in which the recipient is unlikely to know the identity of the subject of the record; (ii) Where disclosure is required by part 20 of this chapter (the public information regulations); or (4) Within the Department of Health and Human Services to officers and employees who have a need for the record in the performance of their duties in connection with the laws administered and enforced by the Food and Drug Administration or that govern the agency. For purposes of this section, officers or employees of the Department shall include the following categories of individuals, who shall thereafter be subject to the same restrictions with respect to disclosure as any Food and Drug Administration employee: Food and Drug Administration consultants and advisory committees, State and local government employees for use only in their work with the Food and Drug Administration, and contractors and their employees to the extent that the records of such contractors are subject to the requirements of this part under §21.30. (b) No accounting is required for any disclosure or use under paragraph (a) of this section. (a) Except as provided in §21.70, a record about an individual that is contained in a Privacy Act Record System shall not be disclosed by any method of communication except under any of the following circumstances, which are subject to the limitations of paragraphs (b) and (c) of this section and to the accounting requirement of paragraph (d) of this section: (1) To those officers and employees of the agency which maintains the record who have a need for the record in the perfomance of their duties; (2) Required under section 552 of the Freedom of Information Act; (3) For a routine use as described in the routine use section of each specific system notice; (4) To the Bureau of Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13 of the U.S. Code; (5) To a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and that the record is to be transferred in a form that is not individually identifiable; (6) To the National Archives and Records Administration of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the U.S. Government, or to the Archivist of the United States or his or her designee for evaluation to determine whether the record has such value; (7) To another agency or to an instrumentality of any government jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought; (8) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if, upon such disclosure, notification is transmitted to the last known address of such individual; (9) To either House of Congress or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee; (10) To the Comptroller General, or any of his or her authorized representatives in the course of the performance of the duties of the General Accounting Office; (11) Pursuant to the order of a court of competent jurisdiction; or (12) To a consumer reporting agency in accordance with section 3(d) of the Federal Claims Collection Act of 1966 (31 U.S.C. 952(d)). (This “Special Disclosure” statement does not apply to any FDA system of records.) (b) The Food and Drug Administration may in its discretion refuse to make a disclosure permitted under paragraph (a) of this section, if the disclosure would in the judgment of the agency, invade the privacy of the individual or be inconsistent with the purpose for which the information was collected. (c) The Food and Drug Administration may require any person requesting a disclosure of a record under paragraph (a) of this section to provide: (1) Information about the purposes to which the disclosed record is to be put, and (2) A written statement certifying that the record will be used only for the stated purposes and will not be further disclosed without the written permission of the Food and Drug Administration. Under 5 U.S.C. 552a(i)(3), any person who knowingly or willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000. Such person may also be subject to prosecution under the False Reports to the Government Act, 18 U.S.C. 1001. (d) An accounting shall be made, in accordance with paragraph (e) of this section, of any disclosure under paragraph (a) of this section of a record that is not a disclosure under §21.70. (e) Where an accounting is required under paragraph (d) of this section, the Food and Drug Administration shall: (1) Record the name and address of the person or agency to whom the disclosure is made and the date, nature, and purpose of the disclosure. The accounting shall not be considered a Privacy Act Record System. (2) Retain the accounting for 5 years or for the life of the record, whichever is longer, following the disclosure. (3) Notify those recipients listed in the accounting of amendments or disputes concerning the records previously disclosed to them pursuant to §21.51(d)(3), §21.53(c), or §21.54(c). (4) Except when the record is exempt from individual access and contest under §21.61 or to the extent that the accounting describes a transfer for a law enforcement purpose pursuant to paragraph (a)(7) of this section, make the accounting available to the individual to whom the record pertains, in accordance with procedures of subpart D of this part. (f) A single accounting may be used to cover disclosure(s) that consist of a continuing dialogue between two agencies over a prolonged period, such as discussion of an enforcement action between the Food and Drug Administration and the Department of Justice. In such cases, a general notation may be made that, as of a certain date, contract was initiated, to continue until resolution of the matter. [42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985; 54 FR 9038, Mar. 3, 1989] (a) Individuals may consent to disclosure of records about themselves to other persons in several ways, for example: (1) An individual may give consent at the time that the information is collected for disclosure for specific purposes or to specific persons. (2) An individual may give consent for disclosure of his records to a specific person. (3) An individual may request the Food and Drug Administration to transcribe a specific record for submission to another person. (b) In each case the consent shall be in writing and shall specify the individual, organizational unit, or class of individuals or organizational units to whom the record may be disclosed, which record may be disclosed, and, if applicable, for what time period. A blanket consent to release all of an individual's records to unspecified individuals or organizational units will not be honored. Verification of the identity of the individual and, where applicable, of the person to whom the record is to be disclosed shall be made in accordance with §21.44. Consent documents shall be retained for a period of at least 2 years. If such documents are used as a means of accounting for the disclosure, they shall be retained as provided in §21.71(e)(2). (a) The Food and Drug Administration shall make reasonable efforts to assure that a record about an individual in a Privacy Act Record System is accurate, relevant to a Food and Drug Administration purpose, timely, and complete before such record is disclosed under §21.71. (b) Paragraph (a) of this section shall not apply to disclosures that are required under part 20 of this chapter (the public information regulations) or made to other Federal Government departments and agencies. Where appropriate, the letter disclosing the information shall indicate that the Food and Drug Administration has not reviewed the record to assure that it is accurate, relevant, timely, and complete. Whenever an individual has filed a statement of disagreement with the Food and Drug Administration concerning a refusal to amend a record under §21.51(a)(2) or with another agency that provides the record to the Food and Drug Administration, the Food and Drug Administration shall in any subsequent disclosure under this subpart provide a copy of the statement of disagreement and a concise statement by the agency, if one has been prepared, of the reasons for not making the amendment(s) requested. For the purposes of this part, the parent of any individual who is a minor or the legal guardian of any individual who has been declared to be incompetent due to physical or mental incapacity or age by a court of competent jurisdiction may act on behalf of the individual.
Title 21: Food and Drugs
PART 21—PROTECTION OF PRIVACY
Section Contents
§ 21.1 Scope.
§ 21.3 Definitions.
§ 21.10 Policy concerning records about individuals.
§ 21.20 Procedures for notice of Food and Drug Administration Privacy Act Record Systems.
§ 21.21 Changes in systems and new systems.
§ 21.30 Records of contractors.
§ 21.31 Records stored by the National Archives and Records Administration.
§ 21.32 Personnel records.
§ 21.33 Medical records.
§ 21.40 Procedures for submitting requests for notification and access.
§ 21.41 Processing of requests.
§ 21.42 Responses to requests.
§ 21.43 Access to requested records.
§ 21.44 Verification of identity.
§ 21.45 Fees.
§ 21.50 Procedures for submitting requests for amendment of records.
§ 21.51 Responses to requests for amendment of records.
§ 21.52 Administrative appeals of refusals to amend records.
§ 21.53 Notation and disclosure of disputed records.
§ 21.54 Amended or disputed records received from other agencies.
§ 21.60 Policy.
§ 21.61 Exempt systems.
§ 21.65 Access to records in exempt systems.
§ 21.70 Disclosure and intra-agency use of records in Privacy Act Record Systems; no accounting required.
§ 21.71 Disclosure of records in Privacy Act Record Systems; accounting required.
§ 21.72 Individual consent to disclosure of records to other persons.
§ 21.73 Accuracy, completeness, timeliness, and relevance of records disclosed from Privacy Act Record Systems.
§ 21.74 Providing notice that a record is disputed.
§ 21.75 Rights of legal guardians.
Subpart A—General Provisions
top
§ 21.1 Scope.
top
§ 21.3 Definitions.
top
§ 21.10 Policy concerning records about individuals.
top
Subpart B—Food and Drug Administration Privacy Act Record Systems
top
§ 21.20 Procedures for notice of Food and Drug Administration Privacy Act Record Systems.
top
§ 21.21 Changes in systems and new systems.
top
Subpart C—Requirements for Specific Categories of Records
top
§ 21.30 Records of contractors.
top
§ 21.31 Records stored by the National Archives and Records Administration.
top
§ 21.32 Personnel records.
top
§ 21.33 Medical records.
top
Subpart D—Procedures for Notification of and Access to Records in Privacy Act Record Systems
top
§ 21.40 Procedures for submitting requests for notification and access.
top
§ 21.41 Processing of requests.
top
§ 21.42 Responses to requests.
top
§ 21.43 Access to requested records.
top
§ 21.44 Verification of identity.
top
§ 21.45 Fees.
top
Subpart E—Procedures for Requests for Amendment of Records
top
§ 21.50 Procedures for submitting requests for amendment of records.
top
§ 21.51 Responses to requests for amendment of records.
top
§ 21.52 Administrative appeals of refusals to amend records.
top
§ 21.53 Notation and disclosure of disputed records.
top
§ 21.54 Amended or disputed records received from other agencies.
top
Subpart F—Exemptions
top
§ 21.60 Policy.
top
§ 21.61 Exempt systems.
top
§ 21.65 Access to records in exempt systems.
top
Subpart G—Disclosure of Records in Privacy Act Record Systems to Persons Other Than the Subject Individual
top
§ 21.70 Disclosure and intra-agency use of records in Privacy Act Record Systems; no accounting required.
top
§ 21.71 Disclosure of records in Privacy Act Record Systems; accounting required.
top
§ 21.72 Individual consent to disclosure of records to other persons.
top
§ 21.73 Accuracy, completeness, timeliness, and relevance of records disclosed from Privacy Act Record Systems.
top
§ 21.74 Providing notice that a record is disputed.
top
§ 21.75 Rights of legal guardians.
top
