unless the contract provides otherwise. If the Food and Drug Administration subsequently needs the names of such individuals, a separate request will be made.

(3) Relating to individuals whom the contractor employs, or with whom the contractor otherwise deals, in the course of providing goods and services to the Food and Drug Administration. (4) Operated under grants.

(d) The requirements of this part shall apply when a contractor who operates a system of records not subject to this part reports to the Food and Drug Administration information that is a system of records about individuals from which personal information is retrieved by names or other personal identifiers. Where the information would be a new Privacy Act Record System, or a change in an existing Privacy Act Record System of a type described in §21.21, the Food and Drug Administration shall comply with the requirements of § 21.21.

(e) The Food and Drug Administration will review all contracts before award to determine whether operation of a system from which information is retrieved by individual names or other personal identifiers will be required of the contractor, by the terms of the contract or as a matter of practical necessity. If such operation will be required, the solicitation and contract shall include the following clause, or a clause of similar effect:

or

Whenever the contractor or any of his employees is required by this contract to operate a system of records from which information is retrieved by individual names other personal identifiers in order to accomplish a Food and Drug Administration function, the contractor and every employee is considered to be an employee of the Food and Drug Administration and shall operate such system of records in accordance with the Privacy Act of 1974 (5 U.S.C. 552a), regulations of the Food and Drug Administration in 21 CFR part 21, and rules of conduct that apply to Food and Drug Administration employees who work with such systems of records. The contractor and his employees are subject to the criminal penalties set forth in 5 U.S.C. 552a(i) for violations of the Privacy Act.

§ 21.31 Records stored by the National Archives and Records Administration.

(a) Food and Drug Administration records that are stored, processed, and serviced by the National Archives and Records Administration in accordance with 44 U.S.C. 3103 shall be considered to be maintained by the Food and Drug Administration. The National Archives and Records Administration shall not disclose the record except to authorized Food and Drug Administration employees.

(b) Each Food and Drug Administration record pertaining to an identifiable individual that was transferred to the National Archives of the United States as a record determined by the National Archives to have sufficient historical or other value to warrant its continued preservation shall be considered to be maintained by the National Archives and shall not be subject to the provisions of this part.

[42 FR 15626, Mar. 22, 1977, as amended at 50 FR 52278, Dec. 23, 1985]

$21.32 Personnel records.

(a) Present and former Food and Drug Administration employees desiring access to personnel records about themselves should consult system notices applicable to the agency's personnel records that are published by the Office of Personnel Management and the Department as well as any notice issued by the Food and Drug Administration.

(b)(1) The procedures of the Office of Personnel Management at 5 CFR parts 293, 294, and 297 rather than the procedures in § 21.33 and subparts D through F of this part, govern systems of personnel records about Food and Drug Administration employees that are subject to notice published by the Office of Personnel Management, i.e., systems that:

(i) The Office of Personnel Management maintains.

(ii) Are maintained by the Division of Human Resources Management, Food and Drug Administration.

(iii) Are maintained by Department Regional Offices, concerning field employees.

(2) The Office of Personnel Management's procedures may, if necessary, be

supplemented in the Food and Drug Administration Staff Manual Guide. Current Food and Drug Administration employees should mail or deliver written requests under the Privacy Act for access to personnel records described in this paragraph to the Office of Personnel Management in accordance with 5 CFR 297.106, the Director, Division of Human Resources Management (HFA400), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857, or the personnel officer in the servicing HHS Regional Personnel Office. An employee may consult with or direct his or her request to the FDA Privacy Act Coordinator (HFI-30). Requests for access to personnel records of former employees that are located in Federal Records Centers should be directed to the Office of Personnel Management. Requests under the Privacy Act for amendment of personnel records should be directed to these same officials who are responsibile for access to personnel records under this paragraph.

(3) With respect to records subject to paragraph (b)(1) of this section:

(i) Refusal to grant access to a record, or refusal to amend a record upon request of an employee, shall only be made by the Associate Commissioner for Management and Operations or his or her designate; and

(ii) Appeals of refusals under paragraph (b)(3)(i) of this section may be made to the Office of Personnel Management in accordance with 5 CFR 297.108(g)(3) and 297.113(b).

(c) Any other Privacy Act Record Systems that contain personnel records, or records that otherwise concern agency employees, that are maintained by offices of the Food and Drug Administration rather than the Division of Human Resources Management but which are not subject to the Department's notice for personnel records in operating offices are subject to this part, except that refusals under this part to grant access to or amend records about present or former employees shall be made by the Associate Commissioner for Management and Operations rather than the Associate Commissioner for Public Affairs.

(d) The following procedures shall govern requests under the Privacy Act for personnel records that are main

tained by the operating offices of the Food and Drug Administration in which employees work:

(1) An employee shall upon request be told whether records about him are maintained. An employee shall be given access to records about himself that are subject to this paragraph in response to an oral or written request and through informal procedures, rather than the procedures specified in §§ 21.40 through 21.43.

(2) Employee identity may be verified, if necessary, by an FDA ID card rather than in accordance with § 21.44.

(3) Generally no fee shall be charged for records requested under this paragraph. However, in cases where the records requested are voluminous, a fee may be charged in accordance with § 21.45.

(4) Records that are subject to this paragraph shall be available for access to an individual, except to the extent that access is refused by the Associate Commissioner for Management and Operations or his or her designate on the grounds that the record is subject to an exemption under §21.61 or 5 CFR 297.111.

(5) Requests under the Privacy Act for amendment of records subject to this paragraph should be directed to the Director, Division of Human Resources Management (HFA-400). Such requests shall be reviewed in accordance with subpart E of this part. Refusal to amend a record subject to this paragraph (d)(5) shall only be made by the Associate Commissioner for Management and Operations or his or her designate.

(6) Appeals of refusals under paragraph (d) (4) or (5) of this section may be made to the Commissioner of Food and Drugs, except where the Associate Commissioner for Management and Operations or his or her designate indicates with his or her refusal that the appeal should be made to the Office of Personnel Management.

(7) Disclosures of records subject to this paragraph are subject to subpart G of this part.

[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8457, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985]

(a) In general, an individual is entitled to have access to any medical records about himself in Privacy Act Record Systems maintained by the Food and Drug Administration.

(b) The Food and Drug Administration may apply the following special procedures in disclosing medical records to an individual:

(1) The agency may review the records to determine whether disclosure of the record to the individual who is the subject of the records might have an adverse effect on him. If it is determined that disclosure is not likely to have an adverse effect on the individual, the record shall be disclosed to him. If it is determined that disclosure is very likely to have an adverse effect on the individual, he may be requested to designate, in writing, a representative to whom the record shall be disclosed. Such representative may be a physician, other health professional, or other responsible person who would be willing to review the record and discuss it with the individual.

(2) The availability of the record may be subject to any procedures for disclosure to an individual of medical records about himself under part 20 of this chapter, in addition to or in lieu of the procedures in paragraph (b)(1), that are not inconsistent with § 21.41(f).

Subpart D-Procedures for Notifi

cation of and Access to Records in Privacy Act Record Systems

§ 21.40 Procedures for submitting requests for notification and access. (a) An individual may request that the Food and Drug Administration notify him whether a Privacy Act Record System contains records about him that are retrieved by reference to his name or other personal identifier. An individual may at the same time, or after receiving notification that such a record about him exists, requests that he be given access to the record.

(b) An individual desiring notification or access to records shall mail or deliver a request for records in any Food and Drug Administration Privacy Act Records System to the FDA Pri

vacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857.

(c) Requests shall be in writing and shall name the Privacy Act Record System or Systems concerning which the individual requests notification of whether there are records about him that are retrieved by reference to his name or other personal identifier. To help assure a prompt response, an individual should indicate that he is making a "Privacy Act Request" on the envelope and in a prominent manner in the letter.

(d) An individual who merely wishes to be notified whether a Privacy Act Record System contains a record about him ordinarily need not provide any verification of his identity other than his name. The mere fact that the Food and Drug Administration has a record about an individual in any of its Privacy Act Records Systems would not be likely to constitute a clearly unwarranted invasion of personal privacy. Where mere disclosure of the fact that a record about the individual exists would be a clearly unwarranted invasion of personal privacy, further verification of the identity of the individual shall be required.

(e) An individual who requests that he be given access to a copy of records about himself, if any exist, should indicate whether he prefers (1) to have copies of any such records mailed to him in accordance with §21.43(a)(1), which may involve a fee under §21.45, including information to verify his identity under § 21.44 or (2) to use the procedures for access in person under § 21.43(a)(2).

(f) A request for notification and access may be submitted under this subpart concerning any Privacy Act Record System that is exempt under § 21.61, as indicated in the notice for the system. An individual seeking access to records under §21.65(b)(2) to investigatory records compiled for law enforcement purposes other than criminal law enforcement purposes should submit a description of the right, benefit, or privilege that he believes he was denied as the result of the Food and Drug Administration's maintenance of the records. Where the system is exempt under §21.61, and access to the requested records is not granted

under § 21.65, the request shall be handled under the provisions of part 20 of this chapter (the public information regulations).

[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985]

$21.41 Processing of requests.

(a) An individual or his guardian under §21.75 shall not be required to show any justification or need to obtain notification under §21.42 or access to a record under § 21.43.

(b) The Food and Drug Administration will determine whether a request by an individual for records about himself is appropriately treated as a request under this subpart, or under the provision of part 20 of this chapter (the public information regulations), or both. Where appropriate, the Food and Drug Administration will consult with the individual concerning the appropriate treatment of the request.

(c) The FDA Privacy Act Coordinator (HFI-30) in the Freedom of Information Staff shall be responsibile for the handling of Privacy Act requests received by the Food and Drug Administration. Requests mailed or delivered to any other office shall be promptly redirected to the FDA Privacy Act Coordinator. Where this procedure would unduly delay the agency's response, however, the agency employee who received the request should consult with the FDA Privacy Act Coordinator and obtain advice as to whether the employee can respond to the request directly.

(d) Upon receipt of a request by the FDA Privacy Act Coordinator, a record shall promptly be made that a request has been received and the date.

(e) A letter in accordance with §21.42 responding to the request for notification shall issue as promptly as possible after receipt of the request by the Food and Drug Administration. Upon determination by the Freedom of Information Staff that a request for access to records is appropriately treated as a request under part 20 of this chapter rather than part 21, or under both parts, the time limitations prescribed in §21.41 shall apply. In any case, access to available records shall be provided as promptly as possible.

(f) Except as provided in § 21.32, an individual's access to records about him/ herself that are retrieved by his/her name or other personal identifiers and contained in any Privacy Act Record System may only be denied by the Associate Commissioner for Public Affairs or his or her designate. An individual shall not be denied access to any record that is otherwise available to him/her under this part except on the grounds that it is exempt under § 21.65(a)(2), that it was compiled in reasonable anticipation of court litigation of formal administrative proceedings, or to the extent that it is exempt or prohibited from disclosure because it includes a trade secret or commercial or financial information that is privileged or confidential information the disclosure of which would constitute a clearly unwarranted invasion of personal privacy of another individual.

(g) The FDA Privacy Act Coordinator shall ensure that records are maintained of the number, status, and disposition of requests under this subpart, including the number of requests for records exempt from access under this subpart and other information required for purposes of the annual report to Congress under the Privacy Act. These temporary administrative management records shall not be considered to be Privacy Act Record Systems. All records required to be kept under this paragraph shall only include requesting individuals' names or personal identifiers for so long as any request for notification, access, or amendment is pending. The identity of individuals making request under this subpart shall be regarded as confidential and shall not be disclosed under part 20 of this chapter (the public information regulations) to any other person or agency except as is necessary for the processing of requests under this subpart.

[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981]

$21.42 Responses to requests.

(a) The FDA shall respond to an individual's request for notification as to whether a Privacy Act Record System contains records about him that are retrieved by his name or other personal

identifier by sending a letter under this paragraph.

(1) If there are no records about the individual that are retrieved by his name or other personal identifier in the named Privacy Act Record System, or the requester is not an "individual" under §21.3(a), the letter shall so state. Where appropriate, the letter shall indicate that the Food and Drug Administration's public information regulations in part 20 of this chapter prescribe general rules governing the availability of information to members of the public, and that a request may be made in accordance with part 20 of this chapter for records that are not retrieved by the requester's name or other personal identifier from a Privacy Act Record System.

(2) If there are records about the individual that are retrieved by his name or other personal identifier and the named Privacy Act Record System is not exempt from individual access and contest under §21.61, or the system is exempt but access is allowed or required under §21.65, the letter shall inform him that the records exist and shall either:

(i) Enclose a copy of the records under §21.43(a)(1) or indicate that the records will be sent under separate cover, where there has been adequate verification of the identity of the individual under §21.44 and the fees under § 21.45 do not exceed $25, or

(ii) Inform the individual of the procedures to obtain access to the records by mail or in person under §21.43(a)(2), as well as the approximate dates by which the requested records can be proIvided (if the records are not -hen available), the locations at which access in person may be had, and the information needed, if any, to verify the identity of the individual under § 21.44.

(3) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal identifier, and the system is exempt from individual access and contest under §21.61 and access is not allowed or required under § 21.65, the letter should inform him that the records are exempted from access and contest by §21.61. The letter shall also inform him if the records sought are not available because they

were compiled in reasonable anticipation of court litigation or formal administrative proceedings or are otherwise not available under $21.41(b). Where appropriate, the letter shall also indicate whether the records are available under part 20 of this chapter (the public information regulations), and it may disclose the records in accordance with part 20.

(4) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal identifier, but a final determination has not yet been made with respect to disclosure of all of the records covered by the request, e.g., because it is necessary to consult another person or agency having an interest in the confidentiality of the records, the letter shall explain the circumstances and indicate when a final answer will be given.

(b) Except as provided in § 21.32, access to a record may only be denied by the Associate Commissioner for Public Affairs or his or her designate. If access to any record is denied wholly or in substantial part, the letter shall state the right of the individual to appeal to the Commissioner of Food and Drugs.

(c) If a request for a copy of the records will result in a fee of more than $25, the letter shall specify or estimate the fee involved. Where the individual has requested a copy of any records about him and copying the records would result in a fee of over $50, the Food and Drug Administration shall require advance deposit as well as payment of any amount not yet received as a result of any previous request by the individual for a record about himself, under this subpart or part 20 of this chapter (the public information regulations) before the records are made available. If the fee is less than $50, prepayment shall not be required unless payment has not yet been received for records disclosed as a result of a previous request by the individual for a record about himself under this subpart or part 20 of this chapter.

[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981]

§ 21.43 Access to requested records.

(a) Access may be granted to requested records by: