|
|
| [Code of Federal Regulations] |
| [Title 21, Volume 1] |
| [CITE: 21CFR21] |
TITLE 21--FOOD AND DRUGS CHAPTER I--FOOD AND DRUG ADMINISTRATION DEPARTMENT OF HEALTH AND HUMAN SERVICES
SUBCHAPTER A - GENERAL
| |
| PART 21 | PROTECTION OF PRIVACY |
|
|
|
|
Subpart D - Procedures for Notification of and Access to Records in Privacy Act Record Systems
|
|
Sec. 21.40 Procedures for submitting requests for notification and access.
|
|
(a) An individual may request that the Food and Drug Administration notify him whether a Privacy Act Record System contains records about him that are retrieved by reference to his name or other personal identifier. An individual may at the same time, or after receiving notification that such a record about him exists, requests that he be given access to the record.
(b) An individual desiring notification or access to records shall mail or deliver a request for records in any Food and Drug Administration Privacy Act Records System to the FDA Privacy Act Coordinator (address is located on the agency web site at http://www.gov.fda ).
(c) Requests shall be in writing and shall name the Privacy Act Record System or Systems concerning which the individual requests notification of whether there are records about him that are retrieved by reference to his name or other personal identifier. To help assure a prompt response, an individual should indicate that he is making a "Privacy Act Request" on the envelope and in a prominent manner in the letter.
(d) An individual who merely wishes to be notified whether a Privacy Act Record System contains a record about him ordinarily need not provide any verification of his identity other than his name. The mere fact that the Food and Drug Administration has a record about an individual in any of its Privacy Act Records Systems would not be likely to constitute a clearly unwarranted invasion of personal privacy. Where mere disclosure of the fact that a record about the individual exists would be a clearly unwarranted invasion of personal privacy, further verification of the identity of the individual shall be required.
(e) An individual who requests that he be given access to a copy of records about himself, if any exist, should indicate whether he prefers (1) to have copies of any such records mailed to him in accordance with § 21.43(a)(1), which may involve a fee under § 21.45, including information to verify his identity under § 21.44 or (2) to use the procedures for access in person under § 21.43(a)(2).
(f) A request for notification and access may be submitted under this subpart concerning any Privacy Act Record System that is exempt under § 21.61, as indicated in the notice for the system. An individual seeking access to records under § 21.65(b)(2) to investigatory records compiled for law enforcement purposes other than criminal law enforcement purposes should submit a description of the right, benefit, or privilege that he believes he was denied as the result of the Food and Drug Administration's maintenance of the records. Where the system is exempt under § 21.61, and access to the requested records is not granted under § 21.65, the request shall be handled under the provisions of part 20 of this chapter (the public information regulations).
[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 50 FR 52278, Dec. 23, 1985; 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014]
|
|
|
Sec. 21.41 Processing of requests.
|
|
(a) An individual or his guardian under § 21.75 shall not be required to show any justification or need to obtain notification under § 21.42 or access to a record under § 21.43.
(b) The Food and Drug Administration will determine whether a request by an individual for records about himself is appropriately treated as a request under this subpart, or under the provision of part 20 of this chapter (the public information regulations), or both. Where appropriate, the Food and Drug Administration will consult with the individual concerning the appropriate treatment of the request.
(c) The FDA Privacy Act Coordinator in the Division of Freedom of Information (address is located on the agency web site at http://www.gov.fda ) shall be responsible for the handling of Privacy Act requests received by the Food and Drug Administration. Requests mailed or delivered to any other office shall be promptly redirected to the FDA Privacy Act Coordinator. Where this procedure would unduly delay the agency's response, however, the agency employee who received the request should consult with the FDA Privacy Act Coordinator and obtain advice as to whether the employee can respond to the request directly.
(d) Upon receipt of a request by the FDA Privacy Act Coordinator, a record shall promptly be made that a request has been received and the date.
(e) A letter in accordance with § 21.42 responding to the request for notification shall issue as promptly as possible after receipt of the request by the Food and Drug Administration. Upon determination by the Division of Freedom of Information (address is located on the agency web site at http://www.gov.fda ) that a request for access to records is appropriately treated as a request under part 20 of this chapter rather than part 21, or under both parts, the time limitations prescribed in § 21.41 shall apply. In any case, access to available records shall be provided as promptly as possible.
(f) Except as provided in § 21.32, an individual's access to records about him/herself that are retrieved by his/her name or other personal identifiers and contained in any Privacy Act Record System may only be denied by the Associate Commissioner for Public Affairs or his or her designate. An individual shall not be denied access to any record that is otherwise available to him/her under this part except on the grounds that it is exempt under § 21.65(a)(2), that it was compiled in reasonable anticipation of court litigation of formal administrative proceedings, or to the extent that it is exempt or prohibited from disclosure because it includes a trade secret or commercial or financial information that is privileged or confidential information the disclosure of which would constitute a clearly unwarranted invasion of personal privacy of another individual.
(g) The FDA Privacy Act Coordinator shall ensure that records are maintained of the number, status, and disposition of requests under this subpart, including the number of requests for records exempt from access under this subpart and other information required for purposes of the annual report to Congress under the Privacy Act. These temporary administrative management records shall not be considered to be Privacy Act Record Systems. All records required to be kept under this paragraph shall only include requesting individuals' names or personal identifiers for so long as any request for notification, access, or amendment is pending. The identity of individuals making request under this subpart shall be regarded as confidential and shall not be disclosed under part 20 of this chapter (the public information regulations) to any other person or agency except as is necessary for the processing of requests under this subpart.
[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014]
|
|
|
Sec. 21.42 Responses to requests.
|
|
(a) The FDA shall respond to an individual's request for notification as to whether a Privacy Act Record System contains records about him that are retrieved by his name or other personal identifier by sending a letter under this paragraph.
(1) If there are no records about the individual that are retrieved by his name or other personal identifier in the named Privacy Act Record System, or the requester is not an "individual" under § 21.3(a), the letter shall so state. Where appropriate, the letter shall indicate that the Food and Drug Administration's public information regulations in part 20 of this chapter prescribe general rules governing the availability of information to members of the public, and that a request may be made in accordance with part 20 of this chapter for records that are not retrieved by the requester's name or other personal identifier from a Privacy Act Record System.
(2) If there are records about the individual that are retrieved by his name or other personal identifier and the named Privacy Act Record System is not exempt from individual access and contest under § 21.61, or the system is exempt but access is allowed or required under § 21.65, the letter shall inform him that the records exist and shall either:
(i) Enclose a copy of the records under § 21.43(a)(1) or indicate that the records will be sent under separate cover, where there has been adequate verification of the identity of the individual under § 21.44 and the fees under § 21.45 do not exceed $25, or
(ii) Inform the individual of the procedures to obtain access to the records by mail or in person under § 21.43(a)(2), as well as the approximate dates by which the requested records can be provided (if the records are not then available), the locations at which access in person may be had, and the information needed, if any, to verify the identity of the individual under § 21.44.
(3) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal identifier, and the system is exempt from individual access and contest under § 21.61 and access is not allowed or required under § 21.65, the letter should inform him that the records are exempted from access and contest by § 21.61. The letter shall also inform him if the records sought are not available because they were compiled in reasonable anticipation of court litigation or formal administrative proceedings or are otherwise not available under § 21.41(b). Where appropriate, the letter shall also indicate whether the records are available under part 20 of this chapter (the public information regulations), and it may disclose the records in accordance with part 20.
(4) If the named Privacy Act Record System contains records about the individual that are retrieved by his name or other personal identifier, but a final determination has not yet been made with respect to disclosure of all of the records covered by the request, e.g., because it is necessary to consult another person or agency having an interest in the confidentiality of the records, the letter shall explain the circumstances and indicate when a final answer will be given.
(b) Except as provided in § 21.32, access to a record may only be denied by the Associate Commissioner for Public Affairs or his or her designate. If access to any record is denied wholly or in substantial part, the letter shall state the right of the individual to appeal to the Commissioner of Food and Drugs.
(c) If a request for a copy of the records will result in a fee of more than $25, the letter shall specify or estimate the fee involved. Where the individual has requested a copy of any records about him and copying the records would result in a fee of over $50, the Food and Drug Administration shall require advance deposit as well as payment of any amount not yet received as a result of any previous request by the individual for a record about himself, under this subpart or part 20 of this chapter (the public information regulations) before the records are made available. If the fee is less than $50, prepayment shall not be required unless payment has not yet been received for records disclosed as a result of a previous request by the individual for a record about himself under this subpart or part 20 of this chapter.
[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981]
|
|
|
Sec. 21.43 Access to requested records.
|
|
(a) Access may be granted to requested records by:
(1) Mailing a copy of the records to the requesting individual, or
(2) Permitting the requesting individual to review the records in person between 9 a.m. and 4 p.m. at the office of the FDA Privacy Act Coordinator, at the Division of Freedom of Information Public Reading Room (address is located on the agency's web site at http://www.fda.gov ), or at any Food and Drug Administration field office, listed in part 5, subpart M of this chapter, or at another location or time upon which the Food and Drug Administration and the individual agree. Arrangement for such review can be made by consultation between the FDA Privacy Act Coordinator and the individual. An individual seeking to review records in person shall generally be permitted access to the file copy, except that where the records include nondisclosable information, a copy shall be made of that portion of the records, with the nondisclosable information blocked out. Where the individual is not given a copy of the record to retain, no charge shall be made for the cost of copying a record to make it available to an individual who reviews a record in person under this paragraph.
(b) An individual may request that a record be disclosed to or discussed in the presence of another individual, such as an attorney. The individual may be required to furnish a written statement authorizing the disclosure or discussion in such other individual's presence.
(c) The Food and Drug Administration will make every reasonable effort to assure that records made available under this section can be understood by the individual, such as by providing an oral or written explanation of the records.
[42 FR 15626, Mar. 22, 1977, as amended at 46 FR 8458, Jan. 27, 1981; 69 FR 17290, Apr. 2, 2004; 76 FR 31470, June 1, 2011; 79 FR 68115, Nov. 14, 2014]
|
|
|
Sec. 21.44 Verification of identity.
|
|
(a) An individual seeking access to records in a Privacy Act Record System may be required to comply with reasonable requirements to enable the Food and Drug Administration to determine his identity. The identification required shall be suitable considering the nature of the records sought. No identification shall be required to receive access to information that is required to be disclosed to any member of the public under part 20 of this chapter (the public information regulations).
(b) An individual who appears in person for access to records about himself shall be required to provide at least one document to identify himself, e.g., driver's license, passport, or alien or voter registration card to verify his identity. If an individual does not have any such document or requests access to records about himself without appearing in person under circumstances in which his identity cannot be verified from the request itself, he shall be required to certify in writing that he is the individual he claims to be and that he understands that the knowing and willful request for or acquisition of a record pertaining to an individual under false pretenses is a criminal offense subject to a $5,000 fine.
(c) In making requests under § 21.75, a parent of a minor child or legal guardian of an incompetent individual may be required to verify his relationship to the minor child or the incompetent individual, in addition to verifying his own identity, by providing a copy of the minor's birth certificate, a court order, or other evidence of guardianship.
(d) Where an individual seeks access to particularly sensitive records, such as medical records, the individual may be required to provide additional information beyond that specified in paragraph (b) or (c) of this section, such as the individual's years of attendance at a particular educational institution, rank attained in the uniformed services, date or place of birth, names of parents, an occupation, or the specific times the individual received medical treatment.
|
|
|
(a) Where applicable, fees for copying records shall be charged in accordance with the schedule set forth in this section. Fees may only be charged where an individual has requested that a copy be made of a record to which he is granted access. No fee may be charged for making a search of a Privacy Act Record System whether the search is manual, mechanical, or electronic. Where a copy of the record must be made to provide access to the record, e.g., computer printout where no screen reading is available, the copy shall be made available to the individual without cost. Where a medical record is made available to a representative designated by the individual under § 21.33, no fee will be charged.
(b) The fee schedule is as follows:
(1) Copying of records susceptible to photocopying - $.10 per page.
(2) Copying of records not susceptible to photocopying, e.g., punch cards or magnetic tapes - at actual cost to the determined on a case-by-case basis.
(3) No charge will be made if the total amount of copying for an individual does not exceed $25.
(c) When a fee is to be assessed, the individual shall be notified prior to the processing of the copies, and be given an opportunity to amend his request. Payment shall be made by check or money order made payable to the "Food and Drug Administration," and shall be sent to the Accounting Branch (HFA-120), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857. Advance deposit shall be required where the total amount exceeds $50.
[42 FR 15626, Mar. 22, 1977, as amended at 54 FR 9038, Mar. 3, 1989]
|
|
|
Authority: 21 U.S.C. 371; 5 U.S.C. 552, 552a.
Source: 42 FR 15626, Mar. 22, 1977, unless otherwise noted.
|
|
