Privacy Act

FDA is pleased to provide the following materials regarding the Agency's privacy program.

How to Make a Privacy Act Request
Privacy Program Resources
Privacy Impact Assessments (PIAs)
Privacy Act Records & Applicable System of Records Notices (SORNs)
FDA Systems Containing Privacy Act Records & Applicable System of Records Notices (SORNs)
FDA Privacy Act Systems of Records Notices (SORNs)
Department of Health and Human Services (HHS) SORNs
Rescinded FDA SORNs
Government-Wide SORNs
FDA Exempt Systems

How to Make a Privacy Act Request

Please see the FDA's Privacy Regulations for a detailed description on how to submit a Privacy Act Request.

Privacy Impact Assessments (PIAs)

A PIA is a decision-making tool used to identify and mitigate privacy risks at the beginning of and throughout the development life cycle of a program or system. It helps the public understand what personally identifiable Information (PII) the Department is collecting, why it is being collected, and how it will be used, shared, accessed, secured and stored.

Approved PIAS are published on the HHS Privacy Impact Assessment.

Approved Third-Party Website and Applications PIAs are published on the HHS Privacy Impact Assessment.

Privacy Act Records & Applicable System of Records Notices (SORNs)

Privacy Act Systems of Records Notices (SORNs) describe government records subject to the Privacy Act, relevant use and disclosure practices, and record access and amendment procedures. The Privacy Act requires agencies to publish SORNs in the Federal Register and make them available online. SORNs specific to FDA records that are subject to the Privacy Act are listed below.

FDA also maintains Privacy Act records covered by SORNs published by the Department of Health and Human Services (HHS) or other federal agencies and which are, respectively, HHS-wide and/or government-wide in scope. These SORNs address information collection activities that are common within HHS and across government (e.g., human resources records, for which publication of individual agency SORNs would be duplicative). SORNs for HHS systems are available online at http://www.hhs.gov/foia/privacy/sorns.html. Likewise, SORNs published by agencies outside HHS and which apply to records across the federal government are available line at http://dpclo.defense.gov/Privacy/SORNsIndex/GovernmentWideNotices.aspx. HHS-wide and government-wide SORNs that apply to FDA records are listed below.

In a June 27, 2014 Federal Register Notice FDA added certain standard “routine uses” to the Agency’s remaining SORNs. These added routine uses provide for appropriate disclosures of records to contract employees, to recordkeeping authorities, to law enforcement authorities when a record indicates a violation of law, to the U.S. Department of Justice in the course of obtaining Freedom of Information Act guidance, and to relevant offices and organizations in the course of responding to security breaches. These routine uses are described in more detail in the June 27, 2014 Notice available online at http://www.gpo.gov/fdsys/pkg/FR-2014-06-27/pdf/2014-15022.pdf.

FDA Systems Containing Privacy Act Records & Applicable System of Records Notices (SORNs)

The following FDA systems contain Privacy Act records. The list cites the FDA, HHS and/or Government-wide SORNs that apply to each system. Those SORNs are listed in another section below which links to the full content of each SORN.

Rescinded FDA SORNs

On December 8, 2014, FDA published a SORN for records regarding FDA Commissioning of State and Local Officials, HHS/FDA/ORA, System No. 09-10-0022 (79 FR 72687). This notice also deleted the following SORN which was rendered obsolete: http://www.gpo.gov/fdsys/pkg/FR-2014-12-08/pdf/2014-28634.pdf

• FDA Credential Holder File, HHS/FDA/OC, System No. 09-10-0003

On June 27, 2014 FDA deleted the following four System of Records Notices for record systems no longer in use. The Federal Register Notice of this deletion is available online at http://www.gpo.gov/fdsys/pkg/FR-2014-06-27/pdf/2014-15022.pdf.

• Science Advisor Research Associate Program, HHS/FDA/ORA, System No. 09–10–0007. First published in the Federal Register, September 29, 1977 (42 FR 51922 at 52146).
• Radiation Protection Program Personnel Monitoring System, HHS/FDA/CDRH, System No. 09–10–0008. First published in the Federal Register, September 29, 1977 (42 FR 51922 at 52147) and published as revised with updated system location and manager information, December 31, 1992 (57 FR 62828 at 62829).
• Certified Retort Operators, HHS/FDA/CFSAN, System No. 09–10–0011. First published in the Federal Register, September 29, 1977 (42 FR 51922 at 52148) and published as revised with minor changes, December 29, 1993 (58 FR 69056).
• Epidemiological Research Studies of the Center for Devices and Radiological Health, HHS/FDA/CDRH, System No. 09–10–0017. First published in the Federal Register, May 29, 1979 (44 FR 30765 at 30766) and republished with minor changes in December 28, 1994 (59 FR 67087).

FDA Exempt Systems

Federal Register notices regarding the exemptions for the first three systems listed below are available online: Notice of Proposed Rulemaking (40 FR 41140) and Final Rule (40 FR 47406). For SORN 09-10-0020, the Proposed Rule is available here and the Final Rule is available here.

• 09-10-0002 Regulated Industry Employee Enforcement Records, HHS/FDA/OC

• 09-10-0010 Bioresearch Monitoring Information System, HHS/FDA
• 09-10-0013 Employee Conduct Investigative Records, HHS/FDA/OM
• 09-10-0020 FDA Records Related to Research Misconduct Proceedings, HHS/FDA/OC