(c) A contract is not considered to accomplish a Food and Drug Administration function if the program or activity it supports is not principally operated on behalf of, or is not under the direct management of, the Food and Drug Administration. For example, this part does not apply to systems of records:

1. (1) Operated under contract with the Food and Drug Administration by State or local government agencies, or organizations representing such agencies, when such agencies or organizations are also performing State or local government functions.
2. (2) Operated by contractors with the Food and Drug Administration by individuals or organizations whose primary function is delivery of health services, such as hospitals, physicians, pharmacists, and other health professionals, and that report information concerning products, e.g., injuries or product defects, to the Food and Drug Administration. Before such contractors submit information to the Food and Drug Administration, the names and other personal identifiers of patients or research subjects in any medical or similar report, test, study, or other research project shall be deleted, unless the contract provides otherwise. If the Food and Drug Administration subsequently needs the names of such individuals, a separate request will be made.
3. (3) Relating to individuals whom the contractor employs, or with whom the contractor otherwise deals, in the course of providing goods and services to the Food and Drug Administration.
4. (4) Operated under grants.

(e) The Food and Drug Administration will review all contracts before award to determine whether operation of a system from which information is retrieved by individual names or other personal identifiers will be required of the contractor, by the terms of the contract or as a matter of practical necessity. If such operation will be required, the solicitation and contract shall include the following clause, or a clause of similar effect:

Whenever the contractor or any of his employees is required by this contract to operate a system of records from which information is retrieved by individual names or other personal identifiers in order to accomplish a Food and Drug Administration function, the contractor and every employee is considered to be an employee of the Food and Drug Administration and shall operate such system of records in accordance with the Privacy Act of 1974 (5 U.S.C. 552a), regulations of the Food and Drug Administration in 21 CFR part 21, and rules of conduct that apply to Food and Drug Administration employees who work with such systems of records. The contractor and his employees are subject to the criminal penalties set forth in 5 U.S.C. 552a(i) for violations of the Privacy Act.