(a) It is HHS policy to protect the privacy of individuals to the maximum possible extent, while permitting the exchange of records required to fulfill HHS administrative and program responsibilities and its responsibilities for disclosing records to which the general public is entitled under the Freedom of Information Act (5 U.S.C. 552). The Privacy Act of 1974 and the HHS implementation under 45 CFR Part 5b apply “when an agency provides by a contract for the operation by or on behalf of the agency of a system of records to accomplish any agency function * * *.” The key factor is whether an HHS function is involved. Therefore, the Privacy Act requirements apply to an HHS contract when, under the contract, the contractor must maintain or operate a system of records to accomplish an HHS function.
(e) The Project Officer, and, as necessary, the official designated as the OPDIV's Privacy Act Coordinator and OGC-GLD, shall determine the applicability of the Privacy Act to each proposed acquisition. The Project Officer is required to include a statement in the AP or other acquisition request document indicating whether the Privacy Act is or is not applicable to a proposed acquisition.
(f) Whenever a Contracting Officer is informed that the Privacy Act is not applicable, but the resultant contract will involve the collection of individually identifiable personal data by the contractor, the Contracting Officer shall include provisions to protect the confidentiality of the records and the privacy of individuals identified in the records.
[74 FR 62398, Nov. 27, 2009, as amended at 75 FR 21511, Apr. 26, 2010]
