21 CFR § 20.90 - Disclosure to contractors.

(a) Data and information otherwise exempt from public disclosure may be disclosed to contractors with the Food and Drug Administration and their employees for use only in their work for the Food and Drug Administration. Contractors and their employees are thereafter subject to the same legal restrictions and penalties with respect to the disclosure of such data and information as Food and Drug Administration employees.

(b) A written agreement between the Food and Drug Administration and any contractor shall be entered into before data and information otherwise exempt from public disclosure may be disclosed to the contractor. The contractor shall agree to establish and follow security precautions considered by the Food and Drug Administration to be necessary to ensure proper and confidential handling of the data and information. The written agreement shall include, where appropriate, provisions establishing:

(1) Restrictions on access to the data and information by the contractor, its employees, or other persons;

(2) Physical storage requirements;

(3) Requirements for the handling and accountability of the data and information by the contractor and its employees;

(4) Limitations on reproduction, transmission, and disclosure of the data and information;

(5) A requirement of advance approval by the Food and Drug Administration of the use by the contractor of subcontractors, vendors, or suppliers;

(6) Procedures to be followed when the contractor employs time-shared computer operations;

(7) Methods of destroying source documents or related waste material; and

(8) The period during which the contractor may retain such data and information.