45 CFR 5.4 - Relationship between the FOIA and the Privacy Act of 1974.
(a) Coverage. The FOIA and this rule apply to all HHS records. The Privacy Act, 5 U.S.C. 552a, applies to records that are about individuals, but only if the records are in a system of records. “Individuals” and “system of records” are defined in the Privacy Act and in our Privacy Act regulation, part 5b of this title.
(b) Requesting your own records. If you are an individual and request records, then to the extent you are requesting your own records in a system of records, we will handle your request under the Privacy Act and part 5b. If there is any record that we need not release to you under those provisions, we will also consider your request under the FOIA and this rule, and we will release the record to you if the FOIA requires it.
(c) Requesting another individual's record. Whether or not you are an individual, if you request records that are about an individual (other than yourself) and that are in a system of records, we will handle your request under the FOIA and this rule. (However, if our disclosure in response to your request would be permitted by the Privacy Act's disclosure provision, 5 U.S.C. 552a(b), for reasons other than the requirements of the FOIA, and if we decide to make the disclosure, then we will not handle your request under the FOIA and this rule. For example, when we make routine use disclosures pursuant to requests, we do not handle them under the FOIA and this rule. “Routine use” is defined in the Privacy Act and in part 5b). If we handle your request under the FOIA and this rule and the FOIA does not require releasing the record to you, then the Privacy Act may prohibit the release and remove our discretion to release.