Effective Date: 12/01/2026
HHSAR Text Baseline is 48 CFR Chapter 3 as of July 29, 2026.
Changes to baseline shown as [bolded, bracketed additions] and strikethrough deletions.
For HHSAR part 352, only the provisions and clauses associated with part 324 are shown.
HHSAR PART 324 – PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION [(RFO DEVIATION)]
Subpart 324.1 – Protection of Individual Privacy
324.103 Procedures for the Privacy Act.324.104 Restrictions on Contractor Access to Government or Third Party Information.324.105 Contract clauses.
[Subpart 324.2 – Freedom of Information Act
324.203 Policy.]
Subpart 324.70 – Health Insurance Portability and Accountability Act of 1996 [Requirements]
324.7000 Scope of subpart.
324.7001 Policy on Compliance with HIPAA business associate contract requirements.
Subpart 324.1 – Protection of Individual Privacy
324.103 Procedures for the Privacy Act.
(a) The contracting officer shall review all acquisition request documentation to determine whether the requirements of the Privacy Act of 1974 (5 U.S.C. 552a) are applicable. The Privacy Act requirements apply when a contract or order requires the contractor to design, develop, or operate any Privacy Act system of records on individuals to accomplish an agency function. When applicable, the contracting officer shall include the two Privacy Act clauses required by Federal Acquisition Regulation (FAR) 24.104 in the solicitation and contract or order. In addition, the contracting officer shall include the two FAR Privacy Act clauses, and other pertinent information specified in this subpart, in any modification which results in the Privacy Act requirements becoming applicable to a contract or order.
(b) The contracting officer shall ensure that the statement of work or performance work statement (SOW or PWS) specifies the system(s) of records or proposed system(s) of records to which the Privacy Act and the implementing regulations are applicable or may be applicable. The contracting officer shall send the contractor a copy of 45 CFR part 5b, which includes the rules of conduct and other Privacy Act requirements.
[(2) HHS implements the Privacy Act of 1974 at 45 CFR part 5b, Privacy Act Regulations. Additional information is available at https://www.hhs.gov/privacy/index.html.]
(c) The contracting officer shall ensure that the contract SOW or PWS specifies for both the Privacy Act and the Federal Records Act the disposition to be made of the system(s) of records upon completion of contract performance. The contract SOW or PWS may require the contractor to destroy the records, remove personal identifiers, or turn the records over to the contracting officer. If there is a legitimate need for a contractor to keep copies of the records after completion of a contract, the contractor must take measures, as approved by the contracting officer, to keep the records confidential and protect the individuals' privacy.
(d) For any acquisition subject to Privacy Act requirements, the requiring activity prior to award shall prepare and have published in the Federal Register a “system notice,” describing the Department of Health and Human Services' (HHS) intent to establish a new system of records on individuals, to make modifications to an existing system, or to disclose information in regard to an existing system. The requiring activity shall attach a copy of the system notice to the acquisition plan or other acquisition request documentation. If a system notice is not attached, the contracting officer shall inquire about its status and shall obtain a copy from the requiring activity for inclusion in the contract file. If a notice for the system of records has not been published in the Federal Register, the contracting officer may proceed with the acquisition but shall not award the contract until the system notice is published and the contracting officer verifies its publication.
324.104 Restrictions on Contractor Access to Government or Third Party Information.
The contracting officer shall establish the restrictions that govern the contractor employees' access to Government or third party information in order to protect the information from unauthorized use or disclosure.
324.105 Contract clauses.
(a) The contracting officer shall insert the clause at 352.224-70, Privacy Act, in solicitations, contracts, and orders that require the design, development, or operation of a system of records to notify the contractor that it and its employees are subject to criminal penalties for violations of the Privacy Act (5 U.S.C. 552a(i)) to the same extent as HHS employees. The clause also requires the contractor to ensure each of its employees knows the prescribed rules of conduct in 45 CFR part 5b and each contractor employee is aware that he or she is subject to criminal penalties for violations of the Privacy Act. These requirements also apply to all subcontracts awarded under the contract or order that require the design, development, or operation of a system of records.
(b) The contracting officer shall insert the clause at 352.224-71, Confidential Information, in solicitations, contracts, and orders that require access to Government or to third party information.
[Subpart 324.2 – Freedom of Information Act
324.203 Policy.
(a) The HHS regulation implementing the Freedom of Information Act (FOIA), 5 U.S.C. 552, is set forth in 45 CFR part 5. Additional information is available at https://www.hhs.gov/foia/index.html.]
Subpart 324.70 – Health Insurance Portability and Accountability Act of 1996 [Requirements]
324.7000 Scope of subpart.
All individually identifiable health information that is [“p]Protected [h]Health [i]Information[”] (PHI), as defined in [at] 45 CFR 160.103 shall [must] be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) implementing regulations at 45 CFR parts 160 and 164 (the HIPAA Privacy, Security, and Breach Notification Rules). [Additional information is available at https://www.hhs.gov/hipaa/index.html.] The term “HIPAA” is used in this part to refer to title II, subtitle F of the HIPAA statute, at part C of title XI of the Social Security Act, 42 U.S.C. 1320d et seq., section 264 of HIPAA, subtitle D of title XIII of the American Recovery and Reinvestment Act of 2009, and regulations under such provisions.
324.7001 Policy on Compliance with HIPAA business associate contract requirements.
(a) HHS is a HIPAA “covered entity” that is a “hybrid entity” as these terms are defined at sections [45 CFR] 160.103 and 164.103[,] respectively. As such [Accordingly], only the portions of HHS that the Secretary has designated as “health care components” (HCC)[,] as defined at section [45 CFR] 164.103, are subject to HIPAA.
[(b)] HHS' HCCs may utilize [use] persons or entities known as “business associates,” as defined at section [45 CFR]160.103[, to carry out certain health care activities and functions or to provide certain services that involve the use or disclosure of PHI]. Generally, [a] “business associate” means a “person” as defined by section 160.103 [or entity] (including contractors, and third-party vendors, etc.) if or when the person or entity: [that—]
(1) Creates, receives, maintains, or transmits “protected health information”, as the term is defined at section 160.103, [PHI] on behalf of an HHS HCC to carry out HHS HIPAA “covered functions[,]” as that term is defined at [45 CFR] 164.103; or
(2) Provides certain services to an HHS HCC that involve PHI.
(b)[(c)] Where the Department [When HHS,] as a covered entity[,] is required by 45 CFR 164.502(e)(1) and 164.504(e) and, if applicable, sections [45 CFR] 164.308(b)(3) and 164.314(a), to enter into a HIPAA business associate contract, the relevant HCC contracting officer, acting on behalf of the Department, shall [must] ensure that such contract meets the requirements at section [45 CFR] 164.504(e)(2) and, if applicable, section [45 CFR] 164.314(a)(2).
HHSAR PART 352 - SOLICITATION PROVISIONS AND CONTRACT CLAUSES [(RFO DEVIATION)]
Subpart 352.2 – Texts of Provisions and Clauses
352.224-70 Privacy Act. [[Reserved]]
352.224-71 Confidential Information. [[Reserved]]
Subpart 352.2 – Texts of Provisions and Clauses
352.224-70 Privacy Act. [[Reserved]]
As prescribed in HHSAR 324.105(a), the Contracting Officer shall insert the following clause:
Privacy Act (DEC 2015) [(DEC 2026) (RFO DEVIATION)]
This contract requires the Contractor to perform one or more of the following: (a) Design; (b) develop; or (c) operate a Federal agency system of records to accomplish an agency function in accordance with the Privacy Act of 1974 (Act) (5 U.S.C. 552a(m)(1)) and applicable agency regulations.
The term system of records means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. Violations of the Act by the Contractor and/or its employees may result in the imposition of criminal penalties (5 U.S.C. 552a(i)).
The Contractor shall ensure that each of its employees knows the prescribed rules of conduct in 45 CFR part 5b and that each employee is aware that he/she is subject to criminal penalties for violation of the Act to the same extent as Department of Health and Human Services employees. These provisions also apply to all subcontracts the Contractor awards under this contract which require the design, development or operation of the designated system(s) of records (5 U.S.C. 552a(m)(1)). The contract work statement:
(a) Identifies the system(s) of records and the design, development, or operation work the Contractor is to perform; and
(b) Specifies the disposition to be made of such records upon completion of contract performance.
(End of clause)
352.224-71 Confidential Information. [[Reserved]]
As prescribed in HHSAR 324.105(b), insert the following clause:
Confidential Information (DEC 2015) [(DEC 2026) (RFO DEVIATION)]
(a) Confidential Information, as used in this clause, means information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization.
(b) Specific information or categories of information that the Government will furnish to the Contractor, or that the Contractor is expected to generate, which are confidential may be identified elsewhere in this contract. The Contracting Officer may modify this contract to identify Confidential Information from time to time during performance.
(c) Confidential Information or records shall not be disclosed by the Contractor until:
(1) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to release findings of studies or research, to which an agency response may be appropriate to protect the public interest or that of the agency.
(2) For information provided by or on behalf of the government,
(i) The publication or dissemination of the following types of information are restricted under this contract: [INSERT RESTRICTED TYPES OF INFORMATION. IF NONE, SO STATE.]
(ii) The reason(s) for restricting the types of information identified in subparagraph (i) is/are: [STATE WHY THE PUBLIC OR GOVERNMENT INTEREST REQUIRES THE RESTRICTION OF EACH TYPE OF INFORMATION. ANY BASIS FOR NONDISCLOSURE WHICH WOULD BE VALID UNDER THE FREEDOM OF INFORMATION ACT IS SUFFICIENT UNDER THIS CLAUSE.]
(iii) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to disseminate or publish information identified in subparagraph (2)(i). The contractor shall not disseminate or publish such information without the written consent of the Contracting Officer.
(d) Whenever the Contractor is uncertain with regard to the confidentiality of or a property interest in information under this contract, the Contractor should consult with the Contracting Officer prior to any release, disclosure, dissemination, or publication.