Attachment 6: IT Security and Privacy Clauses

Attachment 6

IT Security and Privacy Clauses
ARTICLE H.56.3. NOTIFICATION OF SYSTEM OF RECORDS NOTICE, HHSAR 352.224-70 (FEB 2024) (DEVIATION).
(a) This contract provides for the design, development, or operation of a system of records about individuals from which information about an individual is retrieved by the individual’s name or by some other identifying particular assigned to the individual. (b) The System of Records Notice(s) (SORN(s)) that is applicable to this contract is: SORN 0925-0200, 09-25-0099, and 09-25-0216. If there is no SORN, indicate that a new or revised SORN will be developed].
(c) The System of Records design, development, or operation work the Contractor is to perform is: contractor personnel may access and handle participant-level clinical research information, including demographic, clinical and medical, genetic and genomic, laboratory, study, and safety-related data, as applicable to the supported protocols. (d) The disposition to be made of the Privacy Act records upon completion of contract performance is as follows: Cut off annually at termination of project/program or when no longer needed for scientific reference, whichever is longer. Destroy seven (7) years after cutoff. (e) Subcontract flow down. The Contractor is required to include this clause in all subcontracts at any tier performing work under the prime contract involving design, development, or operation work involving a System of Records.
(End of clause).
NOTE: The SORN describing the types of information contained in the records, the legal authority for collecting and maintaining the records, how the records are used within HHS, and the purposes (referred to as "routine uses") for which HHS may disclose the records to non-HHS parties without the individual record subject's consent is found at: https://www.hhs.gov/foia/privacy/sorns/nihsorns.html. ARTICLE H.56.4. INFORMATION AND INFORMATION SYSTEMS SECURITY, HHSAR 352.204-71 (FEB 2024) (DEVIATION).
(a) Definitions. As used in this clause—
Breach means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where—
NIH ICO Information Security & Privacy Certification Checklist for Procurements (V2 Aug 2026) FORM Part D Attachment (V1 Aug 2026)

Attachment 6
(1) A person other than an authorized user accesses or potentially accesses personally identifiable information, or
(2) An authorized user accesses personally identifiable information for an other