Personnel, medical, and similar files, disclosure of which constitutes a clearly unwarranted invasion of personal privacy.
21 C.F.R. § 20.63
in effectEffective: 2024-07-01(a) The names or other information which would identify patients or research subjects in any medical or similar report, test, study, or other research project shall be deleted before the record is made available for public disclosure.
(b) The names and other information which would identify patients or research subjects should be deleted from any record before it is submitted to the Food and Drug Administration. If the Food and Drug Administration subsequently needs the names of such individuals, a separate request will be made.
(c) Requests for deletion of business or product names prior to disclosure of any record to the public shall not be granted on the ground of privacy, but such deletion may be justified under another exemption established in this subpart, e.g., the exemption for trade secrets and confidential commercial or financial information under § 20.61.
(d) Names of individuals conducting investigations, studies, or tests on products or ingredients shall not be deleted prior to disclosure of any record to the public unless extraordinary circumstances are shown.
(e) A request for all records relating to a specific individual will be denied as a clearly unwarranted invasion of personal privacy unless accompanied by the written consent of the individual named.
(f) The names and any information that would identify the voluntary reporter or any other person associated with an adverse event involving a human drug, biologic, or medical device product shall not be disclosed by the Food and Drug Administration or by a manufacturer in possession of such reports in response to a request, demand, or order. Information that would identify the voluntary reporter or persons identified in the report includes, but is not limited to, the name, address, institution, or any other information that would lead to the identities of the reporter or persons identified in a report. This provision does not affect disclosure of the identities of reporters required by a Federal statute or regulation to make adverse event reports. Disclosure of the identities of such reporters is governed by the applicable Federal statutes and regulations.
(1) Exceptions. (i) Identities may be disclosed if both the voluntary reporter and the person identified in an adverse event report or that person's legal representative consent in writing to disclosure, but neither FDA nor any manufacturer in possession of such reports shall be required to seek consent for disclosure from the voluntary reporter or the person identified in the adverse event report or that person's legal representative; or
(ii) Identities of the voluntary reporter and the person who experienced the reported adverse event may be disclosed pursuant to a court order in the course of medical malpractice litigation involving both parties; or (iii) The report, excluding the identities of any other individuals, shall be disclosed to the person who is the subject of the report upon request.
(2) Preemption. No State or local governing entity shall establish or continue in effect any law, rule, regulation, or other requirement that permits or requires disclosure of the identities of the voluntary reporter or other person identified in an adverse event report except as provided in this section.
Source: eCFRURL: https://www.ecfr.gov/api/versioner/v1/full/2024-07-01/title-21.xmlFetched: 7/26/2026