Letter to The Honorable Margaret A. Hamburg, M.D., Commissioner, Food and Drug Administration

Letter

Sen. Chuck Grassley of Iowa is asking the Food and Drug Administration to explain a purchase order with a contractor certifying that 80,000 pages of employee communications posted online did not contain sensitive or personally identifiable information.

"The documents contained screen shots of employees' personal email and their email addresses," Grassley said. "That's personally identifiable information by common-sense standards, and it's protected by the Privacy Act. It appears the purchase order certifying there was no personally identifiable information was incorrect, and the FDA needs to account for that."

Grassley is investigating the FDA's email surveillance of a group of whistleblowers who are concerned about the safety and effectiveness of certain medical devices. A government contractor, Quality Associates, Inc., and the FDA put 80,000 pages of documents related to the whistleblowers on the Internet in the process of archiving them, raising questions about violations of privacy protection laws.

Grassley wrote to FDA Commissioner Margaret A. Hamburg to seek an explanation of the purchase order. Last week, Grassley wrote to Hamburg, seeking information about the scope of the surveillance project and who exactly authorized it.

Grassley also wrote to other agencies, including the National Institutes of Health, that had documents made publicly available through the same contractor.

July 24, 2012

Via Electronic Transmission

The Honorable Margaret A. Hamburg
Commissioner
U.S. Food and Drug Administration
10903 New Hampshire Avenue
Silver Spring, MD, 20993

Dear Commissioner Hamburg:

The recent exposure of approximately 80,000 pages of protected whistleblower communications by U.S. Food and Drug Administration ("FDA") employees prompted my staff to look into the circumstances surrounding the release of the documents. Apparently, the FDA contracted with Quality Associates, Inc. to perform document management services, including the conversion of various files generated from spying on whistleblowers into portable document format ("PDF") with unique numbering on each page in anticipation of use in litigation. However, the documents were made available to the public through an unsecure File Transfer Protocol ("FTP") server operated by Quality Associates.

According to Quality Associates, the FDA files on its public FTP site were uploaded on May 3, 2012 and archived on May 9, 2012.1 Further, according to Quality Associates, FDA did not indicate that the documents were sensitive or that they contained personally identifiable information ("PII") under the Privacy Act. This claim appears to be supported by the official work order.2 Although it is dated May 23, 2012,3 two weeks after the work had already been done and two days after the "order" date listed on the Quality Associates invoice,4 the official work order also communicates to Quality Associates that the documents are not classified, not sensitive but unclassified ("SBU"), and do not contain PII.5

In order to fully understand how this document release occurred, please respond to the following questions and provide related documentation:

1. Please provide and describe all communications to Quality Associates regarding the file converting contract, DHHS\FDA work order 69308.

2. Prior to May 23, 2012, did FDA represent to Quality Associates that the files submitted for conversion contained no information that was classified, SBU, or PII? Please describe all communications with Quality Associates regarding the nature of the documents to be converted and provide all records relating to those communications.

3. Why was Quality Associates allowed to begin work without an authorizing work order? Was the work completed on a rush basis, and if so why?

4. Please explain the timeline as to when Quality Associates actually performed services for the federal government. More specifically, please clarify how Quality Associates claims that the files were uploaded on May 3, archived on May 9,6 the order was placed on May 21,7 and the work order was approved May 23.8

5. Who was responsible for initiating the work order eventually received by Quality Associates? Please provide the originating document(s).

6. Were there any additional employees, either within FDA, the Government Printing Office (GPO), or any other federal agency responsible for passing along the details of the Quality Associates work order? Please provide the information about the documents related to all of the steps required from the originating document until the purchase agreement is considered complete.

7. Who was responsible for preparing the "Simplified Purchase Agreement Work Order Form 4044" for Quality Associates' DHHS\FDA work order no. 69308? Where did that person obtain the information contained within the document?

8. Does the FDA still maintain that the documents provided to Quality Associates contain no information that is classified, SBU, or defined as PII under the Privacy Act?

9. What litigation was this document conversion being prepared for? Were the documents being prepared for production or merely for review in order to determine what would and would not be produced?

10. Quality Associates asserts that the original files were initially supplied on physical media to another contractor. What is the name of the other contractor?

11. How many files were contained on the physical media?

12. What was the total number of pages provided from Quality Associates to FDA following the conversion?

Thank you in advance for your prompt attention to these matters. Please answer the previous questions and provide the requested documentation August 3, 2012.
Should you have any questions, please contact Erika Smith of my staff at (202) 224-5225.

Sincerely,

Charles E. Grassley
Ranking Member

1 Letter from Paul Swidersky, President, CEO, Quality Assocs., Inc., to Senator Charles Grassley, July 17, 2012.
2 Simplified Purchase Agreement Work Order Form 4044, Work Order No. 69308, GPO, (Rev. Apr. 2010).
3 Id.
4 Invoice, No. 016000, QUALITY ASSOCS. INC. (June 4, 2012).
5 Simplified Purchase Agreement Work Order Form 4044, Work Order No. 69308, GPO, (Rev. Apr. 2010).
6 Letter from Paul Swidersky, President, CEO, Quality Assocs., Inc., to Senator Charles Grassley, July 17, 2012.
7 Invoice, No. 016000, QUALITY ASSOCS. INC. (June 4, 2012).
8 Simplified Purchase Agreement Work Order Form 4044, Work Order No. 69308, GPO, (Rev. Apr. 2010).

Source