1.75D301-26-R-73374 December 11.docx

This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with part 12. This announcement constitutes the only solicitation. Offers are being requested and a separate written solicitation will not be issued.

The solicitation number for this requirement is 75D301-26-R-73374 and is hereby issued as a Request for Proposal (RFP).

This acquisition is not set-aside for small business concerns. This solicitation incorporates provisions and clauses by reference. The full text of provisions and clauses may be accessed electronically at www.acquisition.gov.

The Centers for Disease Control and Prevention intend to award a hybrid (firm-fixed-price, time and materials) contract for the World Trade Center Health Program National Program Administrator in accordance with solicitation Section E – World Trade Center Program National Program Administrator Performance Work Statement.

See Section B- Schedule of the solicitation for pricing information.

For a list of applicable contract clauses and provisions see Section C, F, and Section G of the solicitation to follow.

For detailed proposal preparation instructions and basis of evaluation see Section H & I.

Questions regarding this solicitation must be submitted via email and received by both Megan Kelly at xvp9@cdc.gov AND Liubov Kriel at vyh1@cdc.gov on or before 10:00 am EST, Monday, January 5, 2026. Please submit questions in accordance with the template provided in ATT025_NPA_QuestionsandAnswersTemplate found in Section D.

Proposals must be submitted via email and received by the undersigned by 10:00 am EST, January 30, 2026.

When submitting your proposal, please include in the Subject Line: Solicitation #75D301-26-R-73374.

PoC for this requirement is:

Megan Kelly 404-498-4805 Xvp9@cdc.gov

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER

PAGE 2 OF

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NUMBER

5. SOLICITATION NUMBER

75D301-26-R-73374

6. SOLICITATION ISSUE DATE

12/11/2025

Megan Kelly

b. TELEPHONE NUMBER (No collect calls) 440-498-4805

8. OFFER DUE DATE/ LOCAL TIME

1/30/2026

9. ISSUED BY11. DELIVERY FOR FOB

DESTINATION UNLESS

BLOCK IS MARKED

12. DISCOUNT TERMS

Centers for Disease Control and Prevention Chamblee Campus Building 108 4770 Buford Hwy Chamblee, GA 30341

X UNRESTRICTED

SET ASIDE: % FOR

SIC:

SIZE STANDARD:

X SEE SCHEDULE

13a. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB X RFP

Centers for Disease Control and Prevention Chamblee Campus Building 108 4770 Buford Hwy Chamblee, GA 30341

Centers for Disease Control and Prevention Chamblee Campus Building 102, MS S102-4 4770 Buford Hwy Atlanta, GA 30341-3717

Centers for Disease Control and Prevention (FMO) PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFERIS CHECKED

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

See Section B

(Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

X 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE X ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE X ARE NOT ATTACHED.

28.

AWARD OF CONTRACT: REFERENCE OFFER

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED

41a. I CERTIFY THIS AMOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print) 42b. RECEIVED AT (Location)

TABLE OF CONTENTS

Points of Contact:

Contracting Officer: Megan Kelly, xvp9@cdc.gov, 404-498-4805 Contracting Officer: Liubov Kriel, vyh1@cdc.gov, 770-488-2856

SECTION B - Schedule

Base Period: March 18, 2026 – March 17,2027

The contractor shall provide services as described in Section E, the Performance Work Statement

Months 1-8: PWS Transition-In Sections 4.1.1 through 4.1.4

Months 9-12: PWS Handover Section 4.1.5

See B.1 Payment Schedule

Non- Severable Services Firm-Fixed-Price March 18, 2026 to March 17, 2027

The contractor shall provide Sustainment services as described in Section E, the Performance Work Statement.

PWS Section:

4.2 through 4.6

Severable Services November 18, 2026 to March 17, 2027 Times & Materials

All travel in accordance with Federal Travel Regulation

March 18, 2026 to March 17, 2027

All travel expenses require prior written approval from the COR

Time and Materials

Base Period Total: $__________

Option Period 1: March 18, 2027 – March 17, 2028

The contractor shall provide Sustainment services as described in Section E, the Performance Work Statement.

PWS Section:

4.2 through 4.6

Severable Services March 18, 2027 to March 17, 2028 Times & Materials

All travel will be in accordance with the Federal Travel Regulation.

March 18, 2027 to March 17, 2028

All travel expenses require prior written approval from the COR

Time and Materials

Option Period 1 Total:

Option Period 2: March 18, 2028 – March 17, 2029

The contractor shall provide Sustainment services as described in Section E, the Performance Work Statement.

PWS Section:

4.2 through 4.6

Severable Services March 18, 2028 to March 17, 2029 Times & Materials

All travel will be in accordance with the Federal Travel Regulation.

March 18, 2028 to March 17, 2029

All travel expenses require prior written approval from the COR

Time and Materials

Option Period 2 Total:

Option Period 3: March 18, 2029 – March 17, 2030

The contractor shall provide Sustainment services as described in Section E, the Performance Work Statement.

PWS Section:

4.2 through 4.6

Severable Services March 18, 2029 to March 17, 2030 Times & Materials

All travel will be in accordance with the Federal Travel Regulation

March 18, 2029 to March 17, 2030

All travel expenses require prior written approval from the COR

Time and Materials

Option Period 3 Total:

Option Period 4: March 18, 2030 – March 17, 2031

ITEM

The contractor shall provide Sustainment services as described in Section E, the Performance Work Statement.

PWS Section:

4.2 through 4.6

Severable Services March 18, 2030 to March 17, 2031 Times & Materials

All travel will be in accordance with the Federal Travel Regulation.

March 18, 2030 to March 17, 2031

All travel expenses require prior written approval from the COR

Time and Materials

The contractor shall provide the services as described in Section E, the Performance Work Statement

Transition Out Tasks Include: Section 4.5

See Payment Schedule

Non-Severable Services Firm-Fixed-Price March18, 2030 to March 17, 2031

Option Period 4 Total:

Solicitation: 75D301-26-R-73374

Base Year Value:

Option Period 1 Value:

Option Period 2 Value:

Option Period 3 Value:

Option Period 4 Value:

Total Contract Value:

B.1 Payment Schedule

Milestone Payment Schedule for Firm-Fixed-Price CLINs, CLIN 0001 & 4003, ONLY The contractor is invited to propose a Milestone Payment Schedule for CLINs 0001 and 4003, along with its proposed payment percentage allocations for each scheduled payment below based upon your total proposed price for each CLIN 0001 and 4005. Milestones should be tied to the completion of specific, measurable deliverables that provide identifiable benefit to the Government, rather than simply dividing the 12-month period of performance into monthly increments. During negotiations, CDC may suggest alternative milestones and payment percentages. The final Milestone Payment Schedule will be negotiated and incorporated into the award.

Example Payment Schedule -

CLIN 0001: March 18, 2026 – March 17,2027

Milestone 1 –

Milestone 2 –

Milestone 3 –

Milestone 4 –

Total

CLIN 4005: March 18, 2030 – March 17, 2031

Milestone 1 –

Milestone 2 –

Milestone 3 –

Milestone 4 –

Total

B.2 Level of Effort/Labor Categories and ODCs

To be included within the Offeror’s Volume II Business Proposal. Information will form the basis of invoicing for T&M CLINs.

ATTACHMENT ATT024

FULLY BURDENED LABOR RATES

TO BE INCLUDED AS PART OF VOLUME II – BUSINESS PROPSAL

The following labor categories and labor rates shall be used for all CLINs issued under this contract.

Estimated hours & FIXED hourly rates are as follows:

Base Period: Performance Period: 03/18/2026-03/17/2027

Option Period 1 Period: Performance Period: 03/18/2027-03/17/2028

Option Period 2 Period: Performance Period: 03/18/2028-03/17/2029

Option Period 3 Period: Performance Period: 03/18/2029-03/17/2030

Option Period 4 Period: Performance Period: 03/18/2030-03/17/2031

NOTATION REGARDING LABOR HOUR VARIANCE: Performance under this Time and Materials Contract is in accordance with FAR 52.232-7, “Payments under Time and Materials and Labor Hour Contracts,” incorporated by reference in Section C, which requires the vendor to manage to the ceiling price in the contract and the ceiling price of the line items. The number of hours per labor category are estimates. The COR must be notified of any variance from the estimated hours shown in the Level of Effort/Labor Categories chart. If the variance in hours for a specific labor category line in the Level of Effort/Labor Categories chart above is 10% or more, the Contracting Officer must be notified.

SECTION C - CONTRACT CLAUSES

FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/

HHSAR 352.231-70,[footnoteRef:1] [1: See https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/salary-rate-limitation/index.html for guidance on the application of this clause.]

Salary Rate Limitation (DEC 2015)

FAR clauses incorporated in full text:

Addendum to FAR 52.212-4 and FAR 52.212-4 Alt I

Paragraph (s) of FAR 52.212-4 and FAR 52.212-4 Alt I is revised as shown below in the [emphasized text]:

(s) Order of precedence. Any inconsistencies in this solicitation or contract shall be resolved by giving precedence in the following order:

(1) The schedule of supplies/services.

(2) The Assignments, Disputes, Payments, Invoice, Other Compliances, Compliance with Laws Unique to Government Contracts, and Unauthorized Obligations paragraphs of this clause;

(3) Addenda to this solicitation or contract, including any license agreements for computer software.

(4) Solicitation provisions if this is a solicitation.

(5) Other paragraphs of this clause.

(6) The Standard Form 1449.

(7) Other documents, exhibits, and attachments. [The following order of precedence applies to this contract: The Performance Work Statement, followed by, in order of most recent publication date, the Technical Guidance Documents, Program Administrative Manual, other attachments in Section D and all other Program materials.]

(8) The specification.

FAR 52.217-8 Option to Extend Services (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 60 days of expiration of contract.

(End of clause)

FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 15 days of expiration of term; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed five years.

(End of clause) 52.222-42 Statement of Equivalent Rates for Federal Hires. (MAY 2014) In compliance with the Service Contract Labor Standards statute and the regulations of the Secretary of Labor ( 29 CFR Part 4), this clause identifies the classes of service employees expected to be employed under the contract and states the wages and fringe benefits payable to each if they were employed by the contracting agency subject to the provisions of 5 U.S.C.5341 or 5332.

This Statement is for Information Only: It is not a Wage Determination

(End of Clause) FAR 52.223-23 Sustainable Products and Services (MAY 2024) [(DEVIATION FEB 2025)]

(a) Definitions. As used in this clause—

Biobased product means a product determined by the U.S. Department of Agriculture (USDA) to be a commercial product or industrial product (other than food or feed) that is composed, in whole or in significant part, of biological products, including renewable domestic agricultural materials and forestry materials, or that is an intermediate ingredient or feedstock. The term includes, with respect to forestry materials, forest products that meet biobased content requirements, notwithstanding the market share the product holds, the age of the product, or whether the market for the product is new or emerging. (7 U.S.C. 8101) (7 CFR part 4270.2).

Recovered material means waste materials and by-products recovered or diverted from solid waste, but the term does not include those materials and by-products generated from, and commonly reused within, an original manufacturing process. ( 42 U.S.C. 6903).

Sustainable products and services means:

(1) Products containing recovered material designated by the U.S. Environmental Protection Agency (EPA) under the Comprehensive Procurement Guidelines (42 U.S.C. 6962) (40 CFR part 247) (https://www.epa.gov/smm/comprehensive-procurement-guideline-cpg-program#products).

(2) Energy- and water-efficient products that are ENERGY STAR® certified or Federal Energy Management Program (FEMP)-designated products ( 42 U.S.C. 8259b) (10 CFR part 436, subpart C) (https://www.energy.gov/eere/femp/search-energy-efficient-products and https://www.energystar.gov/products?s=mega).

(3) Biobased products meeting the content requirement of the USDA under the BioPreferred® program (7 U.S.C. 8101) (7 CFR part 4270.2) (https://www.biopreferred.gov).

(4) Acceptable chemicals, products, and manufacturing processes listed under EPA's Significant New Alternatives Policy (SNAP) program, which ensures a safe and smooth transition away from substances that contribute to the depletion of stratospheric ozone ( 42 U.S.C. 7671l) ( 40 CFR part 82, subpart G) (https://www.epa.gov/snap).

(b) Requirements.

(1) The sustainable products and services, including the purchasing program and type of product or service, that are applicable to this contract, and any products or services that are not subject to this clause, will be set forth in the statement of work or elsewhere in the contract.

(2) The Contractor shall ensure that the sustainable products and services required by this contract are—

(i) Delivered to the Government;

(ii) Furnished for use by the Government;

(iii) Incorporated into the construction of a public building or public work; and

(iv) Furnished for use in performing services under this contract, where the cost of the products is a direct cost to this contract (versus costs which are normally applied to the Contractor's general and administrative expenses or indirect costs). This includes services performed by contractors performing management and operation of Government-owned facilities to the same extent that, at the time of award, an agency would be required to comply if an agency operated or supported the facility.

(c) Resource. The Green Procurement Compilation (GPC) available at https://sftool.gov/greenprocurement provides a comprehensive list of sustainable products and services and sustainable acquisition guidance. The Contractor should review the GPC when determining which statutory purchasing programs apply to a specific product or service.

(End of clause)

HHSAR 352.204-71 Information and Information Systems Security (FEB 2024) (DEVIATION)

(a) Definitions. As used in this clause—

Breach means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where—

(1) A person other than an authorized user accesses or potentially accesses personally identifiable information, or

(2) An authorized user accesses personally identifiable information for an other than authorized purpose.

Business associate (see 45 CFR 160.103), except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person who -

(1) On behalf of such covered entity or of an organized health care arrangement (as defined in this clause) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this contract or agreement, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or

(2) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in 45 CFR section 164.501), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.

(3) A covered entity may be a business associate of another covered entity.

(4) Business associate includes the following:

(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

(5) Business associate does not include:

(i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.

(ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of 45 CFR 164.504(f) apply and are met.

(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.

(iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.

Business associate agreement means the agreement, or other arrangement, as dictated by the HIPAA Privacy Rule (45 CFR 160), between an HHS covered entity and a business associate, which must be entered into in addition to the underlying contract for services and before any disclosure (see 45 CFR 160.103) of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of an HHS entity.

Controlled unclassified information (CUI) means information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.

Healthcare component means a component or combination of components of a hybrid entity designated by the hybrid entity in accordance with 45 CFR 164.105(a)(2)(iii)(D) (see 45 CFR 164.103). The Secretary of HHS has designated HHS as a covered entity (further designated as a “hybrid entity”), and has also designated four HHS divisions as healthcare components under HIPAA, including —

(1) The Centers for Medicare and Medicaid Services (CMS), insofar as it operates the fee-for-service Medicare program;

(2) The Program Support Center (PSC), Division of Commissioned Personnel, insofar as it operates a health plan for Commissioned Corps officers;

(3) The World Trade Center (WTC) Health Program; and,

(4) The Indian Health Service (IHS), insofar as it operates a health plan and a program providing healthcare that uses electronic transactions.

HHS Information Technology General Rules of Behavior means a set of HHS rules that describes the responsibilities and expected behavior of users of HHS information or information systems.

HHS sensitive information means all HHS data, on any storage media or in any form or format, which requires confidentiality, integrity, and availability protection due to the risk of harm that could result to interests of HHS, other agencies or entities, or individuals from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes—

(1) Information where the improper use or disclosure could adversely affect the ability of HHS to accomplish its mission, i.e., HHS proprietary information;

(2) Records about individuals requiring protection under laws and regulations such as the E-Government Act, Privacy Act and the HIPAA Privacy Rule, or based on a data use agreement or a promise or assurance of confidentiality; and

(3) Information that would be exempt from disclosure if requested under the Freedom of Information Act. Examples of HHS sensitive information include—

(i) Individually-identifiable medical, benefits, and personnel information;

(ii) Financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, security-sensitive, procurement-sensitive, investigatory, and law enforcement information;

(iii) Controlled unclassified information;

(iv) Information that would be confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and

(v) Other information which, if released, could result in a violation of law or agreement, could cause harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and part 164.

Incident means an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information systems; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable policies.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Information system security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

Information technology (see FAR 2.101) also means Information and Communication Technology (ICT).

Information technology-related contracts means those contracts that include services (including support services), and related resources for information technology.

Organized health care arrangement (see 45 CFR 160.103) means:

(1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider.

(2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities:

(i) Hold themselves out to the public as participating in a joint arrangement; and

(ii) Participate in joint activities that include at least one of the following:

(A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;

(B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or

(C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.

(3) A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;

(4) A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or

(5) The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.

Privacy officer means the HHS official(s) with responsibility for implementing and oversight of privacy related policies and practices that impact a given HHS acquisition.

(b) General. Contractors, subcontractors, their employees, third-parties, and business associates with access to HHS information, information systems, or information technology (IT) or providing and accessing IT-related goods and services, shall adhere to the HHS Cybersecurity Program and the directives and handbooks, complete HHS security training prior to accessing HHS information (including HHS sensitive information and information systems security and privacy) and on an annual basis thereafter, as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, HHS Personnel Security and Suitability Program, which establishes HHS procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards, and guidance for protecting HHS information, information systems (see 302.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing HHS information or information systems.

(c) Access to HHS information and HHS information systems.

(1) Contractors are limited in their request for logical or physical access to HHS information or HHS information systems for their employees, subcontractors, third parties and business associates to the extent necessary to perform the services or provide the goods as specified in the contracts, agreements, task, delivery, or purchase orders.

(2) All Contractors, subcontractors, third parties, and business associates working with HHS information are subject to the same investigative requirements as those of HHS appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors to access HHS information and HHS information systems shall be in accordance with HHS Personnel Security and Suitability Program.

(3) Contractors, subcontractors, third parties, and business associates who require access to national security programs must have a valid security clearance.

(4) The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be –

(i) Marked appropriately;

(ii) Disclosed to authorized personnel on a need-to-know basis;

(iii) Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

(iv) Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

(5) HIPAA business associate agreements. Under the HIPAA Privacy and Security Rules (see 45 CFR 164), pursuant to 45 CFR 164.502(e)(1), a covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor of a covered entity’s business associate. Additionally, a business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information. The satisfactory assurances required by 45 CFR 45 CFR 164.504(e)(1) of this section shall be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of 45 CFR 164.504(e). The contracts shall also include breach reporting policies and procedures for suspected or confirmed breaches of protected health information. The contract shall impose a duty to cooperate with the healthcare component and/or HHS breach investigation and response and must require all subcontractors to comply with the same HIPAA Rules requirements as a condition of receiving government data.

(i) Contractors or entities required to execute business associate agreements for contracts and other agreements become HHS business associates. Business associate agreements are issued by HHS or may be issued by other HHS programs in support of HHS. The HIPAA Privacy Rule requires HHS to execute compliant business associate agreements with persons or entities that create, receive, maintain, or transmit HHS PHI or that will store, generate, access, exchange, process, or utilize such PHI in order to perform certain activities, functions or services to, for, or on behalf of HHS. There may be other HHS components or staff offices which also provide certain services and support to HHS and must receive PHI in order to do so. If these components award contracts or enter into other agreements, purchase/delivery orders, modifications and issue governmentwide purchase card transactions to help in the delivery of these services to HHS, they will also fall within the requirement to obtain a satisfactory assurance from these contractors by executing a business associate agreements.

(ii) Business associate agreement flow down to subcontractors. A prime contractor required to execute a business associate agreement shall also obtain a satisfactory assurance, in the form of a business associate agreement, of its subcontractors who will also create, receive, maintain, or transmit PHI or that will store, generate, access, exchange, process, or utilize such PHI will comply with HIPAA Rules requirements to the same degree as the Contractor. A contractor employing a subcontractor who creates, receives, maintains, or transmits PHI or that will store, generate, access, exchange, process, or utilize such PHI under a contract or agreement is required to execute a business associate agreement with each of its subcontractors which also obligates the subcontractor (i.e., also a business associate) to provide the same protections and safeguards and agree to the same disclosure restrictions to PHI that is required of the covered entity and the prime contractor.

(d) Contractor operations required to be in United States. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practicable. If such services are proposed to be performed outside the continental United States, and are not otherwise disallowed by other Federal law, regulations or policy, or other HHS policy or other mandates as stated in the contract, specifications, statement of work or performance work statement (including applicable business associate agreements), the Contractor/subcontractor must state in its proposal where all non-U.S. services are provided. At a minimum, the Contractor/subcontractor must include a detailed Information System Security Plan, for review and approval by the Contracting Officer, specifically to address mitigation of the resulting problems of communication, control, and data protection.

(e) Roster of employees. Contractors and subcontractors shall provide a roster containing the name, position, e-mail address, phone number, and responsibilities of each employee, including subcontractors, performing work under the contract to develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to Contracting Officer by the effective date of the contract. Revisions to the roster as a result of staffing changes must be submitted within the number of days of the change provided by the Contracting Officer. The Contracting Officer, or the Contracting Officer’s Representative (COR), will notify the Contractor of the appropriate level of investigation required for each staff member based on the information provided on the roster. If an employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

(f) Contractor/subcontractor employee reassignment and termination notification. Contractors and subcontractors shall provide written notification to the Contracting Officer and COR immediately, and not later than four (4) hours, when an employee working on an HHS information system or with access to HHS information is reassigned or leaves the Contractor or subcontractor's employment on the cognizant HHS contract. The Contracting Officer and COR must also be notified immediately by the Contractor or subcontractor prior to an unfriendly termination.

(g) Non-disclosure agreement. The Contractor and subcontractors shall submit completed non-disclosure agreements, as provided by the Contracting Officer, for each employee having access to non-public government information under this contract. The non-disclosure agreements shall be submitted to the Contracting Officer prior to the performance of work.

(h) HHS information custodial requirements.

(1) Release, publication, and use of data. Information made available to a Contractor or subcontractor by HHS for the performance or administration of a contract or information developed by the Contractor/subcontractor in performance or administration of a contract shall be used only for the stated contract purpose and shall not be used in any other way without HHS prior written approval. This clause expressly limits the Contractor’s/subcontractor's rights to use data as described in 52.227-14, Rights in Data—General, paragraph (d).

(2) Media sanitization. HHS information shall not be co-mingled with any other data on the Contractors/subcontractor’s information systems or media storage systems in order to ensure federal and HHS requirements related to data protection, information segregation, classification requirements, and media sanitization can be met (see HHS Cybersecurity Program). HHS reserves the right to conduct scheduled or unscheduled on- site inspections, assessments, or audits of Contractor and subcontractor IT resources, information systems and assets to ensure data security and privacy controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with Federal and HHS requirements. The Contractor and subcontractor will provide all necessary access and support to HHS and/or GAO staff during periodic control assessments or audits.

(3) Data retention, destruction and contractor self-certification. The Contactor and its subcontractors are responsible for collecting and destroying any HHS data provided, created, or stored under the terms of this contract, to a point where HHS data or materials are no longer readable or reconstructable to any degree, in accordance with NIST SP 800- 88, Guidelines for Media Sanitization, or subsequent directive. Prior to termination or completion of this contract, the Contractor/subcontractor must provide its plan for destruction or return of all HHS data in its possession accordance with contract requirements or Contracting Officer instructions for disposition, including compliance with National Institute of Standards and Technology (NIST) SP 800-88, Guidelines for Media Sanitization, for the purposes of media sanitization on all IT equipment. The Contractor must certify in writing to the Contracting Officer within 30 days of termination of the contract that the data destruction requirements in this paragraph have been met.

(4) Return of HHS data and information. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to the HHS (as stipulated by the Contracting Officer or the COR) or the Contractor/subcontractor must hold it until otherwise directed. Items returned will be hand carried, securely mailed, emailed, or securely electronically transmitted to the Contracting Officer or to the address as provided in the contract or by the assigned COR, and/or accompanying business associate agreement. Depending on the method of return, Contractor/subcontractor must store, transport, or transmit HHS sensitive information, when permitted by the contract using HHS-approved encryption tools that are, at a minimum, validated under Federal Information Processing Standards (FIPS) 140-3 (or its successor). If mailed, Contractor/subcontractor must send via a trackable method (USPS, UPS, Federal Express, etc.) and immediately provide the Contracting Officer with the tracking information. No information, data, documentary material, records or equipment will be destroyed unless done in accordance with the terms of this contract and the HHS Agency Records Control Schedules (2019).

(5) Use of HHS data and information. The Contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of HHS information only in compliance with the terms of the contract and applicable Federal and HHS information confidentiality and security laws, regulations, and policies. If Federal or HHS information confidentiality and security laws, regulations, and policies become applicable to the HHS information or information systems after execution of the contract, or if the NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies for this contract as a result of any updates, if required.

(6) Copying HHS data or information. The Contractor/subcontractor shall not make copies of HHS information except as authorized and necessary to perform the terms of the contract or to preserve electronic information stored on Contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

(7) Violation of information custodial requirements. If HHS determines that the Contractor has violated any of HHS information confidentiality, privacy, or security provisions, it shall be sufficient grounds for HHS to withhold payment to the Contractor or third-party or terminate the contract for default in accordance with FAR part 49 or terminate for cause in accordance with FAR 12.403.

(8) Encryption. The Contractor/subcontractor must store, transport, or transmit HHS sensitive information, when permitted by the contract, using cryptography, HHS encryption policies, and HHS-approved encryption tools that are, at a minimum, validated under FIPS 140-3 (or its successor).

(9) Firewall and web services security controls. The Contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed HHS minimum requirements. HHS Configuration Standards Guidelines are available upon request.

(10) Disclosure of HHS data and information. Except for uses and disclosures of HHS information authorized in a cognizant contract for performance of the contract, the Contractor/subcontractor may use and disclose HHS information only in two other situations: (i) subject to paragraph 10 of this section, in response to a court order from a court of competent…