26-SOL-IHS1524457.pdf

26-SOL-IHS1524457

ScriptPro Upgrade and Maintenance

1 | P a g e

SECTION A - Solicitation/Contract Form

A.1 TASK ORDER ACCEPTANCE

SOLICITATION NOTIFICATION AND SUBMISSION

The Government does not intend to incorporate quotes into the contract and requires that Quoters sign this page of the RFQ and must include this completed signature page with their submission in order to ensure their submission is binding and responsive to the solicitation. Should the Government decide to incorporate the Quoter’s submission as part of the contract; in the event of a discrepancy between the Contractor's submission including associated terms and any of the Government’s Contract/Task Order documents (such as the description of need, terms and conditions, etc.), the Government’s Contract and Task Order language take precedence.

Signature of the Contractor represents binding submission.

Signature Print Name/Title Date

A.2 TASK ORDER ACCEPTANCE

Pursuant to the terms and conditions of General Services Administration (GSA) Multiple Award Schedule (MAS) ***TBD (hereafter referred to as “contract”) and this Call Order *** TBD (hereafter referred to as “contract”), the contractor shall perform the work required in accordance with Section B.

Signature of the Contractor represents acceptance of this contract.

Signature Print Name/Title Date

NOTE: Only those contract sections which provide more detailed information specific to this particular contract are provided below. For those contract sections not identified below, all terms and conditions of the paraent Contract remain in effect.

2 | P a g e

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SUPPLIES

The Department of Health and Human Services (HHS) Indian Health Service (HIS) has a need for ScriptPro maintenance and support.

B.2 TYPE OF CONTRACT

The contract type awarded is a Firm Fixed Price (FFP) task order.

B.3 COMMERCIAL SERVICES

The services specified in this contract have been determined to be commercial.

B.4 SEVERABLE SERVICES

The services acquired under this contract are severable services. Funds are only available for use for the contract line item (CLIN) to which they are obligated. Unused funds from one CLIN may not rollover for use in other periods.

B.5 CONSIDERATION AND PAYMENT

Payment shall be made upon delivery and acceptance of the supplies required in accordance with the following payment schedule:

CLIN Period of Performance Total

CLIN 01 BASE PERIOD

09/30/2026 – 09/29/2027 $

TOTAL:$

3 | P a g e

B.6 PRICE TABLE

In consideration of satisfactory performance of the work as described throughout this contract, the Contractor shall be paid a fixed price as follows:

Period of Performance: 09/30/2026 – 09/29/2027

ITEM DESCRIPTION QTY UNIT PRICE EXTENDED PRICE

Customer Hard Drive Retention

HCI 1000 / HCI

2000 / Workflow Platform Server

Security Entitlement:

Customer Hard Drive Retention

HCI 1000 / HCI

2000 (per node) / Workflow Platform Server (per server)

1 $ $

Customer Hard Drive Retention Robotic Systems

Security Entitlement:

Customer Hard Drive Retention Robotic System (per robot)

1 $ $

ScriptPro Firewall Management

ScriptPro Firewall Management

1 $ $

Endpoint Security Management (per pharmacy)

Endpoint Security Management (per pharmacy)

1 $ $

Endpoint Security (per server/client computer)

Endpoint Security (per server computer, HCI VM, client computer)

9 $ $

SPX00/CRSX

Legacy CPU to i5C6 Computer, Windows 11, Peripherals On-Site Upgrade

Robot Upgrade:

Windows 11 Operating System, Legacy CPU to i5C6 Computer, and Peripherals On-Site Upgrade for SP X00 or CRSX

1 $ $

SP Datapoint or Client Upgrade: 6 $ $

4 | P a g e

Notice Board Factory Upgrade, i5C4 to i5C6, Windows 11

Windows 11 Operating System and i5C4 to i5C6 Computer Factory Upgrade for SP Datapoint or Notice Board

SPCE On-Site Upgrade, Server

OS 2019, SQL

Server Upgrade:

Windows 2019 Operating System and SQL 2019 Database Upgrade for the SP Central Expanded Server (includes both primary and secondary servers)

1 $ $

Customer Owned Equipment Uninstall

Customer owned ScriptPro equipment that will be uninstalled and support terminated, includes; (1) Virus Protection Platform, (3) SP Datapoint

4 $ $

TOTAL $

SECTION C - Description/Specifications

C.1. PURPOSE

The purpose of this Statement of Work (SOW) is to define the tasks, responsibilities, and requirements for continued maintenance, support, and modernization of the ScriptPro pharmacy system in support of patient care services. This combines ongoing maintenance services with a comprehensive operating system and infrastructure upgrade to ensure system reliability, cybersecurity compliance, and continuity of pharmacy operations.

C.2. BACKGROUND

The Pharmacy Department utilizes ScriptPro pharmacy automation equipment to support high-volume

5 | P a g e prescription fulfillment and patient safety. The department fills out approximately 1,000 prescriptions daily. Continued vendor maintenance is required to preserve equipment warranties, reduce medication errors, and ensure accurate National Drug Code (NDC) verification.

In addition, existing systems require upgrades to support operating systems and infrastructure to meet federal cybersecurity requirements, maintain vendor supportability, and ensure compatibility with ScriptPro automation software.

C.3. SCOPE OF WORK

This SOW applies to the terms stated in the ScriptPro contract and includes the following services:

A. Maintenance and Support Services

Perform preventive maintenance, emergency repairs, and safety inspections Provide required system updates and additional software updates as needed

B. Operating System and Infrastructure Upgrade Services

Upgrade pharmacy automation robotic systems to Windows 11–compatible operating systems and supported hardware configurations

Upgrade pharmacy automation servers to support Windows Server and database platforms Upgrade associated client devices (e.g., dispensing terminals, notice boards, kiosks, or equivalent) Perform required hardware upgrades, including BIOS updates, processors, memory, and solid-state drives (SSD) Provide on-site, factory, and/or remote installation and configuration services Ensure compatibility with existing pharmacy automation software and workflows Conduct system validation, testing, and verification following upgrades Implement required security controls, including endpoint protection, firewall management, encryption, and access controls Decommission or remove obsolete or unsupported components, as required

C.4. TASKS AND DELIVERABLES

Service Reporting Requirements Service reports shall be provided for all service activities and must include:

Name of Site Service Request (SR) Number Date and Time of Service Issue Reported By (if applicable) Product Problem Area (if applicable) Resolution (if applicable)

6 | P a g e

Serial Number serviced or replaced Signature of Pharmacy staff member who witnessed the service event (available upon request)

Service reports will be emailed upon completion of work to the Contracting Officer’s Representative (COR), Biomedical Engineering, or other designated personnel.

C.5. DUTIES AND RESPONSIBILITIES

Contractor Responsibilities The Contractor shall:

Provide qualified and experienced technical personnel Coordinate all maintenance and upgrade activities with Government-designated staff Perform work in a manner that minimizes disruption to pharmacy operations Ensure all systems are fully operational and supported upon completion Comply with all applicable federal IT, security, and privacy requirements

Government Responsibilities The Government shall:

Provide access to facilities, systems, and equipment as required Coordinate scheduling and system availability Designate a Contracting Officer’s Representative (COR) to oversee performance

C.6. CUSTOMER FURNISHED EQUIPMENT AND GOVERNMENT SUPPORT

The Government will provide:

System access in accordance with hospital policies Applicable procedures, guidelines, standards, and documentation Access to appropriate personnel necessary to fulfill contract requirements

C.7. SECURITY REQRUIREMENTS

The Contractor shall comply with all applicable federal information security requirements, including:

HHS and IHS IT security policies Federal Information Security Modernization Act (FISMA) Secure handling of Government systems and data Implementation of encryption, endpoint protection, firewall management, and access controls

SECURITY AND PRIVACY REQUIREMENTS

1.1. The contractor shall comply with HIPAA, FISMA, and IHS OIT cybersecurity requirements. All data generated through the Smartsheet platform shall remain the property of the U.S.

Government. No project-related data shall be stored or transferred outside of approved FedRAMP-authorized environments. The contractor will work with COR and GSU IT to ensure

7 | P a g e that all required security and privacy protocols are followed throughout the period of performance.

2. PRIVACY, INDEMNIFICATION AND GOVERNING LAW:

2.1. The contractor will comply with the following listed regulations:

2.1.1. - Privacy Act, 5 U.S.C. 552a - Office of Privacy and Civil Liberties | Privacy Act of 1974

2.1.2. Health Insurance Portability and Accountability Act (HIPAA) - eCFR :: 45 CFR Part 164 --

Security and Privacy

2.1.3. CFR 42 Part 2 - eCFR :: 42 CFR Part 2 -- Confidentiality of Substance Use Disorder

Patient Records

2.2. Indemnification, Liability, Statute of Limitations: Any provisions in the Terms of Service (TOS) related to indemnification and filing deadlines are hereby waived and shall not apply except to the extent expressly authorized by law. Liability for any breach of the TOS as modified by this amendment, or any claim arising from the TOS as modified by this amendment, shall be determined under the Federal Tort Claims Act, or other governing federal authority. Federal statute of limitations provisions shall apply to any breach or claim.

C8. HANDLING OF SENSITIVE AND PROPRIETARY INFORMATION

All documents and materials generated under this SOW are the property of the Government. Vendor personnel shall sign non-disclosure agreements as required and follow all applicable security and confidentiality provisions.

C.9. TRAVEL

All travel required for performance of this SOW shall be the responsibility of the Contractor. When feasible, remote meetings or conferencing shall be used to minimize travel costs.

SECTION D - Packaging and Marking

D.1 PACKAGING AND MARKING

All deliverables shall be delivered to the Contracting Officer’s Representative (COR) identified in Section G and shall be marked as follows:

1. Name and address of the Contractor;

2. Contract Number;

3. Description of item contained therein; and

4. Consignee's name and address.

D.2 PAYMENT OF POSTAGE AND FEES

8 | P a g e

All postage and fees related to submitting information including forms, reports, etc. to the Contracting Officer or COR shall be paid by the Contractor.

SECTION E - Inspection and Acceptance

E.1 INSPECTION AND ACCEPTANCE

Pursuant to the appropriate inspection clause, all work described in Section C to be delivered under this contract is subject to final inspection and acceptance by an authorized representative of the Government. The authorized representative of the Government is the Contracting Officer’s Representative (COR), who is responsible for inspection and acceptance of all services, materials, or supplies to be provided by the Contractor.

E.1.1 Inspection and Acceptance Criteria Final inspection and acceptance of all work performed, reports and other deliverables will be performed at the place of delivery by the COR.

E.1.2 General Acceptance Criteria General quality measures, as set forth below, will be applied to each work product received from the Contractor under this Statement of Work.

Accuracy - Work Products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

Clarity - Work Products shall be clear and concise. Any/all diagrams shall be easy to understand and be relevant to the supporting narrative.

Consistency to Requirements - All work products must satisfy the requirements of this Statement of Work.

File Editing - All text and diagrammatic files shall be editable by the Government.

Format - Work Products shall be submitted in hard copy and electronic copy. The electronic copy must be in a format as indicated in the Deliverables Table.

SECTION F - Deliveries or Performance

F.1 PERIOD OF PERFORMANCE – Severable Services

CLIN 01 BASE PERIOD

09/30/2026 – 09/29/2027

F.2 PLACE OF PERFORMANCE

The Contractor shall deliver the required devices or licenses to the address listed below. The maintenance software will be delivered via secure e-mail or via website download to the Contracting Officer’s Representative (COR), program manager, technical point of contact, or

9 | P a g e select end users at:

TBD

SECTION G - Contract Administration Data

G.1 AUTHORITIES OF GOVERNMENT PERSONNEL

Notwithstanding the Contractor's responsibility for total management during the performance of this contract, the administration of this contract will require maximum coordination between the Government and the Contractor. The following individuals will be the Government's points of contact during the performance of this contract:

Contracting Officer Name: TBD Email: TBD

All communications pertaining to contractual and/or administrative matters under this contract shall be sent to:

Contract Specialist Name: Darnell Harkless Email: Darnell.Harkless@hhs.gov

Contracting Officer's Representative Name: TBD Address: TBD Phone: TBD Email: TBD

Note: The Contracting Officer is the only individual authorized to modify the contract.

G.2 CONTRACTING OFFICER'S REPRESENTATIVE (COR) AUTHORITY

(a) Performance of work under this contract must be subject to the technical direction of the Contracting Officer's Representative identified above, or a representative designated in writing.

The term "technical direction" includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(b) Technical direction must be within the scope of the specification(s)/work statement.

10 | P a g e

The Contracting Officer's Representative does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the specification(s)/statement of work;

(2) Constitutes a change as defined in the clause entitled "Changes";

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the contractor's employees.

(c) Technical direction may be oral or in writing. The Contracting Officer's Representative shall confirm oral direction in writing within five work days, with a copy to the Contracting Officer.

(d) The contractor shall proceed promptly with performance resulting from the technical direction issued by the Contracting Officers, Representative. If, in the opinion of the contractor, any direction of the Contracting Officers, Representative, or his/her designee, falls within the limitations in (b), above, the contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government work day.

(e) Failure of the contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes."

G.3 INVOICES

Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP)

• All Invoice submissions for goods and or services delivered to facilitate payments must be made electronically through the U.S. Department of Treasury’s Invoice Processing Platform System (IPP).

• Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions –

11 | P a g e

Commercial Items included in commercial items contracts. The IPP website address is:

https://www.ipp.gov.

• The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 – 5 business days of the contract award for new contracts or date of modification for existing contracts.

• Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov.

Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

• The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

• If your company is already registered to use IPP, you will not be required to re-register.

• If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

Additional Office of Acquisition Management Services (OAMS) requirements:

(i) The contractor shall submit invoices under this contract once per month. For indefinite delivery vehicles, separate invoices must be submitted for each order.

(ii) Invoices must break-out price/cost by contract line item number (CLIN) as specified in the pricing section of the contract.

(iii) Invoices must include the Dun & Bradstreet Number (DUNS) or Unique Entity ID (created in SAM.gov) of the Contractor.

(iv) Invoices that include time and materials or labor hours CLINS must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

(v) Invoices that include cost-reimbursement CLINs must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts.

At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

Direct Labor - include all persons, listing the person's name, title, number of

12 | P a g e hours worked, hourly rate, the total cost per person and a total amount for this category;

Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)- show rate, base and total amount;

Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and

Fee – amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

SECTION H - Special Contract Requirements

H.1 PROHIBITION AGAINST PERSONAL SERVICES

The duties and responsibilities set forth in this Contract may not be interpreted or implemented in any manner that results in any Contractor employee creating or modifying Federal Policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee, or otherwise violating the prohibitions set forth in Subparts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Contractor shall not perform personal services under this contract. Contractor personnel are employees of the Contractor or its subcontractors and are under the administrative control and supervision of the Contractor. A Contractor supervisor must give all individual Contractor employee assignments and daily work direction. The Government will not supervise or direct Contractor employees in the performance of their assignments. If at any time the Contractor believes that any Government action or communication has been given that would create a personal service relationship between the Government and any Contractor employee, the contractor shall promptly notify the Contracting Officer of this communication or action. The Contractor shall not perform any inherently-governmental functions under this contract. No Contractor employee shall represent or give the appearance that he/she is a Government employee, agent or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. The Contractor is responsible for ensuring that all employees assigned to this contract understand and are committed to following these requirements.

H.2 POST AWARD ORGANIZATIONAL CONFLICT OF INTEREST

13 | P a g e

a. General: The Contractor shall have programs in place to identify, report, and mitigate actual and potential conflicts of interest for itself, its employees, subcontractors and consultants.

The existence of such programs and the disclosure of known actual or potential conflicts are material performance requirements of this contract.

b. Disclosure: The Contractor shall report all actual and potential conflicts of interest pertaining to this contract to the Contracting Officer, including those that would be caused by a contemplated modification to this contact or another contract, in accordance with FAR Subpart

9.5. Such reports shall be in writing (including by email). Upon request, the Contractor shall respond to a Contracting Officer's request for an OCI mitigation plan.

c. Resolution: In the event the Contracting Officer determines that a conflict of interest exists, based on disclosure from the Contractor or from other sources, the Contracting Officer shall take action which may include, but is not limited to, requesting a mitigation plan from the Contractor, terminating part or all of the contract, modifying the contract or obtaining a waiver in accordance with applicable law, including FAR 9.503 as applicable.

H.3 CONTRACTOR PERFORMANCE EVALUATION(S)

Contractor performance will be evaluated on an interim and final basis pursuant to FAR Subpart

42.15. Interim evaluations will occur on an annual basis upon the completion of the first year of the contract. The Contractor Performance Assessment Reporting System (CPARS) will be used for these reviews. Information on CPARS is located at http://www.cpars.gov.

SECTION I - Contract Clauses

I.1 HHSAR Clause 352.204-70, Prevention and Public Health Fund—Reporting Requirements (December 2015)

Pursuant to Public Law this contract requires the contractor to provide products and/or services that are funded from the Prevention and Public Health Fund (PPHF), Public Law 111-148, sec.

4002. Section 220(a)(5) requires each contractor to report on its use of these funds under this contract. These reports will be made available to the public.

Semi-annual reports from the Contractor for all work funded, in whole or in part, by the PPHF, are due no later than 20 days following the end of each six-month period. The six-month reporting periods are January through June and July through December. The first report is due no later than 20 days after the end of the six-month period following contract award. Subsequent reports are due no later than 20 days after the end of each reporting period. If applicable, the Contractor shall submit its final report for the remainder of the contract period no later than 20 days after the end of the reporting period in which the contract ended.

The Contractor shall provide the following information in an electronic and 508 compliant format to the Contracting Officer.

14 | P a g e

(1) The Government contract and order number, as applicable.

(2) The amount of PPHF funds invoiced by the contractor for the reporting period and the cumulative amount invoiced for the contract or order.

(3) A list of all significant services performed or supplies delivered, including construction, for which the contractor invoiced in the reporting period.

(4) Program or project title, if any.

(5) The Contractor shall report any subcontract funded in whole or in part with PPHF funding, that is valued at $25,000 or more. The Contractor shall advise the subcontractor that the information will be made available to the public. The Contractor shall report:

(i) Name and address of the subcontractor.

(ii) Amount of the subcontract award.

(iii) Date of the subcontract award.

(iv) A description of the products or services (including construction) being provided under the subcontract.

(End of clause)

I.2 HHSAR CLAUSE 352.204-71 INFORMATION AND INFORMATION SYSTEMS

SECURITY (FEB 2024) (DEVIATION)

a) Definitions. As used in this clause— Breach means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where—

(1) A person other than an authorized user accesses or potentially accesses personally identifiable information, or

(2) An authorized user accesses personally identifiable information for an other than authorized purpose.

Business associate (see 45 CFR 160.103), except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person who -

(1) On behalf of such covered entity or of an organized health care arrangement (as defined in this clause) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this contract or agreement, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or

(2) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in 45 CFR section 164.501), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.

15 | P a g e

(3) A covered entity may be a business associate of another covered entity.

(4) Business associate includes the following:

(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

(5) Business associate does not include:

(i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.

(ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of 45 CFR 164.504(f) apply and are met.

(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.

(iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.

Business associate agreement means the agreement, or other arrangement, as dictated by the HIPAA Privacy Rule (45 CFR 160), between an HHS covered entity and a business associate, which must be entered into in addition to the underlying contract for services and before any disclosure (see 45 CFR 160.103) of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of an HHS entity Controlled unclassified information (CUI) means information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.

Healthcare component means a component or combination of components of a hybrid entity designated by the hybrid entity in accordance with 45 CFR 164.105(a)(2)(iii)(D) (see 45 CFR 164.103). The Secretary of HHS has designated HHS as a covered entity (further designated as a “hybrid entity”), and has also designated four HHS divisions as healthcare components under HIPAA, including —

(1) The Centers for Medicare and Medicaid Services (CMS), insofar as it operates the fee-for-service Medicare program;

(2) The Program Support Center (PSC), Division of Commissioned Personnel, insofar as it operates a health plan for Commissioned Corps officers;

16 | P a g e

(3) The World Trade Center (WTC) Health Program; and,

(4) The Indian Health Service (IHS), insofar as it operates a health plan and a program providing healthcare that uses electronic transactions.

HHS Information Technology General Rules of Behavior means a set of HHS rules that describes the responsibilities and expected behavior of users of HHS information or information systems.

HHS sensitive information means all HHS data, on any storage media or in any form or format, which requires confidentiality, integrity, and availability protection due to the risk of harm that could result to interests of HHS, other agencies or entities, or individuals from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes—

(1) Information where the improper use or disclosure could adversely affect the ability of HHS to accomplish its mission, i.e., HHS proprietary information;

(2) Records about individuals requiring protection under laws and regulations such as the E-Government Act, Privacy Act and the HIPAA Privacy Rule, or based on a data use agreement or a promise or assurance of confidentiality; and

(3) Information that would be exempt from disclosure if requested under the Freedom of Information Act. Examples of HHS sensitive information include—

(i) Individually-identifiable medical, benefits, and personnel information;

(ii) Financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, security-sensitive, procurement-sensitive, investigatory, and law enforcement information;

(iii) Controlled unclassified information;

iv) Information that would be confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and

(v) Other information which, if released, could result in a violation of law or agreement, could cause harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and part 164.

Incident means an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information systems; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable policies.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Information system security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

Information technology (see FAR 2.101) also means Information and Communication Technology (ICT).

17 | P a g e

Information technology-related contracts means those contracts that include services (including support services), and related resources for information technology.

Organized health care arrangement (see 45 CFR 160.103) means:

(1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;

(2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities:

(i) Hold themselves out to the public as participating in a joint arrangement; and

(ii) Participate in joint activities that include at least one of the following:

(A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;

(B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.

(3) A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;

(4) A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or

(5) The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.

Privacy officer means the HHS official(s) with responsibility for implementing and oversight of privacy related policies and practices that impact a given HHS acquisition.

(b) General. Contractors, subcontractors, their employees, third-parties, and business associates with access to HHS information, information systems, or information technology (IT) or providing and accessing IT-related goods and services, shall adhere to the HHS Cybersecurity Program and the directives and handbooks, complete HHS security training prior to accessing HHS information (including HHS sensitive information and information systems security and privacy) and on an annual basis thereafter, as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, HHS Personnel Security and Suitability Program, which establishes HHS procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, 18 | P a g e standards, and guidance for protecting HHS information, information systems (see 302.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing HHS information or information systems.

(c) Access to HHS information and HHS information systems.

(1) Contractors are limited in their request for logical or physical access to HHS information or HHS information systems for their employees, subcontractors, third parties and business associates to the extent necessary to perform the services or provide the goods as specified in the contracts, agreements, task, delivery, or purchase orders.

(2) All Contractors, subcontractors, third parties, and business associates working with HHS information are subject to the same investigative requirements as those of HHS appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors to access HHS information and HHS information systems shall be in accordance with HHS Personnel Security and Suitability Program.

(3) Contractors, subcontractors, third parties, and business associates who require access to national security programs must have a valid security clearance.

(4) The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI.

32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be –

(i) Marked appropriately;

(ii) Disclosed to authorized personnel on a need-to-know basis;

(iii) Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

(iv) Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

(5) HIPAA business associate agreements. Under the HIPAA Privacy and Security Rules (see 45 CFR 164), pursuant to 45 CFR 164.502(e)(1), a covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor of a covered entity’s business associate.

Additionally, a business associate may disclose protected health information to a business

19 | P a g e associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information. The satisfactory assurances required by 45 CFR 45 CFR 164.504(e)(1) of this section shall be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of 45 CFR 164.504(e). The contracts shall also include breach reporting policies and procedures for suspected or confirmed breaches of protected health information.

The contract shall impose a duty to cooperate with the healthcare component and/or HHS breach investigation and response and must require all subcontractors to comply with the same HIPAA Rules requirements as a condition of receiving government data.

(i) Contractors or entities required to execute business associate agreements for contracts and other agreements become HHS business associates. Business associate agreements are issued by HHS or may be issued by other HHS programs in support of HHS. The HIPAA Privacy Rule requires HHS to execute compliant business associate agreements with persons or entities that create, receive, maintain, or transmit HHS PHI or that will store, generate, access, exchange, process, or utilize such PHI in order to perform certain activities, functions or services to, for, or on behalf of HHS. There may be other HHS components or staff offices which also provide certain services and support to HHS and must receive PHI in order to do so. If these components award contracts or enter into other agreements, purchase/delivery orders, modifications and issue governmentwide purchase card transactions to help in the delivery of these services to HHS, they will also fall within the requirement to obtain a satisfactory assurance from these contractors by executing a business associate agreements.

(ii) Business associate agreement flow down to subcontractors. A prime contractor required to execute a business associate agreement shall also obtain a satisfactory assurance, in the form of a business associate agreement, of its subcontractors who will also create, receive, maintain, or transmit PHI or that will store, generate, access, exchange, process, or utilize such PHI will comply with HIPAA Rules requirements to the same degree as the Contractor. A contractor employing a subcontractor who creates, receives, maintains, or transmits PHI or that will store, generate, access, exchange, process, or utilize such PHI under a contract or agreement is required to execute a business associate agreement with each of its subcontractors which also obligates the subcontractor (i.e., also a business associate) to provide the same protections and safeguards and agree to the same disclosure restrictions to PHI that is required of the covered entity and the prime contractor.

(d) Contractor operations required to be in United States. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practicable. If such services are proposed to be performed outside the continental United States, and are not otherwise disallowed by other Federal law, regulations or policy, or other HHS policy or other mandates as stated in the contract, specifications, statement of work or performance work statement (including applicable business associate agreements), the Contractor/subcontractor

20 | P a g e must state in its proposal where all non-U.S. services are provided. At a minimum, the Contractor/subcontractor must include a detailed Information System Security Plan, for review and approval by the Contracting Officer, specifically to address mitigation of the resulting problems of communication, control, and data protection.

(e) Roster of employees. Contractors and subcontractors shall provide a roster containing the name, position, e-mail address, phone number, and responsibilities of each employee, including subcontractors, performing work under the contract to develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to Contracting Officer within TBD days stated number of days from the effective date of the contract. Revisions to the roster as a result of staffing changes must be submitted within the number of days of the change provided by the Contracting Officer. The Contracting Officer, or the Contracting Officer’s Representative (COR), will notify the Contractor of the appropriate level of investigation required for each staff member based on the information provided on the roster. If an employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

(f) Contractor/subcontractor employee reassignment and termination notification.

Contractors and subcontractors shall provide written notification to the Contracting Officer and COR immediately, and not later than four (4) hours, when an employee working on an HHS information system or with access to HHS information is reassigned or leaves the Contractor or subcontractor's employment on the cognizant HHS contract. The Contracting Officer and COR must also be notified immediately by the Contractor or subcontractor prior to an unfriendly termination.

(g) Non-disclosure agreement. The Contractor and subcontractors shall submit completed non-disclosure agreements, as provided by the Contracting Officer, for each employee having access to non-public government information under this contract. The non-disclosure agreements shall be submitted to the Contracting Officer prior to the performance of work.

(h) HHS information custodial requirements.

(1) Release, publication, and use of data. Information made available to a Contractor or subcontractor by HHS for the performance or administration of a contract or information developed by the Contractor/subcontractor in performance or administration of a contract shall be used only for the stated contract purpose and shall not be used in any other way without HHS prior written approval. This clause expressly limits the Contractor’s/subcontractor's rights to use data as described in 52.227-14, Rights in Data— General, paragraph (d).

(2) Media sanitization. HHS information shall not be co-mingled with any other data on the Contractors/subcontractor’s information systems or media storage systems in order to ensure federal and HHS requirements related to data protection, information segregation, classification requirements, and media sanitization can be met (see HHS Cybersecurity Program). HHS reserves the right to conduct scheduled or unscheduled on-site inspections, assessments, or audits of Contractor and subcontractor IT resources, information systems and

21 | P a g e assets to ensure data security and privacy controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with Federal and HHS requirements. The Contractor and subcontractor will provide all necessary access and support to HHS and/or GAO staff during periodic control assessments or audits.

(3) Data retention, destruction and contractor self-certification. The Contactor and its subcontractors are responsible for collecting and destroying any HHS data provided, created, or stored under the terms of this contract, to a point where HHS data or materials are no longer readable or reconstructable to any degree, in accordance with NIST SP 800-88, Guidelines for Media Sanitization, or subsequent directive. Prior to termination or completion of this contract, the Contractor/subcontractor must provide its plan for destruction or return of all HHS data in its possession accordance with contract requirements or Contracting Officer instructions for disposition, including compliance with National Institute of Standards and Technology (NIST) SP 800-88, Guidelines for Media Sanitization, for the purposes of media sanitization on all IT equipment. The Contractor must certify in writing to the Contracting Officer within 30 days of termination of the contract that the data destruction requirements in this paragraph have been met.

(4) Return of HHS data and information. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to the HHS (as stipulated by the Contracting Officer or the COR) or the Contractor/subcontractor must hold it until otherwise directed. Items returned will be hand carried, securely mailed, emailed, or securely electronically transmitted to the Contracting Officer or to the address as provided in the contract or by the assigned COR, and/or accompanying business associate agreement.

Depending on the method of return, Contractor/subcontractor must store, transport, or transmit HHS sensitive information, when permitted by the contract using HHS-approved encryption tools that are, at a minimum, validated under Federal Information Processing Standards (FIPS) 140-3 (or its successor). If mailed, Contractor/subcontractor must send via a trackable method (USPS, UPS, Federal Express, etc.) and immediately provide the Contracting Officer with the tracking information. No information, data, documentary material, records or equipment will be destroyed unless done in accordance with the terms of this contract and the HHS Agency Records Control Schedules (2019).

(5) Use of HHS data and information. The Contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of HHS information only in compliance with the terms of the contract and applicable Federal and HHS information confidentiality and security laws,…