draft RFP QAs.docx

RFP Phase 1 instructions:

1. SAM.gov notes offers are due on April 10, 2026; however, page 71 of the draft RFP notes offers are due no later than 5:00pm EST April 10, 2020. Please confirm offers are due April 10, 2026.

April 21, 2026 is the new due date for Phase 1.

Volume and Service Levels

2. Can CBP define maximum expected daily surge volumes by service type (medical examinations, consultations, PFT-1, and drug testing), and clarify whether performance timelines are adjusted during surge events?

Pre-employment volumes are dependent upon application volume and Congressionally mandated hiring targets for the Agency. Daily volume can vary widely by day for each service type, from several hundred to several thousand. Performance timelines remain as stated in the Statement of Work; however, vendor and COR will maintain communications to identify issues or concerns or changes in volume.

Network Coverage and Geographic Distribution

3. Can CBP provide the anticipated geographic distribution of services (CONUS vs. OCONUS), to include an estimated percentage of cases expected to require exceptions to the 60-mile access requirement?

Candidates requiring testing reside throughout the continental United States and in Alaska, Hawaii, Washington DC, Puerto Rico, the Virgin Islands, Guam, and Saipan. Volume within in each geographical area can vary depending on factors such as number of applicants applying within those areas, number of applicants requiring testing, and Congressionally mandated hiring targets for the Agency; therefore, CBP is unable to provide an estimated percentage of expected exceptions to the 60-mile requirement.

Medical Standards and Scope Definition

4. Can CBP provide draft medical standards, examination protocols, and templates prior to award to support accurate pricing and staffing assumptions?

This cannot be provided by CBP at this time. This information will be shared upon award.

5. Will updates to medical standards or examination requirements post-award be treated as changes to contract scope?

No, we do not anticipate these will be treated as changes to contract scope.

Information Technology and System Integration

6. When will IT security requirements be finalized, and what baseline (e.g., FedRAMP level or equivalent) should offerors assume for proposal development?

For proposal development, offerors should generally assume a baseline equivalent to FedRAMP Moderate.

7. Will integration with CBP systems or external vendor systems (e.g., clinical networks, laboratories) be required, and are APIs or data exchange standards available?

Section 8 of the SOW outlines security requirements for NPD and HC. Specifically, Section 8.9 and 8.10 of the SOW outlines web services requirements.

Operational Workflow and Responsibilities

8. Can CBP define a standardized approval framework for virtual examinations to reduce administrative delays associated with case-by-case approvals?

At this time, CBP/NPD and CBP/HC do not conduct virtual examinations. If we pursue this option, we will work with the Contractor to develop an approval framework that is acceptable to both parties.

9. Can CBP clarify the delineation of responsibilities between the prime contractor and other supporting contractors (e.g., site coordinator, blind sample provider), particularly with respect to scheduling, chain-of-custody, and quality control?

The Prime Contractor is responsible for meeting all requirements outlined in the Statement of Work. The use of subcontractors to support is at the discretion of the Prime Contractor.

Performance Metrics and Service Level Agreements

10. Can CBP provide explicit service level requirements by task type (e.g., scheduling timelines, exam completion, consultation turnaround, drug test processing)?

The service requirements and timelines are outlined in their respective sections.

11. What performance metrics and evaluation criteria (including any CPARS-related factors) will be used to assess contractor performance?

The metrics and evaluation criteria will be based on the requirements in the Statement of Work.

Staffing and Demand Characteristics

12. What is the expected frequency and volume of after-hours (24/7) service requests?

The Drug Free Workplace Team received 5 total after hours service drug testing requests in FY 2025.

The overall frequency and volume of after-hour service needs from CBP/NPD and CBP/HC is likely to be low and rare as unique circumstances arise.

13. Can CBP provide estimated workload assumptions or staffing ratios to support appropriate resourcing models?

Please use the information, such as the historical amount of employees and applicants tested or examined to help develop your staffing rations/workload functions. CBP is unable to provide a document detailing estimated workload assumptions or staffing rations. In the staffing sections of the SOW, the key and non-key personnel information is provided, and that should help with calculations.

Transition and Records Management

14. Will CBP provide incumbent contractor data and transition support to facilitate continuity of operations?

CBP and the incumbent contractor will help facilitate transition support to facilitate continuity of operations.

15. What are the required records retention periods, and which party will be designated as the system of record for long-term data storage?

Contractors are fully responsible and accountable for ensuring compliance with all Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST), Federal Information Processing Standard (FIPS), and related DHS security control requirements (to include records retention schedules, configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance).

The Contractor shall maintain electronic copies of all documentation and associated data on requested services for the duration of this agreement.

The Contractor MRO shall retain records of all results reported by the laboratory as negative for three (3) years from the date of the Contractor’s review. For results verified by the Contractor as other than negative, the Contractor shall retain the records for five (5) years from the date of the MRO review.

Additional questions:

16. Does CBP require that the contractor provide a fully automated candidate self-scheduling capability at initial contract start, or will a phased implementation be acceptable during transition? Additionally, are there any specific user interface, accessibility, or authentication standards the scheduling system must meet?

CBP’s mandatory drug testing of employees and candidates is a continuous process. In addition, CBP continually orders medical examinations, consultations, and fitness tests without long breaks in ordering; as such, it is imperative that the Contractor be able to perform all requirements in this SOW within ninety (90) business days of contract award. During this transition in period, the incumbent vendor will be performing the required services.

Section 8 of the SOW outlines security requirements for NPD and HC. Specifically, Section 8.9 and 8.10 of the SOW outlines web services requirements.

17. If the Contractor must establish new medical examination, fitness testing, or specimen collection facilities to meet the 60-mile access requirement, are the costs associated with establishing these facilities expected to be included in contract pricing, or will CBP reimburse such startup costs?

The costs associated with establishing these facilities are the responsibility of the Contractor. CBP will not reimburse startup costs.

18. Can CBP provide detailed facility and equipment requirements for PFT-1 testing locations, including medical monitoring expectations, emergency response requirements, and acceptable facility types (e.g., occupational health clinics vs. fitness facilities)?

See Section C Task 6.3.2.9.

All testing facilities shall have a space that is at least twenty-five (25) feet by twenty-five (25) feet, with a minimum ceiling height of eight (8) feet to conduct the PFT.

All testing facilities shall have at least one (1) treadmill available on site to use in administering the PFT, if required.

One (1) 25 foot tape measure;

One (1) stop watch;

One (1) Exercise mat (at least 2 feet wide by 6 feet long);

One (1) 4-inch foam block and One (1) 5-inch foam block;

One (1) 12-inch high step bench and one (1) 14-inch step bench, OR one (1) step bench and enough risers to bring the bench to a height of exactly twelve (12) inches and fourteen (14) inches;

One (1) scale calibrated and able to measure up to 350 pounds;

One (1) Height measuring device to measure up to 96” in height;

One (1) Automated External Defibrillator (AED) shall be available at each facility. Portable units are allowed. The Contractor shall comply with all Federal and applicable State laws pertaining to AEDs and shall provide compliance information or documents to the COR upon request;

Sufficient administrative items such as pens, clipboards, and paper as needed for administering and documenting the PFT. (See Government Furnished Equipment in this SOW);

Scanner to scan fitness score sheet and other pertinent fitness testing documents.

Each testing facility shall have an emergency plan readily available in the event of an emergency during the PFT. The emergency plan shall include:

Identification of available emergency equipment, including an AED, and a maintenance plan for that equipment; and Identification of available emergency medical services including the nearest local fire, police, ambulance, hospital, and/or critical care facility.

An AED shall be accessible at all testing facilities at all times during testing and shall be maintained in compliance with Federal, state, and local laws.

19. Beyond scheduling attempts, what additional candidate communication responsibilities are expected of the contractor (e.g., appointment reminders, follow-up notifications, document collection, or call center support)?

One (1) business day prior to the appointment date, the Contractor shall send the candidate a reminder email and SMS text message providing, at a minimum, the scheduled appointment information, facility location, and a reminder to complete any items the candidate is required to complete and bring to the appointment.

Additionally, Section B with Tasks 4.1, 4.3, and 4.4 outline specific candidate communication requirements.

20. Once a candidate has been classified as “hard to reach” after the required contact attempts, what is the expected contractor action and how will the case be dispositioned?

"Hard to reach" candidates are those individuals whom the Contractor has been unable to reach after three (3) documented attempts on at least three (3) separate days using all telephone numbers and email addresses available. The Contractor shall not close requests until at least one (1) business day following the third attempt to contact the candidate; this shall allow the candidate time to return the call to the Contractor for scheduling. When a candidate is deemed "hard to reach", the Contractor shall send the candidate an email giving notification of scheduling attempts and return call information.

The Contractor shall submit electronic data via web services containing information on the medical examination, consultation, fitness test, and drug test scheduling and appointment activity as it takes place. The electronic data shall provide information noting not only the appointment date, but also the actual date the candidate attended the appointment. In cases where multiple services are requested together, the electronic data shall report back the actual date each part of the process was attended. The electronic data shall also indicate those candidates who are hard to reach or failed to attend their appointments.

21. Who will be designated as the official system of record for candidate medical information generated under this contract, and what long-term data retention obligations will apply to the contractor?

The Contractor shall maintain electronic copies of all documentation and associated data the duration of this agreement. Documentation and data includes, but is not limited to: examination forms, rating documents, score sheets, Custody and Control Forms (CCFs), scheduling data, Specimen Collector logs, etc. Except where it is expressly stated otherwise in this SOW, the contractor shall maintain all specimen collection records (to include but not be limited to: CCFs, scheduling data, Specimen Collector logs, etc.) for a minimum of three (3) years. Additionally, the Contractor HHS Certified laboratory shall retain all records generated to support test results for at least two (2) years, unless specified otherwise in writing by CBP’s Contracting Officer or COR.

DRAFT RFP – RECOMMENDED QUESTIONS FOR SUBMISSION

1. Pricing construct & CLINs: Please confirm whether pricing will be structured as per‑exam/per‑test unit rates, hybrid models, or another structure, and how on‑site vs. modified on‑site vs. off‑site collections should be priced.

For NPD and HC, examinations will be priced per exam/per test. Off-site and on-site collection pricing is the same.

Unless otherwise stated, consultations will be priced per number of pages reviewed.

2. Volume baselines: Can CBP provide forecasted annual volumes for all services at specified locations (medical exams, consultations, PFT‑1, drug tests, IMEs) including anticipated hiring surges?

For NPD, the number of Fitness for Duty cases, and consultations is included in Section 1 of the SOW.

For HC, FY21-FY25 pre-employment service volumes are included in Section 1 of the SOW. Candidates requiring testing reside throughout the continental United States and in Alaska, Hawaii, Washington DC, Puerto Rico, the Virgin Islands, Guam, and Saipan. Volume within in each geographical area can vary depending on factors such as number of applicants applying within those areas, number of applicants requiring testing, and Congressionally mandated hiring targets for the Agency.

3. Geo‑access clarification: Please confirm that the 60‑mile requirement applies to all services (CONUS) and clarify expectations for duty‑station‑based employee exams and IMEs.

For NPD, examinations are not duty based. If there is a need to schedule a general examination or IME outside the 60-mile radius, the Contractor must obtain approval before scheduling.

For HC, the 60-mile requirement applies to all services for candidates requiring testing reside throughout the continental United States and in Alaska, Hawaii, Washington DC, Puerto Rico, the Virgin Islands, Guam, and Saipan.

4. Timeline clarification: Do service‑level clocks begin upon successful receipt of web‑service requests? Please confirm if timeline expectations differ for OCONUS.

Timeline expectations are the same for OCONUS, but if there is an issue, the Contractor should notify CBP as soon as possible.

5. IT integration & security: Request interface specifications, security authorization expectations (FedRAMP/FISMA baseline), and availability of CBP testing environments.

CBP's security expectations, including those for contractors, are designed to meet stringent federal guidelines, ensuring that all systems handling sensitive CBP data, whether internal or external, maintain a high level of security. Adherence to Federal Information Processing System (FIPS) 140-2 validated encryption is crucial for maintaining the confidentiality and integrity of information, aligning with federal mandates like Federal Information Security Modernization Act (FISMA) and the security controls outlined by National Institute of Standards and Technology (NIST). These standards are designed to protect federal information and information systems from a wide range of threats. CBP provides various testing environments to test systems and processes before interacting with live production environments. These testing environments are crucial for ensuring data accuracy, system compatibility, and compliance with CBP regulations.

Additionally, see Section 8 of the SOW for security requirements for NPD and HC. Specifically, Section 8.9 and 8.10 of the SOW outlines web services requirements.

6. eCCF adoption: Does CBP expect 100% eCCF readiness at Day 1, or is phased implementation acceptable?

Phased implementation is acceptable.

CBP’s mandatory drug testing of employees and candidates is a continuous process; as such, it is imperative that the Contractor be able to perform all requirements in this SOW within ninety (90) business days of contract award. During this transition in period, the incumbent vendor will be performing the required services.

7. MRO service levels: Please confirm timing requirements for negative and non‑negative results and expectations when donor contact delays occur.

The Contractor MRO shall post on the Contractor’s secured database, verified drug test results determined to be “negative” within twenty-four (24) hours of receipt of the results and associated CCF from the testing laboratory.

Within two hours of receipt of the notification of an insufficient specimen situation from the Specimen Collector, the Contractor MRO shall contact the donor via telephone who is unable to provide a sufficient amount of urine within the allotted three (3) hour time period to determine a medical cause for the insufficient specimen. Within seventy-two (72) hours of the receipt of a donor’s supporting documentation, the Contractor MRO shall provide a written report to the COR via e-mail or secured electronic transmission.

8. On‑site vs modified on‑site criteria: Will CBP identify which duty stations require on‑site collectors, or may contractors propose a decision model using duty‑location data?

CBP will identify which duty stations require on-site collectors. Anything that is proposed by the contractor must be approved by the COR/DFWP Program Manager.

9. Post‑accident & reasonable suspicion SLAs: Request clarification on exceptions for remote or OCONUS locations.

The Contractor shall dispatch a collector to the duty station, jail, Contractor’s nearest network facility, hospital, and/or at the scene of an accident for specimen collection for post-accident drug testing within one (1) hour after notification via telephone by the COR.

The Contractor shall complete the collection process within eight (8) hours of notification for post-accident request.

The Contractor shall respond telephonically to the COR’s request to schedule an appointment for specimen collection at a HHS-certified clinic for reasonable suspicion testing within thirty (30) minutes after notification by the COR.

The Contractor shall provide to the COR a valid and safe location approved by the COR of an HHS-certified clinic via secure electronic transmission e-mail message within one (1) hour of the notification.

10. Laboratory redundancy: May contractors propose multiple HHS‑certified secondary labs for split‑specimen routing?

This can be proposed, but it must be approved by the COR and DFWP Program Manager.

11. Pre‑employment mental‑health screening triggers: Request a definitive list of conditions requiring full follow‑up rather than screening.

CBP is unable to provide a definitive list of conditions. As stated in the SOW: If, upon completion of a medical examination, a candidate’s psychiatric health and ability to perform required duties cannot be substantiated through the information provided in the general medical examination, CBP may require the candidate to complete a pre-employment mental health screening.

12. IME billing & timelines: Confirm that only IMEs include billable no‑show/cancellation fees and whether expedited IMEs will have separate CLINs.

For the National Programs Division portion of the Medical Services contract IME cancellation fees are not billable. Only No-show fees are billable. National Programs Division does not anticipate use of expedited IMEs, but if this arises, we would update the contract and billing fees.

13. Specialty testing standards: Confirm acceptance of ANSI and HRR vision standards and if equivalents may be proposed.

ANSI and HRR standards accepted, and equivalents may be proposed, but must be approved by the COR.

14. PFT‑1 safety: Request credential requirements for Emergency Responders and whether mobile teams are acceptable for surge events.

For every PFT administered, an Emergency Responder shall be onsite and available in case of emergency during the PFT. The Emergency Responder shall possess current Basic Life Support (BLS) CPR/AED and First Aid certifications by recognized organizations such as the American Heart Association (AHA) or the American Red Cross. Any other certifying organization shall be approved by the COR.

Mobile teams may be proposed for surge events, but must be approved by the COR.

15. Virtual service options: Request which activities CBP will approve for virtual delivery and documentation requirements.

For NPD/CBP, we may consider virtual psychiatric IMEs. Virtual examinations cannot be scheduled without approval of the COR and Nurse Consultant.

Additionally, as generally stated in the SOW: The Government will consider technology related methods for interaction, such as virtual attendance. When feasible, the Agency may implement practices including virtual examinations. All virtual examination scheduling must be approved, in writing, by the COR.

16. Dashboard expectations: Request minimum required fields, export expectations, and update cadence.

As stated in the SOW: The Contractor shall provide access to a dashboard that displays the status of all pre-employment medical examinations, fitness tests, drug tests, mental health screenings, and consultations throughout the processing pipeline. The dashboard shall be updated at least daily and shall present the volume of each exam type, the number of days each has been in process, and offer user-friendly filtering options by position, exam type, and processing status (e.g. exams completed, exams in scheduling, exams with appointments, exams in review with Medical Review Officer, etc.).

In addition, the Contractor must provide the CBP authorized users with the ability to produce standard and ad hoc reports from the Contractor’s data system

17. Litigation package delivery: Confirm acceptable formats and whether portal upload meets delivery requirements.

Yes, portal upload can meet delivery requirements.

18. Records retention & destruction: Request confirmation of retention periods and sanitization requirements per DHS 4300A.

DHS 4300A will be provided to the Contractor. This is publicly available here: DHS 4300A Sensitive Systems Attachments | Homeland Security Additionally, the Contractor shall maintain electronic copies of all documentation and associated data on requested services for the duration of this agreement. Documentation and data includes, but is not limited to: examination forms, rating documents, score sheets, Custody and Control Forms (CCFs), scheduling data, Specimen Collector logs, etc. Except where it is expressly stated otherwise in this SOW, the contractor shall maintain all specimen collection records (to include but not be limited to: CCFs, scheduling data, Specimen Collector logs, etc.) for a minimum of three (3) years. Additionally, the Contractor HHS Certified laboratory shall retain all records generated to support test results for at least two (2) years, unless specified otherwise in writing by CBP’s Contracting Officer or COR. Formal contract closeout shall include the CBP Office of Information Technology overseeing the Contractor destroying all data, as required by CBP regulation, which was obtained and retained per this contract.

19. Key personnel requirements: Request clarification on onsite vs remote, response‑time expectations, and backup personnel requirements.

The SOW does not specify that key personnel must work onsite in the Contractor’s facility at this time. Response times are outlined in the SOW, as are requirements for alternates to key and non-key personnel.

20. Suitability timeline mitigation: Request whether interim access, staggered onboarding, or waivers will be allowed.

All requirements in the SOW must be met, but requests made by the contractor may be considered.

21. 24/7 operational coverage: Request confirmation of expected response SLAs and whether a centralized command center is required.

Not sure what SLA means.

22. International services: Request clarification of timelines, customs/shipping requirements, and country‑specific constraints.

This may vary, but the timeframes should still reflect what is in the SOW.

23. Two‑phase submission details: Request page limits, oral presentation expectations, and Geo‑Access map specifications.

The final RFP addresses these details.

24. Small Business Utilization: Request evaluation factors for mentor‑protégé/JV structures and SB participation expectations.

The final RFP addresses this evaluation.

25. NP/PA Exam services: Can nurse practitioners (NP) and physician assistants (PA) complete the exams in leu of physicians?

For the National Programs Division portion of the Medical Services Contract, NPs/PAs can conduct general examinations, but they must be signed off by a DO or MD.

For the CBP Hiring Center portion of the Medical Services Contract, NPs/PAs can conduct general examinations, but they must be signed off by a DO or MD unless the State Scope of Practice allows NPs/PAs to complete the exams without a co-signing by an MD or DO.