75FCMC20R0026 SF-1449 and Cont of Pages Sections B - E.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

AGG/JS2

BALTIMORE MD 2124-1850

7500 SECURITY BLVD

Contract Specialist Jean Sillon

CODE 16. ADMINISTERED BYCODE

X

X

X

337127

SIZE STANDARD:

100.00 % FOR:SET ASIDE:UNRESTRICTED ORAGG - DBSC

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

08/18/2020 1600 ES

08/04/2020

Jean Sillon (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

75FCMC20R0026

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 71 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

BALTIMORE MD 21244-1850

7500 SECURITY BLVD., MS: B3-30-03

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

CMS,OAGM,AGG,DBSC

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Period of Performance: 09/16/2020 to 07/31/2021

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

XX

DATED

Jennifer Davis

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

71 2 of

SF-1449 Continuation of Pages CMS Auditorium Chair Procurement

SF-1449

RFP# 75FCMC20R0026

TABLE OF CONTENTS

SECTION A – SF-1449

SECTION B – CONTINUATION OF SF-1449 (BLOCKS 19, 20, 24)

B.1 BRIEF DESCRIPTION OF SERVICES

B.2 TYPE OF CONTRACT

B.3 SCHEDULE OF SUPPLIES/SERVICES

B.4 PERIOD OF PERFORMANCE

SECTION C – CONTRACT CLAUSES

C.1 FAR 52.212-4 CONTRACT TERMS AND CONDITIONS – COMMERCIAL

ITEMS – BY REFERENCE

C.2 ADDENDA TO 52.212-4 CONTRACT TERMS AND CONDITIONS

COMMERCIAL ITEMS

C.3 FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO

IMPLEMENT STATUTES OR EXECUTIVE ORDERS – COMMERCIAL

ITEMS

SECTION D – ATTACHMENTS

D.1 STATEMENT OF WORK

D.2 PRICING TEMPLATE

D.3 PAST PERFORMANCE QUESTIONNAIRE

D.4 PROPOSAL INTENT RESPONSE FORM

D.5 PERSONAL CONFLICT OF INTEREST DISCLOSURE TEMPLATE

D.6 CONTRACTOR BUSINESS ETHICS, CONFLICT OF INTEREST AND

PROGRAM REQUIREMENTS

SECTION E – SOLICITATION PROVISIONS

E.1 FAR 52.212-1 INSTRUCTIONS TO OFFERORS – COMMERCIAL ITEMS

E.2 ADDENDUM TO FAR 52.212-1 INSTRUCTIONS TO OFFERORS –

COMMERCIAL ITEMS)

E.3 ADDENDUM TO 52.212-2 EVALUATION – COMMERCIAL ITEMS

E.4 FAR 52.212-3 OFFERORS REPRESENTATION AND CERTIFICATIONS –

COMMERCIAL ITEMS

E.5 FAR 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY

REFERENCE

E.6 FAR 52.233-2 -- SERVICE OF PROTEST (SEP 2006)

SECTION B-CONTINUATION OF SF1449 (BLOCKS 19, 20, 24)

B.1 BRIEF DESCRIPTION OF SERVICES

The purpose of this contract is to replace the chairs in the auditorium including: 551 stackable wood armchairs and 21 stackable wood armless chairs.

B.2 TYPE OF CONTRACT

This is a firm-fixed-priced (FFP) contract.

B.3 SCHEDULE OF SUPPLIES/SERVICES

CLIN/

SLIN

Description PSC Accounting Classification

Unit of Measure

QTY Unit Price

Total Price

0001 Stackable wood chair with arms

7195 TBD Each 551.00

0002 Stackable wood chair without arms

7195 TBD Each 21.00

TOTAL

B.4 PERIOD OF PERFORMANCE

The period of performance of this contract is anticipated as September 16, 2020 through July 31, 2021.

SECTION C CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS – COMMERCIAL ITEMS

(OCT 2018) – BY REFERENCE

C.2 ADDENDA TO 52.212-4 CONTRACT TERMS AND CONDITIONS –

COMMERCIAL ITEMS (OCT 2018)

I. FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: www.acquisition.gov

NUMBER TITLE DATE

52.203-12 Limitation on Payments to Influence Certain Federal

Transactions

JUN 2020

52.204-4 Printed or Copied Double-Sided On Postconsumer fiber Content Paper

MAY 2011

52.204-13 System for Award Management Maintenance OCT 2018 52.204-18 Commercial and Government Entity Code Maintenance AUG 2020 52.204-19 Incorporation By Reference of Representations and

Certifications

DEC 2014

52.232-40 Providing Accelerated Payments to Small Business Subcontractors

DEC 2013

II. DEPARTMENT OF HEALTH AND HUMAN SERVICES ACQUISITION

REGULATION (HHSAR) CLAUSES INCORPORATED BY REFERENCE

This contract incorporates one or more clauses by reference, with the same force and effect as if they were provided in full text. Upon request, the Contracting Officer will provide the information in full text. The full text of a clause is also available electronically at http://www.hhs.gov/policies/hhsar/.

NUMBER TITLE DATE

352.203-70 Anti-Lobbying DEC 2015 352.208-70 Printing and Duplication DEC 2015 352.222-70 Contractor Cooperation in Equal Employment

Opportunity Investigations

DEC 2015

III. CMS SPECIFIC TERMS AND CONDITIONS

A. PAYMENTS - INVOICES - (AUG 2020)

a. GENERAL: Effective August 31, 2020, the contractor/vendor shall create an invoice within the Invoice Processing Platform (IPP), a secure Web-based service for federal agencies and their vendors to manage government invoicing from purchase order (PO) through payment notification. Note: All invoice terms and conditions are contract specific and may vary from contract to contract.

b. CONTENT OF INVOICE: FAR 32.905 Payment Documentation and Process, provides the required content for a proper invoice. In addition to the requirements of FAR 32.905, the following items shall also be included on the invoice to be considered proper:

• Line item number (i.e. CLIN/SLIN as applicable)

• Contractor’s DUNS Number;

• Period of performance or delivery date of goods or services provided.

c. INVOICE SUBMISSION: The contractor/vendor shall create an invoice from the Purchase Order (PO)/Contract via the IPP website http://www.ipp.gov/. For questions, call IPP Customer Support at (866) 973-3131 or email the IPP Customer Support at IPPCustomerSupport@fiscal.treasury.gov.

d. PAYMENTS: The Government shall make payment of all proper invoices in accordance with the following clauses:

•FAR 52.232-33 Payments by Electronic Funds Transfer – System for Award Management, •FAR 52.232-1 Payments •FAR 52.212-4 Contract Terms and Conditions – Commercial Items (If applicable)

Payment shall be made upon acceptance by the Contracting Officer’s Representative (COR)in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer’s approval, as appropriate.

Reimbursement for invoices submitted under this contract shall be made no later than 30 calendar days after receipt of a proper invoice from the Contractor requested at the paying office designated above. Contracts with a 15-day payment term are not subject to interest payments until after day 30.

e. INTEREST ON OVERDUE PAYMENT: The Prompt Payment Act, Public Law 97-177 (96 Stat.85.31 U.S.C. 1801) is applicable to payments under this contract and requires the payment of interest on payments made more than 30 calendar days after receipt of a proper invoice in IPP.

Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and 5 CFR 1315.

B. CONTRACTOR PERFORMANCE EVALUATION(S) (OCT 2014)

a. General:

In accordance with Federal Acquisition Regulation (FAR) 42.15, Contractor Performance Information, past performance evaluations shall be prepared at least annually and at the time the work under a contract or order is completed. Additional interim performance evaluations may be prepared at Contracting Officer discretion, as necessary.

CMS will utilize the Contractor Performance Assessment Reporting System (CPARS), the Government-wide evaluation reporting tool for all past performance reports on contracts and orders, as appropriate. CPARS is a secure Internet website located at https://www.cpars.gov.

b. CPARS Process:

1. CPARS Training: Contractors may obtain CPARS training material and register for on-line training https://www.cpars.gov.

2. Post-Award Contract Registration: CMS is responsible for registering the contract in CPARS within 30 calendar days of contract award. The Contractor shall:

i.Designate at least one (1) point of contact that will be responsible for serving as the Contractor’s Representative (CR). Additional CRs may also be identified; and, ii.Provide the CMS Contract Specialist with the name(s) and email address(es) of the CPARS point(s) of contact.

Once CMS registers the contract in CPARS, the CR(s) will receive an automated CPARS email message that contains User IDs and instructions for creating a password for future past performance evaluation processing.

3. Interim, Annual and Final Past Performance Evaluation Reports:

a. Issuing the Evaluation: Once the CMS Assessing Official (AO) issues an evaluation to the Contractor in CPARS, the CR(s) will receive an email instructing them to login to CPARS to review the evaluation.

b. Contractor Comments: The CR has the option to provide comments on the evaluation, indicate if they concur or do not concur with the evaluation, sign, and then return the evaluation to the AO. The CR has a total of 60 days following the AO’s evaluation signature date to submit comments. If the CR submits comments within the first 14 days following the AO’s signature date and the AO closes the evaluation, the evaluation will become available in Past Performance Information Retrieval System - Report Card (PPIRS-RC) within 1 day.

On day 15 following the AO’s evaluation signature date, the evaluation will become available in PPIRS-RC with or without CR comments and whether or not it has been closed by the AO. If no CR comments have been sent and the evaluation has not been closed, it will be marked as “Pending” in PPIRS-RC.

If the CR sends comments at any time prior to 61 days following the AO’s evaluation signature date, those comments will be reflected in PPIRS-RC within 1 day. On day 61 following the AO’s evaluation signature date, the CR will be “locked out” of the evaluation and may no longer send comments.

C. GOVERNMENT REPRESENTATIVES AND RESPONSIBILITIES (JUL 2016)

Following are the Government Representatives and their respective roles and responsibilities on this contract:

a. Contracting Officer

As defined in Federal Acquisition Regulation (FAR) 2.101, Definitions, and in accordance with FAR 1.602-1, Authority, “Contracting officers have authority to enter into, administer, and/or terminate contracts and make related determinations and findings.” There is no other authorized representative or any other Administrative Contracting Officer assigned to this contract to carry out a Contracting Officer’s duties, except for technical direction assigned to the Contracting Officer’s Representative, if applicable.

The Contracting Officer is: Jennifer Davis

Centers for Medicare & Medicaid Services Office of Acquisition & Grants Management Acquisition and Grants Group Division of Beneficiary Support Contracts ATTN: Ms. Jennifer Davis 7500 Security Blvd.

Mail-stop: B3-30-03 Baltimore, MD 21244-1850

Phone: 410-786-2460 Email Address: Jennifer.Davis@cms.hhs.gov

b. Contract Specialist

Notwithstanding any of the other provisions of this Contract, the Contract Specialist will assist the Contracting Officer with her responsibilities as defined in the FAR.

The Contract Specialist is: Jean Sillon mailto:Jennifer.Davis@cms.hhs.gov

Acquisition and Grants Group Division of Beneficiary Support Contracts ATTN: Mr. Jean Sillon 7500 Security Blvd.

Mail-stop: B3-30-03 Baltimore, MD 21244-1850

Phone: 410-786-8513 Email Address: Jean.Sillon@cms.hhs.gov

c. Contracting Officer’s Representative and Alternate Contracting Officer’s Representative

The Contracting Officer’s Representative (COR), as defined in FAR 2.101, Definitions, is: TBD

ATTN: TBD

7500 Security Blvd.

Mail-stop:

Baltimore, MD 21244-1850

Phone: TBD Email Address: TBD

In accordance with FAR 1.602-2(d), Responsibilities, the COR’s delegated responsibilities are identified in the Contracting Officer’s appointment memorandum, a copy of which will be furnished to the contractor.

Technical direction must be within the general scope of the work stated in the contract. The term "technical direction" is defined to include, without limitation, the following:

(1) Directions to the Contractor which direct the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual technical requirements as identified in the Statement of Work or Performance Work Statement; or

(2) Provision of information to the Contractor, which assists in the interpretation of drawings, specifications, or technical portions of the work description.

The COR does not have the authority to:

1. Make changes to contract terms and conditions;

2. Direct the contractor to perform work or make deliveries not specifically required under the contract;

mailto:Jean.Sillon@cms.hhs.gov

3. Waive or relax the Government’s rights with regard to the Contractor’s compliance with the specifications, price, delivery or any other terms or conditions of the contract;

4. Make any commitments or approve any actions that would create any financial obligation on the part of the Government; or

5. Issue direction that constitutes a “change” as defined in:

FAR 52.243-1, Changes – Fixed Price;

FAR 52.243-2, Changes – Cost Reimbursement;

FAR 52.243-3, Changes – Time and Material and Labor Hour;

FAR 52.243-4, Changes; or, FAR 52.243-5, Changes and Changed Conditions.

All technical direction shall be issued in writing by the COR or, if issued verbally, shall be confirmed in writing by the COR within five (5) business days after issuance.

The Contractor shall proceed promptly with the performance of technical direction duly issued by the COR within the scope of his/her authority.

If, in the opinion of the Contractor, any instruction or direction issued by a Government representative constitutes a change to the contract or constitutes a “Change Order” as defined in FAR 2.101, Definitions, the Contractor shall follow the instructions identified in FAR 52.243-7 Notification of Changes.

D. POST AWARD BUSINESS ETHICS, CONFLICT OF INTEREST AND

COMPLIANCE (OCT 2015)

a. General: It is imperative that the Contractor and the services provided under this contract be free, to the greatest extent possible, of all Organizational and Personal Conflicts of Interest. In this clause, all references to Organizational and/or Personal Conflicts of Interests will be referred to individually or collectively, as the text justifies, as Conflicts of Interest (COI). Except as provided below, the Contracting Officer shall not maintain a contract with a Contractor that the Contracting Officer determines has, or has the potential for, an unresolved COI. However, in accordance with FAR 9.503 Waiver, the Contracting Officer may contract with a Contractor that has an unresolved COI if he/she determines that it is in the best interest of the Government to do so.

b. Definitions:

Actual COI– means that the COI is currently in existence as determined by the Offeror’s or Contractor’s Compliance Officer and/or as determined by CMS. This form of COI will require avoidance, neutralization or mitigation acceptable to CMS.

Affiliates – As defined in FAR 2.101 means associated business concerns or individual(s) if, directly or indirectly either one controls or can control the other; or a third party controls or can control both.

For purposes of this contract, affiliate control or influence may include, but is not limited to:

(a) Interlocking management or ownership (e.g., individuals serving in similar capacities in several companies);

(b) Identity of interests among family members such as spouse/domestic partner and/or any dependent of the respondent;

(c) Shared facilities and equipment;

(d) Common use of employees; or

(e) A business concern organized just prior to, or immediately following, the release of a solicitation or request for information, which has the same or similar management, ownership, or principal employees as the Offeror or Contractor.

Any business, whether or not it is organized for profit or located in the United States or its outlying areas, or person may be found to be an affiliate. Control may be affirmative or negative and it is immaterial whether it is exercised so long as the power to control exists.

Apparent (Perceived) COI – means that the COI on first observation appears to be an actual or potential COI, but may or may not be after analysis. Even if the apparent COI is determined to be non-existent, this perception may still require further explanation.

Financial Interests/Relationships – means a healthcare related direct or indirect ownership or investment interest (including an option or non-vested interest) in any entity that exists through equity, debt, or other means and includes any indirect ownership or investment interest no matter how many levels removed from a direct interest.

A financial interest/relationship may arise from the following non-exclusive examples:

(a) Compensation, including wages, salaries, commissions, professional fees, or fees for business referrals;

(b) Current or known future arrangements or requirements for which you are defined as an interested party including, but not limited to, an entity that may create one or more of the three forms of COI;

(c) Consulting relationships, including commercial and professional consulting and service arrangements, scientific and technical advisory board memberships, or serving as an expert witness in litigation;

(d) Services provided in exchange for honorariums including travel expense reimbursements;

(e) Research funding or other forms of research support;

(f) Healthcare related investment in the form of stock or bond ownership, including healthcare sector investment only mutual funds;

(g) Healthcare business ownership or partnership interests;

(h) Patents, copyrights, and other intellectual property interests;

(i) Seeking or negotiating for prospective employment or business; or

(j) Gifts, including travel.

Mitigation – means action taken by the Contractor to reduce the COI risk to a level acceptable to CMS on a present contract.

Organizational Conflict of Interest – In accordance with FAR 2.101 Definitions, means that because of other activities or relationships with other persons, a person is unable, or potentially unable, to render impartial assistance or advice to the Government, or the person’s objectivity in performing the contract work is, or might be, otherwise impaired, or a person has an unfair competitive advantage.

For purposes of this contract, the COI definition includes direct or indirect relationships including, but not limited to, the Contractor and its parent company, subsidiaries, affiliates, subcontractors, clients and principals.

Personal Conflicts of Interest – A situation in which a person has a financial interest, personal activity, or relationship that could impair the person’s ability to act impartially and in the best interest of the Government when performing under this contract.

(a) Among the sources of personal conflicts of interest are—

i. Financial interests of the person, spouse/domestic partner and/or any other dependent of the person, as defined for Federal tax purposes;

ii. Other employment or financial relationships (including seeking or negotiating for prospective employment or business) and,

iii. Gifts, including travel.

(b) For example, financial interests referred to in paragraph (a)(i) of this definition may arise from—

i. Compensation, including wages, salaries, commissions, professional fees, or fees for business referrals;

ii. Consulting relationships;

iii. Services provided in exchange for honoraria or travel expense reimbursements;

iv. Research funding or other forms of research support;

v. Healthcare related investments;

vi. Real estate investments;

vii. Patents, copyrights, and other intellectual property interests; or

viii. Business ownership and investment interests.

Potential COI – means that the COI could become an actual COI due to contingency events and/or as determined by CMS. This form of COI will require mitigation acceptable to CMS.

Principal – As defined in FAR 52.203-13, Contractor Code of Business Ethics and Conduct, means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager, plant manager, head of a division or business segment, and similar positions).

Three (3) Types of COIs include:

Conflict Types Definitions

Biased Ground Rules

Consists of situations in which a firm, as part of its performance of a Government contract, has helped (or is in a position to help) set the ground rules for another Government contract by, for example, writing the statement of work or the specifications, or establishing source-selection criteria. In these “biased ground rules” cases, the primary concern is that the firm could skew the competition, whether intentionally or not, in favor of itself and/or its affiliates.

Impaired Objectivity

Consists of situations where a firm has an interest (typically financial) that may conflict with the interest of the Government to whom the firm has a contractual obligation, and the firm’s work under the Government contract could give the firm the opportunity to benefit its other business interests. If the firm is providing recommendations, judgment or advice, and its other business interests could be affected by that recommendation, judgment or advice, the firm’s objectivity may be impaired. An example is where the firm was evaluating itself, an affiliate or a competitor, either through an assessment of performance under another contract or an evaluation of proposals.

Unequal Access to Information

“Unfair” access to non-public information – Consists of situations in which a firm has access to nonpublic information (including proprietary information and non-public source-selection information) as part of its performance of a Government contract and that information may provide the firm with a competitive advantage in a later competition for a Government contract. In these “unequal access to information” cases, the concern is limited to the risk of the firm gaining an unfair competitive advantage;

there is no issue of bias. Note: Incumbency alone does not constitute an “unequal access to information.”

c. Conflicts of Interest Identified During Contract Performance – In accordance with FAR 3.10 and 52.203-13, Contractor Code of Business Ethics and Conduct, and this contract, the Contractor shall have procedures in place to detect and disclose all COIs throughout the life of the contract.

1. COI Oversight Program: The Contractor shall maintain an effective COI Oversight

Program. As part of the program, the Contractor shall implement company business practices, procedures, polices and internal controls for compliance with COI requirements, such as:

(a) Preventing conflicts of interest, prohibiting the use of non-public information accessed through this contract for personal gain, and obtaining a signed non-disclosure agreement to prohibit disclosure of non-public information accessed through this contract;

(b) Conducting Internal and External Audits;

(c) Policy Enforcement and Employee Disciplinary Actions;

(d) Retention of Records;

(e) Management of Subcontractors;

(f) Internal control systems;

(g) Display of Fraud Hotline Poster(s) in accordance with FAR 52.203-14

Display of Hotline Poster(s).

(h) Reviewing the information required by Attachment D.5, Contractor Personal

Conflict of Interest Financial Disclosure Template, for each principal, officer and governing body member (e.g., Board of Directors; Trustees; etc.) of the organization, as well as managers and key personnel who would be, or are involved with, the performance of this contract. It is recommended that individuals who have not disclosed changes within the reporting period, submit an annual disclosure update to their Compliance Officer for review;

(i) Informing employees, through an employee education and training program, of their obligation to disclose and prevent conflicts of interest, not to use non-public information accessed through performance of this contract for personal gain, and to avoid even the appearance of personal conflicts of interest; and,

(j) Reporting to the Contracting Officer any conflict of interest violations.

The following details are provided for respective COI disclosure expectations when/if a COI arises during contract performance:

2. Conflict of Interest:

COI information shall be submitted as follows:

(a) Conflict of Interest Submission During Contract Performance:

At any time during the performance of this contract, if the Contractor learns of any actual, potential, or apparent COI, whereby a reasonable business person might equate the COI to one (1) of the three (3) types of COIs identified in C.2.III.D.b Definitions, the Contractor shall notify the Contracting Officer in writing within five (5) business days of the identification of the actual, potential, or apparent COI. Within 30 calendar days, or as otherwise negotiated with the Contracting Officer, the Contractor shall submit a COI Disclosure in accordance with 2(b) below.

(b) What is Required in a COI Disclosure: When an initial COI disclosure is submitted and/or a revision thereof is required, the Contractor shall provide an initial or revised, as the case may be, Attachment D.6 Contractor Business Ethics, Conflict of Interest and Compliance Program Requirements.

(c) Personal COI Information: It is the Offeror/Contractor’s responsibility to have a plan in place (see C.2.III.D.c.1 COI Oversight Program) to ensure that actual, potential, or apparent personal conflicts of interest are identified, analyzed and mitigated for performance of this contract.

Personal COI information shall be obtained by the Offeror/Contractor for each:

• Manager or Key personnel who would be, or are involved with, the performance of this contract;

• Governing Body member (e.g., Board of Directors, Trustees, etc.); and,

• Principals of the organization as defined by FAR 52.203-13, Contractor

Code of Business Ethics and Conduct.

Attachment D.5, Contractor Personal Conflict of Interest Financial Disclosure Template is provided as a “sample” for the Offeror/Contractor to follow when identifying, analyzing and mitigating actual, potential, or apparent Personal COIs for this contract. Notwithstanding, Personal COI information obtained from the above individuals shall not be submitted to the Government.

(d) Mitigation/Resolution: The Contracting Officer determines whether a COI has been identified and whether the actual, potential or apparent COI has been mitigated/resolved to the Government’s satisfaction. The Mitigation/Resolution plan may include a COI audit requirement as determined by the Contracting Officer. The Contractor's approved COI Mitigation/Resolution plan shall be incorporated into the contract.

In cases whereby a COI cannot be, or has not been, mitigated to the Contracting Officer’s satisfaction, the Contracting Officer may take the following action including, but not limited to:

i. Request a post-award waiver in accordance with FAR 9.503 Waiver, from the Head of the Contracting Activity; or

ii. Make changes to the requirements of the contract; or

iii. Terminate the contract.

(e) Independent Audit: If the Contracting Officer requires a COI audit as part of the accepted mitigation plan, the Contractor shall obtain the services of an External/Independent auditor to conduct an audit. If the Government chooses to undertake the audit in lieu of the Contractor’s independent auditor, the Contracting Officer will notify the Contractor within 60 days of the anniversary date of the contract.

Such auditor shall have expertise in conducting compliance program and conflict of interest audits. The Contractor’s records may also be subject to audit by the Government to ensure compliance with this contract’s C.2.III.D clause requirements and/or ensure that any corrective action, if necessary, has been implemented.

1. Subcontractors: A COI independent audit shall be required at the discretion of the Prime Contractor. If the Prime Contractor requires an audit of the subcontractor(s), the subcontractor’s audit shall be included with the Prime Contractor’s audit submission.

2. First Audit: When an audit is required as part of an acceptable mitigation plan, the Contracting Officer will negotiate the frequency of the audits and required deliverable dates. Generally, only one audit will be required during the period of performance subject to Contracting Officer discretion. The independent audit will be submitted by the auditor directly to the Contracting Officer with a copy to the Contractor.

3. Subsequent Audits: Additional audits are at the discretion of the Contracting Officer. The Contracting Officer will consider previous audit findings, any corrective action(s) and any new COI information, when making the decision to require subsequent audits.

4. Audit Findings: When Contractor Conflict of Interest Oversight findings are disclosed in an independent audit, the Contractor shall include in the draft audit report its proposed corrective action plan for each finding. The Contracting Officer may require a revised COI mitigation plan to be submitted as a result of the audit findings.

5. Independent Audit Requirements:

(a) The auditor shall decide what processes it will use to review, verify and confirm the information, processes and policies disclosed by the Contractor to the Government. The audit shall include a process for the contractor to review audit findings and provide a response to the auditor, which shall be included in the final audit submitted to the CMS Contracting Officer.

(b) The audit shall confirm that any and all COI mitigation plans, approved by the Government, have been implemented and are functioning as anticipated. Although not all inclusive, the auditor may also want to consider the following:

(i) Review of all COI disclosures submitted to the Government to validate the accuracy and completeness of such disclosures;

(ii) Conducting appropriate interviews with principals, key personnel and independent members of the board of directors, as appropriate;

(iii) Reviewing the Contractor’s organizational chart(s), articles of incorporation, bylaws and/or other documents, to validate the accuracy and completeness of COI disclosures to the Government;

(iv) Confirming that the Contractor annually, at a minimum, collects and reviews for assessment and appropriate action by the Compliance Officer, personal conflict information from its principals, key personnel (on the relevant contract(s)) and board of director members;

(v) Confirming whether the Contractor is in compliance with its internal Contractor Conflict of Interest Oversight program(s);

and,

(vi) For its Subcontractors, confirming whether the prime

Contractor is monitoring Subcontractor compliance with the required contract flow-down provisions and disclosed practices, in accordance with contract paragraph C.2.III.D. The auditor may review other information as it deems appropriate to ensure that COI issues have been identified and resolved, in accordance with Contractor disclosures.

(vii) The auditor will also examine the Contractor’s records to verify that all of the requirements specified in FAR 52.203- 13(c)(2)(ii), Contractor Code of Business Ethics and Conduct, are met.

6. Reporting Requirements: The audit report, inclusive of all auditor findings and proposed corrective actions, shall be delivered via e-mail or US Postal Service to the Contracting Officer directly from the auditor.

d. Subsequent COI Disclosures (i) When/if a COI is discovered during contract performance, subsequent COI disclosures may be required as follows:

• If as a result of, the Government or Contractor independent auditor review, any findings require a change in the Initial Disclosure, submit a COI Disclosure Revision, in accordance d (ii). below, to the Contracting Officer within 30 calendar days of the final audit report.

• Within 30 calendar days when the Contracting Officer requests a revision.

• At least 45 calendar days prior to a change due to proposed or planned business actions, e.g., acquiring or selling a business or business segment, changes in ownership of the organization holding the contract, etc.

(ii)What is Required in a Revision:

When COI disclosures require revision, the Contractor shall provide a revised Attachment D.6, Contractor Business Ethics, Conflict of Interest and Compliance Program Requirements. Red-lined versions are preferred.

e. Subcontractor Flow-Down Clause: The prime Contractor is responsible for avoiding, neutralizing and mitigating all actual, potential, or apparent COIs of its Subcontractors, in accordance with this clause. Therefore, the prime Contractor shall flow-down C.2.III.D. Post Award Business Ethics, Conflict of Interest and Compliance, of this contract in all subcontracts. For Subcontractors, wherever the term “Contractor” is used, insert “Subcontractor.”

E. CONTRACTOR WORK PERFORMED OUTSIDE THE UNITED STATES AND

ITS TERRITORIES (APR 2016)

To comply with requirements of Homeland Security Presidential Directive -12 (HSPD-

12) and Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple CMS information systems by efficiently verifying the claimed identity of individuals working on the contract. The Contractor and its subcontractor(s) shall not perform any activities under this contract, including the transmission of data or other information, outside of the United States (U.S.) and its Territories without the prior written approval of the Contracting Officer. If work must be performed outside the U.S., the Contractor shall submit a request to the Contracting Officer, in writing, at least 45 calendar days prior to the work beginning.

The Contracting Officer will consider the following factors in making a decision whether to authorize the performance of work outside the U.S. and its Territories:

1. Statement of Work requirements, which are being requested to be completed outside the U.S. and its Territories;

2. Total projected dollar value of the work to be performed outside the U.S.;

3. The desired country/location where the work will be performed;

4. FAR Part 25, Foreign Acquisitions, and all other laws and regulations applicable to the performance of work outside the United States;

5. Whether the contractor and/or its subcontractor(s) have plans in place to adequately protect and secure CMS data, as well as abide by all applicable laws and regulations when work is performed outside of the U.S. and its Territories. Plans shall include -

a. Adequate contract terms regarding system security;

b. Adequate contract terms regarding the confidentiality and privacy requirements for information and data protection;

c. Adequate contract terms that are otherwise relevant, including the requirements of the Statement of Work;

d. The Contractor’s corporate compliance plan and internal policies and procedures designed to prevent and detect violations of applicable law, regulations, rules and ethical standards by employees, agents and others; and,

6. Whether the approval would be in best interests of the United States.

The Contractor’s request for authorization to perform work outside the U.S. shall demonstrate that the performance of the work outside the U.S. satisfies all of the above factors. Contracting Officer approval to perform work outside the U.S. may require additional Statement of Work requirements, additional contract terms and conditions and/or Federal Acquisition Regulation (FAR) clauses to be incorporated into the contract.

F. HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. § 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor's duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

"Business Associate'' shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS’ HIPAA-covered functions.

"Covered Entity" shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

"Secretary" shall mean the Secretary of the Department of Health & Human Services or the Secretary's designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or on behalf of, Covered Entity other than as permitted or required by this Contract or as required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual for:

A. Filing a complaint under 45 CFR § 160.306;

B. Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under 45 CFR Part 160; or

C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its security policies and procedures, including workforce security measures, to ensure proper security awareness and training (including security incident response and reporting), and security incident procedures, in accordance with this Contract, including this HIPAA Business Associate Clause and the Contract’s clause entitled “CMS Information Security.”

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI created, received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as provided for by this Contract. In doing so, it shall implement policies and procedures to address the following and, where applicable, ensure that such policies and procedures are also in conformance with this Contract’s clause entitled “CMS Information Security:”

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual’s access rights to PHI (including the implementation of workforce security measures to ensure continued appropriate role-based access to PHI), and technical policies and procedures to ensure compliance with grants of access (including unique user identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities in which they are housed.

C. Implement policies, procedures and physical security measures that will limit access to PHI through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or outside of the Business Associate’s facility as well as the disposal and reuse of media containing PHI.

E. Implement appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability (including the use of contingency plans) of any electronic protected health information ("EPHI") it creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, maintenance or transmission of such EPHI. In the establishment of such safeguards, Business Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, and its hardware and software security capabilities.

iii. Assess, and implement, where appropriate, any addressable implementation specifications associated with applicable PHI security standards.

iv. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

v. Comply with the following Incident Reporting:

A. Report to Covered Entity any security incident/breach involving unsecured PHI, of which it becomes aware, including those of its agents and subcontractors. The Business Associate shall report any violation of the terms of this contract involving PHI and any security incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in accordance with the CMS Risk Management Handbook (RMH), specifically “RMH Vol II Procedure 7-2 Incident Handling Procedure” and “RMH Vol III Standard 7-1 Incident Handling.” These procedures can be found at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/InformationSecurity/Information-Security-Library.html. In addition, the Business Associate will also notify the CMS Contracting Officer and the Contracting Officer’s Representative (COR) by email within one (1) hour of identifying such violation or incident.

B. Upon Covered Entity's knowledge of any material security incident/breach by Business Associate, Covered Entity will provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination clause of this Contract. See also paragraph D. Term of Clause below.

vi. Ensure that any agent or subcontractor agrees through a written contract, or other legally enforceable arrangement, to the same restrictions and conditions that apply through this HIPAA Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or on behalf of, Covered Entity.

vii. Upon Covered Entity’s request:

A. Provide the Covered Entity or its designee with access to the PHI created, received, maintained or transmitted by Business Associate from or on behalf of the Covered Entity in the course of contract performance in order to ensure Covered Entity’s ability to meet the requirements under 45 CFR § 164.524.

B. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR § 164.526.

viii. Make its facilities and any books, records, accounts, and any sources of PHI, including any policies and procedures, that are pertinent to ascertaining its own compliance with this contract or the Covered Entity’s compliance with the applicable HIPAA requirements, available to Covered Entity, or, in the context of an investigation or compliance review, to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the various rules implementing the HIPAA.

ix. Document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

x. Provide to Covered Entity, or an individual identified by the Covered Entity, information collected under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45

CFR § 164.528.

xi. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

d. Term of Clause

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of the PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity in accordance with “CMS Information Security” procedures. Business Associate shall not retain any

PHI.

2. Security Incident/Breach:

Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall take action consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts – Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of Contracts, if the Business Associate does not cure the security incident/breach within the time specified by Covered Entity and/or cure is not possible; or, B. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

ii. Other Agreements –Covered Entity shall either:

A. Provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination terms of this Contract. Covered Entity may terminate this Contract for default if the Business Associate does not cure the breach or end the violation within the time specified by Covered Entity; or, B. Consistent with the terms of this Contract, terminate this Contract for default if Business Associate has breached a material term of this Contract and cure is not possible;

or, C. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

3. Returning or Destroying PHI:

Business Associate, as defined above, which includes subcontractors or agents of the Contractor, shall:

i. Upon expiration or termination of this Contract, for any reason, return or destroy all PHI received from Covered Entity or another Business Associate of the Covered Entity, as well as any PHI created, received, maintained or transmitted from or on behalf of Covered Entity, or another Business Associate of the Covered Entity, in accordance with this contract, including the “CMS Information Security” clause.

ii. In the event that Business Associate determines that returning or destroying the PHI is infeasible, provide to Covered Entity notification of the conditions that make return or destruction infeasible.