75FCMC24RJ002_Amendment 0001.pdf

RFP-75FCMC24RJ002_Amendment 0001 State Medicaid Program Integrity Audits

75FCMC24RJ002, State Medicaid Program Integrity Audits, is hereby amended as follows:

Section J- Exhibit E.1 - SMPIA Questions Submission Template has been replaced with Exhibit E.1 SMPIA Questions Submission – Responses.

Section L.5 - has been updated to clarify that only Volume 1, Section A & B are to be included in the Phase 1 submission and that Phase 2 shall include Volume 1, Section A, C & D and Volume II & III.

Section L.6 - has been updated to add assumptions.

Section L.7 - has been updated to accommodate a one-page cover letter with each Phase submission.

Section L.7 - has been updated to clarify that only Volume 1, Section A & B are to be included in the Phase 1 submission and that Phase 2 shall include Volume 1, Section A, C & D and Volume II & III.

Section L.7 – has been updated to increase the page limit for Scenario 2 to five-pages.

Section L.8 - has been updated to correct the naming convention. Specifically, the Section entitled "Business Proposal Spreadsheet" has been renamed Section "E" and the Section entitled "Business Proposal Narrative" has been renamed Section "F".

PART I – THE SCHEDULE

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 DESCRIPTION OF SERVICES

The purpose of the State Medicaid Program Integrity (PI) Audits (SMPIA) contract is to assist CMS with its review of state Medicaid and Children’s Health Insurance Program (CHIP) program integrity oversight functions, including compliance with Medicaid PI regulations and beneficiary eligibility requirements.

The work to be performed is described in detail in the SMPIS Statement of Work (SOW), provided as Attachment J.1.

B.2 TYPE OF CONTRACT

The contract is Cost-Plus-Fixed-Fee (CPFF). A contract line item number (CLIN) is established for the base period and each optional period.

B.3 SCHEDULE OF SERVICES

The total estimated cost of this contract is $TBD. The total estimates fixed fee amount for this contract is $TBD. The total estimated CPFF for this contract is $TBD.

The following schedule delineates the estimated cost and fixed fee for each period of performance:

CLIN # Description Cost Fee Total CPFF Funded Period of Performance CLIN 0001 Base Period 12/1/2024 – 11/30/2025 CLIN 0002 Option Period 1 12/1/2025 – 11/30/2026 CLIN 0003 Option Period 2 12/1/2026 – 11/30/2027 CLIN 0004 Option Period 3 12/1/2027 – 11/30/2028 CLIN 0005 Option Period 4 12/1/2028 – 8/31/2029

CLIN 0006 Option Period 5 3 MO Fully Operational 9/1/2029 – 11/30/2029

CLIN 0007 Optional Transition-Out 9/1/2029 – 11/30/2029

B.4 FIXED FEE PAYMENT SCHEDULE

In accordance with FAR 16.306, under this CPFF Term type contract, in order to be paid fixed fee, the contractor must meet the following:

1) At a minimum, devote the following Level of Effort (LOE) for each performance period per Contract Line Item Number as follows:

CLIN Level of Effort Definite Time Period

0001 TBD 12/1/2024 – 11/30/2025

0002 TBD 12/1/2025 – 11/30/2026

0003 TBD 12/1/2026 – 11/30/2027

0004 TBD 12/1/2027 – 11/30/2028

0005 TBD 12/1/2028 – 8/31/2029

0006 TBD 9/1/2029 – 11/30/2029

0007 TBD 9/1/2029 – 11/30/2029

a. The contractor will receive fixed fee based on the following chart for each CLIN for that specified time period:

Specified Level of Effort Met Percent of Fee Received 75% - 100% 100% 60% - 74% 75% 45% - 59% 50% 30% - 44% 25% 1% - 29% 5%

0% 0%

b. In the event that the contractor provides more than 100% of the estimated LOE, the fixed fee of the Contract shall not be adjusted.

2) Performance must be considered satisfactory during each time period. At the expiration of each time period the Contracting Officer, in coordination with the Contracting Officer’s Representative, will make a determination of satisfactory performance.

If both of the above are met, the Contracting Officer will authorize the contractor to bill for the fixed fee, except the 15% withhold (up to the maximum of $100,000) in accordance with FAR 52.216-8.

3) The contractor’s monthly voucher shall provide the current LOE utilized for both the current billed period and the cumulative LOE for that period of performance/CLIN as follows:

CLIN 000X

LOE from X/X/X to X/X/X Cumulative LOE to date

Prime X Hours X Hours

Subcontractor X Hours X Hours

These terms and conditions do not supersede the requirements of either FAR clause 52.232-20 “Limitation of Cost” or FAR clause 52.232-22 “Limitation of Funds.”

(END OF SECTION B)

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 STATEMENT OF WORK

Independently and not as an agent of the Government, the contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the SMPIA Statement of Work, Section J, Attachment J.1 attached hereto and made a part of this contract.

(END OF SECTION C)

SECTION D - PACKAGING AND MARKING

D.1 PACKAGING, MARKING AND SHIPPING

Deliverables shall be marked in accordance with the SOW Appendix B – List of Deliverables.

(END OF SECTION D)

SECTION E - INSPECTION AND ACCEPTANCE

E.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

https://www.acquisition.gov/

Clause No. Title Date 52.246-5 Inspection of Services – Cost Reimbursement APR 1984

E.2 INSPECTION AND ACCEPTANCE

(a) All work under this contract is subject to inspection and final acceptance by the Contracting Officer or the duly authorized representative of the Government.

(b) The Government's Contracting Officer Representative (COR) is a duly authorized representative of the Government and is responsible for inspection and acceptance of all items to be delivered under this contract.

(c) Inspection and acceptance of the contractor’s performance shall be in accordance with the applicable FAR clauses in Section E.1 above.

(END OF SECTION E)

SECTION F - DELIVERIES OR PERFORMANCE

F.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text

52.242-15 Stop-Work Order – Alternate I (Aug 1989) APR 1984

F.2 PERIOD OF PERFORMANCE (JAN 2014)

The Period of Performance for SMPIA is estimated to be December 1, 2024 to November 30, 2025.

The contract includes the following estimated Option Periods:

F.3 SCHEDULE OF DELIVERABLES

The Contractor shall submit all required deliverables in accordance with the SOW Schedule of Deliverables.

(END OF SECTION F)

Option Period 1 CLIN 0002 12/01/2025 – 11/30/2026 Option Period 2 CLIN 0003 12/01/2026 – 11/30/2027 Option Period 3 CLIN 0004 12/01/2027 – 11/30/2028 Option Period 4 CLIN 0005 12/01/2028 – 08/31/2029 Option Period 5 3 MO Fully Operational

CLIN 0006 09/01/2029 – 11/30/2029

Optional Transition Out CLIN 0007 09/01/2029 – 11/30/2029

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 ACCOUNTING AND APPROPRIATION DATA

Requisition Appropriation Object Class CAN Amount

TBD TBD TBD TBD TBD

G.2 PAYMENTS - INVOICES – (March 2024)

a. GENERAL: Effective August 31, 2020, the contractor/vendor shall create an invoice within the Invoice Processing Platform (IPP), a secure Web-based service for federal agencies and their vendors to manage government invoicing from purchase order (PO) through payment notification. Note: All invoice terms and conditions are contract specific and may vary from contract to contract.

b. CONTENT OF INVOICE: FAR 32.905 Payment Documentation and Process, provides the required content for a proper invoice. In addition to the requirements of FAR 32.905, the following items shall also be included on the invoice to be considered proper:

• Line item number (i.e. CLIN/SLIN as applicable);

• Contractor/Vendor’s Unique Entity Identifier (UEI) Number;

• Period of Performance (PoP) or delivery date of goods or services provided;

• Attachments and applicable support documentation requested by the CO;

• The first page of the PDF invoice or PDF SF-1034 shall include:

1. Contractor/Vendor name and address;

2. Bill to: CMS, P.O. Box 7520, Baltimore, MD 21207;

3. Full CMS contract number and task order number;

4. Summary of charges by CLIN/SLIN (if applicable) with a grand total.

CLIN/SLIN(S) on the PDF shall be identical to what is entered in IPP;

5. Invoice number shall be identical to what is entered in IPP. If using a dash in IPP then the dash must be used on the PDF. IPP does not allow any special characters (i.e.*, #, _);

6. Within IPP, the “Bill Period Start” and “Bill Period End” dates should align with the “Service From” and “Service To” dates (this is not the entire POP dates);

7. Date of Delivery or Service dates shown on the PDF should: (i) Fall within the contract POP (unless contract indicates otherwise) (ii) Align with the “Bill Period Start” and “Bill Period End” dates and “Service From” and “Service To” dates, and (iii) Note when the work was performed;

8. Date invoice was prepared;

9. The total invoice amount on the first page of the invoice or SF-1034 must be a debit. A credit may be shown on the first page of the invoice or SF- 1034 if the credit falls within the Period Of Performance and is for the same CLIN as the debit. CMS does not accept credit vouchers or process https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2032_9.html#wp1032997 https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2032_9.html#wp1032997 refunds in IPP or the Invoice Submission Box. Credits must be submitted via Pay.gov (For questions surrounding Pay.gov, contact invoicesubmission@cms.hhs.gov). Credits sent to Pay.gov shall be copied to the CO, CS and COR;

• When an invoice has been resubmitted, an “R” should be added after the invoice number on the PDF and in IPP; this will ensure that the original invoice number is not duplicated in IPP. If a resubmitted invoice is rejected again, each subsequent resubmission requires an additional “R” added after the invoice number (i.e. “RR”);

• The “final” designation should only be used when the contract is being closed out by OAGM. Do not use for the end of POP or Option Year;

• Contractor/Vendor must maintain active registration in SAM.gov. If your SAM account is about to expire, wait until it is updated before submitting your invoice; and,

• Banking or address changes must be submitted via email to CCRchanges@cms.hhs.gov.

c. INVOICE SUBMISSION: The contractor/vendor shall create an invoice from the

Purchase Order (PO)/Contract via the IPP website http://www.ipp.gov/. For questions, call IPP Customer Support at (866) 973-3131 or email the IPP Customer Support at IPPCustomerSupport@fiscal.treasury.gov. Only one PDF invoice per submission is allowed in IPP.

d. PAYMENTS: The Government shall make payment of all proper invoices in accordance with the following clauses, as applicable and included in the respective TO/PO/Contract:

• FAR 52.232-33 Payments by Electronic Funds Transfer – System for Award

Management,

• FAR 52.232-1 Payments

• FAR 52.212-4 Contract Terms and Conditions – Commercial Items (If applicable)

• FAR 52.216-7 Allowable Cost and Payment

• FAR 52.232-7 Payments under Time-and-Materials and Labor-Hour Contracts

Payment shall be made upon acceptance by the Contracting Officer’s Representative (COR) in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer’s approval, as appropriate.

Reimbursement for invoices submitted under this contract shall be made no later than 30 calendar days after receipt of a proper invoice from the Contractor requested at the paying office designated above. Contracts with a 15-day payment term are not subject to interest payments until after day 30.

e. INTEREST ON OVERDUE PAYMENT: The Prompt Payment Act, Public Law 97-177 (96

Stat.85.31 U.S.C. 1801) is applicable to payments under this contract and requires the http://www.ipp.gov/ payment of interest on payments made more than 30 calendar days after receipt of a proper invoice in IPP.

Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and 5 CFR 1315.

G.3 CONTRACTOR PAST PERFORMANCE EVALUATION(S) (OCT 2014)

a. General:

In accordance with Federal Acquisition Regulation (FAR) 42.15, Contractor Performance Information, past performance evaluations shall be prepared at least annually and at the time the work under a contract or order is completed. Additional interim performance evaluations may be prepared at Contracting Officer discretion, as necessary.

CMS will utilize the Contractor Performance Assessment Reporting System (CPARS), the Government-wide evaluation reporting tool for all past performance reports on contracts and orders, as appropriate. CPARS is a secure Internet website located at https://www.cpars.gov.

b. CPARS Process:

1. CPARS Training: Contractors may obtain CPARS training material and register for on-line training https://www.cpars.gov.

2. Post-Award Contract Registration: CMS is responsible for registering the contract in CPARS within 30 calendar days of contract award. The Contractor shall:

i. Designate at least one (1) point of contact that will be responsible for serving as the

Contractor’s Representative (CR). Additional CRs may also be identified; and,

ii. Provide the CMS Contract Specialist with the name(s) and email address(es) of the

CPARS point(s) of contact.

Once CMS registers the contract in CPARS, the CR(s) will receive an automated CPARS email message that contains User IDs and instructions for creating a password for future past performance evaluation processing.

3. Interim, Annual and Final Past Performance Evaluation Reports:

a. Issuing the Evaluation: Once the CMS Assessing Official (AO) issues an evaluation to the Contractor in CPARS, the CR(s) will receive an email instructing them to login to CPARS to review the evaluation.

b. Contractor Comments: The CR has the option to provide comments on the evaluation, indicate if they concur or do not concur with the evaluation, sign, and https://www.cpars.gov/ https://www.cpars.gov/ then return the evaluation to the AO. The CR has a total of 60 days following the AO’s evaluation signature date to submit comments. If the CR submits comments within the first 14 days following the AO’s signature date and the AO closes the evaluation, the evaluation will become available in CPARS within 1 day.

On day 15 following the AO’s evaluation signature date, the evaluation will become available in CPARS with or without CR comments and whether or not it has been closed by the AO. If no CR comments have been sent and the evaluation has not been closed, it will be marked as “Pending” in CPARS.

If the CR sends comments at any time prior to 61 days following the AO’s evaluation signature date, those comments will be reflected in CPARS within 1 day. On day 61 following the AO’s evaluation signature date, the CR will be “locked out” of the evaluation and may no longer send comments.

G.4 Contractor Work Performed Outside the United States and its Territories (JAN 2021)

To comply with requirements of Homeland Security Presidential Directive -12 (HSPD-12) and Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple CMS information systems by efficiently verifying the claimed identity of individuals working on the contract. The Contractor and its subcontractor(s) shall not perform any activities under this contract, including the transmission of data or other information, outside of the United States (U.S.) and its Territories without the prior written approval of the Contracting Officer. If work must be performed outside the U.S., the Contractor shall submit a request to the Contracting Officer, in writing, at least 45 calendar days prior to the work beginning.

The Contracting Officer will consider the following factors in making a decision whether to authorize the performance of work outside the U.S. and its Territories:

1. The necessity of the work to be performed outside the United States and its territories;

2. The Statement of Work under contract that will be performed outside the U.S. and its Territories;

3. Total projected dollar value of the work to be performed outside the U.S.;

4. Total projected number of labor hours and length of time to be performed for each individual employee working outside the U.S.;

5. The desired country/location where the work will be performed;

6. FAR Part 25, Foreign Acquisitions, and all other laws and regulations applicable to the performance of work outside the U.S.;

7. The contractor and/or its subcontractor(s) plans to adequately protect and secure

CMS data, as well as abide by all applicable laws and regulations when work is performed outside of the U.S. and its Territories. Plans shall include -

a. Adequate contract terms regarding system security;

b. Adequate contract terms regarding the confidentiality and privacy requirements for information and data protection;

c. Adequate contract terms that are otherwise relevant, including the requirements of the Statement of Work;

d. The Contractor’s corporate compliance plan and internal policies and procedures designed to prevent and detect violations of applicable law, regulations, rules and ethical standards by employees, agents and others; and,

8. The necessity of Government Furnished Equipment (GFE) or Contractor Owned/Contractor Operated (COCO) devices to be used outside the U.S. and verification of a secure VPN access.

9. Compliance with Executive Order 13940 Aligning Federal Contracting and Hiring Practices With the Interests of American Workers. Determine if approval will reduce opportunities for the United States contractor workers performing in the United States and if this would cause any potential effects to national security.

10. Conformance with Section 889 “Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment”, of Public Law 115-232.

11. Determination that approval is in best interest of the Government.

The Contractor’s request for authorization to perform work outside the U.S.

shall include supplemental information to demonstrate that the performance of the work outside the U.S. satisfies all of the above factors. Contracting Officer approval to perform work outside the U.S. may require additional Statement of Work requirements, additional contract terms and conditions and/or Federal Acquisition Regulation (FAR) clauses to be incorporated into the contract.

G.5 GOVERNMENT REPRESENTATIVES AND RESPONSIBILITIES (SEPT 2021)

Following are the Government Representatives and their respective roles and responsibilities on this contract:

a. Contracting Officer

As defined in Federal Acquisition Regulation (FAR) 2.101, Definitions, and in accordance with FAR 1.602-1, Authority, “Contracting officers have authority to enter into, administer, and/or terminate contracts and make related determinations and findings.” There is no other authorized representative or any other Administrative Contracting Officer assigned to this contract to carry out a Contracting Officer’s duties, except for technical direction assigned to the Contracting Officer’s Representative, if applicable.

The Contracting Officer is:

Centers for Medicare & Medicaid Services

Office of Acquisition & Grants Management Acquisition Support Group Division of Program Integrity and Financial Management Contracts ATTN: Jennifer Kuhn 7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-2299 Email Address: jennifer.kuhn@cms.hhs.gov

b. Contract Specialist

Notwithstanding any of the other provisions of this Contract, the Contract Specialist will assist the Contracting Officer with his/her responsibilities as defined in the FAR.

The Contract Specialist is:

Office of Acquisition & Grants Management Acquisition Support Group Division of Program Integrity and Financial Management Contracts ATTN: Kyle Patton 7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-8714 Email Address: kyle.patton@cms.hhs.gov

c. Contracting Officer’s Representative

The Contracting Officer’s Representative (COR), as defined in FAR 2.101, Definitions, is:

Phone: TBD Email Address: TBD

Center for Program Integrity

ATTN: TBD

7500 Security Blvd.

Mail-stop: TBD Baltimore, MD 21244-1850 mailto:jennifer.kuhn@cms.hhs.gov mailto:kyle.patton@cms.hhs.gov

In accordance with FAR 1.602-2(d), Responsibilities, the COR’s delegated responsibilities are identified in the Contracting Officer’s appointment memorandum, a copy of which will be furnished to the contractor.

Technical direction must be within the general scope of the work stated in the contract. The term "technical direction" is defined to include, without limitation, the following:

(1) Directions to the Contractor which direct the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual technical requirements as identified in the Statement of Work or Performance Work Statement; or

(2) Provision of information to the Contractor, which assists in the interpretation of drawings, specifications, or technical portions of the work description.

The COR does not have the authority to:

1. Make changes to contract terms and conditions;

2. Direct the contractor to perform work or make deliveries not specifically required under the contract;

3. Waive or relax the Government’s rights with regard to the Contractor’s compliance with the specifications, price, delivery or any other terms or conditions of the contract;

4. Make any commitments or approve any actions that would create any financial obligation on the part of the Government; or

5. Issue direction that constitutes a “change” as defined in:

FAR 52.243-1, Changes – Fixed Price;

FAR 52.243-2, Changes – Cost Reimbursement;

FAR 52.243-3, Changes – FAR 52.243-4, Changes; or, FAR 52.243-5, Changes and Changed Conditions.

All technical direction shall be issued in writing by the COR or, if issued verbally, shall be confirmed in writing by the COR within five (5) business days after issuance.

The Contractor shall proceed promptly with the performance of technical direction duly issued by the COR within the scope of his/her authority.

If, in the opinion of the Contractor, any instruction or direction issued by a Government representative constitutes a change to the contract or constitutes a “Change Order” as defined in FAR 2.101, Definitions, the Contractor shall follow the instructions identified in FAR 52.243-7 Notification of Changes.

G.6 SUBCONTRACT CONSENT

(a) For the purposes of this contract, consultants are considered subcontractors.

(b) To facilitate the review of a proposed subcontract, by the COR and the Contracting

Officer, the contractor shall submit the information required by the FAR Clause 52.244-2 entitled, “Subcontracts,” and FAR 52.244-5 “Competition in Subcontracting” to the Contracting Officer. The contracting officer shall review the request for subcontract approval and the COR’s recommendation and advise the contractor of their decision to consent to or dissent from the proposed subcontract, in writing.

(c) Consent is hereby granted to the following subcontracts:

TBD (if applicable)

G.7 INDIRECT COST RATES (May 2021)

Paragraphs 1 and 2 below apply only to contractors where the Department of Human Health and Services (HHS), or one of its Operating Divisions (e.g. CMS), is recognized as the Cognizant Federal Agency (CFA) as defined in FAR 42.003.

If an Agency other than HHS (or one of HHS’ Operating Divisions) is identified as the CFA (e.g.

Defense Contract Management Agency), paragraphs 1 and 2 below do not apply. Rather, the contractor must provide a copy of all applicable and executed provisional billing rate agreements, forward pricing rate agreements, and final indirect cost rate agreements to the CMS Acquisition Division of Financial Services mailbox:

AcquisitionDFSIncurredCostSubmission@cms.hhs.gov.

1. Provisional Billing Rates

(a) Formation

(1) Until final indirect cost rates are established pursuant to FAR 52.216-7(d), the Government will reimburse the contractor’s incurred indirect costs temporarily using the provisional billing rates established in the Provisional Billing Rate Agreement as described below.

(2) In accordance with FAR 52.216-7(e), FAR Subpart 42.704, and HHSAR Subpart 342.705, the following authorized Agency shall execute a Provisional Billing Rate Agreement setting forth the provisional billing rates to be used by the contractor:

mailto:AcquisitionDFSIncurredCostSubmission@cms.hhs.gov

Financial Management Services, Division of Cost Allocation, Program Support Center (PSC) contracts awarded to State and local governments, colleges and universities, hospitals, and other nonprofit organizations

National Institute of Health (NIH), Division of Financial Advisory Services (DFAS) contracts awarded to for profit organizations

Billing rates may be prospectively or retroactively revised by mutual agreement of the respective authorized Agency and the contractor at either party’s request.

(3) The contractor shall submit an annual Provisional Billing Rate Proposal no later than two months prior to the start of the contractor’s fiscal year. For example, if the contractor’s fiscal year ends on December 31 the Provisional Billing Rate Proposal shall be submitted no later than November 1 the preceding year.

(4) In the absence of an executed Provisional Billing Rate Agreement, the contractor shall submit all vouchers for reimbursement of incurred indirect costs at the rates submitted for review in the contractor’s applicable, annual Provisional Billing Rate Proposal.

(5) If the contractor fails to submit a timely Provisional Billing Rate Proposal within the time specified in paragraph (a)(3) of this clause, the Contracting Officer may disallow payment of indirect costs (in part or entirely) until:

(i) A Provisional Billing Rate Proposal is submitted; or

(ii) The authorized Agency representative unilaterally establishes provisional billing rates for the fiscal year in accordance with FAR 52.216-7.

(b) Provisional Billing Rate Proposal Requirements

(1) The Provisional Billing Rate Proposal shall include:

(i) A cover letter which contains:

a. A summary of the proposed billing rates;

b. A listing, with applicable point-of-contact information, of company representatives, who can be contacted regarding the proposal;

c. A listing identifying applicable contract(s) with CMS and other Federal Government awards, which require billings rates for the proposed period.

(ii) Billing rate calculations with separate supporting budgets for each final and intermediate cost pool, including the components of each indirect pool and allocation base as well as the computation of each indirect rate. Each calculation shall include a succinct description and rationale.

(iii) The prior fiscal year pool and base, including the components of each indirect cost pool and corresponding base, as well as the computation of each indirect rate.

(iv) Current FY year to date (YTD) pool and base, including the components of each indirect cost pool and its allocation base, as well as the computation of each YTD indirect rate

(v) Current FY budget pool and base, if available.

(vi) Comparative analysis with explanation of any significant rate differences (at or above 3%) from the previous year.

(2) The Contractor shall submit a revised annual Provisional Billing Rate Proposal in accordance with the Provisional Billing Rate Proposal Requirements as outlined above whenever there is a material change in the contractor’s rates or indirect rate structure.

(i) A material change shall include, but not be limited to, an event which causes a significant rate difference (at or above 3%), such as the award or termination of a contract to the contractor.

(ii) The revised annual Provisional Billing Rate Proposal shall be due within 60 days of the effective date of the material change.

(c) Provisional Billing Rate Proposal Submission

The Provisional Billing Rate Proposal shall be submitted to the CMS Acquisition Division of Financial Services mailbox at AcquisitionDFSIncurredCostSubmission@cms.hhs.gov and to the respective authorized Agency as follows:

PSC contracts awarded to State and local governments, colleges and universities, hospitals, and other nonprofit organizations cas-bethesda@psc.hhs.gov

NIH-

DFAS

contracts awarded to for profit dfas-idc@nih.gov

2. Final Indirect Cost Rates mailto:cas-bethesda@psc.hhs.gov mailto:dfas-idc@nih.gov

(a) Final Rate Agreement

In accordance with FAR 52.216-7(d), FAR Subpart 42.705, and HHSAR Subpart 342.705, the following authorized Agency shall execute a Final Rate Agreement setting forth the final indirect cost rates to be used by the contractor:

PSC contracts awarded to State and local governments, colleges and universities, hospitals, and other nonprofit organizations

NIC contracts awarded to for profit organizations

(b) Incurred Cost Proposal Submission Requirements

The contractor’s adequate final indirect cost rate proposal shall be submitted within the 6-month period following the expiration of each of its fiscal years in accordance with FAR 52.216-7(d) to the CMS Acquisition Division of Financial Services mailbox at AcquisitionDFSIncurredCostSubmission@cms.hhs.gov and to the respective authorized Agency as follows:

PSC contracts awarded to State and local governments, colleges and universities, hospitals, and other nonprofit organizations cas-bethesda@psc.hhs.gov

NIH-

DFAS

contracts awarded to for profit dfas-idc@nih.gov

G. 8 CMS CONTRACT FUNDS MANAGEMENT (CFM) (OCT 2023)

The contractor shall provide a CFM Report which includes information delineated by Contract Line Item Number (CLIN) and Subline Item Number (SLIN) to assist CMS in effectively and efficiently managing contract funds and to assess the contractor’s effectiveness in forecasting, managing and controlling costs. The CFM Report shall be submitted as directed in the Schedule of Deliverables.

This term and condition is intended to augment and work in conjunction with FAR clauses 52.232-20 Limitation of Cost, 52.232-22 Limitation of Funds, and/or 52.212-4(i)(2) Contract Terms and Conditions – Commercial Products and Commercial Services. This language does not replace or otherwise negate contract actions required in any FAR or HHSAR clauses.

For Cost Reimbursement CLIN/SLINs, the contractor shall, at a minimum, provide the following CFM information, per CLIN and SLIN.

• CFM Report to include the following:

mailto:cas-bethesda@psc.hhs.gov mailto:dfas-idc@nih.gov o Basis used for forecasting costs to complete the remainder of the work;

o Identify and explain any variance between billing rates and anticipated end-of-year rates, including impact on cost;

o Indicate if any updates to billing rates are needed, along with rationale;

o Recommendations which may include in-scope work changes, change in level of effort, deobligations, etc. and o Completed Estimate at Completion (EAC) Attachment J.2 to include:

Actual costs of work performed by cost element to date;

Forecasted direct and indirect costs to complete the remainder of the work by cost element; and Indirect Cost Rates used for calculations must be identified and separated by contractor accounting/fiscal year using the contractor’s final or anticipated final indirect cost rates, as applicable.

EAC must be submitted in Excel format with fully functioning formulas and not password protected.

The CFM Report will be used to perform a periodic cost underrun and overrun analysis in an effort to efficiently track and evaluate actual costs incurred as the work is being performed.

The Contracting Officer (CO) reserves the right to request additional CFM information as the CO deems appropriate, provided in a format specified by CMS.

G. 9 DEPARTMENT OF HEALTH AND HUMAN SERVICES ACQUISITION REGULATIONS

(HHSAR) CLAUSES INCORPORATED BY REFERENCE (MAY 2015)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were provided in full text. Upon request, the Contracting Officer will provide the information in full text. The full text of a clause is also available electronically at http://www.hhs.gov/policies/hhsar/.

352.232-71 Electronic Submission of Payment Requests FEB 2022

(END OF SECTION G)

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.1 CONFLICT OF INTEREST (OCT 2020)

a. General: The contractor and the services provided under this contract shall be free, to the greatest extent possible, of all Organizational and Personal Conflicts of Interest. Consistent with these terms and conditions, all references to Organizational and/or Personal Conflicts of Interests will be referred to individually or collectively, as Conflicts of Interest (COI). Except as defined by these terms and conditions and in accordance with FAR 9.503, the Contracting Officer shall not maintain a contract with a contractor the Contracting Officer (CO) determines has, or has the potential for, an unresolved COI.

b. Definitions:

Actual COI– The COI is either currently in existence as determined by the contractor or CMS. This form of COI will require avoidance, neutralization or mitigation acceptable to

CMS.

Affiliates –Associated business concerns or individual(s) if, directly or indirectly, either one controls or can control the other; or a third party controls or can control both.

Apparent (Perceived) COI – The COI on first observation appears to be an actual or potential COI, but may or may not be after analysis.

Avoidance – To prevent the occurrence of a COI through actions such as exclusion of sources or modification of requirements. Avoidance precludes the conflict.

Contractor – The term contractor is used synonymously with offeror.

Financial Relationships – A direct or indirect ownership or investment interest (including a stock option or non-vested interest) in any entity that exists through equity, debt, or other means and includes any indirect ownership or investment interest no matter how many levels removed from a direct interest.

Mitigation– To reduce the effects of a COI to an acceptable level of risk so that the Government’s interest with regard to fair competition and/or contract performance are not impaired. The conflict remains but action was taken that minimizes the impact of the conflict to an acceptable level of risk.

Mitigation Plan – The contractor’s written approach to mitigating a COI as documented in J.2 Section B.4.

Neutralization – To counteract, through a specific action, the effects of potential or actual COI. The conflict remains, but the impact of the conflict has been negated.

Organizational Conflict of Interest – Occurs when other activities or relationships with other persons, a person is unable or potentially unable to render impartial assistance or advice to the Government, or the person’s objectivity in performing the contract work is or might be otherwise impaired, or a person has an unfair competitive advantage.

Personal Conflicts of Interest – A situation in which a person has a financial interest, personal activity, or relationship that could impair the person’s ability to act impartially and in the best interest of the Government when performing under this contract.

Potential COI – A future situation or circumstance that would create a conflict of interest.

Three (3) Types of COIs include:

Conflict Types Definitions

Biased Ground Rules

Consists of situations where a contractor and/or its affiliate(s), as part of its performance of a Government contract, has helped (or is in a position to help) set the ground rules for another Government contract by, for example, writing the statement of work or the specifications, or establishing source-selection criteria. In these “biased ground rules” cases, the primary concern is that the entity could skew the competition, whether intentionally or not, in favor of itself and/or its affiliates.

Impaired Objectivity

Consists of situations where a contractor and/or its affiliate(s) has an interest (typically financial) that may conflict with the interest of the Government to whom the contractor has a contractual obligation, and where the entity’s work under the Government contract could give the contractor the opportunity to benefit its other business interests. If the entity is providing recommendations, judgment or advice, and its other business interests could be affected by that recommendation, judgment or advice, it’s objectivity may be impaired. An example is where the entity was evaluating itself or evaluating an affiliate or a competitor, either through an assessment of performance under another contract or an evaluation of proposals.

Unequal Access to Information

“Unfair” access to non-public information – Consists of situations where a contractor and/or its affiliate(s) has access to nonpublic information (including proprietary information and non-public source-selection information) as part of its performance of a Government contract and that information may provide the entity with a competitive advantage in a later competition for a Government contract. In these “unequal access to information” cases, the concern is limited to the risk of the contractor and/or its affiliates gaining an unfair competitive advantage; there is no issue of bias. Note: Incumbency alone does not constitute “unequal access to information.”

c. Significant Potential Conflict of Interest:

1. Nature of Conflict: Although not all inclusive, the following are considered to be an actual, potential or apparent COI with the work to be performed under this contract. The contractor shall promptly notify the CO if it is an entity, or affiliated with an entity, where any of the following circumstances exist:

a) Biased Ground rules, impaired objectivity or unequal access to information as explained in the definitions above and/or;

b) Within the three types of conflicts of interest, the CO has identified the following specific circumstances of conflicts:

The State Medicaid Program Integrity Audit Contractor cannot be an entity or become organizational affiliated with an entity that is a Medicaid or Children’s Health Insurance Program (CHIP) provider or a State. A financial relationship between the State Medicaid Program Integrity Audit Contractor and the above listed entities based on other than organizational affiliations has the potential for creating significant conflicts of interests. Should the financial relationship create a significant conflict it must be adequately mitigated.

2. Proposed Restraint on Future Contractor Activities: CMS is proposing to restrain future contractor activities as follows:

While performing under the State Medicaid Program Integrity Audit contract, the contractor nor its affiliates, shall become a Medicaid or CHIP provider or a State. While performing under the State Medicaid Program Integrity Audit contract, the contractor nor its affiliates shall establish a financial relationship with a Medicaid or CHIP provider or a State, that the Contracting Officer has determined to present an unmitigable conflict of interest.

d. Conflict of Interest Oversight and Mitigation Plan:

1.Conflict of Interest Oversight Program: The contractor shall maintain an effective COI Oversight Program throughout the performance of the contract which includes procedures to monitor and disclose all Organizational and Personal Conflicts of Interest. A COI oversight program should include the monitoring of personal conflicts of interest such as, but not limited to:

a) Managers or Key Personnel who would be, or are involved with, the performance of this contract;

b) Governing Body Members (e.g., Board of Directors; Trustees); and

c) Principals of the organization as defined by FAR 52.203-13, Contractor Code of Business Ethics and Conduct.

2. Mitigation Plan: At any time during the performance of the contract if an actual, potential, or apparent COI is identified whether by the CO, the contractor or otherwise, the contractor shall submit a mitigation plan (J.1 Contractor/Offeror COI

Submission Template) within 30 days unless otherwise specified by the CO. It is the contractor’s responsibility under the terms and conditions to provide timely notification to the CO those COIs that are self-identified. The CO will notify the contractor regarding the specifics for submission. The Government will review the submission at which time a determination will be made whether a COI has been satisfactorily mitigated or if further action is necessary and will notify the contractor accordingly. In cases where a COI cannot be, or has not been, mitigated to the Government’s satisfaction, the Government may take the following actions (this list is not all inclusive):

a) Request a waiver in accordance with FAR 9.503 Waiver, from the Head of the Contracting Activity;

b) Make changes to the requirements of the contract;

c) Require a subcontractor change (if the conflict lies with the subcontractor); and/or

d) Terminate the contract in whole or in part.

e. Subcontractor Flow-Down Terms and Conditions: The prime contractor is responsible for avoiding, neutralizing and mitigating all actual, potential, or apparent COIs of its subcontractors, in accordance with these terms and conditions. Therefore, the prime contractor shall flow-down terms and conditions H.1 Conflict of Interest, of this contract in all subcontracts. For subcontractors, wherever the term “contractor” is used, insert “subcontractor.”

H.2 CMS INFORMATION SECURITY (OCT 2020)

All CMS information shall be protected from unauthorized access, use, disclosure, duplication, modification, diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, integrity, and availability of such information. Therefore, if this contract requires the contractor to provide services (both commercial and non-commercial) for Federal Information/Data, to include any of the following requirements:

• Process any Information/Data; or

• Store any Information/Data (includes “Cloud” computing services); or

• Facilitate the transport of Information/Data; or

• Host/maintain Information/Data (including software and/or infrastructure developer/maintainers); or

• Have access to, or use of, Personally Identifiable Information (PII), including instances of remote access to, or physical removal of, such information beyond agency premises or control, The contractor shall become familiar and remain compliant with all aspects of the Statement of Work (SOW), Statement of Objectives (SOO), Performance Work Statement (PWS), which includes CMS Information Security requirements.

The contractor shall ensure that the following Federal information security standards are met for all of its CMS contracts:

• Federal Information Security Management Act (FISMA) – FISMA information can be found at https://csrc.nist.gov/projects/risk-management. FISMA requires each Federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source; and,

• Federal Risk and Authorization Management Program (FedRAMP) – FedRAMP information can be found at https://www.gsa.gov/technology/government-it-initiatives/fedramp. The FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

The Contractor shall include in all awarded subcontracts the FISMA/FedRAMP compliance requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/InformationSecurity/Info-Security-Library-Items/CMS-Security-and-Privacy- Language-for-Procurements.

H.3 HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. § 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor's duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

"Business Associate'' shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it uses individually identifiable health information on behalf of CMS, i.e.

PHI, to carry out CMS’ HIPAA-covered functions.

https://csrc.nist.gov/projects/risk-management https://www.gsa.gov/technology/government-it-initiatives/fedramp https://www.gsa.gov/technology/government-it-initiatives/fedramp https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Security-and-Privacy-Language-for-Procurements https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Security-and-Privacy-Language-for-Procurements https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Security-and-Privacy-Language-for-Procurements

"Covered Entity" shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

"Secretary" shall mean the Secretary of the Department of Health & Human Services or the Secretary's designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or on behalf of, Covered Entity other than as permitted or required by this Contract or as required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual for:

A. Filing a complaint under 45 CFR § 160.306;

B. Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under 45 CFR Part 160; or

C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its security policies and procedures, including workforce security measures, to ensure proper security awareness and training (including security incident response and reporting), and security incident procedures, in accordance with this Contract, including this HIPAA Business Associate Clause and the Contract’s clause entitled “CMS Information Security.”

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI created, received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as provided for by this Contract. In doing so, it shall implement policies and procedures to address the following and, where applicable, ensure that such policies and procedures are also in conformance with this Contract’s clause entitled “CMS Information Security:”

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual’s access rights to

PHI (including the implementation of workforce security measures to ensure continued appropriate role-based access to PHI), and technical policies and procedures to ensure compliance with grants of access (including unique user identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities in which they are housed.

C. Implement policies, procedures and physical security measures that will limit access to PHI through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or outside of the Business Associate’s facility as well as the disposal and reuse of media containing PHI.

E. Implement appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability (including the use of contingency plans) of any electronic protected health information ("EPHI") it creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, maintenance or transmission of such EPHI. In the establishment of such safeguards, Business Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, and its hardware and software security capabilities.

iii. Assess,…