RFP 75N98025R00007 Revised 9.21.2025.pdf

SOLICITATION

SECTION A - SOLICITATION/CONTRACT FORM

1.RequisiƟon or other Purchase Authority: Public Law 81-692, as amended

2. Request for Proposal (RFP) Number:

75N98025R00007

3. Issue Date:

September 21, 2025

4. Set Aside: 100% for Small Business [ ] No [X] Yes See Part IV SecƟon L

5. Title : American Sign Language InterpreƟng and CART AccommodaƟon Service with CapƟoning and Other Accessibility Services

6. ISSUED BY:

NaƟonal InsƟtutes of Health Office of the Director, Office of AcquisiƟons 6701 Rockledge Drive, Bethesda, MD 20817

7. SUBMIT OFFERS TO:

See Part III, SecƟon J, "Packaging and Delivery of the Proposal," ATTACHMENT 1 of this SolicitaƟon.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in AƩachment 1, "Packaging and Delivery of the Proposal," unƟl 3:00 pm Eastern Time on November 1, 2025 . Offers will be valid for 120 days unless a different period is specified by the offeror on the AƩachment enƟtled, "Proposal Summary and Data Record, NIH 2043.

9. This solicitaƟon requires delivery of proposals as stated in ATTACHMENT 1, "PACKAGING AND DELIVERY OF THE PROPOSAL." If proposals are required to be delivered to two different locaƟons, the OFFICIAL POINT OF RECEIPT for determining TIMELY DELIVERY is the address provided for the OFFICE OF ACQUISITIONS.

IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS, THEN IT WILL BE CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH subparagraph (c)(3) of FAR Clause 52.215-1, InstrucƟons to Offerors--CompeƟƟve AcquisiƟon, LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Award Management (SAM) prior to award of a contract.

Offerors must access the CCR through The System for Award Management (SAM) at hƩps://www.sam.gov/SAM/ .

11. FOR INFORMATION CALL: Callie Prassinos

PHONE: 2406695155

e-MAIL: Callie.Prassinos@nih.gov

COLLECT CALLS WILL NOT BE ACCEPTED.

We strongly suggest that any questions regarding the solicitation be submitted by 3:00 PM EST, on October 1, 2025, so that we can provide timely responses before proposals are due.

Callie Prassinos ContracƟng Officer Office of AcquisiƟons

RFP Number: 75N98025R00007

- 2 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND THE TERMS

AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The Contractor shall provide professional services capable of delivering both 501 accommodation and 508 accessibility services for deaf and hard of hearing employees, patients, and visitors, leveraging existing and new technologies, in compliance with the law.

ARTICLE B.2. PRICES/COSTS

a. This is an Indefinite Quantity contract as contemplated by FAR 16.504. The Contractor shall be reimbursed by the Government in an amount not less than a total of $2,500 (minimum) nor more than a total of $45,000,000 (maximum) for successful performance of this contract.

b. The costs set forth in this ARTICLE will cover the contract period April 1, 2026 through March 31, 2031.

c. The Government will issue Task Orders based on the work described in SECTION C of this contract. Upon delivery and acceptance of the item(s) described in each Task Order, the Government shall pay to the Contractor the unit price(s) set forth below:

504 Accommodation and 508 Accessibility Services Combined

Service Description QTY (per year) Unit Unit Price

CART 10,098 Hours $

Basic ASL Onsite 3,090 Hours $

ScienƟfic Onsite 6,630 Hours $

Virtual Basic ASL 42,000 Hours $

Virtual ScienƟfic ASL 11,235 Hours $

Interpreter Travel NTE $10,000.00

RFP Number: 75N98025R00007

- 3 -

Captioning & Transcription and Other 508 Services

Service Description QTY (per year) Unit Unit Price

Remote Real-Ɵme CapƟoning 2,884 Hours $

Remote Real-Ɵme CapƟoning (Spanish) 75 Hours $

Remote On-Site CapƟoning (Includes Setup Fee) 10 Hours $

Post-ProducƟon (CapƟon files) 75 Files $

Post-ProducƟon (Video files) 250 Files $

Post-ProducƟon CapƟoning with transcripƟon - Standard 5-7 day turnaround 1,500 Minutes $

Post-ProducƟon CapƟoning with transcripƟon - Expedited 3 day turnaround 150 Minutes $

Post-ProducƟon CapƟoning with transcripƟon - Expedited Nextday turnaround 100 Minutes $

Post-ProducƟon CapƟoning with transcripƟon - Expedited Sameday turnaround 100 Minutes $

VerbaƟm TranscripƟon: Standard 5-7-day turnaround 250 Hours $

VerbaƟm TranscripƟon: Rush 3day turnaround 10 Hours $

VerbaƟm TranscripƟon: Rush next day turnaround 10 Hours $

VerbaƟm TranscripƟon: Rush same-day turnaround 10 Hours $

TranscripƟon Onsite 10 Hours $

Timecoded TranscripƟon 10 Files $

CapƟoning & TranscripƟon from English to Spanish, French and Chinese NTE $1,300

Audio DescripƟon (for the blind) NTE $6,500

ARTICLE B.3. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurring the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

1. Invoice Processing Platform (IPP)

NIH is using a phased transition approach from the NIH Office of Financial Management (OFM) Electronic Invoice Submission instructions to the Department of Treasury’s Invoice Processing Platform (IPP). This award will transition to IPP in the future. The Contractor/Vendor shall use the attached NIH OFM Electronic Invoice Submission Instructions until the Contractor/Vendor has transitioned to IPP as specified on the OALM IPP website at https://oalm.od.nih.gov/IPP. It is the Contractor/Vendor’s responsibility to periodically check the OALM IPP website and be prepared to transition to IPP on the designated transition date. Questions concerning the transition to IPP should be directed to NIH-IPPinvoicing@mail.nih.gov. Questions concerning this award should be directed to the NIH Contracting Officer.

All IPP invoices must contain a Unique Entity Identifier (UEI) which is located in the System for Award Management (SAM) and replaces the Dun & Bradstreet Data Universal Numbering System (DUNS) number.

If this award is a parent indefinite delivery award or a Blanket Purchase Agreement Set-Up, then HHSAR 352.232-71 applies to all task/delivery orders or Blanket Purchase Agreement calls issued under this award.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. PERFORMANCE WORK STATEMENT

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Performance Work Statement dated September 19, 2025, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports shall be submitted electronically. These reports shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at:

https://www.hhs.gov/web/section-508/index.html and at:

https://www.section508.gov/create/documents , "Create Accessible Documents."

a. Technical Progress Reports In addition to the required reports set forth elsewhere in this Schedule, the preparation and submission of regularly recurring Technical Progress Reports will be required in any contract resulting from this solicitation. These reports will require descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods. The frequency and specific content of these reports will be determined prior to contract award. [Note: Beginning May 25, 2008, the Contractor shall include the applicable PubMed Central or NIH Manuscript Submission reference number when citing publications that arise from its NIH funded research.]

For proposal preparation purposes only, it is estimated that in addition to the required electronic version(s) of these reports will be required as follows:

[ X ] Monthly on Task orders [ X ] Annually on Task orders

b. Summary of Salient Results

The Contractor will be required to prepare and submit, with the final report, a summary (not to exceed 200 words) of salient results achieved during the performance of the contract.

This report will be required on or before the expiration date of the contract.

c. Other Reports /Deliverables

1. Section 508 Annual Report

The Contractor must submit an annual Section 508 report in accordance with the schedule set forth by the Contracting Officer (CO)/Contracting Officer Representative (COR). The Section 508 Report Template and Instructions for completing the report are available at: https://www.hhs.gov/sites/default/files/web/508/contracting/technology/section_508_annual_ report.doc.

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, the Contracting Officer’s Representative is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at: TBD prior to award.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-4, Inspection of Services - Fixed Price (August 1996).

FAR Clause 52.246-16, Responsibility for Supplies (April 1984).

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

The period of performance of this contract shall be from April 1, 2026 through March 31, 2031.

ARTICLE F.2. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY 1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989) Alternate I (April 1984) is not applicable to this contract.

52.242-17, Government Delay of Work (April 1984).

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

TBD prior to award

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements;

(2) interpreting the Performance Work Statement and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

[The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.]

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the Performance Work Statement; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. KEY PERSONNEL, HHSAR 352.237-75 (December 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of Clause)

The following individual(s) is/are considered to be essential to the work being performed hereunder:

[Offerors need to include the names and titles of their key personnel staff in their technical proposal]

Name Title

TBD prior to award

ARTICLE G.3. METHOD OF ORDERING

a. Orders issued under this contract may be placed in writing via electronic mail (e-mail).

b. The Contracting Officer is authorized to issue orders and provide written confirmation of oral orders, if applicable, under the contract.

ARTICLE G.4. TASK ORDER PROCEDURE

This contract provides for the issuance of Task Orders on a negoƟated basis as follows:

a. General

Only the ContracƟng Officer may issue Task Orders to the Contractor, providing specific authorizaƟon or direcƟon to perform work within the scope of the contract and as specified in the Statement of Work. Unless specifically authorized by the ContracƟng Officer, the Contractor shall not commence work unƟl a fully executed Task Order has been awarded. The Contractor may incur costs under this contract in performance of task orders and task order modificaƟons issued in accordance with this ARTICLE.

No other costs are authorized unless otherwise specified in the contract or expressly authorized by the ContracƟng Officer.

b. RequesƟng Task Order Proposals.

The ContracƟng Officer or a designated individual may solicit responses to requirements from Contractors within a technical area covered by a task order requirement in wriƟng. A Task Order Request for Proposals (TORFP) will be prepared and issued for each task order requirement.

Generally, the Task Order Request for Proposal (TORFP) will include but is not limited to the following:

1. Statement of Work;

2. ReporƟng Requirements and Deliverables;

3. Proposal Due Date and LocaƟon to Deliver Proposals;

4. Period of Performance of Task Order;

All contract clauses contained this contract shall be incorporated in the TORFP and the resultant task order. If conflicts exist between the contract clauses and the informaƟon outlined in the task order, the contract language takes precedence over the informaƟon in the task order.

c. EvaluaƟon and Award of Task Order Proposals The Government will evaluate the Task Order proposals against the requirements of the TORFP. Specifically, the technical evaluaƟon factors, cost/price, and any other factor specifically idenƟfied in the TORFP will be used for evaluaƟon of each proposal. In addiƟon, the TORFP will idenƟfy the basis for selecƟng a Contractor for award. Generally, technical factors will be more important than cost or price. However, each TORFP will specify how the award decision will be made.

Upon compleƟon of evaluaƟons, the ContracƟng Officer will issue a task order to the Contractor whose proposal is most advantageous to the government.

ARTICLE G.4. INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH(RC)-2, are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment and shall invoice monthly (within 14 days following the end of each month).

1. The Contractor shall submit invoices to the Department of Treasury's Invoice Processing

Platform (IPP) at https://www.ipp.gov with a copy to the approving official, as directed below. The Contractor shall submit a copy of the electronic invoice to the following Approving Official (Contracting Officer) and Contracting Officer Representative:

Approving Official: Contracting Officer [To be specified at time of award]

Name- Email Address-

Contracting Officer’s Representative [To be specified at time of award]

Name- Email Address-

For inquiries regarding the status of invoices, contact OFM Customer Service via email at ofm_customer_service@incontactemail.com or via phone at 301-496-6088. To send your inquiries via other available communication methods refer to the OFM Customer Service website at https://ofm.od.nih.gov/Pages/Customer-Service.aspx.

Note: The OFM Customer Service is open Eastern Standard Time Monday - Friday from 8:30 a.m. to 5:00 p.m. and is closed between 12:00 p.m. to 1:00 p.m.

2. In addition to the requirements specified in FAR 32.905 for a proper invoice, the Contractor shall include the following information on the face page of all payment requests:

a. Name of the Office of Acquisitions. The Office of Acquisitions for this contract is National Institute of Allergy and Infectious Diseases (NIAID) .

b. Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid TIN, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, Unique Entity Identifier (UEI), or VIN, contact the Contracting Officer. Note: The Contractor shall not include TIN if it is a Social Security Number.

c. Unique Entity Identifier (UEI). The UEI is located in the System for Award Management (SAM) and replaces the Dun & Bradstreet Data Universal Numbering System (DUNS) number. The UEI number must identify the Contractor's name and address exactly as stated in the contract and as registered in the Central Contractor Registration (CCR) database. If the Contractor does not have a valid UEI number, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, UEI, or VIN, contact the Contracting Officer.

d. Invoice Matching Option. This contract requires a three-way match.

e. Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

f. Contract Title: AMERICAN SIGN LANGUAGE INTERPRETING AND CART ACCOMMODATIONS

WITH CAPTIONING AND OTHER ACCESSIBILITY SERVICES

b. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301) 496- 6088.

c. The Contractor shall include the following certification on every invoice for reimbursable costs incurred with Fiscal Year funds subject to HHSAR Clause 352.231-70, Salary Rate Limitation in SECTION I of this contract. For billing purposes, certified invoices are required for the billing period during which the applicable Fiscal Year funds were initially charged through the final billing period utilizing the applicable Fiscal Year funds:

"I hereby certify that the salaries charged in this invoice are in compliance with HHSAR Clause 352.231-70, Salary Rate Limitation in SECTION I of the above referenced contract."

ARTICLE G.5. PROVIDING ACCELERATED PAYMENT TO SMALL BUSINESS

SUBCONTRACTORS, FAR 52.232-40 (Mar 2023).

(a) (1) In accordance with 31 U.S.C. 3903 and 10 U.S.C. 3801, within 15 days after receipt of accelerated payments from the Government, the Contractor shall make accelerated payments to its small business subcontractors under this contract, to the maximum extent practicable and prior to when such payment is otherwise required under the applicable contract or subcontract, after receipt of a proper invoice and all other required documentation from the small business subcontractor.

(2) The Contractor agrees to make such payments to its small business subcontractors without any further consideration from or fees charged to the subcontractor.

(b) The acceleration of payments under this clause does not provide any new rights under the Prompt Payment Act.

(c) Include the substance of this clause, including this paragraph (c), in all subcontracts with small business concerns, including subcontracts with small business concerns for the acquisition of commercial products or commercial services.

(End of clause).

ARTICLE G.6. ON-SITE CONTRACTOR ACCESS TO GOVERNMENT PROPERTY

The Contractor shall be held responsible for Government Property, regardless of dollar value, when:

The contract requires Contractor personnel to be located on a Government site or installation;

The property utilized by Contractor personnel is incidental to the place of performance; and, The property used by the Contractor remains accountable to the Government.

Responsibility includes physical presence, proper use and handling, normal maintenance, and reporting loss, damage or destruction.

Responsibility for government property shared by two or more Contractors or located in space shared by two or more Contractors, shall be determined and documented by the contractors involved. In cases where the parties cannot reach agreement on shared responsibility, the matter will be referred to the NIH Property Officer for resolution.

ARTICLE G.7. GOVERNMENT PROPERTY

If this RFP will result in the acquisition or use of Government Property provided by the contracting agency or if the Contracting Officer authorizes in the pre-award negotiation process, the acquisition of property (other than real property), this ARTICLE will include applicable provisions and incorporate the HHS Publication, entitled, "HHS Contracting Guide for Contract of Government Property," Appendix Q, which can be found at:

https://oamp.od.nih.gov/sites/default/files/DGS/HHS%20Contracting%20Guide%20for%20Contract%20of%2 0Government%20Property-Appendix%20Q.pdf ௗ

ARTICLE G.8. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations ௗௗ

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation,ௗInterim evaluation(s) will beௗprepared to coincide with the anniversary date of the contract.ௗௗ

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted sixty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address: https://www.cpars.gov .

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.2. DISSEMINATION OF FALSE OR DELIBERATELY MISLEADING INFORMATION

The Contractor shall not use contract funds to disseminate information that is deliberately false or misleading.

ARTICLE H.3. RESTRICTION ON PORNOGRAPHY ON COMPUTER NETWORKS

The Contractor shall not use contract funds to maintain or establish a computer network unless such network blocks the viewing, downloading, and exchanging of pornography.

ARTICLE H.4. GUN CONTROL

The Contractor shall not use contract funds in whole or in part, to advocate or promote gun control.

ARTICLE H.5. INFORMATION AND INFORMATION SYSTEMS SECURITY, HHSAR 352.204-71

(FEB 2024) (DEVIATION).

(a) Definitions. As used in this clause— Breach means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where—

(1) A person other than an authorized user accesses or potentially accesses personally identifiable information, or

(2) An authorized user accesses personally identifiable information for an other than authorized purpose.

Business associate (see 45 CFR 160.103), except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person who –

(1) On behalf of such covered entity or of an organized health care arrangement (as defined in this clause) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this contract or agreement, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or

(2) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in 45 CFR section 164.501), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.

(3) A covered entity may be a business associate of another covered entity.

(4) Business associate includes the following:

(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

(5) Business associate does not include:

(i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.

(ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of 45 CFR 164.504(f) apply and are met.

(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.

(iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.

Business associate agreement means the agreement, or other arrangement, as dictated by the HIPAA Privacy Rule (45 CFR 160), between an HHS covered entity and a business associate, which must be entered into in addition to the underlying contract for services and before any disclosure (see 45 CFR 160.103) of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of an HHS entity.

Controlled unclassified information (CUI) means information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.

Healthcare component means a component or combination of components of a hybrid entity designated by the hybrid entity in accordance with 45 CFR 164.105(a)(2)(iii)(D) (see 45 CFR 164.103). The Secretary of HHS has designated HHS as a covered entity (further designated as a “hybrid entity”), and has also designated four HHS divisions as healthcare components under HIPAA, including

(1) The Centers for Medicare and Medicaid Services (CMS), insofar as it operates the fee-for-service Medicare program;

(2) The Program Support Center (PSC), Division of Commissioned Personnel, insofar as it operates a health plan for Commissioned Corps officers;

(3) The World Trade Center (WTC) Health Program; and,

(4) The Indian Health Service (IHS), insofar as it operates a health plan and a program providing healthcare that uses electronic transactions.

HHS Information Technology General Rules of Behavior means a set of HHS rules that describes the responsibilities and expected behavior of users of HHS information or information systems.

HHS sensitive information means all HHS data, on any storage media or in any form or format, which requires confidentiality, integrity, and availability protection due to the risk of harm that could result to interests of HHS, other agencies or entities, or individuals from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes—

(1) Information where the improper use or disclosure could adversely affect the ability of HHS to accomplish its mission, i.e., HHS proprietary information;

(2) Records about individuals requiring protection under laws and regulations such as the E-Government Act, Privacy Act and the HIPAA Privacy Rule, or based on a data use agreement or a promise or assurance of confidentiality; and

(3) Information that would be exempt from disclosure if requested under the Freedom of Information Act. Examples of HHS sensitive information include—

(i) Individually-identifiable medical, benefits, and personnel information;

(ii) Financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, security-sensitive, procurement-sensitive, investigatory, and law enforcement information;

(iii) Controlled unclassified information;

(iv) Information that would be confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and

(v) Other information which, if released, could result in a violation of law or agreement, could cause harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and part 164.

Incident means an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information systems; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable policies.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Information system security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

Information technology (see FAR 2.101) also means Information and Communication Technology (ICT).

Information technology-related contracts means those contracts that include services (including support services), and related resources for information technology.

Organized health care arrangement (see 45 CFR 160.103) means:

(1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;

(2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities:

(i) Hold themselves out to the public as participating in a joint arrangement; and

(ii) Participate in joint activities that include at least one of the following:

(A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;

(B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or

(C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.

(3) A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;

(4) A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or

(5) The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.

Privacy officer means the HHS official(s) with responsibility for implementing and oversight of privacy related policies and practices that impact a given HHS acquisition.

(b) General. Contractors, subcontractors, their employees, third-parties, and business associates with access to HHS information, information systems, or information technology (IT) or providing and accessing IT-related goods and services, shall adhere to the HHS Cybersecurity Program and the directives and handbooks, complete HHS security training prior to accessing HHS information

(including HHS sensitive information and information systems security and privacy) and on an annual basis thereafter, as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, HHS Personnel Security and Suitability Program, which establishes HHS procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards, and guidance for protecting HHS information, information systems (see 302.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing HHS information or information systems.

(c) Access to HHS information and HHS information systems.

(1) Contractors are limited in their request for logical or physical access to HHS information or HHS information systems for their employees, subcontractors, third parties and business associates to the extent necessary to perform the services or provide the goods as specified in the contracts, agreements, task, delivery, or purchase orders.

(2) All Contractors, subcontractors, third parties, and business associates working with HHS information are subject to the same investigative requirements as those of HHS appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors to access HHS information and HHS information systems shall be in accordance with HHS Personnel Security and Suitability Program.

(3) Contractors, subcontractors, third parties, and business associates who require access to national security programs must have a valid security clearance.

(4) The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

(i) Marked appropriately;

(ii) Disclosed to authorized personnel on a need-to-know basis;

(iii) Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

(iv) Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

(5) HIPAA business associate agreements. Under the HIPAA Privacy and Security Rules (see 45 CFR 164), pursuant to 45 CFR 164.502(e)(1), a covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor of a covered entity’s business associate. Additionally, a business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information. The satisfactory assurances required by 45 CFR 45 CFR 164.504(e)(1) of this section shall be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of 45 CFR 164.504(e). The contracts shall also include breach reporting policies and procedures for suspected or confirmed breaches of protected health information. The contract shall impose a duty to cooperate with the healthcare component and/or HHS breach investigation and response and must require all subcontractors to comply with the same HIPAA Rules requirements as a condition of receiving government data.

(i) Contractors or entities required to execute business associate agreements for contracts and other agreements become HHS business associates. Business associate agreements are issued by HHS or may be issued by other HHS programs in support of HHS. The HIPAA Privacy Rule requires HHS to execute compliant business associate agreements with persons or entities that create, receive, maintain, or transmit HHS PHI or that will store, generate, access, exchange, process, or utilize such PHI in order to perform certain activities, functions or services to, for, or on behalf of HHS. There may be other HHS components or staff offices which also provide certain services and support to HHS and must receive PHI in order to do so. If these components award contracts or enter into other agreements, purchase/delivery orders, modifications and issue governmentwide purchase card transactions to help in the delivery of these services to HHS, they will also fall within the requirement to obtain a satisfactory assurance from these contractors by executing a business associate agreements.

(ii) Business associate agreement flow down to subcontractors. A prime contractor required to execute a business associate agreement shall also obtain a satisfactory assurance, in the form of a business associate agreement, of its subcontractors who will also create, receive, maintain, or transmit PHI or that will store, generate, access, exchange, process, or utilize such PHI will comply with HIPAA Rules requirements to the same degree as the Contractor. A contractor employing a subcontractor who creates, receives, maintains, or transmits PHI or that will store, generate, access, exchange, process, or utilize such PHI under a contract or agreement is required to execute a business associate agreement with each of its subcontractors which also obligates the subcontractor (i.e., also a business associate) to provide the same protections and safeguards and agree to the same disclosure restrictions to PHI that is required of the covered entity and the prime contractor.

(d) Contractor operations required to be in United States. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practicable. If such services are proposed to be performed outside the continental United States, and are not otherwise disallowed by other Federal law, regulations or policy, or other HHS policy or other mandates as stated in the contract, specifications, statement of work or performance work statement (including applicable business associate agreements), the Contractor/subcontractor must state in its proposal where all non-U.S. services are provided. At a minimum, the Contractor/subcontractor must include a detailed Information System Security Plan, for review and approval by the Contracting Officer, specifically to address mitigation of the resulting problems of communication, control, and data protection.

(e) Roster of employees. Contractors and subcontractors shall provide a roster containing the name, position, e-mail address, phone number, and responsibilities of each employee, including subcontractors, performing work under the contract to develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to Contracting Officer within 60 days from the effective date of the contract. Revisions to the roster as a result of staffing changes must be submitted within the number of days of the change provided by the Contracting Officer. The Contracting Officer, or the Contracting Officer’s Representative (COR), will notify the Contractor of the appropriate level of investigation required for each staff member based on the information provided on the roster. If an employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

(f) Contractor/subcontractor employee reassignment and termination notification. Contractors and subcontractors shall provide written notification to the Contracting Officer and COR immediately, and not later than four (4) hours, when an employee working on an HHS information system or with access to HHS information is reassigned or leaves the Contractor or subcontractor's employment on the cognizant HHS contract. The Contracting Officer and COR must also be notified immediately by the Contractor or subcontractor prior to an unfriendly termination.

(g) Non-disclosure agreement. The Contractor and subcontractors shall submit completed non-disclosure agreements, as provided by the Contracting Officer, for each employee having access to non-public government information under this contract. The non-disclosure agreements shall be submitted to the Contracting Officer prior to the performance of work.

(h) HHS information custodial requirements. (1) Release, publication, and use of data. Information made available to a Contractor or subcontractor by HHS for the performance or administration of a contract or information developed by the Contractor/subcontractor in performance or administration of a contract shall be used only for the stated contract purpose and shall not be used in any other way without HHS prior written approval. This clause expressly limits the Contractor’s/subcontractor's rights to use data as described in 52.227-14, Rights in Data—General, paragraph (d).

(2) Media sanitization. HHS information shall not be co-mingled with any other data on the Contractors/subcontractor’s information systems or media storage systems in order to ensure federal and HHS requirements related to data protection, information segregation, classification requirements, and media sanitization can be met (see HHS Cybersecurity Program). HHS reserves the right to conduct scheduled or unscheduled on-site inspections, assessments, or audits of Contractor and subcontractor IT resources, information systems and assets to ensure data security and privacy controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with Federal and HHS requirements. The Contractor and subcontractor will provide all necessary access and support to HHS and/or GAO staff during periodic control assessments or audits.

(3) Data retention, destruction and contractor self-certification. The Contactor and its subcontractors are responsible for collecting and destroying any HHS data provided, created, or stored under the terms of this contract, to a point where HHS data or materials are no longer readable or reconstructable to any degree, in accordance with NIST SP 800-88, Guidelines for Media Sanitization, or subsequent directive. Prior to termination or completion of this contract, the Contractor/subcontractor must provide its plan for destruction or return of all HHS data in its possession accordance with contract requirements or Contracting Officer instructions for disposition, including compliance with National Institute of Standards and Technology (NIST) SP 800-88, Guidelines for Media Sanitization, for the purposes of media sanitization on all IT equipment. The Contractor must certify in writing to the Contracting Officer within 30 days of termination of the contract that the data destruction requirements in this paragraph have been met.

(4) Return of HHS data and information. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to the HHS (as stipulated by the Contracting Officer or the COR) or the Contractor/subcontractor must hold it until otherwise directed.