SECTION H.docx

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.1 SECURITY CLAUSE-BACKGROUND-INVESTIGATIONS FOR CONTRACTOR PERSONNEL

a. If applicable, Contractor personnel performing services for CMS under this contract shall be required to undergo a background investigation. CMS will pay for the background investigations.

b. After contract award, the CMS COTR and the Emergency Management & Response Group (EMRG), with the assistance of the Contractor, shall perform a position-sensitivity analysis based on the duties contractor personnel shall perform on the contract, contract or delivery order. The results of the position-sensitivity analysis will determine first, whether the provisions of this clause are applicable to the contract and second, if applicable, determine each position’s sensitivity level (i.e., high risk, moderate risk or low risk) and dictate the appropriate level of background investigation to be processed. Investigative packages may contain the following forms:

1. SF-85, Questionnaire for Non-Sensitive Positions, 09/1995

2. SF-85P, Questionnaire for Public Trust Positions, 09/1995

3. OF-612, Optional Application for Federal Employment, 12/2002

4. OF-306, Declaration for Federal Employment, 01/2001

5. Credit Report Release Form

6. FD-258, Fingerprint Card, 5/99, and

7. CMS-730A, Request for Physical Access to CMS Facilities (NON-CMS ONLY), 11/2003.

c. The Contractor personnel shall be required to undergo a background investigation commensurate with one of these position-sensitivity levels:

(i) High Risk (Level 6)

Public Trust positions that would have a potential for exceptionally serious impact on the integrity and efficiency of the service. This would include computer security of a major automated information system (AIS). This includes positions in which the incumbent’s actions or inaction could diminish public confidence in the integrity, efficiency, or effectiveness of assigned government activities, whether or not actual damage occurs, particularly if duties are especially critical to the agency or program mission with a broad scope of responsibility and authority.

Major responsibilities that would require this level include:

a. development and administration of CMS computer security programs, including direction and control of risk analysis and/or threat assessment;

b. significant involvement in mission-critical systems;

c. preparation or approval of data for input into a system which does not necessarily involve personal access to the system but with relatively high risk of causing grave damage or realizing significant personal gain;

d. other responsibilities that involve relatively high risk of causing damage or realizing personal gain;

e. policy implementation;

f. higher level management duties/assignments or major program responsibility; or

g. independent spokespersons or non-management position with authority for independent action.

Approximate cost of each investigation: $3,500

(ii) Moderate Risk (Level 5)

Public Trust positions that have potential for moderate to serious impact on the integrity and efficiency of the service, including computer security. These positions involve duties of considerable importance to the CMS mission with significant program responsibilities that could cause damage to large portions of AIS. Duties involved are considerably important to the agency or program mission with significant program responsibility, or delivery of service. Responsibilities that would require this level include:

a. the direction, planning, design, operation, or maintenance of a computer system and whose work is technically reviewed by a higher authority at the High Risk level to ensure the integrity of the system;

b. systems design, operation, testing, maintenance, and/or monitoring that are carried out under the technical review of a higher authority at the High Risk level;

c. access to and/or processing of information requiring protection under the Privacy Act of 1974;

d. assists in policy development and implementation;

e. mid-level management duties/assignments;

f. any position with responsibility for independent or semi-independent action; or

g. delivery of service positions that demand public confidence or trust.

Approximate cost range of each investigation: $150 - $2,600

(iii) Low Risk (Level 1)

Positions having the potential for limited interaction with the agency or program mission, so the potential for impact on the integrity and efficiency of the service is small. This includes computer security impact on AIS.

Approximate cost of each investigation: $100

a. The Contractor shall submit the investigative package(s) to the EMRG within three (3) days after being advised by the EMRG of the need to submit packages. Investigative packages shall be submitted to the following address:

b.

Centers for Medicare & Medicaid Services Office of Operations Management Emergency Management & Response Group Mail Stop SL-13-15 7500 Security Boulevard Baltimore, Maryland 21244-1850

e. The Contractor shall submit a copy of the transmittal letter to the Contracting Officer (CO).

f. Contractor personnel shall submit a CMS-730A (Request for Badge) to the EMRG (see attachment in Section J). The Contractor and the PO shall obtain all necessary signatures on the CMS-730A prior to any Contractor employee arriving for fingerprinting and badge processing.

g. The Contractor must appoint a Security Investigation Liaison as a point of contact to resolve any issues of inaccurate or incomplete form(s). Where personal information is involved, EMRG may need to contact the contractor employee directly. The Security Investigation Liaison may be required to facilitate such contact.

h. After EMRG fingerprints contractor personnel and issues them a temporary CMS identification badge, the EMRG will send their completed investigative package to the Office of Personnel Management (OPM). OPM will conduct the background investigation. Badges will be provided by EMRG while contractor personnel investigative forms are being processed. The Contractor remains fully responsible for ensuring contract, contract or delivery order performance pending completion of background investigations of contractor personnel.

i. EMRG shall provide written notification to the CO with a copy to the COTR of all suitability decisions. The PO shall then notify the Contractor in writing of the approval of the Contractor’s employee(s), at that time the Contractor’s employee(s) will receive a permanent identification badge. Contractor personnel who the EMRG determines to be ineligible may be required to cease working on the contract immediately.

j. The Contractor shall report immediately in writing to EMRG with copies to the CO and the COTR, any adverse information regarding any of its employees that may impact their ability to perform under this contract, contract or delivery order. Reports should be based on reliable and substantiated information, not on rumor or innuendo. The report shall include the contractor employee’s name and social security number, along with the adverse information being reported.

k. Contractor personnel shall be provided an opportunity to explain or refute unfavorable information found in an investigation to EMRG before an adverse adjudication is made. Contractor personnel may request, in writing, a copy of their own investigative results by contacting:

Office of Personnel Management Freedom of Information Federal Investigations Processing Center PO Box 618 Boyers, PA 16018-0618.

l. At the Agency’s discretion, if an investigated contractor employee leaves the employment of the contractor, or otherwise is no longer associated with the contract, contract, or delivery order within one (1) year from the date the background investigation was completed, then the Contractor may be required to reimburse CMS for the full cost of the investigation. Depending upon the type of background investigation conducted, the cost could be approximately $100 to $3,500. The amount to be paid by the Contractor shall be due and payable when the CO submits a written letter notifying the Contractor as to the cost of the investigation. The Contractor shall pay the amount due within thirty (30) days of the date of the CO’s letter by check made payable to the “United States Treasury.” The Contractor shall provide a copy of the CO’s letter as an attachment to the check and submit both to the Office of Financial Management at the following address:

Centers for Medicare & Medicaid Services PO Box 7520 Baltimore, Maryland 21207

m. The Contractor must immediately provide written notification to EMRG (with copies to the CO and the COTR) of all terminations or resignations of Contractor personnel working on this contract, contract or delivery order. The Contractor must also notify EMRG (with copies to the CO and the COTR) when a Contractor’s employee is no longer working on this contract, contract or delivery order.

n. At the conclusion of the contract, contract or delivery order and at the time when a contractor employee is no longer working on the contract, contract or delivery order due to termination or resignation, all CMS-issued parking permits, identification badges, access cards, and/or keys must be promptly returned to EMRG. Contractor personnel who do not return their government-issued parking permits, identification badges, access cards, and/or keys within 48 hours of the last day of authorized access shall be permanently barred from the CMS complex and subject to fines and penalties authorized by applicable federal and State laws.

H.2 CONTRACTOR ACCCESS AND TERMINATION FROM ACCESS TO CMS BUILDING

CMS is a professional environment and contractor personnel coming onto the premises are advised that it is a non-smoking environment as well. Contractor personnel and the COTR shall coordinate regarding the need for contractor access to the facility in Baltimore and the possible need for badges to allow for such access. Security procedures defined in H.2 above are applicable prior to obtaining a badge for contractor employees.

In the event that the contractor terminates an employee working on this contract, or an employee working on this contract voluntarily leaves the employment of the contractor and that employee has been issued a contractor’s badge by CMS for access to CMS Buildings. The contractor shall immediately take the following actions:

Secure the CMS contractor’s badge from the employee;

Formally advise the contracting officer that the individual is no longer an employee of the contractor, and;

Return the badge with the notification to the contracting officer.

H.3 HIPAA BUSINESS ASSOCIATE PROVISION II

[Note to states: This clause is mandatory in all CMS contracts; however, the CO will coordinate with the COTR to determine the applicability of this clause under this contract and shall provide guidance to contractor management regarding the implementation of this clause if necessary.]

a. Definitions:

All terms used herein and not otherwise defined shall have the same meaning as in the Health Insurance Portability and Accountability Act of 1996 (“HIPAA,” 42 U.S.C. sec. 1320d) and the corresponding implementing regulations. Provisions governing the Contractor’s duties and obligations under the Privacy Act (including data use agreements) are covered elsewhere in the contract.

"Business Associate'' shall mean the Contractor.

"Covered Entity" shall mean CMS’ Medicare Fee for Service program and/or Medicare’s Prescription Drug Discount Care and Transitional Assistance Programs.

"Secretary" shall mean the Secretary of the Department of Health and Human Services or the Secretary’s designee.

b. Obligations and Activities of Business Associate

(a) Business Associate agrees to not use or disclose Protected Health Information (“PHI”), as defined in 45 C.F.R. § 160.103, created or received by Business Associate from or on behalf of Covered Entity other than as permitted or required by this Contract or as required by law.

(b) Business Associate agrees to use safeguards to prevent use or disclosure of PHI created or received by Business Associate from or on behalf of Covered Entity other than as provided for by this Contract. Furthermore, Business Associate agrees to use appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic protected health information (“EPHI”), as defined in 45 C.F.R. 160.103, it creates, receives, maintains or transmits on behalf of the Covered Entity to prevent use or disclosure of such EPHI.

(c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

(d) Business Associate agrees to report to Covered Entity any use or disclosure involving PHI it receives/maintains from/on behalf of the Covered Entity that is not provided for by this Contract of which it becomes aware. Furthermore, Business Associate agrees to report to Covered Entity any security incident involving EPHI of which it becomes aware.

(e) Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Contract to Business Associate with respect to such information. Furthermore, Business Associate agrees to ensure that its agents and subcontractors implement reasonable and appropriate safeguards for the PHI received from or on behalf of the Business Associate.

(f) Business Associate agrees to provide access, at the request of Covered Entity, to PHI received by Business Associate in the course of contract performance, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR § 164.524.

(g) Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 upon request of Covered Entity.

(h) Business Associate agrees to make internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to Covered Entity, or to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the various rules implementing the HIPAA.

(i) Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

(j) Business Associate agrees to provide to Covered Entity, or an individual identified by the Covered Entity, information collected under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

c. Permitted Uses and Disclosures by Business Associate

Except as otherwise limited in this Contract, Business Associate may use or disclose PHI on behalf of, or to provide services to, Covered Entity for purposes of the performance of this Contract, if such use or disclosure of PHI would not violate the HIPAA Privacy or Security Rules if done by Covered Entity or the minimum necessary policies and procedures of Covered Entity.

d. Obligations of Covered Entity

(a) Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI.

(b) Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI.

(c) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

e. Permissible Requests by Covered Entity

Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy or Security Rules.

f. Term of Provision

(a) The term of this Provision shall be effective as of {insert effective date}, and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions in this Section.

(b) Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall either:

(1) Provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination terms of this Contract. Covered Entity may terminate this Contract for default if the Business Associate does not cure the breach or end the violation within the time specified by Covered Entity; or

(2) Consistent with the terms of this Contract, terminate this Contract for default if Business Associate has breached a material term of this Contract and cure is not possible; or

(3) If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

(c) Effect of Termination.

(1) Except as provided in paragraph (2) of this section, upon termination of this Contract, for any reason, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the PHI.

(2) In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon such notice that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.

g. Miscellaneous

(a) A reference in this Contract to a section in the Rules issued under HIPAA means the section as in effect or as amended.

(b) The Parties agree to take such action as is necessary to amend this Contract from time to time as is necessary for Covered Entity to comply with the requirements of the Rules issued under HIPAA.

(c) The respective rights and obligations of Business Associate under paragraph (c) of the section entitled “term of Provision” shall survive the termination of this Contract.

(d) Any ambiguity in this Contract shall be resolved to permit Covered Entity to comply with the Rules implemented under HIPAA.

H.4 RESTRICTIONS ON THE USES OF INFORMATION

The access to and use of data/information under this contract shall be in accordance with FAR clause 52.224-2 Privacy Act, set forth in Section I.

H.5 ORGANIZATIONAL CONFLICTS OF INTEREST

a. Purpose. The primary purpose of this clause is to aid in ensuring that the Contractor (1) does not obtain any unfair competitive advantage over other parties by virtue of its performance of this contract, and (2) is not biased because of its current or planned interest (financial, organizational, or otherwise) which relate to the work under this contract.

b. Scope. The restrictions described herein shall apply to performance or participation by the Contractor and any of its affiliate organizations or their successors in interest (hereinafter collectively referred to as the "Contractor") in the activities covered by this clause as a prime Contractor, subcontractor, co-sponsor, joint venturer, consultant, or in any similar capacity.

(1) Advisory, consulting, analytical, evaluation, or study work, including the preparation of statements of work and specifications: (i) If the Contractor performs advisory, consulting, analytical, evaluation, study, or similar work under this contract, it shall be ineligible thereafter to participate in any capacity in Government contractual efforts (solicited or unsolicited) which stem directly from such work, and the Contractor agrees not to perform similar work for prospective offerors with respect to any such contractual efforts.

Furthermore, unless so directed in writing by the Contracting Officer, the Contractor shall not perform any such work under this contract on any of its products or services, or the products or services of another firm for which the Contractor performs similar work. Nothing in this subparagraph shall preclude the Contractor from competing for HHS management and technical support services follow-on contracts as defined in paragraph 6. below.

If the Contractor under this contract assists substantially in the preparation of a statement of work or specifications, the Contractor shall be ineligible to perform or participate in any capacity in any contractual effort which is based on such statement of work or specifications. The Contractor shall not incorporate its products or services in such statement of work or specifications unless so directed in writing by the Contracting Officer, in which case the restriction in this subparagraph shall not apply.

(2) Access to the use of information:

(a) If the Contractor in the performance of this contract obtains access to information, such as HHS plans, policies, reports, studies, financial plans, or data which has not been released to the public, the Contractor agrees not to (a) use such information for any private purpose unless the information has been released to the public; (b) disclose such information for a period of six (6) months after the completion of this contract, or the release of such information to the public, whichever is first; (c) submit an unsolicited proposal to the Government which is based on such information until one (1) year after the release of such information to the public; or (d) release such information without prior written approval by the Contracting Officer.

(b) In addition, the Contractor agrees that to the extent it receives or is given access to proprietary data or other confidential technical, business or financial information under this contract, it shall treat such information in accordance with any restrictions imposed on such information.

(c) The Contractor shall have, subject to patent and security provisions of this contract, the right to use technical data it first produces under this contract for its private purposes provided that, as of the date of such use, all data requirements of this contract have been met.

(3) Subcontracts. The Contractor shall include this clause, including this paragraph, in subcontracts of any tier which involve performance of work of the type specified in b.(1) above or access to information covered in b.(2) above. The use of this clause in such subcontracts shall be read by substituting the word "Subcontractor" for the word "Contractor" whenever the word "Contractor" appears.

(4) Remedies: For breach of the above restrictions or for non-disclosure or misrepresentation of any relevant interest required to be disclosed concerning this contract, the Government may, at no cost, terminate the contract, disqualify the Contractor for subsequent related contractual efforts, and pursue other remedies as may be permitted by law or this contract.

(5) Waiver. Any request for waiver under this clause shall be directed in writing to the Contracting Officer and shall include a full description of the requested waiver and the reasons in support thereof. If it is determined to be in the best interest of the Government, the Contracting Officer shall grant such waiver in writing.

(6) Definitions. The term "management and technical support services" includes any advice, assistance, analysis, consultation, evaluation, examination, report, review, study, survey, or similar assistance, including providing assistance in procurement and related activities, to support any program or their operations of CMS.

H.6 ELECTRONIC INFORMATION AND TECHNOLOGY ACCESSIBILITY – HHSAR 352.239-73 (JAN 2006)

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by Public Law 105–220 under Title IV (Rehabilitation Act Amendments of 1998) and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that all EIT acquired must ensure that:

(1) Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities; and

(2) Members of the public with disabilities seeking information or services from an agency have access to and use of information and data that is comparable to the access to and use of information and data by members of the public who are not individuals with disabilities. This requirement includes the development, procurement, maintenance, and/or use of EIT products/services; therefore, any proposal submitted in response to this solicitation must demonstrate compliance with the established EIT Accessibility Standards. Information about Section 508 is available at http://www.section508.gov/ (New Window).

H.7 CMS INFORMATION SECURITY

This clause applies to all organizations which possess or use Federal information, or which operate, use or have access to Federal information systems (whether automated or manual), on behalf of CMS.

The central tenet of the CMS Information Security (IS) Program is that all CMS information and information systems shall be protected from unauthorized access, disclosure, duplication, modification, diversion, destruction, loss, misuse, or theft—whether accidental or intentional. The security safeguards to provide this protection shall be risk-based and business-driven with implementation achieved through a multi-layered security structure. All information access shall be limited based on a least-privilege approach and a need-to-know basis, i.e., authorized user access is only to information necessary in the performance of required tasks. Most of CMS' information relates to the health care provided to the nation’s Medicare and Medicaid beneficiaries, and as such, has access restrictions as required under legislative and regulatory mandates.

The CMS IS Program has a two-fold purpose:

(1) To enable CMS’ business processes to function in an environment with commensurate security protections, and

(2) To meet the security requirements of federal laws, regulations, and directives.

The principal legislation for the CMS IS Program is Public Law (P.L.) 107-347, Title III, Federal Information Security Management Act of 2002 (FISMA), http://csrc.nist.gov/drivers/documents/FISMA-final.pdf. FISMA places responsibility and accountability for IS at all levels within federal agencies as well as those entities acting on their behalf. FISMA directs Office of Management and Budget (OMB) through the Department of Commerce, National Institute of Standards and Technology (NIST), to establish the standards and guidelines for federal agencies in implementing FISMA and managing cost-effective programs to protect their information and information systems. As a contractor acting on behalf of CMS, this legislation requires that the Contractor shall:

· Establish senior management level responsibility for IS,

· Define key IS roles and responsibilities within their organization,

· Comply with a minimum set of controls established for protecting all Federal information, and

· Act in accordance with CMS reporting rules and procedures for IS.

Additionally, the following laws, regulations and directives and any revisions or replacements of same have IS implications and are applicable to all CMS contractors.

· P.L. 93-579, The Privacy Act of 1974, http://www.usdoj.gov/oip/privstat.htm , (as amended);

· P.L. 99-474, Computer Fraud & Abuse Act of 1986, www.usdoj.gov/criminal/cybercrime/ccmanual/01ccma.pdf P.L. 104-13, Paperwork Reduction Act of 1978, as amended in 1995, U.S. Code 44 Chapter 35, www.archives.gov/federal-register/laws/paperwork-reduction;

· P.L. 104-208, Clinger-Cohen Act of 1996 (formerly known as the Information Technology Management Reform Act), http://www.cio.gov/Documents/it_management_reform_act_Feb_1996.html;

· P.L. 104-191, Health Insurance Portability and Accountability Act of 1996 (formerly known as the Kennedy-Kassenbaum Act) http://aspe.hhs.gov/admnsimp/pl104191.htm;

· OMB Circular No. A-123, Management’s Responsibility for Internal Control, December 21, 2004, http://www.whitehouse.gov/omb/circulars/a123/a123_rev.html;

· OMB Circular A-130, Management of Federal Information Resources, Transmittal 4, November 30, 2000, http://www.whitehouse.gov/omb/circulars/a130/a130trans4.html;

· NIST standards and guidance, http://csrc.nist.gov/; and,

· Department of Health and Human Services (DHHS) regulations, policies, standards and guidance http://www.hhs.gov/policies/index.html These laws and regulations provide the structure for CMS to implement and manage a cost-effective IS program to protect its information and information systems. Therefore, the Contractor shall monitor and adhere to all IT policies, standards, procedures, directives, templates, and guidelines that govern the CMS IS Program, http://www.cms.hhs.gov/informationsecurity and the CMS System Lifecycle Framework, http://www.cms.hhs.gov/SystemLifecycleFramework.

The Contractor shall comply with the CMS IS Program requirements by performing, but not limited to, the following:

· Implement their own IS program that adheres to CMS IS policies, standards, procedures, and guidelines, as well as industry best practices;

· Participate and fully cooperate with CMS IS audits, reviews, evaluations, tests, and assessments of contractor systems, processes, and facilities;

· Provide upon request results from any other audits, reviews, evaluations, tests and/or assessments that involve CMS information or information systems;

· Report and process corrective actions for all findings, regardless of the source, in accordance with CMS procedures;

· Document its compliance with CMS security requirements and maintain such documentation in the systems security profile;

· Prepare and submit in accordance with CMS procedures, an incident report to CMS of any suspected or confirmed incidents that may impact CMS information or information systems; and

· Participate in CMS IT information conferences as directed by CMS.

If the contractor believes that an updated IS-related requirement posted to the CMS website may result in a significant cost impact, the contractor may submit a request for equitable cost adjustment before implementing change.

H.8 ADDITIONAL SECURITY

The government expects that in order to maintain HIPAA, FISMA and Privacy Act requirements in conjunction with the data under this contract, the vendor would be required to perform this contract within the CONUS boundaries, excluding sharing of data electronically outside of CONUS.

H.9 SECTION 508 COMPLIANCE FOR COMMUNICATIONS

The contractor shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents and the SOW, the SOW shall take precedence.

Rehabilitation Act, Section 508 Accessibility Standards

1. 29 U.S.C. 794d (Rehabilitation Act as amended)

2. 36 CFR 1194 (508 Standards)

3. www.access-board.gov/sec508/508standards.htm (508 standards)

4. FAR 39.2 (Section 508)

5. CMS/HHS Standards, policies and procedures (Section 508) In addition, all contract deliverables are subject to these 508 standards as applicable.

Regardless of format, all Web content or communications materials produced, including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents (above/below). Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW shall be the responsibility of the contractor or consultant.

The following Section 508 provisions apply to the content or communications material identified in this SOW:

36 CFR Part 1194.22 a – j, l – p 36 CFR Part 1194.41 a – c