RFP 220509_Amendment 2_6-30-22.pdf

DEPARTMENT OF HEALTH & HUMAN SERVICES

Centers for Medicare & Medicaid Services 7500 Security Boulevard, Mail Stop B3-30- 03 Baltimore, Maryland 21244-1850

June 10, 2022June 30, 2022

To: All Service-Disabled Veteran-Owned Small Businesses

From: The Centers for Medicare and Medicaid Services (CMS)

Subject: Request for Proposal (RFP) #220509 – Enterprise Cybersecurity Awareness and Training Program Support – AMENDMENT 2

The Centers for Medicare and Medicaid Services (CMS) is issuing this competitive solicitation to all qualified Service-Disabled Veteran-Owned Small Business (SDVOSB) concerns for the purpose of entering into a Firm Fixed Price (FFP) Contract with a North American Industry Classification System (NAICS) code of 541519 – Other Computer Related Services. Offerors must either ensure that the System for Award Management (SAM) record for their company contains the designated NAICS code or provide self-certification that the offeror is a SDVOSB concern for the size standard for the designated NAICS code (i.e., $30M in average annual receipts/average employment of 150 employees for Information Technology Value Added Resellers). The Agency will conduct this acquisition in accordance with FAR Part 15 and FAR Part 19 procedures (as applicable). If you are interested in this acquisition, you may participate by submitting your response in accordance with the following instructions.

Offerors are required to submit both written technical and business proposals to the designated Government officials for the purposes of assuring that the prospective Contractor is fully cognizant of the scope of this contract and has the capability to perform all Statement of Work (SOW) requirements.

CMS anticipates a single contract award for this procurement based on the evaluation criteria in this document. However, CMS reserves the right to make multiple awards.

Please be advised that this RFP does not commit the Government to pay any cost for the preparation and submission of a proposal. In addition, the Contracting Officer is the only individual who can legally commit the Government to the expenditures of public funds in connection with the proposed procurement.

If you have any questions concerning this request contact Carrie Vien, Contract Specialist, at (410)786-8068, carrie.vien@cms.hhs.gov or the undersigned at 410-786-4588, dawn.wilkins@cms.hhs.gov.

Sincerely, Dawn R. Wilkins Contracting Officer

TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 DESCRIPTION OF SERVICES

B.2 TYPE OF CONTRACT

B.3 SCHEDULE OF SERVICES

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 STATEMENT OF WORK

SECTION D - PACKAGING AND MARKING

D.1 PACKAGING AND MARKING

SECTION E - INSPECTION AND ACCEPTANCE

E.1 INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

F.1 PERIOD OF PERFORMANCE

F.2 ITEMS TO BE FURNISHED AND DELIVERY SCHEDULE

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 ACCOUNTING AND APPROPRIATION DATA

G.2 PAYMENTS – INVOICES (AUG 2020)

G.3 CONTRACTOR PAST PERFORMANCE EVALUATIONS (OCT 2014)

G.4 GOVERNMENT REPRESENTATIVES AND RESPONSIBILITIES (JUL 2016)

G.5 CONTRACTOR WORK PERFORMED OUTSIDE THE UNITED STATES AND

ITS TERRITORIES (JAN 2021)

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.1 CONFLICT OF INTEREST (OCT 2020)

H.2 HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

H.3 CMS SECURITY CLAUSE

H.4 HHSAR 352.237-75 KEY PERSONNEL

H.5 CMS INFORMATION SECURITY (OCT 2020)

H.6 MANDATORY CONTRACTOR TRAINING (FEB 2020)

PART II - CONTRACT CLAUSES

SECTION I - CONTRACT CLAUSES

I.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

I.2 DEPARTMENT OF HEALTH AND HUMAN SERVICES ACQUISITION

REGULATION (HHSAR) CLAUSES INCORPORATED BY REFERENCE

I.3 HHSAR 352.252-20 DEPARTMENT OF HEALTH AND HUMAN SERVICES

ACQUISITION REGULATION (HHSAR)

I.4 HHSAR 352.239-74 ELECTRONIC AND INFORMATION TECHNOLOGY

ACCESSIBILITY (DEC 2015)

I.5 FAR 52.204-23 PROHIBITION ON CONTRACTING FOR HARDWARE,

SOFTWARE, AND SERVICES DEVELOPED OR PROVIDED BY

KASPERSKY LAB AND OTHER COVERED ENTITIES (JUL 2018)

I.6 FAR 52.204-24 REPRESENTATION REGARDING CERTAIN

TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR

EQUIPMENT

I.7 FAR 52.204-25 PROHIBITION ON CONTRACTING FOR CERTAIN

TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR

EQUIPMENT

I.8 FAR 52.204-26 COVERED TELECOMMUNICATIONS EQUIPMENT OR

SERVICES REPRESENTATION

I.9 FAR 52.215-19 NOTIFICATION OF OWNERSHIP CHANGES (OCT 1997)

I.10 FAR 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

I.11 FAR 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT

(MAR 2000)

I.12 FAR 52.232-18 AVAILABILITY OF FUNDS (APR 1984)

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS AND EXHIBITS

J.1 STATEMENT OF WORK (SOW)

J.2 CONTRACTOR/OFFEROR CONFLICT OF INTEREST

J.3 QUESTION SUBMISSION FORM

J.4 PAST PERFORMANCE QUESTIONNAIRE

PART IV -- REPRESENTATIONS AND INSTRUCTIONS

SECTION K – REPRESENTATIONS, CERTIFICATIONS, AND OTHER

STATEMENTS OF OFFERORS OR RESPONDENTS

K.1 FAR 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY

REFERENCE (FEB 1998)

K.2 FAR 52.204-7 SYSTEM FOR AWARD MANAGEMENT (JUL 2013)

K.3 FAR 52.204-8 ANNUAL REPRESENTATIONS AND CERTIFICATIONS

(MAY 2022)

K.4 FAR 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS

(OCT 2018)

SECTION L – INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS OR

RESPONDENTS

L.1 FAR 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY

REFERENCE (FEB 1998)

L.2 DEPARTMENT OF HEALTH AND HUMAN SERVICES ACQUISITION

REGULATIONS (HHSAR) PROVISIONS INCORPORATED BY

REFERENCE

L.3 FAR 52.215-1 INSTRUCTIONS TO OFFERORS – COMPETITIVE

ACQUISITION (NOV 2021)

L.4 FAR 52.216-1 TYPE OF CONTRACT (APR 1984)

L.5 FAR 52.233-2 SERVICE OF PROTEST (SEP 2006)

L.6 FAR 52.252-5 AUTHORIZED DEVIATIONS IN PROVISIONS (APR 1984)

L.7 GENERAL

L.8 SUBMISSION OF QUESTIONS

L.9 NOTICE OF INTENT

L.10 SUBMISSION REQUIREMENTS AND PROPOSAL DUE DATE

L.11 AVAILABILITY OF FUNDS

SECTION M – EVALUATION FACTORS FOR AWARD

M.1 FAR 52.217-5 EVALUATION OF OPTIONS (JUL 1990)

SECTION B - SUPPLIES OR SERVICES/PRICES

B.1 The purpose of this contract is to obtain Enterprise Cybersecurity Awareness and Training Program Support services needed to consolidate existing ISPG training efforts and support the continuation of the program’s training activities of ISPG.

B.2 TYPE OF CONTRACT

This is a Firm-Fixed-Price contract. The total price of this contract is $TBD.

B.3 SCHEDULE OF SERVICES PRICE/COSTS

The total FFP of this contract is allocated as follows:

CLIN Description FFP Unit # of Units Unit Price Total Price

CLIN 0001*

Base Year

09/16/22 – 09/15/23 Month 12 $ $

CLIN 0002

Option Year 1

09/16/23 – 09/15/24 Month 12 $ $

CLIN 0003

Option Year 2

09/16/24 – 09/15/25 Month 12 $ $

CLIN 0004

Option Year 3

09/16/25 – 09/15/26 Month 12 $ $

CLIN 0005

Option Period 4

09/16/26 – 07/15/27 Month 10 $ $

CLIN 0006

Transition-Out

07/16/27 – 09/15/27 Month 2 $ $

Total Contract Price $

*Includes Transition-In not to exceed 2 months.

(END OF SECTION B)

SECTION C - DESCRIPTION/SPECIFICATIONS

C.1 STATEMENT OF WORK

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work (SOW), ATTACHMENT 1, attached hereto and made a part of this solicitation.

(END OF SECTION C)

SECTION D - PACKAGING AND MARKING

D.1 PACKAGING AND MARKING

Not Applicable.

(END OF SECTION D)

SECTION E - INSPECTION AND ACCEPTANCE

E.1 INSPECTION AND ACCEPTANCE (MAY 2013)

a. Inspection and acceptance of the Contractor’s supplies or services shall be in accordance with the applicable FAR Clause in the contractor’s GSA contract.

All work under this contract is subject to inspection and final acceptance by the Contracting Officer, or the Contracting Officer’s Representative (COR), a duly authorized representative of the Contracting Officer. The COR is hereby delegated responsibility for inspection and acceptance of all supplies and/or services to be delivered under this contract.

(END OF SECTION E)

SECTION F – DELIVERIES OR PERFORMANCE

F.1 PERIOD OF PERFORMANCE

Base Year: 9/16/22 – 09/15/23 (includes Transition-In not to exceed 2 months) Optional Year 1: 9/16/23 – 9/15/24 Optional Year 2: 9/16/24 – 09/15/25 Optional Year 3: 9/16/25 – 9/15/26 Optional Period 4: 9/16/26 – 7/15/27 Transition Out: 7/16/27 - 9/15/27

F.2 ITEMS TO BE FURNISHED AND DELIVERY SCHEDULE

The Contractor shall furnish the items required under this contract in accordance with the reporting instructions and delivery schedule set forth in the ECATPS Statement of Work.

(END OF SECTION F)

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 ACCOUNTING AND APPROPRIATION DATA

REQUISITION # APPROPRIATION CAN OBJECT

CODE

AMOUNT

TOTAL

G.2 PAYMENTS - INVOICES - (August 2020)

a. GENERAL: Effective August 31, 2020, the contractor/vendor shall create an invoice within the Invoice Processing Platform (IPP), a secure Web-based service for federal agencies and their vendors to manage government invoicing from purchase order (PO) through payment notification. Note: All invoice terms and conditions are contract specific and may vary from contract to contract.

c. CONTENT OF INVOICE: FAR 32.905 Payment Documentation and Process, provides the required content for a proper invoice. In addition to the requirements of FAR 32.905, the following items shall also be included on the invoice to be considered proper:

Line item number (i.e. CLIN/SLIN as applicable);

Contractor’s DUNS Number;

Period of performance or delivery date of goods or services provided;

Attachments

d. INVOICE SUBMISSION: The contractor/vendor shall create an invoice from the Purchase

Order (PO)/Contract via the IPP website http://www.ipp.gov/. For questions, call IPP Customer Support at (866) 973-3131 or email the IPP Customer Support at IPPCustomerSupport@fiscal.treasury.gov.

e. PAYMENTS: The Government shall make payment of all proper invoices in accordance with the following clauses:

FAR 52.232-33 Payments by Electronic Funds Transfer – System for Award Management, FAR 52.232-1 Payments FAR 52.212-4 Contract Terms and Conditions – Commercial Items (If applicable) FAR 52.216-7 Allowable Cost and Payment FAR 52.232-7 Payments under Time-and-Materials and Labor-Hour Contracts

Payment shall be made upon acceptance by the Contracting Officer’s Representative (COR)in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer’s approval, as appropriate.

Reimbursement for invoices submitted under this contract shall be made no later than 30 calendar days after receipt of a proper invoice from the Contractor requested at the paying office designated above. Contracts with a 15-day payment term are not subject to interest payments until after day 30.

f. INTEREST ON OVERDUE PAYMENT: The Prompt Payment Act, Public Law 97-177 (96

Stat.85.31 U.S.C. 1801) is applicable to payments under this contract and requires the payment of interest on payments made more than 30 calendar days after receipt of a proper invoice in

IPP.

Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and 5 CFR 1315.

G.3 CONTRACTOR PAST PERFORMANCE EVALUATION(S) (OCT 2014)

a. General:

In accordance with Federal Acquisition Regulation (FAR) 42.15, Contractor Performance Information, past performance evaluations shall be prepared at least annually and at the time the work under a contract or order is completed. Additional interim performance evaluations may be prepared at Contracting Officer discretion, as necessary.

CMS will utilize the Contractor Performance Assessment Reporting System (CPARS), the Government-wide evaluation reporting tool for all past performance reports on contracts and orders, as appropriate. CPARS is a secure Internet website located at https://www.cpars.gov.

b. CPARS Process:

1. CPARS Training: Contractors may obtain CPARS training material and register for on-line training https://www.cpars.gov.

2. Post-Award Contract Registration: CMS is responsible for registering the contract in CPARS within 30 calendar days of contract award. The Contractor shall:

i. Designate at least one (1) point of contact that will be responsible for serving as the

Contractor’s Representative (CR). Additional CRs may also be identified; and,

ii. Provide the CMS Contract Specialist with the name(s) and email address(es) of the

CPARS point(s) of contact.

Once CMS registers the contract in CPARS, the CR(s) will receive an automated CPARS email message that contains User IDs and instructions for creating a password for future past performance evaluation processing.

3. Interim, Annual and Final Past Performance Evaluation Reports:

a. Issuing the Evaluation: Once the CMS Assessing Official (AO) issues an evaluation to the Contractor in CPARS, the CR(s) will receive an email instructing them to login to CPARS to review the evaluation.

b. Contractor Comments: The CR has the option to provide comments on the evaluation, indicate if they concur or do not concur with the evaluation, sign, and then return the evaluation to the AO. The CR has a total of 60 days following the AO’s evaluation signature date to submit comments. If the CR submits comments within the first 14 days following the AO’s signature date and the AO closes the evaluation, the evaluation will become available in Past Performance Information Retrieval System - Report Card (PPIRS-RC) within 1 day.

On day 15 following the AO’s evaluation signature date, the evaluation will become available in PPIRS-RC with or without CR comments and whether or not it has been closed by the AO. If no CR comments have been sent and the evaluation has not been closed, it will be marked as “Pending” in PPIRS-RC.

If the CR sends comments at any time prior to 61 days following the AO’s evaluation signature date, those comments will be reflected in PPIRS-RC within 1 day. On day 61 following the AO’s evaluation signature date, the CR will be “locked out” of the evaluation and may no longer send comments.

G.4 GOVERNMENT REPRESENTATIVES AND RESPONSIBILITIES (JUL

2016)

Following are the Government Representatives and their respective roles and responsibilities on this contract:

a. Contracting Officer As defined in Federal Acquisition Regulation (FAR) 2.101, Definitions, and in accordance with FAR 1.602-1, Authority, “Contracting officers have authority to enter into, administer, and/or terminate contracts and make related determinations and findings.” There is no other authorized representative or any other Administrative Contracting Officer assigned to this contract to carry out a Contracting Officer’s duties, except for technical direction assigned to the Contracting Officer’s Representative, if applicable.

The Contracting Officer is:

Centers for Medicare & Medicaid Services Office of Acquisition & Grants Management Information Technology Contracts Group (ITCG) Division of Division of Information Systems Support Contracts (DISC) ATTN: Dawn R. Wilkins 7500 Security Blvd.

Baltimore, MD 21244-1850 Phone: 410-786-4588 Email Address: Dawn.Wilkins@cms.hhs.gov

b. Contract Specialist Notwithstanding any of the other provisions of this Contract, the Contract Specialist will assist the Contracting Officer with his/her responsibilities as defined in the FAR.

The Contract Specialist is:

Centers for Medicare & Medicaid Services Office of Acquisition & Grants Management Information Technology Contracts Group (ITCG) Division of Information Systems Support (DISC) ATTN: Carrie Vien 7500 Security Blvd.

Baltimore, MD 21244-1850 Phone: 410-786-8068 Email Address: Carrie.Vien@cms.hhs.gov

c. Contracting Officer’s Representative The Contracting Officer’s Representative (COR), as defined in FAR 2.101, Definitions, is:

Centers for Medicare & Medicaid Services Office of Acquisition & Grants Management

TBD

Division of TBD

ATTN: TBD

7500 Security Blvd.

Mail-stop: TBD Baltimore, MD 21244-1850 Phone: 410-786-XXXX Email Address: TBD

In accordance with FAR 1.602-2(d), Responsibilities, the COR’s delegated responsibilities are identified in the Contracting Officer’s appointment memorandum, a copy of which will be furnished to the contractor.

Technical direction must be within the general scope of the work stated in the contract. The term "technical direction" is defined to include, without limitation, the following:

(1) Directions to the Contractor which direct the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual technical requirements as identified in the Statement of Work or Performance Work Statement; or

(2) Provision of information to the Contractor, which assists in the interpretation of drawings, specifications, or technical portions of the work description.

The COR does not have the authority to:

1. Make changes to contract terms and conditions;

2. Direct the contractor to perform work or make deliveries not specifically required under the contract;

3. Waive or relax the Government’s rights with regard to the Contractor’s compliance with the specifications, price, delivery or any other terms or conditions of the contract;

4. Make any commitments or approve any actions that would create any financial obligation on the part of the Government; or

5. Issue direction that constitutes a “change” as defined in:

FAR 52.243-1, Changes – Fixed Price;

FAR 52.243-2, Changes – Cost Reimbursement;

FAR 52.243-3, Changes – Time and Material and Labor Hour;

FAR 52.243-4, Changes; or, FAR 52.243-5, Changes and Changed Conditions.

All technical direction shall be issued in writing by the COR or, if issued verbally, shall be confirmed in writing by the COR within five (5) business days after issuance.

The Contractor shall proceed promptly with the performance of technical direction duly issued by the COR within the scope of his/her authority.

If, in the opinion of the Contractor, any instruction or direction issued by a Government representative constitutes a change to the contract or constitutes a “Change Order” as defined in FAR 2.101, Definitions, the Contractor shall follow the instructions identified in FAR 52.243-7 Notification of Changes.

G.5 CONTRACTOR WORK PERFORMED OUTSIDE THE UNITED STATES

AND ITS TERRITORIES (JAN 2021)

To comply with requirements of Homeland Security Presidential Directive -12 (HSPD-12) and Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple CMS information systems by efficiently verifying the claimed identity of individuals working on the contract. The Contractor and its subcontractor(s) shall not perform any activities under this contract, including the transmission of data or other information, outside of the United States (U.S.) and its Territories without the prior written approval of the Contracting Officer. If work must be performed outside the U.S., the Contractor shall submit a request to the Contracting Officer, in writing, at least 45 calendar days prior to the work beginning.

The Contracting Officer will consider the following factors in making a decision whether to authorize the performance of work outside the U.S. and its Territories:

1. The necessity of the work to be performed outside the United States and its territories;

2. The Statement of Work under contract that will be performed outside the U.S. and its Territories;

3. Total projected dollar value of the work to be performed outside the U.S.;

4. Total projected number of labor hours and length of time to be performed for each individual employee working outside the U.S.;

5. The desired country/location where the work will be performed;

6. FAR Part 25, Foreign Acquisitions, and all other laws and regulations applicable to the performance of work outside the U.S.;

7. The contractor and/or its subcontractor(s) plans to adequately protect and secure

CMS data, as well as abide by all applicable laws and regulations when work is performed outside of the U.S. and its Territories. Plans shall include -

a. Adequate contract terms regarding system security;

b. Adequate contract terms regarding the confidentiality and privacy requirements for information and data protection;

c. Adequate contract terms that are otherwise relevant, including the requirements of the Statement of Work;

d. The Contractor’s corporate compliance plan and internal policies and procedures designed to prevent and detect violations of applicable law, regulations, rules and ethical standards by employees, agents and others; and,

8. The necessity of Government Furnished Equipment (GFE) or Contractor Owned/Contractor Operated (COCO) devices to be used outside the U.S. and verification of a secure VPN access.

9. Compliance with Executive Order 13940 Aligning Federal Contracting and Hiring Practices With the Interests of American Workers. Determine if approval will reduce opportunities for the United States contractor workers performing in the United States and if this would cause any potential effects to national security.

10. Conformance with Section 889 “Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment”, of Public Law 115-232.

11. Determination that approval is in best interest of the Government.

The Contractor’s request for authorization to perform work outside the U.S. shall include supplemental information to demonstrate that the performance of the work outside the U.S. satisfies all of the above factors. Contracting Officer approval to perform work outside the U.S. may require additional Statement of Work requirements, additional contract terms and conditions and/or Federal Acquisition Regulation (FAR) clauses to be incorporated into the contract.

(END OF SECTION G)

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H.1 - CONFLICT OF INTEREST (OCT 2020)

a. General: The contractor and the services provided under this contract shall be free, to the greatest extent possible, of all Organizational and Personal Conflicts of Interest. Consistent with these terms and conditions, all references to Organizational and/or Personal Conflicts of Interests will be referred to individually or collectively, as Conflicts of Interest (COI). Except as defined by these terms and conditions and in accordance with FAR 9.503, the Contracting Officer shall not maintain a contract with a contractor the Contracting Officer (CO) determines has, or has the potential for, an unresolved COI.

b. Definitions:

Actual COI– The COI is either currently in existence as determined by the contractor or CMS. This form of COI will require avoidance, neutralization or mitigation acceptable to

CMS.

Affiliates –Associated business concerns or individual(s) if, directly or indirectly, either one controls or can control the other; or a third party controls or can control both.

Apparent (Perceived) COI – The COI on first observation appears to be an actual or potential COI, but may or may not be after analysis.

Avoidance – To prevent the occurrence of a COI through actions such as exclusion of sources or modification of requirements. Avoidance precludes the conflict.

Contractor – The term contractor is used synonymously with offeror.

Financial Relationships – A direct or indirect ownership or investment interest (including a stock option or non-vested interest) in any entity that exists through equity, debt, or other means and includes any indirect ownership or investment interest no matter how many levels removed from a direct interest.

Mitigation– To reduce the effects of a COI to an acceptable level of risk so that the Government’s interest with regard to fair competition and/or contract performance are not impaired. The conflict remains but action was taken that minimizes the impact of the conflict to an acceptable level of risk.

Mitigation Plan – The contractor’s written approach to mitigating a COI as documented in J.2 Section B.4.

Neutralization – To counteract, through a specific action, the effects of potential or actual COI. The conflict remains, but the impact of the conflict has been negated.

Organizational Conflict of Interest – Occurs when other activities or relationships with other persons, a person is unable or potentially unable to render impartial assistance or advice to the Government, or the person’s objectivity in performing the contract work is or might be otherwise impaired, or a person has an unfair competitive advantage.

Personal Conflicts of Interest – A situation in which a person has a financial interest, personal activity, or relationship that could impair the person’s ability to act impartially and in the best interest of the Government when performing under this contract.

Potential COI – A future situation or circumstance that would create a conflict of interest.

Three (3) Types of COIs include:

Conflict Types Definitions

Biased Ground Rules

Consists of situations where a contractor and/or its affiliate(s), as part of its performance of a Government contract, has helped (or is in a position to help) set the ground rules for another Government contract by, for example, writing the statement of work or the specifications, or establishing source-selection criteria. In these “biased ground rules” cases, the primary concern is that the entity could skew the competition, whether intentionally or not, in favor of itself and/or its affiliates.

Impaired Objectivity

Consists of situations where a contractor and/or its affiliate(s) has an interest (typically financial) that may conflict with the interest of the Government to whom the contractor has a contractual obligation, and where the entity’s work under the Government contract could give the contractor the opportunity to benefit its other business interests. If the entity is providing recommendations, judgment or advice, and its other business interests could be affected by that recommendation, judgment or advice, it’s objectivity may be impaired. An example is where the entity was evaluating itself or evaluating an affiliate or a competitor, either through an assessment of performance under another contract or an evaluation of proposals.

Unequal Access to Information

“Unfair” access to non-public information – Consists of situations where a contractor and/or its affiliate(s) has access to nonpublic information (including proprietary information and non-public source-selection information) as part of its performance of a Government contract and that information may provide the entity with a competitive advantage in a later competition for a Government contract. In these “unequal access to information” cases, the concern is limited to the risk of the contractor and/or its affiliates gaining an unfair competitive advantage; there is no issue of bias. Note: Incumbency alone does not constitute “unequal access to information.”

c. Significant Potential Conflict of Interest:

1. Nature of Conflict: Although not all inclusive, the following are considered to be an actual, potential or apparent COI with the work to be performed under this contract. The contractor shall promptly notify the CO if it is an entity, or affiliated with an entity, where any of the following circumstances exist:

a) Biased Ground rules, impaired objectivity or unequal access to information as explained in the definitions above and/or;

b) Within the three types of conflicts of interest, the CO has identified the following specific circumstances of conflicts:

Not Applicable

Proposed Restraint on Future Contractor Activities: CMS is proposing to restrain future contractor activities as follows:

Not Applicable

d. Conflict of Interest Oversight and Mitigation Plan:

1. Conflict of Interest Oversight Program: The contractor shall maintain an effective COI Oversight Program throughout the performance of the contract which includes procedures to monitor and disclose all Organizational and Personal Conflicts of Interest. A COI oversight program should include the monitoring of personal conflicts of interest such as, but not limited to:

a) Managers or Key Personnel who would be, or are involved with, the performance of this contract;

b) Governing Body Members (e.g., Board of Directors; Trustees); and

c) Principals of the organization as defined by FAR 52.203-13, Contractor

Code of Business Ethics and Conduct.

2. Mitigation Plan: At any time during the performance of the contract if an actual, potential, or apparent COI is identified whether by the CO, the contractor or otherwise, the contractor shall submit a mitigation plan (J.2 Contractor/Offeror COI Submission Template) within 30 days unless otherwise specified by the CO. It is the contractor’s responsibility under the terms and conditions to provide timely notification to the CO those COIs that are self-identified. The CO will notify the contractor regarding the specifics for submission. The Government will review the submission at which time a determination will be made whether a COI has been satisfactorily mitigated or if further action is necessary and will notify the contractor accordingly. In cases where a COI cannot be, or has not been, mitigated to the Government’s satisfaction, the Government may take the following actions (this list is not all inclusive):

a) Request a waiver in accordance with FAR 9.503 Waiver, from the Head of the Contracting Activity.

b) Make changes to the requirements of the contract

c) Require a subcontractor change (if the conflict lies with the subcontractor); and/or

d) Terminate the contract in whole or in part.

e. Subcontractor Flow-Down Terms and Conditions: The prime contractor is responsible for avoiding, neutralizing and mitigating all actual, potential, or apparent COIs of its subcontractors, in accordance with these terms and conditions. Therefore, the prime contractor shall flow-down terms and conditions H.1 Conflict of Interest and Compliance, of this contract in all subcontracts. For subcontractors, wherever the term “contractor” is used, insert “subcontractor.”

H.2 HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. § 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor's duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

"Business Associate'' shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS’ HIPAA-covered functions.

"Covered Entity" shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

"Secretary" shall mean the Secretary of the Department of Health & Human Services or the Secretary's designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or on behalf of, Covered Entity other than as permitted or required by this Contract or as required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual for:

A. Filing a complaint under 45 CFR § 160.306;

B. Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under 45 CFR Part 160; or

C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its security policies and procedures, including workforce security measures, to ensure proper security awareness and training (including security incident response and reporting), and security incident procedures, in accordance with this Contract, including this HIPAA Business Associate Clause and the Contract’s clause entitled “CMS Information Security.”

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI created, received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as provided for by this Contract. In doing so, it shall implement policies and procedures to address the following and, where applicable, ensure that such policies and procedures are also in conformance with this Contract’s clause entitled “CMS Information Security:”

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual’s access rights to PHI (including the implementation of workforce security measures to ensure continued appropriate role-based access to PHI), and technical policies and procedures to ensure compliance with grants of access (including unique user identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities in which they are housed.

C. Implement policies, procedures and physical security measures that will limit access to PHI through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or outside of the Business Associate’s facility as well as the disposal and reuse of media containing PHI.

E. Implement appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability (including the use of contingency plans) of any electronic protected health information ("EPHI") it creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, maintenance or transmission of such EPHI. In the establishment of such safeguards, Business Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, and its hardware and software security capabilities.

iii. Assess, and implement, where appropriate, any addressable implementation specifications associated with applicable PHI security standards.

iv. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

v. Comply with the following Incident Reporting:

A. Report to Covered Entity any security incident/breach involving unsecured

PHI, of which it becomes aware, including those of its agents and subcontractors. The Business Associate shall report any violation of the terms of this contract involving PHI and any security incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in accordance with the CMS Risk Management Handbook (RMH), specifically “RMH Vol II Procedure 7-2 Incident Handling Procedure” and “RMH Vol III Standard 7-1 Incident Handling.” These procedures can be found at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-

Technology/InformationSecurity/Information-Security-Library.html In addition, the Business Associate will also notify the CMS Contracting Officer and the Contracting Officer’s Representative (COR) by email within one (1) hour of identifying such violation or incident.

B. Upon Covered Entity's knowledge of any material security incident/breach by

Business Associate, Covered Entity will provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination clause of this Contract. See also paragraph D. Term of Clause below.

vi. Ensure that any agent or subcontractor agrees through a written contract, or other legally enforceable arrangement, to the same restrictions and conditions that apply through this HIPAA Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or on behalf of, Covered Entity.

vii. Upon Covered Entity’s request:

A. Provide the Covered Entity or its designee with access to the PHI created, received, maintained or transmitted by Business Associate from or on behalf of the Covered Entity in the course of contract performance in order to ensure Covered Entity’s ability to meet the requirements under 45 CFR § 164.524.

B. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR §

164.526.

viii. Make its facilities and any books, records, accounts, and any sources of PHI, including any policies and procedures, that are pertinent to ascertaining its own compliance with this contract or the Covered Entity’s compliance with the applicable HIPAA requirements, available to Covered Entity, or, in the context of an investigation or compliance review, to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the various rules implementing the HIPAA.

ix. Document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

x. Provide to Covered Entity, or an individual identified by the Covered Entity, information collected under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

xi. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

d. Term of Clause

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of the PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity in accordance with “CMS Information Security” procedures. Business Associate shall not retain any PHI.

2. Security Incident/Breach:

Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall take action consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts – Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of Contracts, if the Business Associate does not cure the security incident/breach within the time specified by Covered Entity and/or cure is not possible; or, B. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

ii. Other Agreements –Covered Entity shall either:

A. Provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination terms of this Contract. Covered Entity may terminate this Contract for default if the Business Associate does not cure the breach or end the violation within the time specified by Covered Entity; or, B. Consistent with the terms of this Contract, terminate this Contract for default if

Business Associate has breached a material term of this Contract and cure is not possible; or, C. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

3. Returning or Destroying PHI:

Business Associate, as defined above, which includes subcontractors or agents of the Contractor, shall:

i.Upon expiration or termination of this Contract, for any reason, return or destroy all

PHI received from Covered Entity or another Business Associate of the Covered Entity, as well as any PHI created, received, maintained or transmitted from or on behalf of Covered Entity, or another Business Associate of the Covered Entity, in accordance with this contract, including the “CMS Information Security” clause.

ii. In the event that Business Associate determines that returning or destroying the PHI is infeasible, provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon such notice that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such

PHI.

e. Miscellaneous

1. A reference in this Contract to a section in the Rules issued under HIPAA means the section as in effect or as amended.

2. The respective rights and obligations of Business Associate under paragraph D.3.b of the section entitled "Term of Clause" shall survive the termination of this Contract.

Any ambiguity in this Contract clause shall be resolved to permit Covered Entity to comply with the Rules implemented under HIPAA.

H.3 CMS SECURITY CLAUSE

a. Applicability

In accordance with OMB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive 12 (HSPD-12): Policy for a Common Identification Standard for Federal Employees and Contractors, dated August 27, 2004, and FIPS PUB Number 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple applications by efficiently verifying the claimed identity of individuals seeking physical access to Federally controlled government facilities and logical access to government information systems. Contractors that require physical access to a CMS facility and/or routine access to a CMS-controlled information system or sensitive information, will be required to obtain a PIV card. FIPS PUB 201-2 specifies the architecture and technical requirements for a common identification standard for Federal employees and contractors.

In accordance with HHSAR 352.239-70, Standard for Security Configurations, when a Personal Identify Verification (PIV) card is provided, it shall be used in conjunction with a compliant card reader for logical system access.

b. Definitions

“Agency Access” means access to CMS facilities, sensitive information, information systems or other CMS resources.

“Applicant” is a contractor employee for whom the contractor submits an application for a CMS identification card.

“Contractor Employee” means prime contractor and subcontractor employees who require agency access to perform work under a CMS contract.

“Federal Identification Card” (or “ID card”) means a federal government issued or accepted identification card such as a Personal Identity Verification (PIV) card, or a Local-Based Physical Access Card issued by CMS, or a Local-Based Physical Access Card issued by another Federal agency and approved by CMS. PIV and Local-Based Physical Access cards have physical and electronic attributes that other (Local-Based Physical Access Cards) do not have.

“Issuing Office” means the CMS entity that issues identification cards to contractor employees.

“Local Security Servicing Organization” means the CMS entity that provides security services to the CMS organization sponsoring the contract, Division of Critical Infrastructure and Protection (DCIP).

“Official duty station”—An area defined by the agency that includes the location where the employee regularly performs his or her duties or an invitational traveler’s home or regular place of business. The area may be a mileage radius around a particular point, a geographic boundary, or any other definite domain, provided no part of the area is more than 100 miles from where the employee regularly performs his or her duties or from an invitational traveler’s home or regular place of business. If the employee’s work involves recurring travel or varies on a recurring basis, the location where the work activities of the employee’s position of record are based is considered the regular place of work.

“Personal Identity Verification (PIV) card” is a physical artifact (e.g., identity card, “smart” card) issued to an individual that contains a PIV Card Application which stores identity credentials (e.g., photograph, cryptographic keys, digitized fingerprint representation) so that the claimed identity of the cardholder can be verified against the stored credentials by another person (human readable and verifiable) or an automated process (computer readable and verifiable)..

c. Screening of Contractor Employees

1. Contractor Screening of Applicants

i. Contractor Responsibility: The contractor shall pre-screen individuals designated for employment under any CMS contract by verifying minimal suitability requirements to ensure that only qualified candidates are considered for contract employment, and to minimize the burden on the Government of conducting background investigations on objectionable applicants. The contractor shall exercise due diligence in pre-screening all employees prior to submission to CMS for agency access.

ii. Alien Status: The Contractor shall monitor an alien’s (foreign nationals) continued authorization for employment in the United States. If requested by the Agency, the Contractor shall provide documentation to the Contracting Officer (CO) or the COR that validates that the Employment Eligibility Verification (e- Verify) requirement has been met for each contractor or sub-contractor employee working on the contract in accordance with regulation defined in the Federal Acquisition Regulation (FAR) 52.222-54 - Employment Eligibility Verification.

iii. Residency Requirement: All CMS contractor applicants shall have lived in the United States at least three (3) out of the last five (5) years prior to submitting an application for a Federal ID Card. CMS will process background investigations for foreign nationals in accordance with Office of Personnel Management (OPM) guidance. Contractor employees who worked for the U. S. Government as an employee overseas in a Federal or military capacity; and/or been a dependent of a U.S. Federal or military employee serving overseas, must be able to provide state-side reference coverage.

State-side coverage information is required to make a suitability or security determination. Examples of state-side coverage information include: the state-side address of the company headquarters where the applicant’s personnel file is located, the state-side address of the Professor in charge of the applicant’s “Study Abroad” program, the church records for the applicant’s overseas church missions, and/or the state-side addresses of anyone who worked or studied with the applicant while overseas.

iv. Selective Service Registration: All males born after December 31, 1959, must meet the Federal Selective Service System requirements as established on www.sss.gov.

2. Identification Card Application Process ID Card Sponsor: The CMS Contracting Officer’s Representative (COR) will be the CMS ID card Sponsor and point of contact for the contractor’s application for a CMS ID card. The COR will review and approve/deny the CMS ID card application before the form is submitted to the CMS, Office of Operations Management (OOM), Division of Personnel Security Services (DPSS), for processing. If approved, an applicant may be issued either a Personal Identity Verification (PIV) card that meets the standards of HSPD-12 or a Local-Based Physical Access Card.

Contractor Application Required Submissions:

i. All applicants shall submit an HHS-745, HHS ID Badge Request, form for issuance of a PIV or Local-Based Physical Access Card.

ii. PIV Training: Contractors who need PIV ID cards shall complete HHS PIV

Applicant Training.

CMS Applicant Evaluations: CMS will evaluate an applicant’s required access level.

Once the review is complete and accepted for further processing, the applicant will be contacted by DPSS to submit the below information, as applicable.

i. e-QIP: Contractor employees will be required to submit information into e-QIP, a web-based automated system that is designed to facilitate the processing of standard investigative forms used when conducting background investigations for Federal security, suitability, fitness and credentialing purposes.

ii. Fingerprints: Instructions for obtaining fingerprints will be provided by CMS, OOM, DPSS.

iii. Security Education Awareness and Training: All contractors are to complete Security and Insider Threat Awareness Training.