Att D - 2025-EM-SOW-Mass Notification System-V4.pdf

PHOENIX AREA INDIAN HEALTH SERVICE

Cloud Based Notification System

Statement of Work

Prepared by: Phoenix

Area Office 40 N Central, Suite 605 Phoenix, Arizona 85004

Introduction and Background

A Software as a Service (SaaS) based Critical Event Management platform is being requested that can be utilized for any public safety threats (e.g., active shooter, severe weather conditions). This SaaS application automates and accelerates the government’s operational response to critical emergency events. The Solution shall provide the government with the ability to distribute mass notifications and alerts in a timely manner on a 24/7/365 basis. The Solution will also provide a robust contact database to track the contacts’ information and responses to alerts.

Required Services

1. The main technical features being requested are listed in tables 1 and 2.

2. In addition to providing the Government with access to the Solution, the Contractor shall provide the following services in order to ensure productive use of the Solution (“Services”); consulting for professional services, training in the form of user manuals and web-based tutorials, support, backup and recovery (individually and collectively referred to herein as the “Services”), as necessary for as further set forth in this Contract.

1. Annual maintenance of software

2. Technical support

3. A dedicated Technical Account Manager (TAM) consisting of:

a. One onsite meetings and trainings per year as requested by the Organization.

b. Provide product and Organization strategy and goals

c. Technical support & training

d. Manage ongoing communications and tasks

e. On site point of contact – support and point of escalation

• Additional Modules. The Government may purchase any one or more of the additional modules listed below:

• A comprehensive travel risk management program that accurately evaluates potential risks, gathers relevant information, and maintains effective communication with their business travelers.

• A risk monitoring solution that integrates risk intelligence technology and resources around all-hazards information collection and analysis, enhancing our ability to monitor, analyze, and respond to risk.

• A single solution for business continuity, disaster recovery and emergency communication. That enables crisis teams to coordinate response activities, team members and resources to accelerate recovery times during unanticipated scenarios.

• A safety connection the helps our organization quickly locate and communicate with their people who may be in harm’s way.

• A multi-channel communication software to reach and engage employees on desktop, mobile and digital signage.

• Development & maintenance of custom data integrations into the Solution.

• Integration with any data, risk management, badging, travel, Wi-Fi, CRM, or other IoT systems

a. Additional Training. Additional training services requested by the Government.

Onsite training (requires a minimum of 2 consecutive days at (1) client location

1. Table 1: FUNCTIONAL REQUIREMENTS – The government shall have access to the minimum available requirements:

Reqmt # Requirement Description

1. Federal Risk and Authorization Management Program (FedRAMP) certified;

solution shall be vendor hosted.

2. Solution shall be an Off-The Shelf product with configurable ability.

3. Solution shall provide coverage for a minimum of 2,500 subscribers.

4.

Solution shall provide area wide coverage scalable.

5.

Solution can provide area wide coverage to an unlimited number of Message recipients.

6.

Solution shall have tiered levels of administration to include System Administrators, Organization Administrators and Organizational Message Originators (i.e., Notifiers). System Administrators shall be able to view system activity of all administrators and Notifiers. There shall be no limit on the number of administrators or Notifiers. All Administration is based on the current Solutions role-based access controls.

7.

Solution shall allow System Administrators and Organization Administrators to manage user accounts. Solution includes flexible role-based access controls to manage user permissions.

8.

Solution shall allow System Administrators and Organization Administrators to create and edit an unlimited number of notification groups and sub-groups. System Administrators and Organization Administrators shall be able to manage their own groups.

9. Solution includes access to out-of-the box custom branded community opt-in portal with custom fields and opt-in subscriptions. Users can have up to 5 locations/addresses in their profile, prioritize how they are contacted and/or set Quiet Times. The registration portal can support Google Translate.

10.

Solution public portal shall support both PC and mobile devices (i.e., responsive web design).

11. Solution shall support Email Notifications.

12. Solution shall support SMS Notifications via SMPP.

13. Solution supports Web Posting. To initiate notifications to partner systems or client‐side web sites, you can provide one or more URLs. As needed, provide a corresponding username and password for each URL. When sending your notifications, you can select Web Posting as a publishing option and then select the check box for the specific URLs.

14. Solution shall support the ability for client message initiators to post messages to Twitter (as “tweets”) by configuring our solution to connect to and post to the client designated Twitter site(s). The Solution shall also support posting to one or more Facebook pages.

15. Solution shall support Fax Notifications.

16. Solution shall provide an email-based delivery method to send an email from the Solution to an intermediary service which allows passing email content on to web-based platforms such as social networks, web pages, RSS feeds, etc. or an HTTPS post method whereby clients may “post” notification to any external system which supports HTTPS input/ingestion.

Depending on the requirements, this may require an additional Statement of Work and/or cost.

17. Solution shall support text to speech notifications.

18. Out-of-the-box registration portal will support Google Translate.

19. Solution shall support the ability to deploy telephone calls to landline, mobile, and VoIP telephones.

20. Solution shall have the capability to support polling notifications whereby a client may deliver message content to the target audience, ask them a question, and provide the recipients with up to 9 responses from which they can choose. Any interaction by the recipient of a polling notification will be reported back to the Solution for immediate reporting purposes.

21. Solution shall be able to support live voice recordings.

22. Solution shall allow voice recorded messages to be reviewable prior to message publication/transmission.

23. Solution shall allow for call (phone) retries in the event of a ring-no-answer.

24. Solution shall have the ability to detect if a human or an answering machine has answered a placed phone call.

25. Solution shall leave a voice mail message if an answering machine has answered a placed call (phone).

26. Solution shall have the ability to set a unique Caller ID for outbound

Notifications.

27. Solution shall have reporting and communication functionality to determine telephone numbers or contacts that should be removed from the solution.

28. Solution shall allow for the creation and storage of predefined messages/scenarios (templates). The Solution shall be able to store templates with content and target groups for later deployment.

29. Solution shall support a one screen notification workflow, where the user can enter the message content, determine the message type (e.g. standard, polling or 1-click conference bridge), select who should receive the message (internal groups and/or residents), and confirm the delivery settings.

30. Solution shall support a Web Posting option. The Solution’s recipient mobile app shall provide the public with a user-friendly, interactive map to view active Incident Zones, and users can click on the map to see details of alerts from public agencies.

31. Solution shall support a master account and all organizations capable of having their own configurations, private groups, templates, broadcast capability, data management capability, etc.

32. Solution shall support a master account and all organizations capable of having their own configurations, private groups, templates, broadcast capability, data management capability, etc.

33. Solution shall have a built-in text editor allowing Rich Text formatting of message content for Notifications (public and private).

34. Solution shall support the ability for system administrators (Account Admins and Organization Admins only) to manually upload data (CSV) that can add, edit, and delete message recipients and/or groups from the Solution without vendor assistance.

35. Solution shall allow via the web interface the ability to edit a notification template prior to sending, update a message template prior to sending, or follow up editing of a previously sent message to a specific audience.

36. Solution shall allow ability to see the complete Notification prior to Notification publication/transmission. The Solution does not include an additional preview page to send a notification.

37. Solution shall allow a message sender or administrator to stop a notification after it has been initiated, thereby stopping attempts to delivery methods that have not yet been sent.

38. Solution shall allow for Notifications to be scheduled for delivery based on date and time.

39. The Solution supports a broadcast duration of up to 24 hours.

40. Solution shall be able to display all Organizational Notifications (current, scheduled, templates, recurring and archived). Contractor stores data for up to 18 months.

41. Solution allows users to add up to five (5) locations to their profile, as well as to opt-in to topical subscriptions.

42. Solution shall allow a message sender to draw a polygon in the map tab or us “My Shapes” to select are area, and the Solution to will display the number of contacts selected within the polygon(s).

43. Solution shall allow the Organization Administrators the ability to populate the target Notification recipient list by geospatial polygons, either drawn at time of notification, or uploaded by administrators ahead of.

44. Solution shall allow the Organization Administrators the ability to populate the Notification recipient list via a GIS map (e.g., circle, rectangle/square, free form polygon or enter an address and then put in a radius).

45. Solution shall support the ability to import and display organization based predefined GIS shape files. The My Shapes library accepts only closed, single‐loop polygons; the application does not accept or load point or line shapes for selecting contacts. Also, your file can contain multiple polygons, which you will be able to load/hide separately on the map. This feature does not currently accept polygons with holes (for example, donuts) and multi‐ part polygons. In addition, you can export any shapes from the My Shapes library; the exported shape will be provided in Shapefile format. We recommend involving a member of your GIS team in the initial planning discussions for the solution.

46. Solution can automatically geo-coded contacts based on physical address information (or latitude/longitude). For addresses that are not able to be geo-coded, the user can also select to “drop a pin” on the map in the exact location of their physical address.

47. The Solution’s recipient mobile app shall provide the public with a user-friendly, interactive map to view active Incident Zones, and users can click on the map to see details of alerts from public agencies.

48. All (Agency/Department orgs) and sandbox organizations will have their own Test Organization (environment).

49. Solution shall support the ability to send Notifications to Private Groups.

50. Solution can accomplish mass notification TO BOTH the Public and Private

Groups from a single Notification via phone, SMS messaging, email, FAX as well as web publishing, and social media to contacts in the same Organization. Many clients leverage separate Organizations for internal contacts. Contractor will recommend best practices based on our experience with other large deployments. Vendor may provide other methods as capable or available.

52. Solution supports two different priorities of messages (High Priority or Non-Priority.) A high priority message will take precedence over a standard priority message if the two are in the message queue.

53. Solution shall allow Notifications to contain links/urls, photos, video, audio, and other document attachments (e.g., .DOC, DOCX - Microsoft Word, .XLS, XLSX - Microsoft Excel, .PPT, PPTX - Microsoft PowerPoint, .TIF/TIFF - Tagged Image File Format, .TXT - Plain Text, .HTML - Hypertext Markup Language, .RTF - Rich Text Format, .PDF - Adobe Portable Document Format, .JPG - JPEG images, .VSD - Visio drawings and .GIF - Graphics Interchange Format).

54. Solution shall allow a quick-link (e.g., tinyurl) for recipients of text messages to click on or to copy link into browser for viewing full message.

Users must create those with a separate tinyurl creation tool not provided by Contractor and copy and paste the url into the Text message.

55. Solution shall allow Notification attachments with a maximum of 2MB size.

56. Before sending a notification, the Solution allows the user to view the number of contacts manually added to a notification, the number of groups included in a notification, and the number of contacts added to a notification using the Mapping feature. Users can also click on “Preview contacts” to view the total number of unique contacts for the notification. After the notification has been sent the Solution provides notification analysis reports.

57.

Solution allows a recipient to text “STOP”, and the Solution will automatically remove the SMS number to be compliant with SMS regulations. If the Department wants to create a blacklist, the Department can use custom attributes in the Solution to manually add numbers to a blacklist.

58.

Solution shall have a configurable call throttling mechanism. The throttling settings should allow Admin users to modify the overall speed for all calls going out or specify an area code and prefix to modify the speed for a specific area or building.

59.

Solution allows message sender or administrator to stop a notification after it has been initiated, thereby stopping alerts to delivery methods that have not yet been sent.

60.

Solution shall allow for contacts to define quiet time periods for specific delivery methods during which users may not receive notifications.

61.

Solution Administrators for an Organization shall have the ability to create one (1) customized default phone call greeting/preamble (e.g., 'This is a message from the HHS mass notification and alerting Solution').

62.

Solution shall have the ability for Organizational Administrators to create one (1) customized phone call greetings.

63.

Solution shall allow Solution Administrators to customize, without vendor intervention, MNS web page content, banners (e.g., email, FAX, etc. for custom branding), numeric caller-id, email source (sender) address and reports.

64.

Solution shall allow Organizational Administrators to customize, without vendor intervention, MNS web page content, banners (e.g., email, FAX, etc.

for custom branding), numeric caller-id, email source (sender) address and reports for their specific organization.

65.

High level log information is available for user record changes directly in the console (who last updated the record, when it was last updated) and clients may generate Ad-Hoc Reports based on this information.

66.

Solution shall have a profile page allowing user to edit their account information (i.e. - password, security question, etc.) with at least 1 security challenge question.

67.

Solution shall allow the public to opt into the Solution by registering associated contact information (e.g., phone numbers, SMS numbers, email addresses, and FAX numbers). The Solution will only require the public to enter one selection for the account to be eligible to receive alerts.

68.

Solution shall allow a public Subscriber to register up to five location points (addresses) in their profile (e.g., home, work, school, etc.).

69.

Solution shall not allow a public Subscriber to register without identifying at least one location point (address) in their profile (e.g., home, work, school, etc.).

70. Contact paths in the Solution include: 6 phones, 5 phones with extension, 2 SMS devices, 1 One Way SMS, (often used for SMS paging), 3 email addresses, 3 TTY/TDD devices, 1 recipient app.

71. Solution shall allow a Public Subscriber to subscribe to different message categories and sub-categories.

72. Solution shall allow a Public Subscriber in their profile on the registration portal to prioritize their contact paths (e.g., text, then email, then mobile app, then home phone, etc.) to receive notifications.

73. Solution shall provide default alert settings for Public Subscribers who do not wish to customize their alerts.

74. Solution shall provide a self-service method for Public Subscribers to retrieve their passwords without a Solution Administrator or help desk assistance.

75. Vendor shall provide a Project Manager to manage the project for all deliverables defined in the scope of work.

76. Vendor shall provide an Onboarding Specialist to support implementation deliverables defined in the scope of work.

77. Project Manager shall provide a detailed work plan which identifies and sequences the activities needed to successfully complete the project defined in the scope of work.

78. Project Manager shall provide a detailed project schedule defined in the scope of work with milestones and resources assignments.

79. Project Manager shall provide weekly reports and status updates in a format mutually acceptable to Government and Contractor.

80. Project Manager shall track vendor work defined in the scope of work and provide weekly reports and status updates in a format mutually acceptable to Government and Contractor.

81.

Vendor shall provide System Administrator's training on administrative functions within the application.

82.

Vendor shall provide System Administrator training on reporting and creating custom reports.

83.

Vendor shall provide tutorials for Organizational Administrators on how to create Notifications and provide updates as needed for the duration of the Contract.

84.

Vendor shall provide a plan to migrate all subscribers of the current system to the vendor hosted solution. The Organization must provide subscriber data to Contractor along with a data dictionary of the fields and a tech resource to assist in mapping. Contractor will conduct a one-time baseline migration of the data and the Organization will be responsible for updating and/or managing the data moving forward. Data will not include usernames or passwords.

85.

All requirements are applicable to the Development, Testing and Live Production Environments. Development and Testing regions may be a scaled version of production as appropriate to the testing and development being performed. Contractor will provide an organization as a testing and training environment and the Organization will be responsible for configuring and maintaining these environments.

86. Solution shall encrypt Organization Data in transit and at rest. Encryption must comply with federal standards, such as FIPS 140-2.

87.

Solution shall encrypt application databases used to support the

SOLUTION.

88.

High level log information is available for user record changes directly in the console (who last updated the record, when it was last updated) and clients may generate Ad-Hoc Reports based on this information.

89.

Solution shall provide online real time reports detailing the success, failure and reason for failure of Notification dissemination.

90.

Solution shall allow for online real time granular and detailed reporting on Subscriber counts by jurisdiction, alerting category/sub-category, member organization and Notification group.

91.

Solution shall generate Ad Hoc reports using a drag and drop interface and provide detailed notification analysis reports.

92.

Solution shall provide System Administrators the ability to send out a notification to all subscribers and direct recipients to review and update contact information preferences and provide a link to the Contact Self-Serve recipient portal in the message body.

93.

Solution shall provide System Administrators the ability to report on the number of subscribers who have edited their account information.

94.

Solution shall provide the System Administrators the ability to delete all inactive accounts one at a time or “en masse”.

95. Vendor shall provide application enhancements, patches, and hotfixes.

96.

Vendor shall provide their Change Management process in regard to implementing Solution changes, patch deployments, and hotfixes.

97.

Solution shall support the application on all supported versions of industry standard browsers that supports TLS 1.2 encryption.

98.

Solution shall generate Ad Hoc reports using drag and drop interface and four standard reports including Notification Dashboard Report, Broadcast Report, Detailed Notification Analysis Report, and an Event Analysis Report. Reports shall include detailed results of message content, target audience, contact attempts made, devices targeted, and time/date stamp.

99.

Vendor shall be responsible for the security of the Solution data and infrastructure that supports it.

100.

Vendor shall logically and/or physically segregate the live production environment from the Testing and Development environments.

101.

Vendor shall have each client's data partitioned within the production database. To address the privacy and segregation of each Contractor client’s data, Contractor employs a unique Account ID, ORG ID, Data Segregation, and query validations for all operations to ensure one client does not gain access to another’s data.

102.

Vendor warrants that all data center(s) used to perform the services under the resulting Contract will be Tier 3 compliant to an industry standard.

103.

Vendor shall maintain a reliable data center using stable network fiber and power grid.

104.

Vendor shall notify Government Administrators of planned maintenance, patches, code revisions, etc.

105.

Vendor shall maintain detailed records for any hardware and software changes.

106.

Solution shall allow designated personnel the ability to distribute Notifications on the behalf of other Authorized Organizations.

2. Table 2: TECHNICAL REQUIREMENTS

1.

Contractor’s security infrastructure shall be based upon compliance with the NIST 800-53 framework.

2.

Contractor shall, should a catastrophic event occur, and the recovery of systems is required, comply with the stated maximum Recovery Time Objective (RTO) of 15 minutes (or less) and the Recovery Point Objective (RPO) of 24 hours (or less).

3.

Contractor shall maintain a Business Continuity and Disaster Recovery (BCDR) plan that is reviewed and tested annually and approved by Executive Management. Vendor shall provide the BCDR Plan Table of Contents (ToC) and the latest Continuity Plan Test Results within 30 days of contract execution.

4.

Every system and tier within the solution infrastructure shall be individually fault tolerant, with redundant power, networking, and hardware, telephony, and data communication wherever possible. Solution Service Level Agreement (SLA) is defined in Exhibit 3

5.

Contractor shall host and manage all elements of the solutions. Security, operating system, and application updates shall be certified prior to consideration for rollout and all updates shall adhere to change management procedures which are governed by NIST 800-53 (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 53r4.pdf) CM-1 through CM-11.

6.

Contractor shall apply active monitoring and intrusion detection against all aspects of the solution from multiple monitoring points around the globe.

Contractor shall apply audit and logging procedures which are governed by

NIST 800-37/53

(http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 53r4.pdf) and details can be found in controls AU-1 through AU-16.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

7.

Data backup activities shall be performed consistent with NIST 800-

53. Partial backups shall be performed daily and full backups shall be conducted weekly. Backups shall be stored on SANs within each cloud facility and shall be encrypted.

This product must conform to the Revised Section 508 (https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines) and WCAG 2.0 Level AA standards as outlined below.

Solicitations for supplies and services shall require the submission of a Section 508 Product Assessment Template. The template can be found at https://www.itic.org/policy/accessibility/vpat.

BEGINNING of Provision 352.239-73

352.239-73 Electronic Information and Technology Accessibility Notice.

(a) As prescribed in HHSAR 339.203-70(a), the Contracting Officer shall insert the following provision:

Electronic and Information Technology Accessibility Notice (December 18, 2015)

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards.

(c) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239-74, Electronic and Information Technology Accessibility.

In order to facilitate the Government’s determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and document—in detail— whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS website http://www.hhs.gov/web/508.

In order to facilitate the Government’s determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbBnkxPtBw$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbBnkxPtBw$ https://urldefense.us/v3/__https:/www.itic.org/policy/accessibility/vpat__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbAGbzHRkw$ https://urldefense.us/v3/__http:/www.hhs.gov/web/508__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbBVlJpnlw$ https://urldefense.us/v3/__http:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbDXUVtAFw$ https://urldefense.us/v3/__http:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbDXUVtAFw$ https://urldefense.us/v3/__http:/www.hhs.gov/web/508__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbBVlJpnlw$

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

Standards

The included standards that must be met for this contract are taken from the following two resources. Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

• Section 508 Standards and Guidelines: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

• Web Content Accessibility Guidelines (WCAG) 2.0: https://www.w3.org/TR/WCAG20/

Electronic content must be accessible to HHS acceptance criteria

Checklist for various formats are available at http://508.hhs.gov, or from the IHS Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html, (email:

IHSSection508@ihs.gov). Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

Electronic Content Accessibility - Web Based

• 602 Support Documentation

• 603 Support Services

• All WCAG A & AA Success Criteria

Software Accessibility - Non-Web Based

• All WCAG A & AA Success Criteria apply – EXCEPT the following:

o 2.4.1 Bypass Blocks o 2.4.5 Multiple Ways o 3.2.3.Consistent Navigation o 3.2.4 Consistent Identification

• 502 Interoperability with Assistive Technology

• 503 Application

• 602 Support Documentation

• 603 Support Services

• 302 All Functional Performance Criteria - Note: Applies when Chapter 5 does not address one or more functions of ICT (E204), or when an agency invokes "equivalent facilitation" (E101.2)

Support Documentation Accessibility

• E602.1 General - Documentation that supports the use of ICT shall conform to 602.

https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbBnkxPtBw$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbBnkxPtBw$ https://urldefense.us/v3/__https:/www.w3.org/TR/WCAG20/__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbBX8ToWaw$ https://urldefense.us/v3/__http:/508.hhs.gov/__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbB2SS2Q3A$ https://urldefense.us/v3/__https:/www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html__;!!Og_tST9LxTiQE1I!oPpbOcjKAuqE5VmW2eN95yx_0FoSeoVNpkJP5Sp7xKaCLNBbKHvxOgGHrzdIFOzJN98ZZlHCZY0i7BXjySPadG_9JbDvfrPObQ$ mailto:IHSSection508@ihs.gov

• E602.2 Accessibility and Compatibility Features - Documentation shall list and explain how to use the accessibility and compatibility features required by Chapters 4 and 5. Documentation shall include accessibility features that are built-in and accessibility features that provide compatibility with assistive technology.

• E602.3 Electronic Support Documentation - Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

• E602.4 Alternate Formats for Non-Electronic Support Documentation - Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

• E602.3 Electronic Support Documentation - Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

• E602.4 Alternate Formats for Non-Electronic Support Documentation - Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

• E603.1 General - ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

• E603.2 Information on Accessibility and Compatibility Features - ICT support services shall include information on the accessibility and compatibility features required by 602.2.

• E603.3 Accommodation of Communication Needs - Support services shall be provided directly to the user or through a referral to a point of contact. Such ICT support services shall accommodate the communication needs of individuals with disabilities.

• WCAG – All WCAG 2.0 A & AA Success Criteria

EXCEPTION:

o Non-Web documents shall not be required to conform to the following four WCAG 2.0 Success Criteria: 2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation, and 3.2.4 Consistent Identification.

o E205.4.1 Word Substitution when Applying WCAG to Non-Web Documents. For non-Web documents, wherever the term "Web page" or "page" appears in WCAG 2.0 Level A and AA Success Criteria and Conformance Requirements, the term "document" shall be substituted for the terms "Web page" and "page". In addition, in Success Criterion in 1.4.2, the phrase "in a document" shall be substituted for the phrase "on a Web page".

• Appendix A – Section 508 of the Rehabilitation Act: Application and Scoping Requirements o E208 Support Documentation and Services

• Appendix C – Functional Performance Criteria and Technical Requirements o 302 - Functional Performance Criteria o 602 – Support Documentation o 603 – Support Services

Functional Performance Criteria

• 301.1 Scope - The requirements of Chapter 3 shall apply to ICT where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

• 302.1 Without Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

• 302.2 With Limited Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

• 302.3 Without Perception of Color - Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

• 302.4 Without Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

• 302.5 With Limited Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

• 302.6 Without Speech - Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

• 302.7 With Limited Manipulation - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

• 302.8 With Limited Reach and Strength - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

• 302.9 With Limited Language, Cognitive, and Learning Abilities - ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

END of Provision 352.239-73

48 CFR § 52.239-1 Privacy or Security Safeguards.

As prescribed in 39.106, insert a clause substantially the same as the following:

Privacy or Security Safeguards (Aug 1996)

(a) The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government.

(b) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

(c) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

Privacy Act (December 18, 2015)

This contract requires the Contractor to perform one or more of the following: (a) design; (b) develop; or (c) operate a Federal agency system of records to accomplish an agency function in accordance with the Privacy Act of 1974 (Act) (5 U.S.C. 552a(m)(1)) and applicable agency regulations.

The term system of records means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2039_1.html#wp1096858 the individual. Violations of the Act by the Contractor and/or its employees may result in the imposition of criminal penalties (5 U.S.C. 552a(i)).

The Contractor shall ensure that each of its employees knows the prescribed rules of conduct in 45 CFR part 5b and that each employee is aware that he/she is subject to criminal penalties for violation of the Act to the same extent as Department of Health and Human Services employees. These provisions also apply to all subcontracts the Contractor awards under this contract which require the design, development or operation of the designated system(s) of records (5 U.S.C. 552a(m)(1)). The contract work statement:

(a) Identifies the system(s) of records and the design, development, or operation work the Contractor is to perform; and

(b) Specifies the disposition to be made of such records upon completion of contract performance.

48 CFR § 352.224-71 Confidential Information.

As prescribed in HHSAR 324.105(b), insert the following clause:

Confidential Information (December 18, 2015)

(a) Confidential Information, as used in this clause, means information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization.

(b) Specific information or categories of information that the Government will furnish to the Contractor, or that the Contractor is expected to generate, which are confidential may be identified elsewhere in this contract. The Contracting Officer may modify this contract to identify Confidential Information from time to time during performance.

(c) Confidential Information or records shall not be disclosed by the Contractor until:

(1) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to release findings of studies or research, to which an agency response may be appropriate to protect the public interest or that of the agency.

(2) For information provided by or on behalf of the government. written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to disseminate or publish information, but contractor shall not disseminate or publish such information without the written consent of the Contracting Officer.

(d) Whenever the Contractor is uncertain with regard to the confidentiality of or a property interest in information under this contract, the Contractor should consult with the Contracting Officer prior to any release, disclosure, dissemination, or publication.

Indemnification, Liability, Statute of Limitations: Any provisions in the TOS related to indemnification and filing deadlines are hereby waived, and shall not apply except to the extent expressly authorized by law. Liability for any breach of the TOS as modified by this Amendment, or any claim arising from the TOS as modified by this Amendment, shall be determined under the Federal Tort Claims Act, or other governing federal authority. Federal Statute of Limitations provisions shall apply to any breach or claim.

Governing law: Any arbitration, mediation or similar dispute resolution provision in the TOS is hereby deleted. The TOS and this Amendment shall be governed by and interpreted and enforced in accordance with the laws of the United States of America without reference to conflict of laws. To the extent permitted by federal law, the laws of the State of [Company to insert name of state if one is mentioned in its TOS] (excluding [Company's state] choice of law rules) will apply in the absence of applicable federal law.

PERIOD OF PERFORMANCE:

1.The requested period of performance shall commence as implemented by the Contracting Officer or his/her delegated representative. The Indian Health Service is requesting a contract awarded for one base year and four option years to be exercised at the government’s option.

2. Option renewals will be on the basis on the existing requirement of the Government, performance of satisfactory service provided during the base year, and contingent upon availability of funds for the appropriate fiscal year(s).

3. A representative will be appointed and contact information will be given to the Contractor at the award of the contract.

http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-324-protection-privacy-and-freedom-information/index.html#324.105

POINTS OF CONTACT:

Phoenix Area Acquisitions

PAYMENT AND INVOICING INSTRUCTIONS:

1. Invoices shall be prepared with the following information CLEARLY identified on the invoice:

(a) Invoice Date and Number

(b) Contract Number

(c) Charges for service

(d) Description of services rendered

(e) Dates of Service

2. Invoice shall be prepared and submitted electronically and in accordance with rates and terms as stated in the contract. Invoice should be sent electronically via IPP:

I certify that the following criteria have been met in determining the need for the requested item:

(a) The item is absolutely essential to the program needs.

(b) The item required is the best value which will satisfy the needs of the requesting program.

(c) The item meets initial use of replacement standards.

(d) There are no other items available, either from equipment pools or unrequired sources within the agency/office that will meet the program needs.

(e) Staff is now or will be qualified to utilize the requested item.

EVALUATION FACTORS

Meeting Functional Requirements

Meeting Technical Requirements

Pricing

Past Performance

48 CFR § 52.239-1 Privacy or Security Safeguards.