Attachment A Provisions and Clauses.pdf

This acquisition incorporates by reference the following FAR provisions and clauses:

52.203-11 Certification and Disclosure Regarding Payments to Influence Certain Federal Transactions (Sep 2007 52.203-12 Limitation on Payments to Influence Certain Federal Transactions (Jun 2020) 52.204-7 System for Award Management (Oct 2018) 52.204-13 System for Award Management Maintenance (Oct 2018) 52.204-16 Commercial and Government Entity Code Reporting (Aug 2020) 52.204-18 Commercial and Government Entity Code Maintenance (Aug 2020) 52.204-19 Incorporation by Reference of Representations and Certifications (Dec 2014) 52.204-20 Predecessor of Offeror (Aug 2020) 52.204-21 Basic Safeguarding of Covered Contractor Information Systems (Nov 2021) 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021) Only complete if not already completed in SAM 52.204-26 Covered Telecommunications Equipment or Services-Representation (Oct 2020) Only complete if not already completed in SAM 52.212-3 Offeror Representations and Certifications—Commercial Products and Commercial Services (DEVIATION 2023-O0002) (Dec 2022), Alternate I (Oct 2014) 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services (Dec 2022) 52.223-22 Public Disclosure of Greenhouse Gas Emissions and Reduction Goals—representation (Dec 2016) 52.232-39 Unenforceability of Unauthorized Obligations (Jun 2013)

The following additional DFARS provisions and clauses applicable to this acquisition are incorporated by reference:

252.203-7000 Requirements Relating to Compensation of Former DoD Officials (Sep 2011) 252.203-7002 Requirement to Inform Employees of Whistleblower Rights (Sep 2013) 252.203-7005 Representation Relating to Compensation of Former DoD Officials (Sep 2022) 252.204-7003 Control of Government Personnel Work Product (Apr 1992) 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls (Oct 2016) 252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support (Jan 2023) 252.204-7016 Covered Defense Telecommunications Equipment or Services—Representation (Dec 2019) 252.204-7017 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services—Representation (May 2021) 252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services (Jan 2023) 252.204-7024 Notice on the Use of the Supplier Performance Risk System (Mar 2023) 252.211-7003 Item Unique Identification and Valuation (Jan 2023) 252.211-7008 Use of Government-Assigned Serial Numbers (Sep 2010) 252.223-7008 Prohibition of Hexavalent Chromium (Jan 2023) 252.225-7001 Buy American and Balance of Payments Program--Basic (Jan 2023) 252.225-7002 Qualifying Country Sources as Subcontractors (Mar 2022) 252.225-7048 Export-Controlled Items (Jun 2013)

252.225-7055 Representation Regarding Business Operations with the Maduro Regime (May 2022) 252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime (Jan 2023) 252.225-7059 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region– Certification (Dec 2022) 252.225-7060 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region (Jan 2023) 252.232-7003 Electronic Submission of Payment Requests and Receiving Reports (Dec 2018) 252.232-7006 Wide Area Workflow Payment Instructions (Jan 2023) 252.232-7010 Levies on Contract Payments (Dec 2006) 252.244-7000 Subcontracts for Commercial Items and Commercial Components (DoD Contracts) (Jan 2023) 252.247-7023 Transportation of Supplies by Sea—Basic (Jan 2023)

The following FAR provisions and clauses incorporated by full text apply to this acquisition:

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (JUN 2023)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Nov 2021) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) (31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108- 77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Jun 2020), with Alternate I (Nov 2021) (41 U.S.C. 4704 and 10 U.S.C. 4655).

(2) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C.

3509).

(3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

(4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) (31 U.S.C. 6101 note).

(5) [Reserved].

(6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

(7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts

(Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

(8) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of

Division R of Pub. L. 117-328).

(9) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (Nov 2021) (31 U.S.C. 6101 note).

(10) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters

(Oct 2018) (41 U.S.C. 2313).

(11) [Reserved].

(12) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Oct 2022) (15 U.S.C.

657a).

(13) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns

(Oct 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

(14) [Reserved]

(15) (i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

(ii) Alternate I (Mar 2020) of 52.219-6.

(16) (i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

(ii) Alternate I (Mar 2020) of 52.219-7.

(17) 52.219-8, Utilization of Small Business Concerns (Oct 2022) (15 U.S.C. 637(d)(2) and

(3)).

(18) (i) 52.219-9, Small Business Subcontracting Plan (Oct 2022) (15 U.S.C. 637(d)(4)).

(ii) Alternate I (Nov 2016) of 52.219-9.

(iii) Alternate II (Nov 2016) of 52.219-9.

(iv) Alternate III (Jun 2020) of 52.219-9.

(v) Alternate IV (Sep 2021) of 52.219-9.

(19) (i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

(ii) Alternate I (Mar 2020) of 52.219-13.

(20) 52.219-14, Limitations on Subcontracting (Oct 2022) (15 U.S.C. 637s).

(21) 52.219-16, Liquidated Damages—Subcontracting Plan (Sep 2021) (15 U.S.C.

637(d)(4)(F)(i)).

(22) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Oct 2022) (15 U.S.C. 657f).

(23) (i) 52.219-28, Post Award Small Business Program Rerepresentation (Mar 2023) (15 U.S.C. 632(a)(2)).

(ii) Alternate I (Mar 2020) of 52.219-28.

(24) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Oct 2022) (15 U.S.C. 637(m)).

(25) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Oct 2022) (15 U.S.C. 637(m)).

(26) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

(27) 52.219-33, Nonmanufacturer Rule (Sep 2021) (15 U.S.C. 637(a)(17)).

(28) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

(29) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Dec 2022)

(E.O.13126).

(30) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(31) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

(ii) Alternate I (Feb 1999) of 52.222-26.

(32) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

(ii) Alternate I (Jul 2014) of 52.222-35.

(33) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C.

793).

(ii) Alternate I (Jul 2014) of 52.222-36.

(34) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

(35) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act

(Dec 2010) (E.O. 13496).

(36) (i) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and

E.O. 13627).

(ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(37) 52.222-54, Employment Eligibility Verification (May 2022) (Executive Order 12989).

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

(38) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA– Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

(ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

(39) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

(40) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

(41) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

(ii) Alternate I (Oct 2015) of 52.223-13.

(42) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

(ii) Alternate I (Jun 2014) of 52.223-14.

(43) 52.223-15, Energy Efficiency in Energy-Consuming Products (May 2020) (42 U.S.C.

8259b).

(44) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

(ii) Alternate I (Jun 2014) of 52.223-16.

(45) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Jun 2020) (E.O. 13513).

(46) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

(47) 52.223-21, Foams (Jun 2016) (E.O. 13693).

(48) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

(ii) Alternate I (Jan 2017) of 52.224-3.

(49) (i) 52.225-1, Buy American-Supplies (Oct 2022) (41 U.S.C. chapter 83).

(ii) Alternate I (Oct 2022) of 52.225-1.

(50) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (Dec 2022) (19

U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C.

chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109- 53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43).

(ii) Alternate I [Reserved].

(iii) Alternate II (Dec 2022) of 52.225-3.

(iv) Alternate III (Jan 2021) of 52.225-3.

(v) Alternate IV (Oct 2022) of 52.225-3.

(51) 52.225-5, Trade Agreements (Dec 2022) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

(52) 52.225-13, Restrictions on Certain Foreign Purchases (Feb 2021) (E.O.s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

(53) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

(54) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C.

5150).

(55) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

(56) 52.229-12, Tax on Certain Foreign Procurements (Feb 2021).

(57) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial

Services (Nov 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

(58) 52.232-30, Installment Payments for Commercial Products and Commercial Services

(Nov 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

(59) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct

2018) (31 U.S.C. 3332).

(60) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award

Management (Jul 2013) (31 U.S.C. 3332).

(61) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

(62) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

(63) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C.

637(d)(13)).

(64) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov

2021) (46 U.S.C. 55305 and 10 U.S.C. 2631).

(ii) Alternate I (Apr 2003) of 52.247-64.

(iii) Alternate II (Nov 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67).

(2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

(3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price

Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C. 206 and 41 U.S.C.

chapter 67).

(4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (May 2014) (29 U.S.C.206 and 41 U.S.C. chapter 67).

(5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

(7) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (Jan 2022).

(8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022) (E.O. 13706).

(9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42

U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records-Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C.

3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Nov 2021) (Section 1634 of Pub. L. 115-91).

(iv) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(v) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of Division R of Pub. L. 117-328).

(vi) 52.219-8, Utilization of Small Business Concerns (Oct 2022) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(vii) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(viii) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

(ix) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

(x) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C.

793).

(xi) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

(xii) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xiii) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67).

(xiv) (A) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and E.O. 13627).

(B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(xv) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(xvi) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

(xvii) 52.222-54, Employment Eligibility Verification (May 2022) (E.O. 12989).

(xviii) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (Jan 2022).

(xix) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022) (E.O.

13706).

(xx) (A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xxi) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

(xxii) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxiii) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) (31 U.S.C. 3903 and 10 U.S.C. 3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxiv) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) (46 U.S.C. 55305 and 10 U.S.C. 2631). Flow down required in accordance with paragraph

(d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

https://www.acquisition.gov/browse/index/far https://www.acquisition.gov/dfars

(End of provision)

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

52.252-5 AUTHORIZED DEVIATIONS IN PROVISIONS (NOV 2020)

(a) The use in this solicitation of any Federal Acquisition Regulation (48 CFR Chapter 1) provision with an authorized deviation is indicated by the addition of “(DEVIATION)” after the date of the provision.

https://www.acquisition.gov/browse/index/far https://www.acquisition.gov/dfars

(b) The use in this solicitation of any Defense Federal Acquisition Regulation Supplement (48 CFR Chapter 2) provision with an authorized deviation is indicated by the addition of “(DEVIATION)” after the name of the regulation.

The following Defense Health Agency (DHA) Procedures, Guidance, and Information (PGI) apply to this acquisition:

DHA PGI 203.104-7 VIOLATIONS OR POSSIBLE VIOLATIONS (January 23, 2020)

IMPROPER BUSINESS PRACTICES AND PERSONAL CONFLICTS OF INTEREST

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1. The Offeror’s attention is directed to FAR, Part 3 and DFARS, Part 203, “Improper Business Practices and Personal Consultant Conflicts of Interest.”

2. DFARS 252.203-7005 Representation Relating to Compensation of Former DoD Officials (Nov 2011)

(a) Definition. “Covered DoD official” is defined in the clause at 252.203-7000, Requirements Relating to Compensation of Former DoD Officials.

(b) By submission of this offer, the offeror represents, to the best of its knowledge and belief, that all covered DoD officials employed by or otherwise receiving compensation from the offeror, and who are expected to undertake activities on behalf of the offeror for any resulting contract, are presently in compliance with all post-employment restrictions covered by 18 U.S.C. 207, 41 U.S.C. 2101-2107, and 5 CFR parts 2637 and 2641, including Federal Acquisition Regulation 3.104-2.

3. Use of Former DoD/Defense Health Agency (DHA) Employees and Uniformed Service Members in Proposal Preparation.

The involvement of a former DoD/DHA employee/member in an offeror’s proposal preparation may give rise to an unfair competitive advantage or the appearance thereof, if the former DoD/DHA employee/ member acquired non-public, competitively-useful information in his or her former position. Such knowledge could include proprietary information of competitor’s performance on past or current contracts with similar requirements or source selection sensitive information pertaining to this procurement.

Consequently, the Offeror must notify the Contracting Officer prior to the involvement in the proposal preparation by a former DoD/DHA employee/member reasonably expected to have had access to such information. Based on the notification, the Contracting Officer will make a determination whether involvement of the former DoD/DHA employee/member in proposal preparation could create an unfair competitive advantage or appearance thereof. The Contracting Officer will further determine whether any mitigation measures taken or proposed by the offeror are adequate to alleviate this concern or whether the offeror will be disqualified from the competition. Failure to comply with these procedures may result in the offeror’s disqualification for award.

CONTRACT CLAUSES

1. DFARS 252.203-7000, Requirements Relating to Compensation of Former DoD Officials (Sep 2011)

(a) Definition. “Covered DoD official,” as used in this clause, means an individual that—

(1) Leaves or left DoD service on or after January 28, 2008; and

(2) (i) Participated personally and substantially in an acquisition as defined in 41 U.S.C.

131 with a value in excess of $10 million, and serves or served—

(A) In an Executive Schedule position under subchapter II of chapter 53 of Title 5, United States Code;

(B) In a position in the Senior Executive Service under subchapter VIII of chapter 53 of Title 5, United States Code; or

(C) In a general or flag officer position compensated at a rate of pay for grade O-7 or above under section 201 of Title 37, United States Code;

or

(ii) Serves or served in DoD in one of the following positions: program manager, deputy program manager, procuring contracting officer, administrative contracting officer, source selection authority, member of the source selection evaluation board, or chief of a financial or technical evaluation team for a contract in an amount in excess of $10 million.

(b) The Contractor shall not knowingly provide compensation to a covered DoD official within 2 years after the official leaves DoD service; without first determining that the official has sought and received, or has not received after 30 days of seeking, a written opinion from the appropriate DoD ethics counselor regarding the applicability of post-employment restrictions to the activities that the official is expected to undertake on behalf of the Contractor.

(c) Failure by the Contractor to comply with paragraph (b) of this clause may subject the Contractor to rescission of this contract, suspension, or debarment in accordance with 41 U.S.C. 2105(c).

DHA PGI 233.103-90 AGENCY LEVEL PROTESTS (March 22, 2020)

An interested party filing a protest with Defense Health Agency (DHA) has the option of requesting review by either the Contracting Officer (CO) or an independent review Official (IRO), who is a DHA official at a level above the CO. Alternately, an interested party may request IRO review as an appeal of the CO’s protest decision.

Where applicable, an interested party must clearly state in the protest that IRO review is requested, and must specify the nature of the independent review sought – whether as an alternative to CO review or as an appeal of the CO’s decision.

Regardless of which review is requested, all protests must be complete and submitted to the CO within the timeframes specified in FAR Subpart 33.1.

(End of DHA language)

The following DHA Standard Language applies to this acquisition:

Personally Identifiable Information, Protected Health Information, and Federal Information Requirements

(Revised 10/27/2020)

1. GENERAL REQUIREMENTS OVERVIEW - PERSONALLY IDENTIFIABLE

INFORMATION (PII), PROTECTED HEALTH INFORMATION (PHI) AND FEDERAL

INFORMATION LAWS

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019, and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach, and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office.

The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. RECORDS MANAGEMENT

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. FREEDOM OF INFORMATION ACT (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

http://www.dtic.mil/whs/directives

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents, and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. SYSTEMS OF RECORDS

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

http://www.foia.gov/ mailto:DHA.FOIA@mail.mil http://www.defenselink.mil/privacy/documents/pa1974.pdf mailto:DHA.PrivacyAct@mail.mil

5. PRIVACY IMPACT ASSESSMENT (PIA)

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. DATA SHARING AGREEMENT (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed, or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

• DSA for De-Identified Data

• DSA for PHI

• DSA for PII Without PHI

• DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (APPLIES IF CONTRACT REQUIREMENTS MAY INCLUDE HUMAN

SUBJECT RESEARCH)

This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD http://www.tricare.mil/tma/privacy/Templates.aspx component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness

(OUSD(P&R)).

7. PRIVACY ACT AND HIPAA TRAINING

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

8. HIPAA BUSINESS ASSOCIATE PROVISIONS

8.1 Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at https://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS.

9. BREACH RESPONSE

[This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference.]

9.1 DEFINITIONS RELATED TO BREACH RESPONSE

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

9.1.3 A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

• How the event was discovered;

• Did the information stay within the covered entity’s control;

• Was the information actually accessed/viewed; and

• Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4 A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

9.1.5 A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e., the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted by the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;

The unauthorized person who used the PHI or to whom the disclosure was made;

Whether the PHI was actually acquired or viewed; and The extent to which the risk to the PHI has been mitigated.

9.1.6 A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI.

However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

9.2 GENERAL

9.2.1 The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

9.2.2 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting, and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs.

non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

9.2.4 In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency Readiness Team (US-CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below.

The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirements.

9.2.5 Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery. The time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours) under paragraph 9.3.2. If a cybersecurity incident is involved, the contractor’s deadline for US-CERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall report directly to US-CERT and the DHA Privacy Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

9.2.6 Contractors shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome. Investigations identifying unauthorized disclosures must be logged for HIPAA and Privacy Act disclosure accounting purposes, whether or not individual notification is required under the HIPAA Breach Rule.

9.2.7…