B.01 Combined Synopsis revised.docx6DEC.pdfREV.pdf

Combined Solicitation/Synopsis

Date:

12/6/2024

Requirement:

Implantable Surgical Lenses for Womack Army Medical Center, Fort Liberty, NC

Solicitation Number:

W91YTZ25QA003

Response Date:

3 January 2025

Point of Contact:

Kimberly.r.jackson.civ@health.mil

Competitive Status:

Unrestricted

Place of Performance:

Womack Army Medical Center (WAMC), Fort Liberty, NC 28310

Period of Performance:

15 January 2025, through 14 January 2028

NAICS Code:

339115, Ophthalmic Goods Manufacturing. The small business size standard is 1000 employees

Questions Due Not later than 13 December at 3:00 PM EST 2024.

The Medical Readiness Contracting Office– East (MRCO-E), Fort Liberty, NC intends to solicit, negotiate, and award a Blanket Purchase Agreements (BPAs) for a supply requirement for

Implantable Surgical Lenses during procedures at to the WAMC Operating Room.

mailto:Kimberly.r.jackson.civ@health.mil

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in the Federal Acquisition Regulation (FAR) Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued.

The solicitation number is W91YTZ25QA003 and is issued as a request for quote (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal

Acquisition Circular 2023-05 and Defense Federal Acquisition Regulation Supplement Publication

Notice 20231025.

The North American Industrial Classification System (NAICS) is 339115, Ophthalmic Goods Manufacturing.

The small business size standard is 1000 employees.

Note: Please provide a Sanitize and Unsanitize copy of the proposal.

DESCRIPTION OF REQUIREMENT: Womack Army Medical Center (WAMC) is requesting approval for a Blanket Purchase Agreements (BPAs) for a supply buy for Implantable Surgical

Lenses during procedures at to the WAMC Operating Room for a period of performance to begin 1

January 2024, through 31 December 2028. Interested persons may identify their interest and capability to respond to the requirement and submit quotes. Provide your Company’s

Unique Entity Identification (UEI); CAGE code; and tax ID number.

QUESTIONS CONCERNING THE SOLICITATION: Interested parties shall submit any questions concerning this solicitation in writing to the following e-mail addresses:

Kimberly.r.jackson.civ@health.mil and donna.l.blossom.civ@health.mil no later than 13

December 2023 at 3 PM EST. Questions received after the prescribed date may not be considered. Telephonic or written inquiries for the solicitation will not be accepted.

Responses to all questions received will be posted as an amendment to the solicitation through sam.gov website.

SOLICITATION RESPONSES: Quotes shall be submitted by email to Kimberly.r.jackson.civ@health.mil and donna.l.blossom.civ@health.mil no later than 1000 AM Eastern Standard Time, on 30 December 2024.

Electronic submission via e-mail is required. Only emailed quotes received directly from the offerors are acceptable. No telephonic requests will be honored. All quotes received after the due date and time will be considered late in accordance with FAR 52.212-1(f).

All quotes received after the date of publication of this synopsis will be considered by the Government.

Clauses and provisions throughout this solicitation can be viewed by accessing website www.acquisition.gov. FAR provision 52.212-1 [Instructions to Offerors Commercial Items] applies to this acquisition to include the following addenda: All offerors are cautioned that if selected for award, they must be registered in the System for Award Management (SAM) program. The SAM can be accessed via the internet at https://www.sam.gov/portal/public/SAM/. Confirmation of SAM registration will be validated prior to awarding a contract. The provision at FAR 52.212-2, Evaluation – Commercial

Items and any addendums to this provision apply to this acquisition. The clause at FAR 52.212-5

(DEVIATION 2018-O0021) (MAR 2023), Contract Terms and Conditions to Implement Statutes or

Executive Orders – Commercial Items applies to this acquisition.

The following provisions in their latest editions apply to this solicitation.

Vendors shall include a completed copy of FAR provision 52.212-3 ALT 1, “Offeror Representations and

Certifications” with their offer. Offerors shall include a confirmation of receipt of any amendments to this solicitation. Failure to submit a confirmation could result in the offer being determined non-https://www.sam.gov/portal/public/SAM/ responsive. Clause 52.212-4 Contract Terms and Conditions—Commercial items, applies to this acquisition to include any applicable addenda.

Signature and Date_________________________________________________________________

BLANKET PURCHASE AGREEMENT (BPA)

Between

TBD

And

Medical Readiness Contracting Office-East

1. AUTHORITY. This agreement is established in accordance with Federal Acquisition Regulation

(FAR) Part 13, Subpart 13.303, Blanket Purchase Agreements (BPAs). This BPA will be reviewed by the

Contracting Officer at least once annually before the anniversary of the effective date, and revised to conform to all requirements of Statutes, Executive Orders, and the FAR. Revisions will be evidenced by a modification to the BPA.

2. DESCRIPTION OF AGREEMENT. Contractor shall provide all supplies and services as per this agreement in

Section B of the BPA Schedule (Supplies, Services and Prices). To include any potential components manufactured/or distributed by the contractor. Supplies and services shall be provided in accordance with the terms and conditions of this agreement. (VTICM) Vision Toric Implantable Collamer Model lenses. The Afinity Collamer . Visian ICL Lens is intended for the correction of moderate to high nearsightedness. Visian ICL and Visian TICL surgery is intended to safely and effectively correct nearsightedness between -3.0 D to -15.0 D, the reduction in nearsightedness up to -

20.0 D, and treatment of astigmatism from 1.0 D to 4.0 D.

3. EVENT OF OBLIGATION. Contractor’s quote i.e. hereby incorporated into this BPA. The

Government is obligated only to the extent of calls (orders) placed by authorized individuals and the purchase limitations of this BPA. Deliver Orders (orders) will be made by placing calls for supplies required. Payment will be made for actual supplies and services delivered.

4. PURCHASE LIMITATION. BPA Call Limit = $278,662.56

GPC: BPA Delivery Order Limit = $10,000.00

BPA MAX: Master Dollar Limit = $835,987.68 for the life of the BPA (Thirty-six months from the date of award.) Limitation also applies to the master dollar limit. If the dollar limit is met, the BPA ends as well.

NOTE: Anything over this amount will have to be processed via WAWF.

5. INDIVIDUALS AUTHORIZED TO PURCHASE UNDER THE BPA.

A listing of individuals authorized to place purchases/calls under this agreement shall be identified by

Medical Readiness Contracting Office-East, Fort Liberty Health Contracting Branch in writing to the contractor, and shall be identified by organization component, title, and dollar limitation per call for each individual authorized to place purchases/calls.

Calls placed by individuals not on the list are not authorized and shall not be honored by the contractor.

Services provided by the contractor in violation of this authorization will be treated as an unauthorized commitment and may result in termination of this agreement by the government. Changes in the list shall require the signature of the Administering Contracting Officer.

Authorized individuals to place orders/calls: Under $25K: Shall be identified by Letter to Contractor upon award of the Blanket Purchase Agreement (BPA).

Payment for under $10,000.00 will made by government credit card.

For orders over $10,000.00 will be through a BPA Call issued by the Contracting Officer.

6. DELIVERY TICKETS. Payments for calls issued under this BPA will be made by credit card and

Wide Area Workflow (WAWF) if applicable. All shipments under this BPA shall be accompanied by delivery ticket that contains the following information:

-Name of Supplier

-BPA Number and Call Number

-Date of Request

-Request Number

-Itemized List of Equipment, Supplies, Materials Furnished of each service

-Quantity, Unit Price, and Extension of Each Item, Less Applicable Discounts

-Date of Delivery of Shipment/Service

-Individual Placing Order

7. NUMBERING OF PURCHASES/CALLS PLACED UNDER THIS AGREEMENT.

Each order for supplies under this agreement shall be assigned a call number with a prefix. The prefix W91YTZ25ATBD will be used for all delivery orders placed under this BPA. Numbers will consist of four numeric characters, i.e., delivery order numbers will read, for example, W91YTZ25AXXXX, etc. The payment process will be through GPC and WAWF. The BPA Call

Number shall contain instructions on invoicing through WAWF.

Orders shall be placed by authorized personnel as calls against this BPA via FAX, mail order, telephonically (with written follow-up) and/or Electronic Data Interchange (EDI).

8. INVOICES/PAYMENTS.

The contractor shall create a per shipment invoice for each call received. The invoice shall list all products received for this shipment. The contractor is expected to submit an invoice upon receipt of a BPA Call.

Invoice payments will be made via GPC and WAWF.

Invoice billings will be generated and emailed or faxed to the authorized ordering individual upon completion of service. The billings are based upon the attached pricing list.

Prices for this BPA are set forth in the contractor's published price list, which is attached to this

BPA, and will be updated at least on an annual basis and/or as required by any equipment change, substitution or upgrade. Pricing shall be based on published catalog pricelist and any discounts offered. Prices to the Government shall be as low as, or lower than, those charged to the contractor’s most favored customers for comparable quantities of similar items or services.

Pricing information will be provided as an attachment to the BPA.

There are no funds available for this BPA. Funds will be made available, and the government will only be obligated for payment upon issuance of valid order/call placed against this BPA. The

Government is only obligated to the extent of authorized orders made against the BPA. There is no minimum monetary amount the Government is obligated to purchase under this BPA.

Invoice billings will be generated and emailed or faxed to the authorized ordering individual monthly. The billings are based upon the attached pricing list.

9. SHIPPING INSTRUCTIONS.

CONTRACT/ PURCHASE ORDER NUMBER: W91YTZ-25-A-TBD

DO NOT UNDER ANY CIRCUMSTANCES SHIP ITEMS TO ADDRESSES OTHER THAN THOSE

SPECIFIED HEREIN. TO DO SO IS IN VIOLATION OF THIS ORDER AND COST OF SHIPMENT

TO ADDRESS OTHER THAN THAT SPECIFIED IN THIS ORDER WILL NOT BE PAID UNLESS

THE SHIP TO/DELIVERY ADDRESS IS CHANGED BY MODIFICATION TO THE ORDER

SIGNED BY A CONTRACTING OFFICER.

SHIP TO THE FOLLOWING ADDRESS:

HQ0911

WOMACK ARMY MEDICAL CENTER

2817 ROCK MERRITT RD

FORT LIBERTY, NC 28310

EXTERIOR OF ALL SHIPPING CARTONS MUST BE MARKED WITH CONTRACT/PURCHASE

ORDER NUMBER. IF YOU ARE “DROP SHIPPING” ENSURE YOUR SHIPPER COMPLIES WITH

THESE INSTRUCTIONS. CARTONS WITHOUT IDENTIFICATION WILL BE RETURNED

“FREIGHT COLLECT”. THE ADDRESS LISTED ABOVE IS THE PRIMARY DELIVERY POINT.

HOWEVER, SHIPPING INSTRUCTION MAY CHANGE DEPENDING ON WHEN, WHERE AND

HOW THE OPERATING ROOM REPRESENTATIVES NEEDS THE PRODUCTS DELIVERED.

FOLLOW THE INSTRUCTIONS FOR THE WAMC REPRESENTATIVE IN THE ORDER.

10. PRICING:

Pricing shall be established at the time of award of the BPA and updated annually and/or as required by any equipment change, substitution or upgrade. Pricing shall be based on published catalog price list and any discounts offered. Prices to the Government shall be as low as, or lower than, those charged to the contractor’s most favored customers for comparable quantities of similar items or services. Pricing information will be provided as an attachment to the BPA.

11. REVIEW: The Medical Readiness Contracting Office-East, Fort Liberty Health Contracting

Branch will review this blanket purchase agreement annually. Review may be conducted to ensure that prices for services are in accordance with the terms and conditions of this BPA and that proper procedure have been followed. This is called an internal review. The contractor will be contacted if there are any discrepancies.

12. Personally Identifiable Information, Protected Health Information, and Federal Information

Requirements

(Revised 10/27/2020)

(1) General Requirements Overview - Personally Identifiable Information (PII), Protected Health

Information (PHI) and Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The

Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act

(HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this

Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI

5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019, and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal

Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military

Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance

Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule

Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually

Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA

Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

(2) Records Management

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36

CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD

Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program”

(May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations

Manual (TOM).

(3) Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information

Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action.

Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

(4) Systems of Records

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the

DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget

(OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

(5) Privacy Impact Assessment (PIA)

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

(6) Data Sharing Agreement (DSA)

( ) (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a

DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD

HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA

Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

• DSA for De-Identified Data

• DSA for PHI

• DSA for PII Without PHI

• DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the

Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

(A) (Applies if contract requirements may include human subject research)

This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense

Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C.

980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program

Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human

Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight

Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

(7) Privacy Act and HIPAA Training

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the

Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered

Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

(8) HIPAA Business Associate Provisions

( ) Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate

Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the

DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Privacy-Contract-

Language/HIPAA-Compliant-Business-Associate-Agreement-for- the-MHS. b.i. and (3)b. ii

(9) Breach Response

[This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the

TOM breach responses provisions, if the contract incorporates the TOM by reference.

( ) Definitions Related to Breach response

• Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

• A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out.

For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the

PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

• How the event was discovered;

• Did the information stay within the covered entity’s control;

• Was the information actually accessed/viewed; and

• Ability to ensure containment (e.g., recovered, destroyed, or deleted).

• A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing

PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

• A HHS breach is an incident that satisfies the definition of breach in

Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.

The unauthorized person who used the PHI or to whom the disclosure was made; Whether the PHI was actually acquired or viewed; and

The extent to which the risk to the PHI has been mitigated.

• A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

(A) General

• The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is

PHI or solely PII.

• Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

• The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA

Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility

(e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA

Privacy Office beyond the 24-hour deadline.. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

• In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency

Readiness Team (US-CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach

(possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below. The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirements.

• Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery.

The time of that report to the contractor shall trigger the contractor’s DHA

Privacy Office reporting deadline (24 hours) under paragraph 9.3.2. If a cybersecurity incident is involved, the contractor’s deadline for US-CERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall report directly to US-CERT and the DHA Privacy Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

• Contractors shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome. Investigations identifying unauthorized disclosures must be logged for HIPAA and Privacy Act disclosure accounting purposes, whether or not individual notification is required under the HIPAA Breach Rule.

• Contractors, when acting as HIPAA-covered entities, and not as business associates, are not subject to the breach response requirements herein.

However, such contractors are subject to both the HIPAA Breach Rule

(applicable to them in their capacity as covered entities) and DoD cybersecurity requirements (applicable to them in their capacity as DoD contractors).

(B) Reporting Provisions

(i) Immediately upon discovery of a possible or confirmed breach or cybersecurity incident, the contractor shall initiate an investigation. If the incident involves electronic PII/PHI, and if the investigation finds a confirmed breach or cybersecurity incident, the contractor shall report it, within 1 hour of confirmation, to the US-CERT Incident Reporting System at https://forms.us- cert.gov/report/, as required by the Department of Homeland Security

(DHS).

Note: DHS no longer requires US-CERT reporting of non-cyber breaches or unconfirmed electronic breaches. However, DHS permits US-CERT reporting of unconfirmed cyber-related incidents on a voluntary basis. Thus, if a contractor is uncertain whether a possible cyber-related incident should be treated as confirmed and thus reportable, the contractor may voluntarily report the incident.

Before submission to US-CERT, the contractor shall save a copy of the on-line report. After submitting the report, the contractor shall record the US-CERT incident reporting number, which shall be included in the initial report to the DHA Privacy Office as described in paragraph 9.3.2.

Note: Regardless of whether or not an incident is confirmed as a breach, the contractor must also investigate whether or not the incident impacts data integrity or availability of PII/PHI. If such impact is confirmed, then the incident is reportable to US-CERT as a cybersecurity incident. For guidance on investigating the impact on data integrity and availability, refer to DoD cybersecurity and NIST guidance.

The contractor shall provide any updates to the initial US-CERT report by email to soc@us- cert.gov, with the Reporting Number in the subject line. The contractor shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office if requested. Contractor questions about US-CERT reporting shall be directed to the DHA Privacy Office, not the US-CERT office.

(ii) In addition to US-CERT reporting, the contractor shall report to the DHA Privacy Office by submitting the form specified below within 24 hours of discovery of a breach (possible or confirmed), unless the breach falls within a category that the Privacy Office has determined to be not reportable. This 24-hour period runs from the time of discovery, unlike the 1 hour US-

CERT reporting period, which runs from the time a cybersecurity incident is confirmed. Thus, depending on the time period needed to confirm, the report to the DHA Privacy Office may be due either before or after the US-CERT report.

The breach report form required within the 24-hour deadline shall be sent by e-mail to:

DHA.PrivacyOfficer@mail.mil. The contractor shall also e-mail the report to the CO, the COR and its usual point of contact at the applicable Program Office. Encryption is not required, because reports and notices shall not contain PII/PHI. If electronic mail is not available, telephone notification is also acceptable (at 703-275-6363), but all notifications and reports delivered telephonically must be confirmed in writing as soon as technically feasible.

Contractors shall prepare the breach reports required within the 24-hour deadline by completing the

Breach Reporting Department of Defense Form DD 2959 (Breach of PII Report), available at https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd2959.pdf. For non-cyber incidents without a US-CERT number, the contractor shall assign an internal tracking number and include that number in Box 1.e of the DD Form 2959. The contractor shall coordinate with the DHA Privacy Office for subsequent action, such as beneficiary notification, and mitigation. The contractor must promptly update the DD Form 2959 as new information becomes available.

When a Breach Report Form initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the Contractor shall submit a revised form or forms promptly after the new information becomes available, stating the updated status and previous report date(s) and showing any revisions or additions in red text. The Contractor shall provide updates to the same parties as required for the initial Breach Report Form.

(C) Individual Notification Provisions

• If the DHA Privacy Office determines that individual notification is required, the Contractor shall provide written notification to beneficiaries affected by the breach as soon as possible, but no later than 10 working days after the breach is discovered and the identities and addresses of the beneficiaries are ascertained. The 10-day period begins when the Contractor is able to determine the identities

(including addresses) of the beneficiaries whose records were impacted. If notification cannot be accomplished within 10 working days, the contractor shall notify the DHA Privacy Office.

• The Contractor’s proposed notification to be issued to the affected beneficiaries shall be submitted to the DHA Privacy Office for approval. The notification to beneficiaries shall include, at a minimum, the following:

(1) Specific data elements,

(2) Basic facts and circumstances,

(3) Recommended precautions the beneficiary can take,

(4) Federal Trade Commission (FTC) identity theft hotline information, and

(5) Any mitigation support services offered, such as credit monitoring.

Contractors shall ensure any envelope containing written notifications to affected individuals are clearly labeled to alert the recipient to the importance of its contents, e.g., “Data Breach

Information Enclosed,” and that the envelope is marked with the identity of the Contractor and/or subcontractor organization that suffered the breach.

If media notice is required, the contractor will submit a proposed notice and suggested media outlets for the DHA Privacy Office review and approval (which will include coordination with the DHA

Communications Division).

(D) In the event the Contractor is uncertain on how to apply the above requirements, the Contractor shall consult with the CO, who will consult with the Privacy Office as appropriate when determinations on applying the above requirements are needed.

The Contractor shall, at no cost to the government, bear any costs associated with a breach of PII/PHI that the Contractor has caused or is otherwise responsible for addressing.

SCHEDULE B.

EXHIBIT A - PRODUCT LIST

2.1 Affinity Collamer IOL Collamer is a unique lens material that is composed of collagen, a UV-absorbing chromophore, and a poly-HEMA based copolymer. The Afinity Collamer Aspheric IOL Model CC4204A provides outstanding optical performance, including reduced spherical aberration, and is highly biocompatible. The Model

CC4204A of the Afinity Collamer IOL is a single piece lens placed completely in the capsular bag. The lens has large fenestrations to enhance postoperative fixation. The light patterns associated with the Collamer lens are nearly identical to those of the human crystalline lens.

2.2 Elastimide Silicone IOL Silicone Elastimide Silicone Aspheric Lens is the latest refinement in silicone foldable

IOLs. In addition to its aspheric optic, the lens features the square edge configuration.

2.3 The EVO Visian ICL Lens is intended for the correction of moderate to high nearsightedness. EVO Visian ICL and EVO Visian TICL surgery is intended to safely and effectively correct nearsightedness between -3.0 D to -15.0

D, the reduction in nearsightedness up to -20.0 D and treatment of astigmatism from 1.0 D to 4.0 D. If you have nearsightedness within these ranges, EVO Visian ICL surgery may improve your distance vision without eyeglasses or contact lenses.

CLAUSES INCORPORATED BY REFERENCE

52.212-4 Contract Terms and Conditions--Commercial Products and Commercial Services

DEC 2022

52.212-4 ADDENDUM

(w) The non-FAR Part 12 discretionary FAR and DFARS clauses included herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 herein for locations where full text can be found.

(End of Addendum)

CLAUSES INCORPORATED BY REFERENCE

52.203-3 Gratuities APR 1984

52.203-12 Limitation On Payments To Influence Certain Federal

Transactions

JUN 2020

52.204-10 Reporting Executive Compensation and First-Tier

Subcontract Awards

JUN 2020

52.204-13 System for Award Management Maintenance OCT 2018

52.204-18 Commercial and Government Entity Code Maintenance AUG 2020

52.204-23 Prohibition on Contracting for Hardware, Software, and

Services Developed or Provided by Kaspersky Lab and

Other Covered Entities

NOV 2021

52.204-25 Prohibition on Contracting for Certain

Telecommunications and Video Surveillance Services or Equipment

NOV 2021

52.204-27 Prohibition on a ByteDance Covered Application JUN 2023

52.209-6 Protecting the Government's Interest When

Subcontracting With Contractors Debarred, Suspended, or Proposed for Debarment

NOV 2021

52.222-3 Convict Labor JUN 2003

52.222-19 Child Labor -- Cooperation with Authorities and

Remedies

DEC 2022

52.222-21 Prohibition Of Segregated Facilities APR 2015

52.222-50 Combating Trafficking in Persons NOV 2021

52.223-18 Encouraging Contractor Policies To Ban Text

Messaging While Driving

JUN 2020

52.224-1 Privacy Act Notification APR 1984

52.224-2 Privacy Act APR 1984

52.224-3 Privacy Training JAN 2017

52.225-13 Restrictions on Certain Foreign Purchases FEB 2021

52.232-33 Payment by Electronic Funds Transfer--System for

Award Management

OCT 2018

52.232-36 Payment by Third Party MAY 2014

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013

52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

MAR 2023

52.233-3 Protest After Award AUG 1996

52.233-4 Applicable Law for Breach of Contract Claim OCT 2004

52.242-5 Payments to Small Business Subcontractors JAN 2017

52.244-6 Subcontracts for Commercial Products and Commercial

Services

MAR 2023

252.201-7000 Contracting Officer Representative DEC 1991

252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower

Rights

DEC 2022

252.203-7003 Agency Office of the Inspector General AUG 2019

252.204-7003 Control Of Government Personnel Work Product APR 1992

252.204-7018 Prohibition on the Acquisition of Covered Defense

Telecommunications Equipment or Services

JAN 2023

252.209-7004 Subcontracting With Firms That Are Owned or

Controlled By The Government of a Country that is a

State Sponsor of Terrorism

MAY 2019

252.219-7003 Small Business Subcontracting Plan (DOD Contracts) DEC 2019

252.225-7002 Qualifying Country Sources As Subcontractors MAR 2022

252.225-7021 Trade Agreements--Basic JAN 2023

252.225-7048 Export-Controlled Items JUN 2013

252.226-7001 Utilization of Indian Organizations, Indian-Owned

Economic Enterprises, and Native Hawaiian Small

Business Concerns

JAN 2023

252.232-7003 Electronic Submission of Payment Requests and

Receiving Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006

252.243-7001 Pricing Of Contract Modifications DEC 1991

CLAUSES INCORPORATED BY FULL TEXT

52.209-10 Prohibition on Contracting With Inverted Domestic Corporations. (NOV 2015)

(a) Definitions. As used in this clause--

Inverted domestic corporation means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of

6 U.S.C. 395(c).

Subsidiary means an entity in which more than 50 percent of the entity is owned--

(1) Directly by a parent corporation; or

(2) Through another subsidiary of a parent corporation.

(b) If the contractor reorganizes as an inverted domestic corporation or becomes a subsidiary of an inverted domestic corporation at any time during the period of performance of this contract, the

Government may be prohibited from paying for Contractor activities performed after the date when it becomes an inverted domestic corporation or subsidiary. The Government may seek any available remedies in the event the Contractor fails to perform in accordance with the terms and conditions of the contract as a result of Government action under this clause.

(c) Exceptions to this prohibition are located at 9.108-2.

(d) In the event the Contractor becomes either an inverted domestic corporation, or a subsidiary of an inverted domestic corporation during contract performance, the Contractor shall give written notice to the

Contracting Officer within five business days from the date of the inversion event.

(End of clause)

52.219-28 POST-AWARD SMALL BUSINESS PROGRAM REREPRESENTATION (MAR 2023)

Long-term contract means a contract of more than five years in duration, including options. However, the term does not include contracts that exceed five years in duration because the period of performance has been extended for a cumulative period not to exceed six months under the clause at 52.217-8, Option to

Extend Services, or other appropriate authority.

Small business concern--

(1) Means a concern, including its affiliates, that is independently owned and operated, not dominant in its field of operation, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (d) of this clause.

(2) Affiliates, as used in this definition, means business concerns, one of whom directly or indirectly controls or has the power to control the others, or a third party or parties control or have the power to control the others. In determining whether affiliation exists, consideration is given to all appropriate factors including common ownership, common management, and contractual relationships. SBA determines affiliation based on the factors set forth at 13 CFR 121.103.

(b) If the Contractor represented that it was any of the small business concerns identified in 19.000(a)(3) prior to award of this contract, the Contractor shall represent its size and socioeconomic status according to paragraph (f) of this clause or, if applicable, paragraph (h) of this clause, upon occurrence of any of the following:

(1) Within 30 days after execution of a novation agreement or within 30 days after modification of the contract to include this clause, if the novation agreement was executed prior to inclusion of this clause in the contract.

(2) Within 30 days after a merger or acquisition that does not require a novation or within 30 days after modification of the contract to include this clause, if the merger or acquisition occurred prior to inclusion of this clause in the contract.

(3) For long-term contracts--

(i) Within 60 to 120 days prior to the end of the fifth year of the contract; and

(ii) Within 60 to 120 days prior to the date specified in the contract for exercising any option thereafter.

(c) If the Contractor represented that it was any of the small business concerns identified in 19.000(a)(3) prior to award of this contract, the Contractor shall represent its size and socioeconomic status according to paragraph (f) of this clause or, if applicable, paragraph (h) of this clause, when the Contracting Officer explicitly requires it for an order issued under a multiple-award contract.

(d) The Contractor shall represent its size status in accordance with the size standard in effect at the time of this representation that corresponds to the North American Industry Classification System (NAICS) code(s) assigned to this contract. The small business size standard corresponding to this NAICS code(s) can be found at https://www.sba.gov/document/support--table-size-standards.

(e) The small business size standard for a Contractor providing an end item that it does not manufacture, process, or produce itself, for a contract other than a construction or service contract, is 500 employees, or

150 employees for information technology value-added resellers under NAICS code 541519, if the acquisition--

(1) Was set aside for small business and has a value above the simplified acquisition threshold;

(2) Used the HUBZone price evaluation preference regardless of dollar value, unless the Contractor waived the price evaluation preference; or

(3) Was an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(f) Except as provided in paragraph (h) of this clause, the Contractor shall make the representation(s) required by paragraph (b)…