CMS-Adobe-151737.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

AGG/AA1

Contract Specialist Amy Anderson

CODE 16. ADMINISTERED BYCODE

X

X

X

SIZE STANDARD:

100.00 % FOR:SET ASIDE:UNRESTRICTED ORITCG - DMITSC

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

08/14/2015 1000 ES

08/01/2015

6-8832Amy Anderson (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

HHSM-500-2015-RFP-0132

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 54 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

BALTIMORE MD 21244-1850

7500 SECURITY BLVD., MS: B3-30-03

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

CMS,OAGM,ITCG,DMITSC

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Period of Performance: 09/24/2015 to 09/23/2016

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

XX

DATED

Ryan Kooy

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

54 2 of

HHSM-500-2015-RFP-0132 (CMS-Adobe-151737) Adobe Digital Publishing Suite

I. SF 1449- ADDENDUM

A. Continuation of Block 18a

PAYMENTS - INVOICES (FIRM FIXED PRICE CONTRACTS – MAR 2014)

a. GENERAL: The Contractor may submit to the Government an invoice for payment in accordance with the instructions below.

b. METHOD OF PAYMENT: CMS shall only make an electronic payment of invoices in accordance with FAR 52.232-33, Payments by Electronic Funds Transfer – System for Award Management. In order to receive payments, the contractor shall register in the System for Award Management (SAM) database, in accordance with FAR 52.204-7, System for Award Management. Failure to register in SAM may prohibit CMS from making payments to your organization.

ADDRESS CHANGES: The contractor shall notify CMS’ Division of Accounting Operations of all EFT and address changes in SAM via the following email address:

CCRChanges@cms.hhs.gov.

c. CONTENT OF INVOICE - Invoices shall include, at a minimum:

• Contractor’s name and address;

• Contractor’s Tax Identification Number (TIN);

• Contractor’s DUNS Number;

• Invoice date;

• Invoice Number to include the designation of the Contract Payment Category Type as follows:

Contract Payment Category Type I

• Contract and Order Number, as applicable;

• Contract line item number and/or Subcontract line item number;

• Description, quantity, unit of measure, unit price and extended price of the items actually delivered or services rendered;

• Shipping and payment terms;

• Terms of any discount for prompt payment offered;

• Other substantiating documentation or information as required by the contract;

• Name, title, phone number and complete mailing address of responsible official to whom payment is to be sent;

• Name, title, phone number of person to notified in the event of a defective invoice; and,

• Period of performance or delivery date of goods or services provided.

d. WHERE/HOW TO SUBMIT INVOICE FOR PAYMENT: Invoices shall be submitted electronically as an email attachment as follows:

To…: CMSInvoiceSubmissions@CMS.HHS.Gov

Cc…: Please "Cc…" your respective Contract Specialist (CS) and Contracting Officer's

Representative (COR) as follows:

mailto:CCRChanges@cms.hhs.gov mailto:CMSInvoiceSubmissions@CMS.HHS.Gov

• Contract Specialist – amy.anderson@cms.hhs.gov; and

• COR – tbd@cms.hhs.gov.

SUBJECT

LINE: When submitting the invoice for payment, the email SUBJECT line shall read as follows:

Contract # / Invoice # / Payment Category Type I

PLEASE DO NOT INCLUDE ANY ADDITIONAL INFORMATION IN THE

SUBJECT LINE as doing so may delay internal processing of your invoice for payment.

EMAIL

BODY: Because the important information to quickly process your invoice is included in the SUBJECT line, and since the invoice attachment should be self-explanatory, please limit information in the email body, e.g., Include senders contact information and/or a statement such as "Attached is XYZ Corporation’s April 2014 Invoice," etc.

e. PAYMENTS: The Government shall make payment of all invoices in accordance with

• FAR 52.232-1 Payments, and

• FAR 52.212-4 Contract Terms and Conditions – Commercial Items (If applicable) upon acceptance by the Contracting Officer’s Representative (COR) in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer’s approval, as appropriate.

Reimbursement for invoices submitted under this contract shall be made not later than thirty (30) calendar days after receipt of an acceptable invoice from the Contractor at the paying office designated above. Any discrepancies determined as a result of the audit could delay the processing of the invoice and may result in the invoice being returned to the Contractor for corrections.

f. INTEREST ON OVERDUE PAYMENT

The Prompt Payment Act, Public Law 97-177 (96 Stat.85.31 U.S.C. 1801) is applicable to payments under this contract and requires the payment of interest on payments made more than 30 calendar days after receipt of an invoice by the Division of Accounting Operations.

Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and Office of Management and Budget Circular A-125.

mailto:amy.anderson@cms.hhs.gov mailto:tbd@cms.hhs.gov

II. Clauses

A. ADDENDA to 52.212-4 Contract Terms and Conditions – Commercial Items (Feb 2007)

1. HHSAR Clauses Incorporated by Reference

352.201-70 PAPERWORK REDUCITON ACT (JAN 2006)

352.202-1 DEFINITIONS (JAN 2006)

352.203-70 ANTI-LOBBYING (MAR 2012)

352.222-70 CONTRACTOR COOPERATION IN EQUAL EMPLOYMENT

OPPORTUNITY INVESTIGATIONS (JANUARY 2010)

352.224-70 PRIVACY ACT (JAN 2006)

352.227-70 PUBLICATION AND PUBLICITY (JAN 2006)

352.231-71 PRICING OF ADJUSTMENTS (JANUARY 2001)

352.239-70 STANDARD FOR SECURITY CONFIGURATIONS (JAN 2010)

352.239-71 STANDARD FOR ENCRYPTION LANGUAGE (JAN 2010)

352.239-72 SECURITY REQUIREMENTS FOR FEDERAL INFORMATION

TECHNOLOGY RESOURCES (JAN 2010)

352.239-73 ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY

(JAN 2010)

352.270-1 ACCESSIBILITY OF MEETINGS, CONFERENCES, AND SEMINARS TO

PERSONS WITH DISABILITIES (JAN 2001)

2. Government Contracting Officer’s Representative (COR)

___TBD____is designated as the Contracting Officers Representative (COR) for this task order.

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and compliance with all substantive project objectives;

(2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this task order; (5) assisting in the resolution of technical problems encountered during performance; and (6) providing technical direction in accordance with Section G; and, (7)reviewing of invoices/vouchers.

The COR does not have authority to act as agent of the Government under this task order. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this task order

3. CONTRACTOR PERFORMANCE EVALUATION(S) (OCT 2014)

General:

In accordance with Federal Acquisition Regulation (FAR) 42.15, Contractor Performance Information, past performance evaluations shall be prepared at least annually and at the time the work under a contract or order is completed. Additional interim performance evaluations may be prepared at Contracting Officer discretion, as necessary.

CMS will utilize the Contractor Performance Assessment Reporting System (CPARS), the Governmentwide evaluation reporting tool for all past performance reports on contracts and orders, as appropriate. CPARS is a secure Internet website located at https://www.cpars.gov.

A. CPARS Process:

1. CPARS Training: Contractors may obtain CPARS training material and register for on-line training https://www.cpars.gov.

2. Post-Award Contract Registration: CMS is responsible for registering the contract in CPARS within 30 calendar days of contract award. The Contractor shall:

i. Designate at least one (1) point of contact that will be responsible for serving as the Contractor’s Representative (CR). Additional CRs may also be identified; and,

ii. Provide the CMS Contract Specialist with the name(s) and email address(es) of the CPARS point(s) of contact.

Once CMS registers the contract in CPARS, the CR(s) will receive an automated CPARS email message that contains User IDs and instructions for creating a password for future past performance evaluation processing.

3. Interim, Annual and Final Past Performance Evaluation Reports:

a. Issuing the Evaluation: Once the CMS Assessing Official (AO) issues an evaluation to the Contractor in CPARS, the CR(s) will receive an email instructing them to login to CPARS to review the evaluation.

b. Contractor Comments: The CR has the option to provide comments on the evaluation, indicate if they concur or do not concur with the evaluation, sign, and then return the evaluation to the AO. The CR has a total of 60 days following the AO’s evaluation signature date to submit comments. If the CR submits comments within the first 14 days following the AO’s signature date and the AO closes the evaluation, the evaluation will become available in Past Performance Information Retrieval System - Report Card (PPIRS-RC) within 1 day.

On day 15 following the AO’s evaluation signature date, the evaluation will become available in PPIRS-RC with or without CR comments and whether or not it has been closed by the AO. If no CR comments have been sent and the evaluation has not been closed, it will be marked as “Pending” in PPIRS-RC.

https://www.cpars.gov/ https://www.cpars.gov/

If the CR sends comments at any time prior to 61 days following the AO’s evaluation signature date, those comments will be reflected in PPIRS-RC within 1 day. On day 61 following the AO’s evaluation signature date, the CR will be “locked out” of the evaluation and may no longer send comments.

4. DATA TO BE DELIVERED

a. Any working papers, interim reports, data given by the Government or first produced by the

Contractor under the contract or collected or otherwise obtained by the Contractor under the contract, or results obtained or developed by the Contractor (subcontractor or consultants) pursuant to the fulfillment of this contract are to be delivered, documented, and formatted as directed by the Contracting Officer.

b. In addition, information and/or data, which are held by the Contractor related to theoperation of their business and/or institution and which are obtained without the use of Federal funds, shall be considered “PROPRIETARY DATA” and are not subject data tobe delivered under this contract.

5. DISSEMINATION, PUBLICATION AND DISTRIBUTION OF INFORMATION

a. Data and information either provided to the Contractor, or to any subcontractor or generated by activities under this contract or derived from research or studies supported by this contract, shall be used only for the purposes of the contract. It shall not be duplicated, used or disclosed for any purpose other than the fulfillment of the requirements set forth in this contract. This restriction does not limit the Contractor’s right to use data or information obtained from a non-restrictive source. Any questions concerning “privileged information” shall be referred to the Contracting Officer.

b. Some data or information may require special consideration with regard to the timing of its disclosure so that preliminary findings, which could create erroneous conclusions, are not stimulated. Also, some data or information, which relate to policy matters under consideration by the Government, may also require special consideration with regard to the timing of its disclosure so that the open and vigorous debate, within the government, of possible policy options is not damaged.

c. Any questions about use or release of the data or information or handling of material under this contract shall be referred to the Contracting Officer who must render a written determination. The Contracting Officer’s determinations will reflect the results of internal coordination with appropriate program and legal officials.

d. Written advance notice of at least forty-five (45) days shall be provided to the Contracting

Officer of the Contractor’s desire to release findings of studies or research or data or information described above. If the Contractor disagrees with the Contracting Officer’s determinations, and if the Contractor and the Contracting Officer cannot settle this disagreement in a mutually satisfactory manner, then the issue will be settled pursuant to the Disputes clause.

e. Any presentation of any report, statistical or analytical material based on information obtained from this contract shall be subject to review by the COR before dissemination, publication, or distribution. Presentation includes, but is not limited to, papers, articles, professional publications, speeches, testimony or interviews with public print or broadcast media. This does not apply to information that would be available under the Federal Freedom of Information Act.

f. The COR review shall cover accuracy, content, manner of presentation of the information, and also the protection of the privacy of individuals. If the review finds that the Privacy Act is or may be violated, the release/use of the presentation shall be denied until the offending materials is removed or until the Contracting Officer makes a formal determination, in writing, that the privacy of individuals is not being violated.

g. If the review shows that the accuracy, content, or manner of presentation is not correct or is inappropriate in the light of the purpose of the project, the COR shall immediately inform the Contractor, in writing, of the nature of the problem. If the Contractor disagrees, the COR may insist that the presentation contain, in a manner of equal importance, materials which show the government’s problem with the presentation.

h. The Contractor agrees to acknowledge support by CMS whenever reports of projects funding, in whole or in part, by this contract are published in any medium. The Contractor shall include in any publication resulting from work under this contract, an acknowledgment substantially, as follows:

“The analyses upon which this publication is based were performed under Contract Number [ ], entitled, [ ], sponsored by the Centers for Medicare & Medicaid Services, Department of Health and Human Services.”

The Contracting Officer shall approve any deviation from the above legend, in writing.

6. PROPERTY ADMINISTRATION

The CMS Contract Property Administrator, Office of Installation Services, 7500 Security Blvd., Baltimore, Md. 21244, is hereby designated the property administration function for this contract.

The Contractor agrees to furnish information regarding Government Property to the Property Administrator in the manner and to the extent required by the Property Administrator, his duly designated successors, and in accordance with FAR Part 45 and DHHS Manual entitled, Contractor's Guide for Control of Government Property, (1990).

If equipment is procured in order to provide services, CMS will retain title to the equipment.

CMS must be notified as part of the itemized billing arrangement if there is an equipment acquisition, included in the cost of the contract.

All original tapes, video, CD ROM(s), manual, brochures, pamphlets shall remain the property of the CMS. The contractor shall provide to CMS all final, complete and editable web-based training course files.

7. CORRESPONDENCE PROCEDURES

To promote timely and effective administration, correspondence (except for invoices), submitted under this contact shall be subject to the following procedures:

a. Technical Correspondence - Technical correspondence (as used herein, this term excludes technical correspondence which proposes or otherwise involves waivers, deviations or modifications to the requirements, terms or conditions of this contract) shall be addressed to the COR with an informational copy of the basic correspondence to the Contracting Officer.

b. Other Correspondence - All other correspondence shall be addressed to the Contracting

Officer, in duplicate, with an informational copy of the basic correspondence to the COR.

c. Subject Lines - All correspondence shall contain a subject line, commencing with the contract number as illustrated below:

EXAMPLE: Contract No. HHSM-500-2013-XXXX

Request for Subcontract Consent

8. ADP SYSTEMS SECURITY REQUIREMENTS

In the performance of this contract, the Contractor agrees to comply with the ADP systems security requirements of the Office of Management and Budget (OMB) Circular A-130, "Management of Federal Information Resources", and with the ADP systems security policy of DHHS as outlined in Part 6 of the HHS ADP Systems Manual and in CMS's AIS Guide and the CMS Business Partners System Security Manual (BPSSM) found at http://www.cms.hhs.gov/manuals/downloads/117_systems_security.pdf. The Contractor shall include this requirement in any subcontract awarded under this prime contract.

9. SECTION 508 – ACCESSIBILITY OF ELECTRONIC AND INFORMATION

TECHNOLOGY

a. This contract is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the workforce Investment Act of 1998 (P.L. 105-220). Specifically, subsection 508(a)(1) requires that when the Federal Government procures Electronic and Information Technology (EIT), the EIT must allow Federal employees and individuals of the public with disabilities comparable access to and use of information and data that is provided to Federal employees and individuals of the public without disabilities.

b. The EIT accessibility standards at 36 CFR Part 1194 were developed by the Architectural and Transportation Barriers Compliance Board ("Access Board") and apply to contracts and task/delivery orders, awarded under indefinite quantity contracts on or after June 25, 2001.

c. Each Electronic and Information Technology (EIT) product or service furnished under this contract shall comply with the Electronic and Information Technology Accessibility Standards (36 CFR 1194), as specified in the contract, as a minimum. If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within the period of time to be specified by the Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

i. Cancellation of the contract, delivery or task order, purchase or line item without termination liabilities; or,

ii. In the case of custom Electronic and Information Technology (EIT) being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant EIT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

d. The contractor must ensure that all EIT products that are less than fully compliant with the accessibility standards are provided pursuant to extensive market research and are the http://www.cms.hhs.gov/manuals/downloads/117_systems_security.pdf most current compliant products or services available to satisfy the contract requirements.

e. For every EIT product or service accepted under this contact by the Government that does not comply with 36 CFR 1194, the contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date; whichever shall occur first.

10.SECURITY CLAUSE -BACKGROUND - INVESTIGATIONS FOR CONTRACTOR

PERSONNEL

If applicable, Contractor personnel performing services for CMS under this contract, task order or delivery order shall be required to undergo a background investigation. CMS will pay for the background investigations.

After contract award, the CMS Contracting Officers Representative (COR) and the Emergency Management & Response Group (EMRG), with the assistance of the Contractor, shall perform a position-sensitivity analysis based on the duties contractor personnel shall perform on the contract, task order or delivery order. The results of the position-sensitivity analysis will determine first, whether the provisions of this clause are applicable to the contract and second, if applicable, determine each position’s sensitivity level (i.e., high risk, moderate risk or low risk) and dictate the appropriate level of background investigation to be processed. Investigative packages may contain the following forms:

1. SF-85, Questionnaire for Non-Sensitive Positions, 09/1995

2. SF-85P, Questionnaire for Public Trust Positions, 09/1995

3. OF-612, Optional Application for Federal Employment, 12/2002

4. OF-306, Declaration for Federal Employment, 01/2001

5. Credit Report Release Form

6. FD-258, Fingerprint Card, 5/99, and

7. CMS-730A, Request for Physical Access to CMS Facilities

(NON-CMS ONLY), 11/2003.

The Contractor personnel shall be required to undergo a background investigation commensurate with one of these position-sensitivity levels:

1) High Risk (Level 6) Public Trust positions that would have a potential for exceptionally serious impact on the integrity and efficiency of the service. This would include computer security of a major automated information system (AIS). This includes positions in which the incumbent’s actions or inaction could diminish public confidence in the integrity, efficiency, or effectiveness of assigned government activities, whether or not actual damage occurs, particularly if duties are especially critical to the agency or program mission with a broad scope of responsibility and authority.

Major responsibilities that would require this level include:

a. development and administration of CMS computer security programs, including direction and control of risk analysis and/or threat assessment;

b. significant involvement in mission-critical systems;

http://www.gsa.gov/Portal/gsa/ep/formslibrary.do?viewType=DETAIL&formId=FC83C171AE71F90585256A730051C8AB http://www.gsa.gov/Portal/gsa/ep/formslibrary.do?viewType=DETAIL&formId=25292D2D26D8B5EC85256A730051F924 http://www.gsa.gov/Portal/gsa/ep/formslibrary.do?viewType=DETAIL&formId=41A93F1A1771761B85256A720061344C http://www.gsa.gov/Portal/gsa/ep/formslibrary.do?viewType=DETAIL&formId=047C39FC0226D01E85256AAB005DF2AD http://www.opm.gov/extra/investigate/Fin-1998/fin9802.asp http://www.fbi.gov/hq/cjisd/PDF/fpcardb.pdf http://cmsnet.cms.hhs.gov/hpages/oics/formsloc/cms730af.pdf

c. preparation or approval of data for input into a system which does not necessarily involve personal access to the system but with relatively high risk of causing grave damage or realizing significant personal gain;

d. other responsibilities that involve relatively high risk of causing damage or realizing personal gain;

e. policy implementation;

f. higher level management duties/assignments or major program responsibility; or

g. independent spokespersons or non-management position with authority for independent action.

Approximate cost of each investigation: $3,500

2) Moderate Risk (Level 5) Public Trust positions that have potential for moderate to serious impact on the integrity and efficiency of the service, including computer security. These positions involve duties of considerable importance to the CMS mission with significant program responsibilities that could cause damage to large portions of AIS. Duties involved are considerably important to the agency or program mission with significant program responsibility, or delivery of service.

Responsibilities that would require this level include:

a. the direction, planning, design, operation, or maintenance of a computer system and whose work is technically reviewed by a higher authority at the High Risk level to ensure the integrity of the system;

b. systems design, operation, testing, maintenance, and/or monitoring that are carried out under the technical review of a higher authority at the High Risk level;

c. access to and/or processing of information requiring protection under the Privacy Act of 1974;

d. assists in policy development and implementation;

e. mid-level management duties/assignments;

f. any position with responsibility for independent or semi-independent action; or

g. delivery of service positions that demand public confidence or trust.

Approximate cost range of each investigation: $150 - $2,600

3) Low Risk (Level 1) Positions having the potential for limited interaction with the agency or program mission, so the potential for impact on the integrity and efficiency of the service is small. This includes computer security impact on AIS.

Approximate cost of each investigation: $100

The Contractor shall submit the investigative package(s) to the EMRG within three (3) days after being advised by the EMRG of the need to submit packages. Investigative packages shall be submitted to the following address:

Centers for Medicare & Medicaid Services Office of Operations Management Emergency Management & Response Group Mail Stop SL-13-15 7500 Security Boulevard

Baltimore, Maryland 21244-1850

The Contractor shall submit a copy of the transmittal letter to the Contracting Officer (CO).

Contractor personnel shall submit a CMS-730A (Request for Badge) to the EMRG (see attachment in Section J). The Contractor and the COR shall obtain all necessary signatures on the CMS-730A prior to any Contractor employee arriving for fingerprinting and badge processing.

The Contractor must appoint a Security Investigation Liaison as a point of contact to resolve any issues of inaccurate or incomplete form(s). Where personal information is involved, EMRG may need to contact the contractor employee directly. The Security Investigation Liaison may be required to facilitate such contact.

After EMRG fingerprints contractor personnel and issues them a temporary CMS identification badge, the EMRG will send their completed investigative package to the Office of Personnel Management (OPM). OPM will conduct the background investigation. Badges will be provided by EMRG while contractor personnel investigative forms are being processed. The Contractor remains fully responsible for ensuring contract, task order or delivery order performance pending completion of background investigations of contractor personnel.

EMRG shall provide written notification to the CO with a copy to the COR of all suitability decisions. The COR shall then notify the Contractor in writing of the approval of the Contractor’s employee(s), at that time the Contractor’s employee(s) will receive a permanent identification badge. Contractor personnel who the EMRG determines to be ineligible may be required to cease working on the contract immediately.

The Contractor shall report immediately in writing to EMRG with copies to the CO and the COR, any adverse information regarding any of its employees that may impact their ability to perform under this contract, task order or delivery order. Reports should be based on reliable and substantiated information, not on rumor or innuendo. The report shall include the contractor employee’s name and social security number, along with the adverse information being reported.

Contractor personnel shall be provided an opportunity to explain or refute unfavorable information found in an investigation to EMRG before an adverse adjudication is made.

Contractor personnel may request, in writing, a copy of their own investigative results by contacting:

Office of Personnel Management Freedom of Information Federal Investigations Processing Center PO Box 618 Boyers, PA 16018-0618.

At the Agency’s discretion, if an investigated contractor employee leaves the employment of the contractor, or otherwise is no longer associated with the contract, task order, or delivery order within one (1) year from the date the background investigation was completed, then the Contractor may be required to reimburse CMS for the full cost of the investigation. Depending upon the type of background investigation conducted, the cost could be approximately $100 to $3,500. The amount to be paid by the Contractor shall be due and payable when the CO submits a written letter notifying the Contractor as to the cost of the investigation. The Contractor shall pay the amount due within thirty (30) days of the date of the CO’s letter by check made payable to the “United States Treasury.” The Contractor shall provide a copy of the CO’s letter as an attachment to the check and submit both to the Office of Financial Management at the following address:

Centers for Medicare & Medicaid Services PO Box 7520 Baltimore, Maryland 21207

The Contractor must immediately provide written notification to EMRG (with copies to the CO and the COR) of all terminations or resignations of Contractor personnel working on this contract, task order or delivery order. The Contractor must also notify EMRG (with copies to the CO and the COR) when a Contractor’s employee is no longer working on this contract, task order or delivery order.

At the conclusion of the contract, task order or delivery order and at the time when a contractor employee is no longer working on the contract, task order or delivery order due to termination or resignation, all CMS-issued parking permits, identification badges, access cards, and/or keys must be promptly returned to EMRG. Contractor personnel who do not return their government-issued parking permits, identification badges, access cards, and/or keys within 48 hours of the last day of authorized access shall be permanently barred from the CMS complex and subject to fines and penalties authorized by applicable federal and State laws.

11. CONTRACTOR TERMINATION CMS BUILDING PASS

In the event that the contractor terminates an employee working on this contract, or an employee working on this contract voluntarily leaves the employment of the contractor, and that employee has been issued a contractor's badge by CMS for access to CMS buildings, the contractor shall immediately take the following actions:

1. Secure the CMS contractor's badge from the employee;

2. Formally advise the Contracting Officer that the individual is no longer an employee of the contractor; and,

3. Return the badge with the notification to the Contracting Officer.

12. RESTRICTIONS AGAINST DISCLOSURE

(a) The Contractor agrees to keep all information it gathers or analyzes or information the Government in the course of this contract/task order/delivery order furnishes in the strictest confidence. The Contractor also agrees that Government-provided information marked "For Official Use Only," "Confidential", or "Proprietary" must also be similarly protected and shall take all reasonable measures necessary to prohibit access to such information by any such person other than those Contractor employees needing such information to perform the work, i.e., on a need-to-know basis.

(b) The Contractor shall immediately notify the Contracting Officer in writing in the event it has been determined or the Contractor has reason to suspect a breach of this requirement.

(c) The Contractor shall require that all employees and consultants who are given access to such information sign a confidentiality and nondisclosure statement agreeing to safeguard the confidentiality of all such information gathered or provided to them hereunder as an integral condition of their employment.

(d) Upon the Government's written request, the Contractor shall provide the Contracting Officer with plans and procedures to ensure the confidentiality and physical security of information gathered or provided hereunder.

(e) The Contractor may "gather and analyze" information that is not furnished or owned by the Government. Such information shall not be subject to the restrictions in this clause.

13. MONITORING

The Contractor shall be subject to periodic contract performance review(s) as may be deemed necessary by the Contracting Officer or the Project Officer as his/her designee. The Contractor shall make all records and facilities available to the Contracting Officer for the purposes of such monitoring of the contract performance.

No part of any funds under this contract shall be used to pay the salary or expenses of any Contractor's employee or agent acting for the Contractor to engage in any activity designed to influence legislation or appropriations pending before the Congress.

14. CMS INFORMATION SECURITY (APR 2013)

All CMS information shall be protected from unauthorized access, use, disclosure, duplication, modification, diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, integrity, and availability of such information. Therefore, if this contract requires the contractor to provide services (both commercial and non-commercial) for Federal Information/Data, to include any of the following requirements:

• Process any Information/Data; or

• Store any Information/Data (includes “Cloud” computing services); or

• Facilitate the transport of Information/Data; or

• Host/maintain Information/Data (including software and/or infrastructure developer/maintainers); or

• Have access to, or use of, Personally Identifiable Information (PII), including instances of remote access to, or physical removal of, such information beyond agency premises or control,the contractor shall become and remain compliant with the requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics- Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security- Library-Items/CMS-Information-Security-Contract-Clause-Provision.html. The requirements cover all CMS contracts and associated deliverables, which are required on a “per contractor” basis. The contractor shall ensure that the following Federal information security standards are met for all of its CMS contracts:

• Federal Information Security Management Act (FISMA) – FISMA information can be found at http://csrc.nist.gov/groups/SMA/fisma/index.html. FISMA requires each Federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source; and,

• Federal Risk and Authorization Management Program (FedRAMP) – FedRAMP information can be found at http://www.gsa.gov/portal/category/102371. The FedRAMP https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

The Contractor shall include in all awarded subcontracts the FISMA/FedRAMP compliance requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security- Contract-Clause-Provision.html.

15. HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. § 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor's duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

"Business Associate'' shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS’ HIPAA-covered functions.

"Covered Entity" shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

"Secretary" shall mean the Secretary of the Department of Health & Human Services or the Secretary's designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

a. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or on behalf of, Covered Entity other than as permitted or required by this Contract or as required by law;

b. Sell PHI; or,

c. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual for:

https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html

i. Filing a complaint under 45 CFR § 160.306;

ii. Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under 45 CFR Part 160; or

iii. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

a. Have a security official who will be responsible for development and implementation of its security policies and procedures, including workforce security measures, to ensure proper security awareness and training (including security incident response and reporting), and security incident procedures, in accordance with this Contract, including this HIPAA Business Associate Clause and the Contract’s clause entitled “CMS Information Security.”

b. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI created, received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as provided for by this Contract. In doing so, it shall implement policies and procedures to address the following and, where applicable, ensure that such policies and procedures are also in conformance with this Contract’s clause entitled “CMS Information Security:”

i. Prevent, detect, contain and correct security violations through the use of:

1. Risk analyses (including periodic technical and nontechnical evaluations);

2. Appropriate risk management strategies, including system activity review;

3. Information access procedures for approving individual’s access rights to

PHI (including the implementation of workforce security measures to ensure continued appropriate role-based access to PHI), and technical policies and procedures to ensure compliance with grants of access (including unique user identification and tracking of users) and;

4. The imposition of sanctions for violations.

ii.Limit physical access to its electronic information systems and the facility or facilities in which they are housed.

iii. Implement policies, procedures and physical security measures that will limit access to PHI through workstations and other devices, including access through mobile devices.

iv. Implement media controls covering the movement of devices containing PHI within or outside of the Business Associate’s facility as well as the disposal and reuse of media containing PHI.

v.Implement appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability (including the use of contingency plans) of any electronic protected health information ("EPHI") it creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, maintenance or transmission of such EPHI. In the establishment of such safeguards, Business Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, and its hardware and software security capabilities.

c. Assess, and implement, where appropriate, any addressable implementation specifications associated with applicable PHI security standards.

d. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

e. Comply with the following Incident Reporting:

(a) Report to Covered Entity any security incident/breach involving unsecured PHI, of which it becomes aware, including those of its agents and subcontractors. The Business Associate shall report any violation of the terms of this contract involving PHI and any security incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in accordance with the CMS Risk Management Handbook (RMH), specifically “RMH Vol II Procedure 7-2 Incident Handling Procedure” and “RMH Vol III Standard 7-1 Incident Handling.” These procedures can be found at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/InformationSecurity/Information-Security-Library.html In addition, the Business Associate will also notify the CMS Contracting Officer and the Contracting Officer’s Representative (COR) by email within one (1) hour of identifying such violation or incident.

(b) Upon Covered Entity's knowledge of any material security incident/breach by

Business Associate, Covered Entity will provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination clause of this Contract. See also paragraph D. Term of Clause below.

f. Ensure that any agent or subcontractor agrees through a written contract, or other legally enforceable arrangement, to the same restrictions and conditions that apply through this HIPAA Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or on behalf of, Covered Entity.

g. Upon Covered Entity’s request:

i. Provide the Covered Entity or its designee with access to the PHI created, received, maintained or transmitted by Business Associate from or on behalf of the Covered Entity in the course of contract performance in order to ensure Covered Entity’s ability to meet the requirements under 45 CFR § 164.524.

ii. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR §

164.526.

h. Make its facilities and any books, records, accounts, and any sources of PHI, including any policies and procedures, that are pertinent to ascertaining its own compliance with this contract or the Covered Entity’s compliance with the applicable HIPAA requirements, available to Covered Entity, or, in the context of an investigation or http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html compliance review, to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the various rules implementing the HIPAA.

i. Document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

j. Provide to Covered Entity, or an individual identified by the Covered Entity, information collected under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

k. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

d. Term of Clause

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of the PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity in accordance with “CMS Information Security” procedures. Business Associate shall not retain any PHI.

2. Security Incident/Breach:

Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall take action consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts – Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of Contracts, if the Business Associate does not cure the security incident/breach within the time specified by Covered Entity and/or cure is not possible; or, B. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

ii. Other Agreements –Covered Entity shall…