Commercial Item Clauses Services with BAA IEE BPA.pdf

246-25-Q-0015

SECTION C CONTRACT CLAUSES

C.01 FAR 52.212-4 CONTRACT TERMS AND CONDITIONS- COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES (NOV 2023)

C.02 FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS -- COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (FEB 2024)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (DEC 2023) (Section 1634 of Pub. L.

115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108- 77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN 2020), with Alternate I (NOV 2021) ( 41 U.S.C. 4704 and 10 U.S.C. 4655).

(2) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV 2021) ( 41 U.S.C. 3509)).

(3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

(4) 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023) ( 41 U.S.C. 4712);

this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

(5) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

(6) [Reserved]

(7) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

(8) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery

Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

(9) 52.204-27, Prohibition on a ByteDance Covered Application (JUN 2023) (Section 102 of

Division R of Pub. L. 117-328).

https://www.acquisition.gov/far/52.203-19#FAR_52_203_19 https://www.acquisition.gov/far/52.204-23#FAR_52_204_23 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1062680 https://www.acquisition.gov/far/52.232-40#FAR_52_232_40 https://www.govinfo.gov/link/uscode/31/3903 https://www.govinfo.gov/link/uscode/10/3801 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1048661 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1048698 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_203_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.govinfo.gov/link/uscode/10/4655 https://www.acquisition.gov/far/part-52#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_203_15 https://www.acquisition.gov/far/part-52#FAR_52_203_17 https://www.govinfo.gov/link/uscode/41/4712 https://www.acquisition.gov/far/part-3#FAR_3_900 https://www.acquisition.gov/far/part-52#FAR_52_204_10 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_204_14 https://www.acquisition.gov/far/part-52#FAR_52_204_15 https://www.acquisition.gov/far/part-52#FAR_52_204_27

(10) 52.204–28, Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (Dec 2023) ( Pub. L. 115–390, title II).

(11) (i) 52.204–30, Federal Acquisition Supply Chain Security Act Orders— Prohibition. (Dec 2023) ( Pub. L. 115–390, title II).

__ (ii) Alternate I (Dec 2023) of 52.204–30.

(12) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (NOV 2021) ( 31 U.S.C. 6101 note).

(13) 52.209-9, Updates of Publicly Available Information Regarding Responsibility

Matters (OCT 2018) ( 41 U.S.C. 2313).

(14) [Reserved].

(15) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (OCT 2022)

( 15 U.S.C. 657a).

(16) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns

(OCT 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) ( 15 U.S.C. 657a).

(17) [Reserved]

(18) (i) 52.219-6, Notice of Total Small Business Set-Aside (NOV 2020) ( 15 U.S.C. 644).

(ii) Alternate I (Mar 2020) of 52.219-6.

(19) (i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

(ii) Alternate I (Mar 2020) of 52.219-7.

(20) 52.219-8, Utilization of Small Business Concerns (Feb 2024) (15 U.S.C. 637(d)(2) and

(3)).

(21) (i) 52.219-9, Small Business Subcontracting Plan (Sep 2023) (15 U.S.C. 637(d)(4)).

(ii) Alternate I (Nov 2016) of 52.219-9.

(iii) Alternate II (Nov 2016) of 52.219-9.

(iv) Alternate III (Jun 2020) of 52.219-9.

(v) Alternate IV (SEP 2023) of 52.219-9.

(22) (i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

(ii) Alternate I (Mar 2020) of 52.219-13.

(23) 52.219-14, Limitations on Subcontracting (OCT 2022) ( 15 U.S.C. 637s).

(24) 52.219-16, Liquidated Damages—Subcontracting Plan (SEP

2021) ( 15 U.S.C. 637(d)(4)(F)(i)).

(25) 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran-

Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program (FEB 2024) ( 15 U.S.C. 657f).

(26) (i) 52.219-28, Post Award Small Business Program Rerepresentation (FEB 2024)( 15 U.S.C. 632(a)(2)).

Alternate I (MAR 2020) of 52.219-28.

(27) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically

Disadvantaged Women-Owned Small Business Concerns (OCT 2022) ( 15 U.S.C. 637(m)).

(28) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small

Business Concerns Eligible Under the Women-Owned Small Business Program (Oct 2022) (15 U.S.C. 637(m)).

(29) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

(30) 52.219-33, Nonmanufacturer Rule (SEP 2021) ( 15U.S.C. 637(a)(17)).

(31) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

(32) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Feb

2024) (E.O.13126).

https://www.acquisition.gov/far/part-52#FAR_52_209_6 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_209_9 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section2313&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_219_3 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637a&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_219_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_6 https://www.acquisition.gov/far/part-52#FAR_52_219_7 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_7 https://www.acquisition.gov/far/part-52#FAR_52_219_8 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_9 https://www.acquisition.gov/far/part-52#FAR_52_219_9 https://www.acquisition.gov/far/part-52#FAR_52_219_9 https://www.acquisition.gov/far/part-52#FAR_52_219_9 https://www.acquisition.gov/far/part-52#FAR_52_219_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_13 https://www.acquisition.gov/far/part-52#FAR_52_219_14 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_16 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_27 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_28 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_28 https://www.acquisition.gov/far/part-52#FAR_52_219_29 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_30 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_32 https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec644.htm https://www.acquisition.gov/far/part-52#FAR_52_219_33 https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec637.htm https://www.acquisition.gov/far/part-52#FAR_52_222_3 https://www.acquisition.gov/far/part-52#FAR_52_222_19

(33) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(34) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

(ii) Alternate I (Feb 1999) of 52.222-26.

(35) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

(ii) Alternate I (Jul 2014) of 52.222-35.

(36) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun

2020) (29 U.S.C. 793).

(ii) Alternate I (Jul 2014) of 52.222-36.

(37) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

(38) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec

2010) (E.O. 13496).

(39) (i) 52.222-50, Combating Trafficking in Persons (NOV 2021) ( 22 U.S.C. chapter 78 and

E.O. 13627).

(ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(40) 52.222-54, Employment Eligibility Verification (May 2022). (Executive Order 12989).

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

(41) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA– Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

(ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

(42) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

(43) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

(44) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

(ii) Alternate I (Oct 2015) of 52.223-13.

(45) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

(ii) Alternate I (Jun2014) of 52.223-14.

(46) 52.223-15, Energy Efficiency in Energy-Consuming Products (May 2020) (42 U.S.C. 8259b).

(47) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

(ii) Alternate I (Jun 2014) of 52.223-16.

(48) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Jun

2020) (E.O. 13513).

(49) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

(50) 52.223-21, Foams (Jun2016) (E.O. 13693).

(51) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

(ii) Alternate I (Jan 2017) of 52.224-3.

(52) (i) 52.225-1, Buy American-Supplies (OCT 2022) ( 41 U.S.C. chapter 83).

(ii) Alternate I (OCT 2022) of 52.225-1.

(53) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (NOV 2023) ( 19

U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C.

chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109- 53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

(ii) Alternate I (Reserved) https://www.acquisition.gov/far/part-52#FAR_52_222_21 https://www.acquisition.gov/far/part-52#FAR_52_222_26 https://www.acquisition.gov/far/part-52#FAR_52_222_26 https://www.acquisition.gov/far/part-52#FAR_52_222_35 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_222_35 https://www.acquisition.gov/far/part-52#FAR_52_222_36 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title29-section793&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_222_36 https://www.acquisition.gov/far/part-52#FAR_52_222_37 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_222_40 https://www.acquisition.gov/far/part-52#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_54 https://www.acquisition.gov/far/part-22#FAR_22_1803 https://www.acquisition.gov/far/part-52#FAR_52_223_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_223_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_223_11 https://www.acquisition.gov/far/part-52#FAR_52_223_12 https://www.acquisition.gov/far/part-52#FAR_52_223_13 https://www.acquisition.gov/far/part-52#FAR_52_223_13 https://www.acquisition.gov/far/part-52#FAR_52_223_14 https://www.acquisition.gov/far/part-52#FAR_52_223_14 https://www.acquisition.gov/far/part-52#FAR_52_223_15 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_223_16 https://www.acquisition.gov/far/part-52#FAR_52_223_16 https://www.acquisition.gov/far/part-52#FAR_52_223_18 https://www.acquisition.gov/far/part-52#FAR_52_223_20 https://www.acquisition.gov/far/part-52#FAR_52_223_21 https://www.acquisition.gov/far/part-52#FAR_52_224_3 https://www.acquisition.gov/far/part-52#FAR_52_224_3 https://www.acquisition.gov/far/part-52#FAR_52_225_1 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_225_1 https://www.acquisition.gov/far/part-52#FAR_52_225_3 https://www.govinfo.gov/link/uscode/19/3301 https://www.govinfo.gov/link/uscode/19/3301 https://www.govinfo.gov/link/uscode/19/2112 https://www.govinfo.gov/link/uscode/19/3805 https://www.govinfo.gov/link/uscode/19/4001

(iii) Alternate II (Dec 2022) of 52.225-3.

(iv) Alternate III (Feb 2024) of 52.225-3.

(v) Alternate IV (Oct 2022) of 52.225-3.

(54) 52.225-5, Trade Agreements (Nov 2023) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

(55) 52.225-13, Restrictions on Certain Foreign Purchases (FEB 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

(56) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

(57) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov2007) (42 U.S.C. 5150).

(58) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area

(Nov2007) (42 U.S.C. 5150).

(59) 52.229-12, Tax on Certain Foreign Procurements (FEB 2021).

(60) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial

Services (NOV 2021) ( 41 U.S.C. 4505, 10 U.S.C. 3805).

(61) 52.232-30, Installment Payments for Commercial Products and Commercial

Services (NOV 2021) ( 41 U.S.C. 4505, 10 U.S.C. 3805).

(62) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct

2018) (31 U.S.C. 3332).

(63) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award

Management (Jul 2013) (31 U.S.C. 3332).

(64) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

(65) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

(66) 52.242-5, Payments to Small Business Subcontractors (Jan

2017) (15 U.S.C. 637(d)(13)).

(67) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (NOV

2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631).

(ii) Alternate I (Apr 2003) of 52.247-64.

(iii) Alternate II (NOV 2021) of 52.247-64.

c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter67).

(2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May

2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

(3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price

Adjustment (Multiple Year and Option Contracts) (AUG 2018) ( 29 U.S.C. 206 and 41 U.S.C. chapter 67).

(4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (May 2014) ( 29U.S.C.206 and 41 U.S.C. chapter 67).

(5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

(7) 52.222-55, Minimum Wages Under Executive Order 13658 (Jan 2022).

https://www.acquisition.gov/far/part-52#FAR_52_225_3 https://www.acquisition.gov/far/part-52#FAR_52_225_3 https://www.acquisition.gov/far/part-52#FAR_52_225_3 https://www.acquisition.gov/far/part-52#FAR_52_225_5 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section2501&num=0&edition=prelim http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section3301&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_225_13 https://www.acquisition.gov/far/part-52#FAR_52_225_26 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_226_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_226_5 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_229_12 https://www.acquisition.gov/far/part-52#FAR_52_232_29 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.govinfo.gov/link/uscode/10/3805 https://www.acquisition.gov/far/part-52#FAR_52_232_30 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.govinfo.gov/link/uscode/10/3805 https://www.acquisition.gov/far/part-52#FAR_52_232_33 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3332&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_232_34 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_232_36 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_239_1 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_242_5 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_247_64 https://www.govinfo.gov/content/pkg/USCODE-2019-title46/html/USCODE-2019-title46-subtitleV-partD-chap553-subchapI-sec55305.htm http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_247_64 https://www.acquisition.gov/far/part-52#FAR_52_247_64 https://www.acquisition.gov/far/part-52#FAR_52_222_41 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_42 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_43 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_44 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_51 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_53 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_55

(8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2022) (E.O. 13706).

(9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020)

(42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records-Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1), in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV 2021) ( 41 U.S.C. 3509).

(ii) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) ( 41 U.S.C.

4712).

(iii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iv) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (DEC 2023) (Section 1634 of Pub. L. 115-91).

(v) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(vi) 52.204-27, Prohibition on a ByteDance Covered Application (JUN 2023) (Section 102 of Division R of Pub. L. 117-328).

(vii) (A) 52.204–30, Federal Acquisition Supply Chain Security Act Orders— Prohibition. (Dec 2023) ( Pub. L. 115–390, title II).

(B) Alternate I (Dec 2023) of 52.204–30.

(viii) 52.219-8, Utilization of Small Business Concerns (FEB 2024) ( 15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the https://www.acquisition.gov/far/part-52#FAR_52_222_62 https://www.acquisition.gov/far/part-52#FAR_52_226_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-2#FAR_2_101 https://www.acquisition.gov/far/part-52#FAR_52_215_2 https://www.acquisition.gov/far/part-4#FAR_Subpart_4_7 https://www.acquisition.gov/far/part-52#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_203_17 https://www.govinfo.gov/link/uscode/41/4712 https://www.govinfo.gov/link/uscode/41/4712 https://www.acquisition.gov/far/part-52#FAR_52_203_19 https://www.acquisition.gov/far/part-52#FAR_52_204_23 https://www.acquisition.gov/far/part-52#FAR_52_204_25 https://www.acquisition.gov/far/part-52#FAR_52_204_27 https://www.acquisition.gov/far/part-52#FAR_52_219_8 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637&num=0&edition=prelim https://www.acquisition.gov/far/part-19#FAR_19_702 date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(ix) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

(x) 52.222-26, Equal Opportunity (SEP 2015) (E.O.11246).

(xi) 52.222-35, Equal Opportunity for Veterans (JUN 2020) ( 38 U.S.C. 4212).

(xii) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN 2020) ( 29 U.S.C. 793).

(xiii) 52.222-37, Employment Reports on Veterans (JUN 2020) ( 38 U.S.C. 4212).

(xiv) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xv) 52.222-41, Service Contract Labor Standards (AUG

2018) ( 41 U.S.C. chapter 67).

(xvi) (A) 52.222-50, Combating Trafficking in Persons (NOV 2021) ( 22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (MAR 2015) of 52.222- 50 ( 22 U.S.C. chapter 78 and E.O. 13627).

(xvii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) ( 41 U.S.C. chapter 67).

(xviii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services- Requirements (MAY 2014) ( 41 U.S.C. chapter 67).

(xix) 52.222-54, Employment Eligibility Verification (MAY 2022) (E.O. 12989).

(xx) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order

14026 (JAN 2022).

(xxi) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2022) (E.O.

13706).

(xxii) (A) 52.224-3, Privacy Training (Jan 2017) ( 5 U.S.C. 552a).

(B) Alternate I (JAN 2017) of 52.224-3.

(xxiii) 52.225-26, Contractors Performing Private Security Functions Outside the United States (OCT 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

(xxiv) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (JUN 2020) ( 42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxv) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxvi) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (NOV 2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause) https://www.acquisition.gov/far/part-52#FAR_52_219_8 https://www.acquisition.gov/far/part-52#FAR_52_222_21 https://www.acquisition.gov/far/part-52#FAR_52_222_26 https://www.acquisition.gov/far/part-52#FAR_52_222_35 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_36 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_37 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_40 https://www.acquisition.gov/far/part-52#FAR_52_222_40 https://www.acquisition.gov/far/part-52#FAR_52_222_41 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-chapter67-front&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_50 https://www.acquisition.gov/far/part-52#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_51 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_53 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_54 https://www.acquisition.gov/far/part-52#FAR_52_222_55 https://www.acquisition.gov/far/part-52#FAR_52_222_62 https://www.acquisition.gov/far/part-52#FAR_52_224_3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_224_3 https://www.acquisition.gov/far/part-52#FAR_52_225_26 https://www.acquisition.gov/far/part-52#FAR_52_226_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_226_6 https://www.acquisition.gov/far/part-52#FAR_52_232_40 https://www.govinfo.gov/link/uscode/31/3903 https://www.govinfo.gov/link/uscode/10/3801 https://www.acquisition.gov/far/part-52#FAR_52_232_40 https://www.acquisition.gov/far/part-52#FAR_52_247_64 https://www.govinfo.gov/content/pkg/USCODE-2019-title46/html/USCODE-2019-title46-subtitleV-partD-chap553-subchapI-sec55305.htm http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_247_64

C.03 FAR 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months.

The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

(End of Clause)

C.04 FAR 52.224-1 PRIVACY ACT NOTIFICATION (APR 1984)

C.05 FAR 52.224-2 PRIVACY ACT (APR 1984)

C.06 FAR 52.252-2 CLAUSE INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/ , https://www.acquisition.gov/hhsar

C.07 FAR 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter

1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any Department of Health and Human Services Acquisition Regulation (HHSAR) Class Deviation (2024-01) from Part 339, Acquisition of Information Technology; Other Parts; Supply Chain Risk Management, (48 CFR Chapter 3, 45 CFR 160, 42 CFR 3.20, 45 CFR 164, 32 CFR part 2002, 44 u.s.c.21,29,31 and 33, 36 CFR chapter XII subchapter B ) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

(End of clause)

HHSAR CLAUSES

☒ (1) HHSAR 352.203-70, Anti-Lobbying. (Dec 2015) ☐ (2) HHSAR 352.204-70, Prevention and Public Health Fund - Reporting Requirements.

(DEC 2015)

☒ (3) HHSAR 352.204-71, Information and Information Systems Security. (Deviation) (FEB 2024)

(a) Definitions. As used in this clause— Breach means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where—

(1) A person other than an authorized user accesses or potentially accesses personally identifiable information, or

(2) An authorized user accesses personally identifiable information for an other than authorized purpose.

https://www.acquisition.gov/hhsar https://www.acquisition.gov/hhsar/part-352-solicitation-provisions-and-contract-clauses#Section_352_203_70_T48_401836291 https://www.acquisition.gov/hhsar/part-352-solicitation-provisions-and-contract-clauses#Section_352_204_70_T48_401836292

Business associate (see 45 CFR 160.103), except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person who -

(1) On behalf of such covered entity or of an organized health care arrangement (as defined in this clause) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this contract or agreement, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or

(2) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in 45 CFR section 164.501), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.

(3) A covered entity may be a business associate of another covered entity.

(4) Business associate includes the following:

(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

(5) Business associate does not include:

(i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.

(ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of 45 CFR 164.504(f) apply and are met.

(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.

(iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.

Business associate agreement means the agreement, or other arrangement, as dictated by the HIPAA Privacy Rule (45 CFR 160), between an HHS covered entity and a business associate, which must be entered into in addition to the underlying contract for services and before any disclosure (see 45 CFR 160.103) of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of an HHS entity.

Controlled unclassified information (CUI) means information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.

Healthcare component means a component or combination of components of a hybrid entity designated by the hybrid entity in accordance with 45 CFR 164.105(a)(2)(iii)(D) (see 45 CFR 164.103). The Secretary of HHS has designated HHS as a covered entity (further designated as a “hybrid entity”), and has also designated four HHS divisions as healthcare components under HIPAA, including —

(1) The Centers for Medicare and Medicaid Services (CMS), insofar as it operates the fee-for-service Medicare program;

(2) The Program Support Center (PSC), Division of Commissioned Personnel, insofar as it operates a health plan for Commissioned Corps officers;

(3) The World Trade Center (WTC) Health Program; and,

(4) The Indian Health Service (IHS), insofar as it operates a health plan and a program providing healthcare that uses electronic transactions.

HHS Information Technology General Rules of Behavior means a set of HHS rules that describes the responsibilities and expected behavior of users of HHS information or information systems.

HHS sensitive information means all HHS data, on any storage media or in any form or format, which requires confidentiality, integrity, and availability protection due to the risk of harm that could result to interests of HHS, other agencies or entities, or individuals from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes—

(1) Information where the improper use or disclosure could adversely affect the ability of HHS to accomplish its mission, i.e., HHS proprietary information;

(2) Records about individuals requiring protection under laws and regulations such as the E-Government Act, Privacy Act and the HIPAA Privacy Rule, or based on a data use agreement or a promise or assurance of confidentiality; and

(3) Information that would be exempt from disclosure if requested under the Freedom of Information Act. Examples of HHS sensitive information include—

(i) Individually-identifiable medical, benefits, and personnel information;

(ii) Financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, security-sensitive, procurement-sensitive, investigatory, and law enforcement information;

(iii) Controlled unclassified information;

(iv) Information that would be confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and

(v) Other information which, if released, could result in a violation of law or agreement, could cause harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and part 164.

Incident means an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information systems; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable policies.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Information system security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

Information technology (see FAR 2.101) also means Information and Communication Technology

(ICT).

Information technology-related contracts means those contracts that include services (including support services), and related resources for information technology.

Organized health care arrangement (see 45 CFR 160.103) means:

(1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;

(2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities:

(i) Hold themselves out to the public as participating in a joint arrangement; and

(ii) Participate in joint activities that include at least one of the following:

(A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;

(B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or

(C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.

(3) A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;

(4) A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or

(5) The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.

Privacy officer means the HHS official(s) with responsibility for implementing and oversight of privacy related policies and practices that impact a given HHS acquisition.

(b) General. Contractors, subcontractors, their employees, third-parties, and business associates with access to HHS information, information systems, or information technology (IT) or providing and accessing IT-related goods and services, shall adhere to the HHS Cybersecurity Program and the directives and handbooks, complete HHS security training prior to accessing HHS information (including HHS sensitive information and information systems security and privacy) and on an annual basis thereafter, as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, HHS Personnel Security and Suitability Program, which establishes HHS procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards, and guidance for protecting HHS information, information systems (see 302.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing HHS information or information systems.

(c) Access to HHS information and HHS information systems.

(1) Contractors are limited in their request for logical or physical access to HHS information or HHS information systems for their employees, subcontractors, third parties and business associates to the extent necessary to perform the services or provide the goods as specified in the contracts, agreements, task, delivery, or purchase orders.

(2) All Contractors, subcontractors, third parties, and business associates working with HHS information are subject to the same investigative requirements as those of HHS appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors to access HHS information and HHS information systems shall be in accordance with HHS Personnel Security and Suitability Program.

(3) Contractors, subcontractors, third parties, and business associates who require access to national security programs must have a valid security clearance.

(4) The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be –

(i) Marked appropriately;

(ii) Disclosed to authorized personnel on a need-to-know basis;

(iii) Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

(iv) Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

(5) HIPAA business associate agreements. Under the HIPAA Privacy and Security Rules (see 45 CFR 164), pursuant to 45 CFR 164.502(e)(1), a covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor of a covered entity’s business associate. Additionally, a business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.

T…