CSS - IHS1519838 - OCAO DOCUMENT SHREDDING.pdf

Combined Synopsis/Solicitation

This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with part 12. This announcement constitutes the only solicitation.

Offers are being requested and a separate written solicitation will not be issued.

Solicitation number IHS1519838 is issued as a request for quotation (RFQ), for Oklahoma City Area Indian Health Service document destruction.

This acquisition is an Indian Small Business Economic Enterprise set aside under the authority of the Buy Indian Act. This solicitation incorporates provisions and clauses by reference. The full text of provisions and clauses may be accessed electronically at www.acquisition.gov.

The product service code (PSC) for this acquisition is R614 and the North American Industry Classification System (NAICS) code is 561990, with a size standard of $16.5 million.

This RFQ contains 103 Line Items:

CLIN ITEM QUANTITY UOM UNIT

PRICE

TOTAL

PRICE

01 03/01/2026 – 02/28/2027 – Base Period OCAO IHS

– Per pick up charge

26 EA

01A Base Period OCAO IHS – 36” Console 12 EA

01B Base Period OCAO IHS – 96-Gal Poly Cart 1 EA

02 03/01/2026 – 02/28/2027 – Base Period Lawton Indian Hospital – Per pick up charge

02A Base Period Lawton Indian Hospital – 24” Console 18 EA

02B Base Period Lawton Indian Hospital – 36” Console 14 EA

02C Base Period Lawton Indian Hospital – 96-Gal Poly Cart

2 EA

03 03/01/2026 – 02/28/2027 – Base Period Anadarko Indian Health Center – Per pick up charge

13 EA

03A Base Period Anadarko Indian Health Center – 36” Console

3 EA

03B Base Period Anadarko Indian Health Clinic – 96-Gal Poly Cart

1 EA

04 03/01/2026 – 02/28/2027 – Base Period Carnegie

04A Base Period Carnegie Indian Health Center – 96-gal

05 03/01/2026 – 02/28/2027 – Base Period Haskell

05A Base Period Haskell Indian Health Center – 36”

12 EA

http://www.acquisition.gov/

06 03/01/2027 – 02/29/2028 – Option Period 1 OCAO IHS – Per pick up charge

06A Option Period 1 OCAO IHS – 36” Console 12 EA

06B Option Period 1 OCAO IHS – 96-Gal Poly Cart 1 EA

07 03/01/2027 – 02/29/2028 – Option Period 1 Lawton Indian Hospital – Per pick up charge

07A Option Period 1 Lawton Indian Hospital – 24”

18 EA

07B Option Period 1 Lawton Indian Hospital – 36”

14 EA

07C Option Period 1 Lawton Indian Hospital – 96-Gal

08 03/01/2027 – 02/29/2028 – Option Period 1 Anadarko Indian Health Center – Per pickup charge

08A Option Period 1 Anadarko Indian Health Center – 36” Console

08B Option Period 1 Anadarko Indian Health Clinic – 96- Gal Poly Cart

09 03/01/2027 – 02/29/2028 – Option Period 1 Carnegie Indian Health Center – Per pick up charge

09A Option Period 1 Carnegie Indian Health Center – 96-gal Poly Cart

10 03/01/2027 – 02/29/2028 – Option Period 1 Haskell Indian Health Center – Per pick up charge

10A Option Period 1 Haskell Indian Health Center – 36”

11 03/01/2028 – 02/28/2029 – Option Period 2 OCAO

11A Option Period 2 OCAO IHS – 36” Console 12 EA

11B Option Period 2 OCAO IHS – 96-Gal Poly Cart 1 EA

12 03/01/2028 – 02/28/2029 – Option Period 2

12A Option Period 2 Lawton Indian Hospital – 24”

12B Option Period 2 Lawton Indian Hospital – 36”

12C Option Period 2 Lawton Indian Hospital – 96-Gal

13 03/01/2028 – 02/28/2029 – Option Period 2 Anadarko Indian Health Center – Per Pickup Charge

13A Option Period 2 Anadarko Indian Health Center –

13B Option Period 2 Anadarko Indian Health Clinic – 96-

14 03/01/2028 – 02/28/2029 – Option Period 2

14A Option Period 2 Carnegie Indian Health Center –

15 03/01/2028 – 02/28/2029 – Option Period 2

15A Option Period 2 Haskell Indian Health Center – 36”

16 03/01/2029 – 02/28/2030 – Option Period 3 OCAO

16A Option Period 3 OCAO IHS – 36” Console 12 EA

16B Option Period 3 OCAO IHS – 96-Gal Poly Cart 1 EA

17 03/01/2029 – 02/28/2030 – Option Period 3

17A Option Period 3 Lawton Indian Hospital – 24”

17B Option Period 3 Lawton Indian Hospital – 36”

17C Option Period 3 Lawton Indian Hospital – 96-Gal

18 03/01/2029 – 02/28/2030 – Option Period 3 Anadarko Indian Health Center – Per pick up charge

18A Option Period 3 Anadarko Indian Health Center –

18B Option Period 3 Anadarko Indian Health Clinic – 96-

19 03/01/2029 – 02/28/2030 – Option Period 3

19A Option Period 3 Carnegie Indian Health Center –

20 03/01/2029 – 02/28/2030 – Option Period 3

20A Option Period 3 Haskell Indian Health Center – 36”

21 07/01/2029 – 02/28/2030 – Option Period 3 Wewoka Indian Health Center – Per pick up charge

15 EA

21A Option Period 3 Wewoka Indian Health Center –

21B Option Period 3 Wewoka Indian Health Center – 96-Gal Poly Cart

22 09/01/2029 – 02/28/2030 – Option Period 3 Pawnee Indian Health Center – Per pick up charge

5 EA

22A Option Period 3 Pawnee Indian Health Center – 96-

10 EA

23 09/01/2029 – 02/28/2030 – Option Period 3 Clinton Indian Health Center – Per pick up charge

23A Option Period 3 Clinton Indian Health Center – 36”

24 09/01/2029 – 02/28/2030 – Option Period 3 Watonga Indian Health Center – Per pick up charge

24A Option Period 3 Watonga Indian Health Center –

25 09/01/2029 – 02/28/2030 – Option Period 3 El Reno Indian Health Center – Per pick up charge

25A Option Period 3 El Reno Indian Health Center – 36”

26 03/01/2030 – 02/28/2031 – Option Period 4 OCAO

26A Option Period 4 OCAO IHS – 36” Console 12 EA

26B Option Period 4 OCAO IHS – 96-Gal Poly Cart 1 EA

27 03/01/2030 – 02/28/2031 – Option Period 4

27A Option Period 4 Lawton Indian Hospital – 24”

27B Option Period 4 Lawton Indian Hospital – 36”

27C Option Period 4 Lawton Indian Hospital – 96-Gal

28 03/01/2030 – 02/28/2031 – Option Period 4 Anadarko Indian Health Center – Per pick up charge

28A Option Period 4 Anadarko Indian Health Center –

28B Option Period 4 Anadarko Indian Health Clinic – 96-

29 03/01/2030 – 02/28/2031 – Option Period 4

29A Option Period 4 Carnegie Indian Health Center –

30 03/01/2030 – 02/28/2031 – Option Period 4

30A Option Period 4 Haskell Indian Health Center – 36”

31 03/01/2030 – 02/28/2031 – Option Period 4 Wewoka Indian Health Center – Per pick up charge

31A Option Period 4 Wewoka Indian Health Center –

31B Option Period 4 Wewoka Indian Health Center – 96-Gal Poly Cart

32 03/01/2030 – 02/28/2031 – Option Period 4 Pawnee Indian Health Center – Per pick up charge

32A Option Period 4 Pawnee Indian Health Center – 96-

33 03/01/2030 – 02/28/2031 – Option Period 4 Clinton Indian Health Center – Per pick up charge

33A Option Period 4 Clinton Indian Health Center – 36”

34 03/01/2030 – 02/28/2031 – Option Period 4 Watonga Indian Health Center – Per pick up charge

34A Option Period 4 Watonga Indian Health Center –

35 03/01/2030 – 02/28/2031 – Option Period 4 El Reno Indian Health Center – Per pick up charge

35A Option Period 4 El Reno Indian Health Center – 36”

TOTAL PER PICK UP LINE ITEMS

PERIOD OF PERFORMANCE: 03/01/2026 – 02/28/2027

LOCATION: Multiple locations within the OCAO IHS – see attached

Vendor Requirements: SEE ATTACHED STATEMENT OF WORK and Applicable Wage Determinations for each facility.

Submit Quotes no later than: 02/06/2026 02:00p.m. CDT to the Following Point of Contact:

Mary Ann Yocham, Contract Specialist, via Email: maryann.yocham@ihs.gov.

Evaluation: FAR 52.212-2 Evaluation -- Commercial Products and Commercial Services.

(Deviation Date)

(a) Evaluation factors. The Government will award a contract resulting from this solicitation to the responsible Offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors will be used to evaluate offers:

Technical: This is an all or none requirement. Contractor must be able to provide document shredding services to all locations listed and offer varying start dates of service.

• Must be NAID AAA Certified

• Must be able to comply with pickup frequency of quad-weekly and bi-weekly based off of locations needs

• Must be able to provide on-site cross-cut shredding

• Must be able to provide lockable/secure bins Past Performance: This will include reviewing performance information available in CPARS as well as other sources of information.

Price: Entire price schedule above must be completed to be considered. Award will result in one CLIN each for base and option periods per facility; however, quote must show a breakdown of pricing per bin per facility.

(b) Options - The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. The evaluation of options does not obligate the Government to exercise the option(s).

(c) Notice of award. A written notice of award or acceptance of an offer furnished to the successful Offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

The Government contemplates award of a Firm Fixed Price Purchase Order contract resulting from this solicitation pursuant to the terms and conditions below. Terms and conditions other than those stated will not be accepted. The above pricing is all inclusive.

VENDORS SHALL SUBMIT THE FOLLOWING:

COMPLETED PRICE SCHEDULE (TO INCLUDE OPTION PERIODS)

COMPLETED IEE FORM

NAID AAA CERTIFICATE

ADDITIONAL DOCUMENTS NEEDED IN ORDER TO DETERMINE ABILITY TO MEET THE

TECHNICAL REQUIREMENTS

PROVISIONS: The following FAR and HHSAR provisions apply to this solicitation:

FAR 52.212-1, Instructions to Offeror- Commercial Products and Commercial Services (Deviation Date); FAR 52.204-7 System for Award Management—Registration; FAR 52.240-90, Security Prohibitions and Exclusions Representations and Certifications; HHSAR 352.226-4, Notice of Indian Small Business Economic Enterprise set-aside; HHSAR 352.226-5, Notice of Indian Economic Enterprise set-aside; HHSAR 352.226-7, Indian Economic Enterprise Representation

CLAUSES: The following FAR and HHSAR clauses apply to this solicitation:

FAR 52.212-4, Terms and Conditions-Commercial Products and Commercial Services; FAR 52.203-17, Contractor Employee Whistleblower Rights; FAR 52.204-13, System for Award Management—Maintenance; FAR 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment; FAR 52.209- 10, Prohibition on Contracting with Inverted Domestic Corporations; FAR 52.219-6, Notice of Total Small Business Set-Aside; FAR 52.222-3, Convict Labor; FAR 52.222-36, Equal Opportunity for Workers with Disabilities; FAR 52.222-41, Service Contract Labor Standards; FAR 52.222-42, Statement of Equivalent Rates for Federal Hires; FAR 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts); FAR 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment;

FAR 52.222-50, Combating Trafficking in Persons; FAR 52.222-62, Paid Sick Leave Under Executive Order 13706; FAR 52.223-23, Sustainable Products and Services; FAR 52.224-3, Privacy Training; FAR 52.226-8, Encouraging Contractor Policies to Ban Text Messaging While Driving; FAR 52.232-33, Payment by Electronic Funds Transfer—System for Award Management;

FAR 52.232-40, Providing Accelerated Payments to Small Business Subcontractors; FAR 52.233- 3, Protest After Award; FAR 52.233-4, Applicable Law for Breach of Contract Claim; FAR 52.240- 91, Security Prohibitions and Exclusions; FAR 52.240-92, Security Requirements; FAR 52.244-6, Subcontracts for Commercial Products and Commercial Services; HHSAR 352.204-72, Records Management. (Deviation) (Feb 2024); HHSAR 352.226-1, Indian Preference. (Deviation); HHSAR

352.226-3, Native American Graves Protection And Repatriation Act. (Dec 2015); HHSAR 352.226-6, Indian Economic Enterprise Subcontracting Limitations; HHSAR 352.232- 71, Electronic Submission Of Payment Requests

FAR 52.217-8 Option To Extend Services (Nov 1999) The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days of contract or option period expiration.

(End of clause) FAR 52.217-9 Option To Extend The Term Of The Contract (Mar 2000) (a)The Government may extend the term of this contract by written notice to the Contractor within

15 days of contract expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires.

The preliminary notice does not commit the Government to an extension.

(b)If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c)The total duration of this contract, including the exercise of any options under this clause, shall not exceed FIVE years SIX months.

(End of clause)

HHSAR 352.224-71, Confidential Information. (Deviation) (Feb 2024)

(1) The publication or dissemination of the following types of information are restricted under this contract: ANY GOVERNMENT RECORD INFORMATION, PAYMENT INFORMATION, EMPLOYEE/PATIENT PHI OR PII.

(2) The reason(s) for restricting the types of information identified in subparagraph (d)(1) is/are:

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 AND

PRIVACY ACT OF 1974 (2020 EDITION).

(End of clause)

Miscellaneous:

NO FAX QUOTATIONS

ELECTRONIC SUBMISSIONS – SUBMISSION VIA EMAIL IS THE ONLY ACCEPTABLE

ELECTRONIC SUBMISSION. (maryann.yocham@ihs.gov)

“System updates may lag policy updates. The System for Award Management (SAM) may continue to require entities to complete representations based on provisions that are not included in this solicitation. Contracting officers will rely on representations from offers based on provisions in the solicitation. Entities are not required to, nor are they able to, update their entity registration to remove these representations in SAM.”

All contractors must be registered in the System for Award Management database located at https://www.sam.gov when submitting an offer or quotation. Please submit the following information with each quote: Vendor Name, Cage Code, UEI, Tax Identification Number, Prompt Payment Terms, Delivery Time, GSA Contract Number (if applicable), Date quote expires, warranty, total price for each line item, total quote price, and technical documentation in sufficient detail to determine technical acceptability. Failure to provide sufficient technical details may result in rejection of your quote.

https://www.sam.gov/

Document Destruction SOW – 01/08/2026

Statement of Work (SOW) Onsite Document Destruction

1. PURPOSE OF THE PROJECT

The Oklahoma City Area Office (OCAO), Indian Health Services (IHS) has a requirement for onsite document destruction services for Government documents containing sensitive, confidential, and medical records. The Oklahoma City Area Office provides support to clinics and hospitals located in Oklahoma and Kansas.

2. DETAILED DESCRIPTION OF THE TECHNICAL REQUIREMENTS

The Contractor shall provide onsite quad-weekly and bi-weekly shredding services to all Oklahoma City Area Indian Health Service locations as outlined below:

Facility Address Frequency 24” Console 36” Console 96-Gal Poly OCAO IHS 701 Market Dr.

OKC, OK 73114

Bi-Weekly 12 1

Lawton Indian Hospital 1515 NE Lawrie Tatum Rd.

Lawton, Ok 73507

Bi-Weekly 18 14 2

Anadarko Indian Health Center

201 Parker McKenzie Dr.

Anadarko, OK 73005

Quad-Weekly 3 1

Carnegie Indian Health Center

212 East 4th Carnegie, OK 73015

Quad-Weekly 1

Haskell Indian Health Center

2415 Massachusetts St. Lawrence, KS 66046

Quad-Weekly 12

Wewoka Indian Health Center **

36640 US-270

Wewoka, OK 74884

Bi-Weekly 15 2

Pawnee Indian Health Center ***

1201 Heritage Circle Pawnee, OK 74058

Quad-Weekly 10

Clinton Indian Health Center ***

10321 N 2274 Rd.

Clinton, OK 73601

Quad-Weekly 26

Watonga Indian Health Center ***

1305 S. Clarence Nash Blvd.

Watonga, OK 73772

Quad-Weekly 4

El Reno Indian Health Clinic ***

1801 Parkview Dr.

El Reno, OK 73036

Quad-Weekly 9

** Current contract completion date is 06/30/2029. Services begin 07/01/2029.

*** Current contract completion date is 08/31/2029. Services begin 09/01/2029.

3. PERIOD OF PERFORMANCE

The base year Period of Performance will be 12 months from date of award with four (4) twelve (12) month option periods for the Oklahoma City Area Office, Lawton Indian Hospital, Anadarko Indian Health Center, Carnegie Indian Health Center, and Haskell Indian Health Center. Wewoka Indian Health Center, Pawnee Indian Health Center, Clinton Indian Health Center, Watonga Indian Health Center, and El Reno Indian

Health Center will begin on the first date after their current contract ends and will continue under this purchase order at option period 3.

4. LEVEL OF EFFORT

4.1. The Contractor shall provide all labor, materials, containers, transportation, supervision, and disposal necessary to provide quad-weekly (13 times per year) and bi-weekly (26 times per year) onsite shredding services for the Oklahoma City Area Indian Health Services and all supported facilities.

4.2. The Contractor shall provide pick-up frequency as shown in the table located in section 2.

4.3. The Contractor shall provide on-site crosscut shredding that produces particles of 1mm x 5mm (0.04in x 0.2in) or smaller.

4.4. The Contractor shall provide shredding services to all Oklahoma City Area Indian Health Service locations and provide service start dates as outlined in section 3. Period of Performance

4.5. The Contractor shall provide a Certificate of Destruction to the COR after each service.

4.6. The Contractor shall be NAID AAA certified by the National Association for Information Destruction

(NAID).

4.7. The Contractor shall provide lockable, secure bins to prevent unauthorized access.

5. SPECIAL REQUIREMENTS

5.1. In accordance with HHSAR 304.1301 OpDivs/StaffDivs must comply with HHS HSPD-12 Identity and Credential Implementation Policy for Improved Strong Authentication, Assurance, and Access Management, and amended with HHS Approved Physical Access and Logical Access Authentication Mechanisms, available at https://intranet.hhs.gov/policy/hhs-approved-physical-access-and-logical-access-authentication-mechanisms, for personal identity verification for all affected contractor and subcontractor personnel when contract performance requires contractors to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system.

These two policies implement the requirements of FIPS PUB 201 and OMB Guidance M-05-24.

5.2. Indian Health Service facilities are tobacco/smoke free environments (buildings and grounds). No tobacco/smoking use will be tolerated during service.

5.3. Security Requirements: Contractor personnel will be required to contact the government designated point of contact upon arrival when reporting for service calls or delivery supplies. The contractor shall be responsible for the security of all organizational information. Current rules and regulations applicable to the premises, where the work shall be performed shall apply to the contractor and its employees while working on the premises. These regulations include but are not limited to, escort by an Indian Health Center official, presenting valid identification, smoking restriction and any safety procedures.

5.4. The contractor shall not disclose or cause to disseminate any information concerning operations of Indian Health Service. Such action(s) could result in violation of the contract and possible legal actions.

5.5. All inquiries, comments, or complaints arising from any matter observed, experienced or learned of as a result of or in connection with the performance of the contract, the resolution of which may require the dissemination of official information, shall be directed to the government’s designated representative.

6. DELIVERABLES AND REPORTING REQUIREMENTS

6.1. Delivery: The contractor will coordinate the delivery, installation and training date with the designated government employee. The government will provide the contractor with building access for this sole purpose. No deliveries can be made after 4:15pm. Driver needs a valid ID.

6.2. Contractor Point of Contact: The contractor shall furnish one designated point of contact (POC) to the government’s designated representative for coordination of supplies, delivery, and/or maintenance.

The POC will be empowered to make daily decisions to ensure that the contract implementation and day-to-day maintenance meets the terms and conditions of this contract.

6.3. Contractor’s Phone Numbers: The contractor shall provide a toll-free telephone number for service calls, which must be answered during at least eight working hours, between 8:00 am and 4:30 pm, Monday through Friday.

6.4. Personnel Qualifications: Contractor shall have the means to provide onsite cross-cut shredding services

7. GOVERNMENT FURNISHED PROPERTY, FACILITIES AND SERVICES

7.1.The Government shall supply housing for lockable bins and poly-carts.

8. CONTRACTOR FURNISHED PROPERTY, FACILITIES AND SERVICES

8.1.Required personnel, materials, supplies and equipment: The contractor shall provide all labor, materials, containers, transportation, supervision, and disposal necessary to perform work under the contract.

9. CHANGES TO THE STATEMENT OF WORK (SOW)

Any changes to this SOW shall be authorized and approved only through written correspondence from the Contracting Officer. Costs incurred by the contractor through the actions of parties other than the Contracting Officer shall be borne by the contractor.

10. DELIVERABLES PERFORMANCE MATRIX

• Provide on-site quad-weekly and bi-weekly shredding, and disposal of documents and paper.

• Provide mobile collection bins/containers that allow contents to be secured by lock and key.

• Provide a Certificate of Destruction showing that all personal, protected, or potentially private information is shredded.

• Provide all activities to include retrieval of bins throughout the facilities, shredding of contents for each bin, and disposal of shredded contents at contractor’s cost.

• Provide safety procedures, practices, and standards according to Indian Health Service procedures.

DEPARTMENT OF HEALTH & HUMAN SERVICES

Indian Health Service

Office of Management Services Division of Acquisition Policy (DAP)

5600 Fishers Lane Rockville, MD 20857

INDIAN HEALTH SERVICE

BUY INDIAN ACT

INDIAN ECONOMIC ENTERPRISE

REPRESENTATION FORM

SOLICITATION/SOURCES SOUGHT/RFI #: _________________________________________________

PROJECT TITLE: ________________________________________________________

DATE: ___________________________________________________________________

In accordance with 25 U.S.C. 47 the Buy Indian Act, the signature below constitutes self-certification that the Offeror meets the definition of an “Indian Economic Enterprise” (HHSAR 326.601) in response to this Sources Sought Notice, Request for Information (RFI) or Solicitation and resultant contract.

The enterprise must meet the definition of “Indian Economic Enterprise” throughout the following time periods:

(1) At the time an offer is made in response to this solicitation;

(2) At the time of contract award; and

(3) During the full term of the contract performance period. At any point during these periods, if the Contractor no longer meets the eligibility requirements, the contractor must provide immediate written notification to the Contracting Officer.

Individual Contracting Officers may require documentation of eligibility before awarding a set-aside or sole source contracts under the Buy Indian Act and awards may be subject to protest if the eligibility of the successful Offeror is in question. In addition to the self-certification requirements, successful Offerors must also be registered with the System of Award Management (SAM).

Any false or misleading information submitted by an enterprise when submitting an offer in consideration of an award set-aside under the authority of the Buy Indian Act is a violation of the law and punishable under 18 U.S.C. 1001.

False claims submitted as part of contract performance are subject to the penalties enumerated in 31 U.S.C. 3729 to 3731 and 18 U.S.C. 287.

REPRESENTATION

The Offeror represents as part of its offer that it does _____, does not _____ meet the definition of an “Indian Economic Enterprise” with “Indian Ownership” under the authority of the Buy Indian Act.

Name of the 51% owner of IEE Firm

Certifying Signature

Print Name

Name of Federally Recognized Tribal Entity

Business Name

UEI Number

Appendix___: Business Associate Agreement

I. Authority:

Pursuant to 45 C.F.R. § 164.502(e), the Indian Health Service (IHS), as a covered entity, is required to enter into an agreement with a “business associate,” as defined by 45 C.F.R. § 160.103, under which the business associate must agree to appropriately safeguard Protected Health Information (PHI) that it will use and disclose when performing functions, activities or services pursuant to its contract with the IHS. By signing Contract No. ________ (Contract), _______________ agrees that it is a Business Associate and will comply with the terms below, in addition to other applicable Contract terms and conditions, and applicable law, relating to the safekeeping, use, and disclosure of PHI. This Appendix comprises the Business Associate Agreement (Agreement).

II. Definitions:

The following terms shall have the same meaning as those terms in 45 C.F.R. Part 160 and Part 164, which are the federal regulations implementing the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended: Breach, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, PHI, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, and Use.

A. Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 C.F.R. § 160.103, and in reference to the party to this Agreement shall mean ____________.

B. Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 C.F.R. § 160.103, and in reference to the party to this Agreement, shall mean the IHS.

C. HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Part 160 and Part 164.

D. Master Patient Index (MPI). The “Master Patient Index” or “MPI” is composed of a unique list of patients and a current list of medical centers where each patient has been seen. This enables the sharing of patient data between operationally and regionally diverse systems. Each record (or index entry) on the MPI contains a small amount of patient data used to identify individual entries.

The mission of the MPI is to uniquely identify a patient and to “link” that patient’s data throughout the IHS facilities using the Integration Control Number (ICN). The MPI is the authoritative source of a patient’s ICN, the enterprise-wide identifier for IHS facilities and the key to accessing a patient’s record. The accuracy of patient information and patient identification directly affects clinical, administrative, billing, and interdepartmental processes.

III. Obligations and Activities of Business Associate:

A. Compliance: Business Associate agrees not use or disclose PHI other than as authorized by the Agreement or as required by law. Business Associate acknowledges that it is directly liable under the HIPAA Rules and subject to civil and, in some cases, criminal penalties for making uses and disclosures of PHI that are not authorized by the Agreement or required by law. Business Associate agrees that it will require all of its agents, employees, subsidiaries, and affiliates, to whom Business Associate provides PHI, or who create or receive PHI on behalf of Business Associate for Covered Entity, to comply with the HIPAA Rules and to enter into written agreements with Business Associate that provide the same restrictions, terms, and conditions as set forth in the Agreement.

B. Subcontractors: In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and

164.308(b)(2), which govern relations with subcontractors, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions, terms, and conditions that apply to Business Associate with respect to such PHI.

C. Safeguarding PHI: Business Associate shall develop and use appropriate procedural, physical, and electronic safeguards to protect against the use or disclosure of PHI in a manner not authorized by this Agreement or required by law. Business Associate will limit any use, disclosure, or request for use or disclosure of PHI to the minimum amount necessary to accomplish the intended purpose of the use, disclosure, or request.

D. Safeguarding Electronic PHI: Business Associate agrees to use appropriate safeguards, as set forth in Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of electronic PHI other than as authorized by this Agreement or required by law.

E. Reporting Use or Disclosures Not Authorized By this Agreement or Required by Law: Business Associate agrees to report to Covered Entity any use or disclosure of PHI not authorized by this Agreement or required by law within thirty (30) days of discovering the use or disclosure, or any security incident of which it becomes aware. In addition, Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of the use, disclosure, or security incident.

F. Reporting of Breach: In accordance with the policy of the Department of Health and Human Services, Business Associate will report, within one hour of discovery, all suspected or confirmed breaches to Covered Entity.

G. Notification of Breach of Unsecured PHI: In addition to the above, Business

Associate shall notify Covered Entity of a breach, as set forth in 45 C.F.R. § 164.410, of the security of any unsecured PHI that Business Associate received from, or created or received on behalf of, Covered Entity within thirty (30) calendar days after the discovery of the breach by Business Associate, its employees, officers, and/or other agents, unless notification is specifically excepted by 45 C.F.R. § 164.412.

1. Requirements of Notice. Such notice shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such breach; a brief description of the circumstances of the breach of security, including the date of the breach and the date of Business Associate’s discovery of the breach; and the type of unsecured PHI involved in the breach. Business Associate agrees to provide any other available information that Covered Entity is required to include in notification to the individual under 45 §164.404(c). In the event notification is delayed, evidence demonstrating the necessity of the delay shall accompany the notification.

H. Individual Access to PHI: Business Associate shall maintain a designated record set for each individual for whom it maintains PHI. In accordance with an individual’s right to access his or her PHI, Business Associate shall make available all PHI in the individual’s designated record set to the individual to whom that information pertains, or, upon the request of the individual, to that individual’s authorized representative, as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524. Availability to access PHI shall be made within five (5) calendar days of receipt of a valid request.

I. Accounting of Disclosures: Business Associate shall maintain records of PHI received from, or created or received on behalf of, Covered Entity and shall document subsequent uses and disclosures of such information by Business Associate. Business Associate shall, within five (5) calendar days after receiving a request from Covered Entity, provide to Covered Entity such information as Covered Entity may require to fulfill its obligations to account for disclosures of PHI pursuant to 45 C.F.R. § 164.528.

J. Amendment of PHI: Business Associate shall, within five (5) calendar days of a request by Covered Entity, make PHI available to Covered Entity for Covered Entity to fulfill its obligations under 45 C.F.R. § 164.526 to amend PHI and shall, as directed by Covered Entity, within five (5) calendar days of receipt of such direction, incorporate any amendments into PHI held by Business Associate. In addition, Business Associate shall ensure incorporation of any such amendments into PHI held by its agents or subcontractors within ten (10) days of such direction, and shall notify Covered Entity within five (5) calendar days of when those agents or subcontractors have completed the incorporation of the amendments. Business Associate shall forward to Covered Entity all requests to amend PHI that it receives directly from individuals within five (5) calendar days of its receipt of a request.

K. Carrying out Covered Entity’s Obligations: To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).

L. Disclosures for Verifying Compliance: Upon request, Business Associate shall permit access by the Secretary and Covered Entity during normal business hours to its facilities, books, records, accounts, and any other sources of information, including PHI and any agreements that it has with subcontractors, vendors, and/or other agents relating to the use and disclosure of PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, for purposes of determining both Business Associate’s and Covered Entity’s compliance with the HIPAA Rules.

IV. Permitted Uses and Disclosures by Business Associate:

A. Business Associate shall not use or disclose PHI except to perform functions, activities, or services on behalf of Covered Entity as provided for in the Contract, this Agreement, the HIPAA Rules, or other applicable law.

B. Business Associate agrees that it may use or disclose PHI on behalf of Covered Entity only:

1. Upon obtaining the authorization of the individual to whom the PHI pertains;

2. For the purposes of treatment, payment or health care operations unless Covered Entity has agreed to a restriction pursuant to 45 C.F.R. § 164.520(b)(iv)(A) or 45 C.F.R. § 164.522; or

3. Without an authorization or consent, if in accordance with 45 C.F.R. § 164.510, 45 C.F.R. § 164.512, 45 C.F.R. § 164.514(e), 45 C.F.R. § 164.514(f), or 45 C.F.R. § 164.514(g).

C. Business Associate shall use and disclose PHI in compliance with each applicable requirement of 45 C.F.R. § 164.504(e), which section is fully incorporated herein.

D. Business Associate agrees to make uses, disclosures, and requests for PHI consistent with Covered Entity’s minimum necessary policies and procedures.

E. It is anticipated that Business Associate will have access to the MPI.

F. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth below.

1. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

V. Obligations of Covered Entity:

A. Covered Entity shall provide Business Associate with its Notice of Privacy

Practices and any changes to the Notice.

B. Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity’s Notice of Privacy Practices under 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

C. Covered Entity shall notify Business Associate of any change in, or revocation of, the permission by an individual to use or disclose his or her PHI to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

D. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

E. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as provided in Part IV, Subpart F, Section 1.

VI. Termination:

A. Term: The Term of this Agreement shall be effective as of the date Business

Associate signs the underlying Contract and shall terminate when the Contract ends or on the date covered entity terminates for cause as authorized in paragraph

(b) of this Section, whichever is sooner.

B. Termination for Cause: Business Associate authorizes termination of this Agreement by Covered Entity, if Covered Entity determines Business Associate has violated a material term of the Agreement and Business Associate has not ended the violation within the time specified by Covered Entity.

C. Obligations of Business Associate Upon Termination: Upon termination of this Agreement for any reason, Business Associate, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

1. Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

2. Return to Covered Entity, or, if agreed to by Covered Entity, destroy, the remaining PHI that Business Associate does not need to continue its proper management and administration or to carry out its legal responsibilities;

3. Continue to use appropriate safeguards, in compliance with Subpart C of 45 C.F.R. Part 164, with respect to electronic PHI to prevent use or disclosure of electronic PHI, other than as provided for in this Part, for as long as Business Associate retains the PHI;

4. Not use or disclose PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out above, at Part IV, Subpart F, Section 1 of the Agreement which applied prior to termination;

5. Return to Covered Entity, or, if agreed to by Covered Entity, destroy, the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities; and

6. If Business Associate or its agent or subcontractor destroys any PHI, Business Associate will provide Covered Entity with documentation evidencing such destruction within thirty (30) days of completion of destruction.

D. Survival: The obligations of Business Associate under this Part shall survive the termination of this Agreement.

VII. Indemnification:

In the event Business Associate is investigated and/or becomes a party to a civil or criminal cause of action in any forum relating to its failure to comply with the HIPAA Rules, Business Associate shall reimburse Covered Entity all reasonable costs and expenses Covered Entity may incur relating to such investigation and/or cause of action, and will otherwise hold Covered Entity harmless for any and all reasonable costs and expenses relating to the foregoing.

VIII. Miscellaneous:

A. Incorporation: This Agreement is attached to and fully incorporated into the Contract.

B. Notices: All notices under this Agreement shall be provided by certified mailing, and shall require proof of date of receipt.

C. Regulatory References: A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

D. Amendment: The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.

E. Interpretation: Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.

F. Successors and Assigns: This Agreement shall be binding upon, inure to the benefit of and be enforceable by and against the Parties and their successors and assigns.

G. Severability: If a court of competent jurisdiction deems any provision of this Agreement unenforceable, such provision shall be severed from this Agreement and every other provision of the Agreement shall remain in full force and effect.

DEPARTMENT OF LABOR WAGE DETERMINATIONS UNDER THE

SERVICE CONTRACT ACT

WD 2015-5313 REV. 28 DATED 12/03/2025

Lawton Indian Hospital (Comanche County) 1515 NE Lawrie Tatum Rd.

Lawton, Ok 73507

WD 2015-5315 REV. 28 DATED 12/03/2025

OCAO IHS (Oklahoma County) 701 Market Dr.

OKC, OK 73114

El Reno Indian Health Clinic (Canadian County) 1801 Parkview Dr.

El Reno, OK 73036

WD 2015-5317 REV. 28 DATED 12/03/2025

Pawnee Indian Health Center (Pawnee County) 1201 Heritage Circle Pawnee, OK 74058

WD 2015-5321 REV. 29 DATED 12/03/2025

Watonga Indian Health Center (Blaine County) 1305 S. Clarence Nash Blvd.

Watonga, OK 73772

WD 2015-5327 REV. 29 DATED 12/03/2025

Anadarko Indian Health Center (Caddo County) 201 Parker McKenzie Dr.

Anadarko, OK 73005

Carnegie Indian Health Center (Caddo County) 212 East 4th Carnegie, OK 73015

Clinton Indian Health Center (Custer County) 10321 N 2274 Rd.

Clinton, OK 73601

WD 2015-5331 REV. 30 DATED 12/03/2025

Wewoka Indian Health Center (Seminole County)

36640 US-270

Wewoka, OK 74884

WD 2015-5335 REV. 28 DATED 12/03/2025

Haskell Indian Health Center (Douglas County) 2415 Massachusetts St.

Lawrence, KS 66046

%"��0������++1���������� �2�1�!"�!#�����������������2�1�!"��!�,�'3 � ��+�"% �!"1��� % �� #��%1 ���2�1�!",�)'4(/4'('-555555555555555555555555555555555555555�55555555555555555555555555555555555555555555������������������������������������������������������������������������������������ % �,� 60%$!+%����%,� 60%$!+%��!7" ��1�!#��!+%"�$�8��! !"555555555555555555555555555555555555555555555555555555555555555555555555555555555555����������99 ��"*����"�#� 1���:7����� !00!;� $�� ��7<% �!"%0���1 �"*99���������� ������� ���

�1<% �$��8��! !����$��0���������������������������������������������'(�'-��()(>(�.� !�7+�" ����<%�% �!"��0��6�������������������������������������������)?�>-��()(=(�.�

�&��*0%11���������������������������������''�3-��(-()(�.��7 !+! �2����0�� ����%"����������������������������������������������')�(3

CDEDFEG�CHIJK�LM NLMOPQR

STTUVIDDVWXOPQRDYWPZ[\ZTZ]X̂_WT̂Q_DFHCK[K̀C̀DFa CDCH

���3��� �6����� ������������������������������������������������������������"��������0�������

�������������������������������������������%��*�����������0������� ���������������������������������������������������������������*����0������� 7����$ ��������������������������������������������������%��*�����������0������� 7����$ �������������������������������������������%��%�����������0������� ����.� ��� ���1!!����� �������#����3�

���8���.

���$�1!!����� �����%������� �4��� �������������������������������������������������������"�#*���%������2� !$��!�����������������������������������������������%#�%����%��%���3 ���7� .�1!!����� ����/$ �������������������������������������������#�������%������3 ���7� �����������������������������������������������#%������%�%����4 �������������������������������������������������������������������%�������%�%����4 �����')8�

�8 ! �.�3� !$� � 8���������������������������������������������������%%%����<�����8���������������������������������������������������������������#������%%%%���<�����8������������������������������������������������������������������*���%%%#���<�����8���������������������������������������������������������������"��"���%%%����<�����8������������&��������������������������������������������������*������%%#����1���!���4��� �����������������������������������������������������%#�%����%%#"���1���!���/

=>?>@?A�=BCDE�FG HFGIJKL

MNNOPC>>PQRIJKL>SQJTUVTNTWRXYQNXKY>@B=EUEZ=Z>@[ @>=B