HDQMWR21R0016.pdf

July 2021

Prospective Offeror

Subject: REQUEST FOR PROPOSAL (RFP) HDQMWR-21-R-0016

Dear Prospective Offeror:

This Request for Proposal is to provide HR Broker Services for the Commander Navy

Installations Command (CNIC). CNIC intends to issue a no cost contract for Health, Welfare and

Safety (HW&S) programs, benefits reviews, consulting services, and special projects for a two

(2) year base with three (3) option years.

Requests for clarifications and the submission of questions in reference to this request for proposal are due no later than 9 July 2021. The proposal due date is no later than 1 August 2021.

Requests for clarifications and/or questions and offers must be emailed to hubert.l.stewart@navy.mil.

Respectfully, Hubert L. Stewart

Contract Specialist

Attachments:

Contract for Service (pages 1-3)

Appendix A – Performance Work Statement (pages 4-10)

Appendix B – Business Associate Agreement (HIPAA requirement) (pages 11-17)

Appendix C – Non-appropriated Fund Contract Clauses (pages 18-35)

Appendix D – Past Performance Questionnaires (pages 35-37)

Appendix E Preparation of Offers (pages 38-45)

Appendix F – Evaluation and Award Factors (page 46)

HDQMWR-21-R-0016

CONTRACT FOR SERVICES

Solicitation Number: HDQMWR-21-R-0016

Contract Number: _______________________

This contract, made and entered into this ____________________, by and between Commander

Navy Installations Command a Nonappropriated fund instrumentality (hereinafter called NAFI) and __________________________________ ( hereinafter called Contractor), is for Insurance

Brokerage Services for Insured Benefits and other Employee Health and Welfare (H&W) Benefit

Program Services subject to the provisions set forth hereunder. The parties agree to contract for the furnishing of the services as more specifically described in Appendix A and B hereto. The parties agree as follows:

1. Performance of Service/Price: The Contractor agrees to perform services in accordance with this contract and appendices for insurance industry standard commission rates on products sold.

The NAFI will not be liable for any costs incurred by the Contractor.

2. Contract Period. The period of performance for this contract will be for a 2 year base with three (3) option years from the commencement date. The contract service period shall begin

3. Insurance Policies. Insurance policies obtained under this contract shall be considered services rendered, the Contractor agrees to accept commission payments from the insurance companies as payment for services, unless otherwise specified by a modification to this contract.

4. Insurance Policy Payments. The insurance companies providing policies secured through this contract shall submit monthly invoices to CNIC Morale Welfare and Recreation (MWR), Fleet

Family Readiness HR N941, 5720 Integrity Drive, Millington, TN 38055-6590.

5. Subcontracts. The Contractor will not subcontract parts or the whole of this contract without obtaining the Contracting Officer's consent. If a subcontractor is permitted to execute part or this entire contract, the Contractor will continue to be held responsible for all provisions of the contract in total.

6. Licenses, Taxes, Permits, and Fees. The Contractor is fully cognizant that this contract is a contract for services and that an employee-employer relationship does not exist between the

Contractor and NAFI. The Contractor is not an employee of the NAFI and is not covered by

Workmen’s Compensation, group life, accident or health insurance, nor other benefits associated with an employer-employee relationship. Therefore, it is the Contractor's responsibility to obtain, at its own expense, all licenses and permits, and to pay such taxes and fees as may be required of the Contractor by federal, state, and local governments in the execution of the terms of this contract. The Contractor shall comply with all laws, rules, and regulations applicable to the service carried out under this contract.

7. All reports and other documents prepared by the contractor for the NAFI shall become the property of the NAFI. The Contractor shall deliver records maintained with respect to the insured, reports and other documents as well as any books and information related to the scope of services provided by the Contractor to the NAFI. Contractor shall have the right to retain a copy of all documents for its records.

8. Contractor agrees that its entire and only compensation from any source for procuring insurance coverage and providing consulting under this Agreement will be earned through

Contractor accepting and earning all possible commissions, contingency payments and any other remuneration and benefits provided by carriers in connection with policies issued to the NAFI.

NAFI recognizes that Contractor is entitled to all such compensation and fees. NAFI recognizes that to the extent the Contractor is entitled to additional compensation due to an increase in

NAFI’s employee population; such additional compensation is contemplated and expected pursuant to this contract. NAFI also specifically recognizes that Contractor may be entitled to volume or bonus compensation from individual insurance carriers. The Contractor shall provide to the NAFI, on an annual basis, a schedule detailing the coverage placed through the firm and shall fully and comprehensively disclose to NAFI all compensation earned.

9. SPECIAL CONTRACT REQUIREMENTS

APPOINTMENT OF CONTRACTING OFFICER’S REPRESENTATIVE

a. The Contracting Officer hereby designates the following individual as Contracting

Officer’s Representative(s) (COR) for this Contract:

Lynn Hickman, HR Specialist

CNIC MWR Millington

5720 Integrity Drive

Millington, TN 38055

Email: lynn.hickman1@navy.mil, Phone: (901) 874-6729

b. The COR will act as the Contracting Officer’s representative for technical matters, providing technical direction and discussion as necessary with respect to the specification or performance work statement, and monitoring the progress and quality of Contractor performance. The COR is not an Administrative Contracting Officer and does not have authority to take any action, either directly or indirectly, that would change the pricing, quantity, quality, place of performance, delivery schedule, or any other terms and conditions of the Contract, or to direct the accomplishment of effort which goes beyond the scope of the Contractor’s responsibilities.

c. It is emphasized that only a Contracting Officer has the authority to modify the terms of the

Contract, therefore, in no event will any understanding, agreement, modification, change order, or other matter deviating from the terms of the basic Contract between the Contractor and any other person be effective or binding on the NAFI. When/if, in the opinion of the Contractor, an effort outside the existing scope of the Contract is requested, the contractor shall promptly notify the Contracting Officer in writing. No action shall be taken by the Contractor under such direction unless the Contracting Officer has issued a contractual change or otherwise resolved the issue.

Print Name of Contracting Officer Print Name of Contractor

Signature of Contracting Officer Signature of Contractor

Date Date

Address & Telephone Number Address & Telephone Number

APPENDIX A

Performance Work Statement

1. INTRODUCTION

CNIC MWR requires the services of a Broker agency/consultant on insurance, employee benefit matters and other related services.

1.1 For purposes of negotiating with insurance carriers, CNIC MWR will execute a Broker of

Record (BOR) letter which will remain in force for the term of this contract. CNIC MWR agrees not to authorize other "Brokers" to act on its behalf regarding Health and Welfare Services or programs.

1.2 Compensation for evaluating and procuring benefits coverage and providing consulting under this contract will be earned through commissions, contingency payments, remuneration and benefits provided by carriers in connection with policies issued to CNIC MWR.

2. BACKGROUND

2.1 Commander, Navy Installations Command (CNIC) is the Navy's Morale Welfare and

Recreation (MWR) program manager for a variety of recreational, social and community support programs for Naval personnel worldwide. The primary programs provided through CNIC, MWR are clubs, golf, marinas, child care, sports, fitness and youth activities. As the program manager, CNIC MWR, Fleet & Family Division provides management direction and oversight to the various components of CNIC MWR field activities functioning in a manner similar to a corporate headquarters. CNIC MWR is a non-appropriated funded instrumentality of the United

States Government. It is a self-sustaining organization that generates the revenue necessary to operate through the sale of goods and services to authorized patrons.

2.2 CNIC MWR provides a comprehensive benefits package for its regular full and part time employees, which includes, but is not limited to, medical plans, dental plans, life insurance, and long term disability insurance. CNIC employs approximately 9800 full time personnel with approximately 4200 personnel participating in the plans described above. CNIC MWR is headquartered in Washington, D.C. and Millington, TN and has employees located in various locations around the U.S. and the world.

2.3 CNIC MWR Payroll Information

Employees are paid biweekly on a single uniform pay-date

26 pay periods a year with approximately 118 payroll locations (includes overseas locations)

1 central payroll processor (payroll contractor)

2 central bank accounts for Electronic Fund Transfer (EFT)

2 central bank accounts for payroll checks

Bi-weekly contributions are electronically transferred

2.4 There is no guarantee that eligible employees will continue to participate in the plans. The number of active participants could vary from current levels.

2.5 Amount of Annual Premiums - employees pay a percent of their total benefit premium for the plans. In addition, CNIC MWR provides employer dollars to pay the remainder of the premium. The Contractor's plan shall accommodate this option and other option changes as required by CNIC MWR.

3. REQUIREMENTS

3.1 General Requirements

3.1.1 Contractor will be responsible for assisting CNIC MWR with all aspects of health insurance consulting/contracting services and for the management of all aspects of the CNIC

MWR’s Health and Welfare (H&W) insurance programs; this includes, but not limited to, Medical, Dental, Life, Long Term Disability, Worker’s Compensation and Employee Assistance programs

3.1.2 The Contractor shall provide expert advice concerning pending or enacted Federal and

State legislation affecting the CNIC MWR’s H&W insurance programs.

3.2 Payment Methods.

a. Electronic funds transfer payments are available for processing invoices for this contract in accordance with the prompt payment act via the Automated Clearing House (ACH) network, subject to the rules of the National Automated Clearing House Association or via credit card procedures with Single Use Account (SUA). Single-Use Account (SUA) is an electronic payment tool that eliminates the need for a physical credit card. SUA provides a single electronic card for each payment. A 16-digit virtual account is provided for each payment and the credit limit is set for the specific payment amount.

b. Electronic funds transfer ACH payments will be processed on a Net 30 day basis or less if a payment discounted is offered, e.g. 2% 10 days. SUA payments will be processed in 10 days or less.

c. Prospective insurance and benefit program service companies/contractors to include their desired payment method in their proposal/quote submitted to the broker.

3.3 Performance Requirements

Negotiate annual renewal of coverage from carriers for H&W insurance programs. Seek competitive offers through Requests for Proposals from benefit carriers and provide advice and recommendations for consideration. Prepare all necessary competitive specifications, evaluation of offers, coverage and premium analysis, and recommendation of carrier.

All RFPs and Contracts must contain the current non-appropriated fund contract clauses that are available from https://www.navymwr.org/resources/NAF_Aquisitions. CLICK ON the “NAF

Contract Clauses” folder.

The clauses are also listed in Appendix C to this document to include Requirements, Ordering, and other NAFI contract clauses. All contracts must be awarded as an appropriate contract type to allow other NAFIs to place orders against the contracts.

https://www.navymwr.org/resources/NAF_Aquisitions

3.3.1 Review policies and endorsements for accuracy and conformance with negotiated coverage. Insure the timely issuance of policies and endorsements to the CNIC MWR.

3.3.2 Analyze and review all benefit carrier proposed settlements, claims history, group utilization, reserves, claims processing, and other plan costs and expenses to provide information and recommendations to the CNIC MWR.

3.3.3 Assist the CNIC MWR headquarters staff with all questions or grievances relating to insurance benefits issues. Assist the CNIC MWR headquarters staff with health benefit plan administration, wellness and preventive insurance management and provide advice and guidance on new laws, regulations and procedures in the area of health benefit administration.

3.3.4 Assist the CNIC MWR’s personnel in procedure and applications for processing enrollments, terminations, changes, Temporary Continuation of Coverage notifications, and other forms for administration and claims.

3.3.5 Provide the CNIC MWR administration with reasonable preliminary renewal figures during the budget process.

3.3.6 Attend on request CNIC MWR meetings, Finance and Insurance Committee meetings, budget meetings, and other negotiation meetings whenever necessary.

3.3.7 Assist the CNIC MWR’s Human Resources Officer with required employee presentations.

3.3.8 Identify issues and exposures and negotiate on CNIC MWR’s behalf with insurance carriers; keeping CNIC MWR informed of significant developments affecting its insurance coverage. CNIC MWR’s Contractor shall be authorized to represent and assist CNIC MWR in discussions and transactions with all insurance carriers, provided that the Contractor shall not place any insurance on behalf of CNIC MWR unless so authorized in writing by the COR.

3.3.9 Follow up with insurance carriers for timely issuance of policies and endorsements, placing a coverage binder to be delivered to CNIC MWR prior to the expiration of current policies.

3.3.10 Review policies and endorsements for accuracy and conformity to specifications and negotiated coverage.

3.3.11 Provide summaries to CNIC MWR for all new coverage and updates on changes to existing coverage.

3.3.12 Forward CNIC MWR’s claims to the insurance carrier. The Contractor shall monitor the claim status and assist CNIC MWR in obtaining timely resolution of the submitted claim.

3.3.13 Review all correspondence referred by CNIC MWR and preparation of correspondence on behalf of CNIC MWR, if requested.

3.4 Service Requirements

3.4.1 Assist with the development of and planning of long range H&W plan strategies.

3.4.2 Recommend and negotiate to procure H&W plan coverage.

3.4.3 Assist in management of all aspects of the CNIC MWR’s H&W plan analysis for proposals in connection with H&W plan procurement, including, but not limited to, recommend selection criteria, marketplaces and assist in an advisory capacity to evaluate proposals.

3.4.4 Participate in on-going meetings with CNIC MWR personnel regarding insurance strategies and day to day operations of the CNIC MWR’s H&W plans.

3.4.5 Assist in the development of alternative strategies to reduce risk to assets and resources;

provide consultation as to the probable impact of strategies selected by the CNIC MWR.

3.4.6 Assist the CNIC MWR as a resource during employee education sessions.

3.4.7 Facilitate employee group sessions at open enrollments and/or when changes are introduced.

3.4.8 Create employee communication pieces/surveys as necessary/requested by the CNIC

MWR.

3.4.9 Monitor to ensure carrier compliance with plans, commitments, and facilitate carrier relationship with CNIC MWR.

3.4.10 Market programs to CNIC MWR personnel periodically, through flyers and brochures.

3.4.11 Provide annual rate renewal reports that includes an Executive Summary. The report shall include key findings and recommendations; (recommendations can include, in addition to rate actions, the removal plans or corrective actions, the issuance of a Request For Proposal

(RFP), new benefit recommendations or deletions of old benefits, revised programs, and historical highlights (overall historical trends in membership, reserves, trends, etc.). Enrollment

History and Claims Trends - analyze health care trends: methodology for prediction of trends.

Financial Projections – examine past periods to project need for renewal.

3.4.12 Develop Rate Renewal – as part of the analysis, for H&W plans analysis to include identification of plan costs, utilization trends and how those trends parallel or vary from known general experience for other carriers.

3.4.13 Present Premium Rates to CNIC MWR headquarters staff.

3.4.14 CNIC MWR claims experience will be provided to the Contractor on a quarterly basis by the Plan Administrator for the H&W plans. Claims experience provided shall be analyzed upon receipt by the Contractor and any concerns that the Contractor may have shall be immediately reported to the COR.

3.4.15 Develop independent rate renewal projections based upon the Contractor’s review of the CNIC MWR’s experience, cost and utilization trends. During the spring of each year, the

Contractor shall require the administrator for each plan to provide a written projection of costs and proposed rate renewal for the following calendar year.

3.4.16 Assist in the Preparation of Written Materials. Upon the written request of the COR, the Contractor shall provide expert assistance in the writing of technical brochures or technical sections of the CNIC MWR handbooks, language for rule revisions in the CNIC MWR

Personnel Policy and other written materials.

3.4.17 Design new programs or benefits: Upon the written request of the CNIC MWR, the

Contractor shall provide expert assistance, underwriting/actuarial services, advice in the design of new benefits, and will independently recommend new programs.

3.4.18 Evaluate proposed or enacted legislation: The Contractor is expected to immediately advise the CNIC MWR of pending or enacted Federal and State legislation affecting the CNIC

MWR. Upon the written request of the COR, the Contractor shall advise of the financial/administrative impact of State or Federal legislation on the CNIC MWR and assist in the implementation of changes made necessary by such legislation.

3.4.19 Analyze covered service area expansion: For the purposes of providing an adequate choice of plans for the CNIC MWR’s employees, the Contractor, upon written request of the COR, shall analyze service areas of current plans and provide recommendations regarding design and expansion of coverage plans.

4. DELIVERABLES

4.1 Standard Services:

4.1.1 Account Management and Client Services. The Contractor shall:

- Help develop short and long term employee benefits strategy

- Offer options and recommendations regarding program design

- Meet with CNIC and hold conference calls as needed to discuss issues, open items or projects

- Jointly prepare Action Plan/Open Items List with providers of employee benefits and monitor/update regularly

- Process HMO renewal applications & order enrollment materials for each plan & activity

- Inform CNIC of changes in employee benefits marketplace

4.1.2 Vendor Management. The Contractor shall:

- Prepare RFP’s, submit to vendors, summarize, and negotiate results – no limit on number of occurrences

- Coordinate with vendors to resolve issues on delivery/performance, enrollment, and other contract issues

- Negotiate/re-negotiate performance standards for providers of employee benefits

- Conduct meetings with employee benefits providers on as needed basis to identify issues/problems and monitor performance against performance standards

- Conduct quarterly meetings with CNIC discuss the following but not limited to: cost containment, performance, experience

4.1.3 Financial Management. The Contractor shall:

- Complete renewal negotiations with vendors and provide detailed renewal summary with recommendations for all lines of coverage

- Finalize & accept (on behalf of CNIC) all HMO renewals after approval from the COR

- Obtain rate guarantees where applicable

- Communicate all employer and employee contributions for HMO plans to all activities

- Provide summary utilization reports on an as-needed basis (assuming data available for plan)

- Provide plan design pricing services

4.1.4 Benchmarking. The Contractor shall:

- Provide detailed information for benchmarking with national, regional, industry, and size data upon request

4.1.5 Compliance. The Contractor shall:

- Perform initial & annual (when applicable) review of plan docs/SPD’s, contracts to ensure correct plan design, practice, compliance (e.g. HIPAA, plan provisions)

- Send bulletins on hot topics and legislative issues

- Insure responses to compliance questions are legally defensible.

4.1.6 Implementation Services. The Contractor shall:

- Provide annual coverage & rate summaries

- Participate in design and system review meetings

- Establish procedures with vendors

- Post implementation debriefing

4.1.7 Benefits Administration. The Contractor shall:

- Troubleshoot claims issues when requested

- Provide day-to-day support for HR & activity questions

- Assist in benefit program development for Joint Basing if needed

- Process Joint Basing with HMO vendors & Life / Disability vendor (e.g. Set up under plan, establish structure, contracts). Assist in training Local HR/Benefit personnel at activity locations

5. SPECIAL REQUIREMENTS

5.1 The Contractor shall insure all HIPAA requirements and protections are in place and strictly enforced (See Appendix B). The Appendix B Business Associate Agreement is the agreement included in the current CNIC HR Broker contract. Offerors have the option of accepting this agreement or proposing an alternative.

5.2 PRIVACY ACT NOTIFICATION (Jan 2008). The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

5.2.1 PRIVACY ACT (Apr 1984)

(a) The Contractor agrees to –

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies –

(i) The systems of records; and

(ii) The design, development, or operation work that the Contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(3) Include this clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

(c)

(1) “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(2) “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(3) “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

End of Appendix A

Appendix B

BUSINESS ASSOCIATE AGREEMENT

THIS AGREEMENT is effective as of _______________________ or such other date as specified herein (the “Effective Date”), between THE GROUP HEALTH PLANS

SPONSORED BY CNIC (Commander Navy Installations Command) (“Covered Entity”) and ________________________ (“Business Associate”) and is intended to comply with the business associate contract requirements of the Privacy Rule and Security Rule (as defined below and promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996

(“HIPAA”) , and its implementing regulations).

I. Definitions

a. Agreement. “Agreement” shall mean this Business Associate Agreement.

b. Breach. “Breach” shall have the same meaning as the term “breach” in 45 CFR §

164.402.

c. Business Associate. “Business Associate” shall mean

d. Covered Entity. “Covered Entity” shall mean the group health plans sponsored by Insert Name of Plan Sponsor which are subject to HIPAA.

e. Effective Date. “Effective Date” shall have the meaning given in the introductory paragraph above.

f. Individual. “Individual” shall have the same meaning as the term “individual” in

45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

g. Privacy Rule. “Privacy Rule” shall mean the Standards for Privacy of

Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.

h. Protected Health Information. “Protected Health Information” shall have the same meaning as the term “protected health information” in 45 CFR § 160.103, and is limited to the information created or received by Business Associate from or on behalf of Covered Entity.

i. Required By Law. “Required By Law” shall have the same meaning as the term

“required by law” in 45 CFR § 164.103.

j. Secretary. “Secretary” shall mean the Secretary of the Department of Health and

Human Services or his designee.

k. Security Incident. “Security Incident” shall have the same meaning as the term

“security incident” in 45 CFR § 164.304.

l. Security Rule. “Security Rule” shall mean the Security Standards and

Implementation Specifications at 45 CFR Parts 160 and 164, subpart C.

m. Services Agreement. “Services Agreement” shall mean the underlying agreement between Covered Entity and Business Associate, whether written or unwritten, whereby Covered Entity has engaged Business Associate to provide health plan related consulting services and other related services.

n. Unsecured Protected Health Information. “Unsecured Protected Health

Information” shall have the same meaning as the term “unsecured protected health information” in 45 CFR § 164.402.

o. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as ascribed to those terms under HIPAA.

II. Obligations and Activities of Business Associate

a. Business Associate agrees not to use or further disclose Protected Health

Information other than as permitted or required by the Agreement or as Required by Law.

b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this

Agreement. Business Associate further agrees to implement appropriate safeguards that protect electronic Protected Health Information as required by the

Security Rule.

c. Business Associate agrees to report to Covered Entity any use or disclosure of

Protected Health Information not provided for by this Agreement or the Services

Agreement, of which it becomes aware, including any Security Incident or

Breaches of Unsecured Protected Health Information.

d. All written notifications to Covered Entity by Business Associate of a Breach of

Unsecured Protected Health Information shall be provided to Covered Entity without unreasonable delay but in no event later than sixty (60) days following the discovery of the breach, and shall include, to the extent possible, the identification of each Individual whose Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed during the Breach. In addition, Business Associate shall include in the aforementioned written notification, to the extent available, the following information in plain language:

i. A brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known;

ii. A description of the types of Protected Health Information that were involved in the Breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);

iii. Any steps Individuals should take to protect themselves from potential harm resulting from the Breach;

iv. A brief description of what Business Associate is doing to investigate the

Breach, to mitigate harm to Individuals and to protect against any further

Breaches; and

v. Contact procedures for Individuals to ask questions or learn additional information, which shall include provision of a toll-free telephone number, an e-mail address, Web site, or postal address.

e. Business Associate agrees to cooperate with Covered Entity’s preparation and distribution of the Breach notifications required under 45 CFR §§ 164.404,

164.406 and 164.408.

f. In accordance with 45 CFR § 164.502(e)(1)(ii) and § 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the Business

Associate agree in writing to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.

g. Business Associate agrees to provide access, at the request of Covered Entity, to

Protected Health Information in a Designated Record Set (if it has such information in such form) to Covered Entity or to an Individual in order to meet the requirements under 45 CFR § 164.524.

h. Business Associate agrees to make any amendment(s) to Protected Health

Information in a Designated Record Set (if it has such information in such form) as agreed upon pursuant to 45 CFR § 164.526 at the request of Covered Entity or an Individual, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.526.

i. Business Associate agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity available to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule.

j. Business Associate agrees to maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations to respond to a request by an

Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528.

k. Business Associate agrees to maintain records of receipts, transmissions, uses and disclosures of Protected Health Information throughout the term of this

Agreement and for such longer period as may be required by applicable law.

l. To the extent that Business Associate conducts any standard transaction (as defined in 45 CFR Part 162) for or on behalf of Covered Entity, Business

Associate shall comply, and shall require any subcontractor or agent to comply, with each applicable requirement of 45 CFR Part 162.

m. To the extent the Business Associate is to carry out one or more of Covered

Entity’s obligation(s) under the Privacy Rule, Business Associate shall comply with the requirements of the Privacy Rule that apply to the Covered Entity in the performance of such obligation(s).

n. Unless as otherwise permitted under HIPAA, Business Associate will not sell or otherwise exchange for remuneration Protected Health Information or use or disclose Protected Health Information for purposes of marketing.

III. Permitted Uses and Disclosures by Business Associate

A. General Use and Disclosure

i. Except as otherwise limited in this Agreement, Business Associate may only use or disclose Protected Health Information as necessary to perform functions, activities, or services for, or on behalf of, Covered Entity as agreed to in the Services Agreement, provided that such use or disclosure would not violate the Privacy Rule or Security Rule if done by Covered

Entity, except for the specific uses and disclosures set forth in the following section.

B. Specific Use and Disclosure Provisions

i. Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

ii. Except as otherwise limited in this Agreement, Business Associate may disclose Protected Health Information for the proper management and administration of the Business Associate, provided that such disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and be used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and that the person will notify the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

iii. Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information to provide Data Aggregation services to Covered Entity as permitted by 42 CFR § 164.504.

iv. Business Associate may use Protected Health Information as required by law and to report violations of law to appropriate federal and state authorities, consistent with 45 CFR § 164.502(j)(1).

v. Business Associate may use Protected Health Information to de-identify information in accordance with 45 CFR § 164.514(a)-(c).

vi. Except as otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information to another business associate of the Covered Entity to the extent the Covered Entity itself would be permitted to so disclose Protected Health Information.

vii. Except as otherwise required under HIPAA, Business Associate will make reasonable efforts to use or disclose only the minimum amount of

Protected Health Information reasonably necessary to accomplish the intended purpose of the use or disclosure.

IV. Obligations of Covered Entity

a. Covered Entity shall not request Business Associate to use or disclose Protected

Health Information in any manner not permissible under the Privacy and Security

Rules if done by Covered Entity.

b. Covered Entity shall provide Business Associate with any notice of privacy practices that Covered Entity produces in accordance with 45 CFR § 164.520, as well as any changes to such notice.

c. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by Individual to use or disclose Protected Health

Information, if such changes affect Business Associate's permitted or required uses and disclosures.

d. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR § 164.522.

V. Term and Termination

a. Term. This Agreement shall be effective as of the Effective Date and shall terminate when all of the Protected Health Information provided by Covered

Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Article.

b. Termination for Cause. In the event that Covered Entity becomes aware that

Business Associate has breached a material term of this Agreement, Covered

Entity shall provide a reasonable opportunity for Business Associate to cure the breach or end the violation. If Business Associate does not cure the breach or end the violation within the time specified by Covered Entity, Covered Entity shall terminate this Agreement, as well as the Services Agreement. If Business

Associate has breached a material term of this Agreement and cure is not possible, Covered Entity immediately shall terminate this Agreement, as well as the

Services Agreement. In addition, Covered Entity may seek other remedies under this Agreement or the underlying agreement between the parties, or as permitted by law, in the event of a breach of this Agreement by Business Associate.

c. Effect of Termination.

i. Except as provided in paragraph (2) of this Section, upon termination for any reason of this Agreement or the Services Agreement, Business

Associate shall return or destroy all Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to Protected Health

Information that is in the possession of subcontractors or agents of

Business Associate. Business Associate shall retain no copies of the

Protected Health Information.

ii. In the event that Business Associate determines that returning or destroying the Protected Health Information is infeasible, Business

Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health

Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected

Health Information.

iii. Business Associate shall either require the return of all copies of Protected

Health Information created, received, or maintained by agents or subcontractors, or ensure the destruction of the Protected Health

Information created, received, or maintained by such agents or subcontractors.

d. Survival. The obligations of Business Associate under this Article V shall survive the termination of this Agreement.

VI. AMENDMENT

a. Upon the amendment to the Privacy Rule, Security Rule, or any other provision of the Code of Federal Regulations cited herein, the parties agree to amend this

Agreement as is necessary to ensure compliance with the Privacy Rule, Security

Rule, and any other referenced provision of the Code of Federal Regulations.

b. A reference in this Agreement to a provision in the Privacy Rule, Security Rule, or any other provision of the Code of Federal Regulations shall mean the provision in effect or as amended.

VII. MISCELLANEOUS

a. Nothing express or implied in this Agreement is intended to confer, nor shall anything confer, upon any person other than the Covered Entity and Business

Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

b. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits compliance with HIPAA and the regulations promulgated under HIPAA.

c. This Agreement is incorporated into the Services Agreement. However, to the extent that there is a conflict between this Agreement and the Services

Agreement, this Agreement shall control.

d. The relationship between the Covered Entity and Business Associate is that of independent contracting entities. Neither party is the agent or representative of the other, nor shall either party be liable for the acts or omissions of the other, its agents, or its employees. The provisions in this Agreement should not be interpreted in a manner as to impose an “agency relationship” between the

Covered Entity and the Business Associate.

End of Appendix B

Appendix C

NONAPPROPRIATED FUND CONTRACT CLAUSES TABLE OF CONTENTS

CLAUSES MADE INAPPLICABLE BY THE TYPE OF ORDER OR CONTRACT ARE SELF-

DELETING.

1. DEFINITIONS

2. ADVERTISEMENTS

3. ASSIGNMENT

4. COMMERCIAL WARRANTY

5. DISCOUNTS FOR PROMPT PAYMENT

6. DISPUTES

7. EXAMINATION OF RECORDS

8. GRATUITIES

9. HOLD AND SAVE HARMLESS

10. INSPECTION

11. INSURANCE

12. INVOICES

13. LAW GOVERNING CONTRACTS

14. LEGAL STATUS

15. MODIFICATIONS

16. ORDER OF PRECEDENCE

17. PAYMENTS

18. PROOF OF SHIPMENT

19. TAXES

20. TERMINATION FOR CONVENIENCE

21. TERMINATION FOR DEFAULT

22. VARIATION IN QUANTITY

23. PROTESTS

24. PROHIBITION ON CONTRACTING FOR HARDWARE,

SOFTWARE, AND SERVICES DEVELOPED OR PROVIDED BY

KASPERSKY LAB AND OTHER COVERED ENTITIES

25. REPRESENTATION REGARDING CERTAIN

TELECOMMUNICATIONS AND VIDEO SURVEILLANCE

SERVICES OR EQUIPMENT

26. PROHIBITION ON CONTRACTING FOR CERTAIN

TELECOMMUNICATIONS AND VIDEO SURVEILLANCE

SERVICES OR EQUIPMENT

27. COVERED TELECOMMUNICATIONS EQUIPMENT OR

SERVICES REPRESENTATION

The following clauses are incorporated by Reference

28. COVENANT AGAINST CONTINGENT FEES

29. WALSH-HEALEY PUBLIC CONTRACTS ACT

30. EQUAL OPPORTUNITY

31. AFFIRMATIVE ACTION – VETERANS

32. AFFIRMATIVE ACTION – HANDICAPPED WORKERS

33. EMPLOYMENT REPORTS – VETERAN

34. RESTRICTIONS ON CERTAIN FOREIGN PURCHASES

35. EXTRAS

36. CHANGES - FIXED PRICE

37. CONTRACTOR INSPECTOR REQUIREMENTS

38. RESPONSIBILITY FOR SUPPLIES

39. CLEARANCE AND DOCUMENT – SHIPMENTS

40. CONVICT LABOR

41. CONTRACT WORK HOURS & SAFETY STANDARDS ACT

42. SERVICE CONTRACT ACT OF 1965 (AS AMENDED)

43. INSPECTION OF SERVICES – FIXED PRICE

NONAPPROPRIATED FUND CONTRACT CLAUSES

1. Definitions. As used throughout this contract, the following terms and abbreviations have the meaning set forth below:

a. The term “Contract” means this agreement or order and any modifications hereto.

b. The abbreviation “NAFI” means Nonappropriated Fund Instrumentality of the United

States Government.

c. The term “Contracting Officer” means the person executing or responsible for administering this contract on behalf of the NAFI which is a party hereto, or his successor or successors.

d. The term “Contractor” means the party responsible for providing supplies/equipment and/or services at a certain price or rate to the NAFI under this contract.

e. The term “Contracting Officer’s Representative” (COR) means a person appointed by the contracting officer to monitor performance and act as a liaison between the contractor and the contracting officer.

2. Advertisements. The contractor agrees that none of its, nor its agent’s, advertisements to include publications, merchandise, promotions, coupons, sweepstakes, contests, sales brochures, etc., shall state, infer, or imply that the contractor’s products or services are approved, promoted, or endorsed by the NAFI. Any advertisement, including cents off coupons, which refers to a

NAFI will contain a statement that the advertisement is neither paid for nor sponsored, in whole or in part, by that particular activity.

3. Assignment. A contractor may not assign their rights or delegate their obligations under this contract without prior written consent of the contracting officer.

4. Commercial Warranty. The contractor agrees that the supplies/equipment or services furnished under this contract shall be covered by the most favorable commercial warranties the contractor gives to any customer for such supplies/equipment or services and that the rights and remedies provided herein are in addition to and do not limit any rights afforded to the NAFI by any other clause of this contract. The printed terms and conditions of such warranty will be provided to the NAFI with the delivery of any supplies/equipment or services covered.

5. Discounts for Prompt Payment. In connection with any prompt payment discount offered, time will be computed from the date of the contractor’s invoice. Payment is deemed to have been made as of the date on the payment check or date on which electronic funds transfer is made.

6. Disputes. Except as otherwise provided in this contract, any dispute or claim concerning this contract, which is not disposed of by agreement, shall be decided by the contracting officer, who shall state their decision in writing, and mail or otherwise furnish a copy of it to the contractor.

Within 90 days from date of receipt of such copy, the contractor may appeal by mailing or otherwise furnishing to the contracting officer a written appeal addressed to the immediate superior in Command (ISIC) of the Command one level above the contracting officer's

Command. The decision of this authority shall be final and conclusive. If no such appeal is filed, the decision of the contracting officer shall be final and conclusive. The contractor shall be afforded an opportunity to be heard and to offer evidence in support of any appeal under this clause. Pending final decision on such a dispute, the contractor shall proceed diligently with the performance of the contract and according to the decision of the contracting officer, unless directed to do otherwise by the contracting officer.

7. Examination of Records

a. The clause is applicable if the amount of this contract exceeds $10,000 and the contract was entered into by means of negotiation. The contractor agrees that the contracting officer or their duly authorized representative shall have the right to examine and audit the books and records of the contractor directly pertaining to the contract during the period of the contract and up to 3 years after contract expiration date and final payment.

b. The contractor agrees to include the clause in paragraph 7a above in all subcontracts there-under which exceed $10,000.

8. Gratuities

a. The NAFI may, by written notice to the contractor, terminate the right of the contractor to proceed under this contract if it is found, after notice and hearing by the Contracting Officer that gratuities (in the form of entertainment, gifts, or otherwise) were offered or given by the contractor, or any agent or representative of the contractor, to any officer or employee of the government or the NAFI with a view toward securing favorable treatment with respect to the awarding or amending, or the making of any determinations with respect to the performing of such contract. The Contracting Officer must coordinate with and receive approval from N94 on all matters arising under this section.

b. In the event this contract is terminated as provided in paragraph 8a above, the NAFI shall be entitled (1) to pursue the same remedies against the contractor as it would pursue in the event of a breach of contract by the contractor, and (2) as a penalty in addition to any other damages to which it may be entitled by law, to exemplary damages in an amount (as determined by the

Contracting Officer, which shall not be less than three nor more than ten times the cost incurred by the contractor in providing any such gratuities to any such officer or employee.

c. The rights and remedies of the NAFI provided in this clause shall not be exclusive and are in addition to any other rights and remedies provided by law or under this contract.

9. Hold and Save Harmless. The contractor shall indemnify, save harmless, and defend the

NAFI, its outlets, and customers from any liability, claimed or established, for violation or infringement of any patent, copyright, or trademark right asserted by any third party with respect to goods hereby ordered or any part thereof. Contractor further agrees to hold the NAFI harmless from all claims or judgments for damages resulting from the use of products listed in this contract, except for such claims or damages caused by or resulting from negligence of NAFI customers, employees, agents, or representatives. Also, the contractor shall at all times hold and save harmless the NAFI, its agents, representatives, and employees from any and all suits and expenses which arise out of acts or omissions of the contractor, its agents, representatives, or employees.

10. Inspection. Unless otherwise provided herein, inspection shall be made after receipt of the supplies/equipment by the ordering activity, or after completion of services by the contractor.

Inspection and acceptance shall not be conclusive, with respect to latent defects or fraud, or with respect to the NAFI’s rights under the proof of shipment provisions contained herein. In case any supplies/equipment or services are defective in material or workmanship, or are otherwise not in conformity with the requirements of this contract, the NAFI shall have the right to reject such supplies or services, or to require replacement or correction. Rejected supplies/equipment shall be removed by and at the expense of the contractor promptly after notice. If required by the

NAFI, the contractor, after notice of defect or non-conformance, shall, in a timely manner, correct or replace the defective or non-conforming supplies/equipment or services, or any part thereof.