Terms_and_Conditions.pdf

ESS System Refresh Contract No: TBD Task Order No.: TBD

I. Continuation of SF 1449:

A. Block 18a and b

1. PAYMENTS – VOUCHERS - Time & Materials/Labor Hour Contracts (OCT 2015)

a. GENERAL: The Contractor shall submit to the Government a voucher or Standard Form 1034, Public Voucher for Purchases and Services Other Than Personal, for payment in accordance with the instructions below.

b. METHOD OF PAYMENT: CMS shall only make an electronic payment for reimbursement of voucher submissions in accordance with FAR 52.232-33, Payments by Electronic Funds Transfer – System for Award Management. In order to receive payments, the contractor shall register in the System for Award Management (SAM) database, in accordance with FAR 52.204-7, System for Award Management.

ADDRESS CHANGES: The contractor shall notify CMS’ Division of Accounting Operations of all banking and address changes in SAM via the following email address:

CCRChanges@cms.hhs.gov.

c. CONTENT OF VOUCHER - Vouchers shall include, at a minimum:

• Contractor’s name and address

• Contractor’s Tax Identification Number (TIN)

• Contractor’s DUNS Number

• Voucher Number to include the designation of the Contract Payment Category

Type as follows:

• Contract Payment Category Type IA

• Contract and Order Number, as applicable;

• Contract line item number and/or Subcontract line item number;

• Description, quantity, unit of measure, unit price and extended price/cost of the items actually delivered or services rendered, i.e., Labor category and labor hours x labor rate = total direct labor dollars, subcontractor costs, travel, other direct costs, overhead rate(s), etc.;

• Shipping and payment terms;

• Terms of any discount for prompt payment offered;

• Other substantiating documentation or information as required by the contract;

• Name, title, phone number and complete mailing address of responsible official to whom payment is to be sent;

• Name, title, phone number of person to notified in the event of a defective voucher; and,

• Period of performance for delivery date of goods or services provided.

d. MAILINGS: Vouchers shall be submitted as follows:

1. ELECTRONIC MAIL: The contractor shall submit an electronic copy of the voucher to both of the following individuals:

mailto:CCRChanges@cms.hhs.gov

• Contract Specialist – patrick.forgione1@cms.hhs.gov; and

• COR – charles.mathers1@cms.hhs.gov.

2. REGULAR MAIL: An original hard copy of the voucher shall be submitted to the address below:

Department of Health & Human Services Centers for Medicare & Medicaid Services OFM/Division of Accounting Operations P.O. Box 7520 Baltimore, MD 21207-0520

3. OVERNIGHT MAIL: If the contractor chooses to use an overnight mail carrier, the original hard copy of the voucher shall be submitted to the address below:

OFM/Division of Accounting Operations 7500 Security Boulevard/Mailstop: C3-11-03 Baltimore, MD 21244-1850

e. PAYMENTS: The Government shall make payments on all vouchers in accordance with –

• FAR 52.212-4, Contract Terms and Conditions – Commercial Items, (if applicable),

• FAR 52.216-7, Allowable Cost & Payment,

• FAR 52.232-1, Payments, and

• FAR 52.232-7, Payments under Time-and-Materials and Labor-Hour Contracts upon acceptance by the Contracting Officer’s Representative (COR) of the required supplies/services in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer’s approval.

Reimbursement for vouchers submitted under this contract shall be made not later than thirty (30) calendar days after receipt of an acceptable voucher from the Contractor at the paying office designated above. Any discrepancies determined as a result of the audit could delay the processing of the voucher and may result in the voucher being returned to the Contractor for corrections.

f. INTEREST ON OVERDUE PAYMENT

The Prompt Payment Act, Public Law 97-177 (96 Stat.85.31 U.S.C. 1801) is applicable to payments under this contract and requires the payment of interest on payments made more than 30 calendar days after receipt of an voucher by the Division of Accounting Operations.

Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and Office of Management and Budget Circular A-125.

mailto:patrick.forgione1@cms.hhs.gov mailto:charles.mathers1@cms.hhs.gov

2. PAYMENTS - INVOICES (Firm Fixed Price Contracts (OCT 2015)

a. GENERAL: The Contractor shall submit to the Government an invoice for payment in accordance with the instructions below.

b. METHOD OF PAYMENT: CMS shall only make an electronic payment of invoices in accordance with FAR 52.232-33, Payments by Electronic Funds Transfer – System for Award Management. In order to receive payments, the contractor shall register in the System for Award Management (SAM) database, in accordance with FAR 52.204-7, System for Award Management.

ADDRESS CHANGES: The contractor shall notify CMS’ Division of Accounting Operations of all banking and address changes in SAM via the following email address:

CCRChanges@cms.hhs.gov.

c. CONTENT OF INVOICE - Invoices shall include, at a minimum:

• Contractor’s name and address;

• Contractor’s Tax Identification Number (TIN);

• Contractor’s DUNS Number;

• Invoice date;

• Invoice Number to include the designation of the Contract Payment Category Type as follows:

• Contract Payment Category Type IV

• Contract and Order Number, as applicable;

• Contract line item number and/or Subcontract line item number;

• Description, quantity, unit of measure, unit price and extended price of the items actually delivered or services rendered;

• Shipping and payment terms;

• Terms of any discount for prompt payment offered;

• Other substantiating documentation or information as required by the contract;

• Name, title, phone number and complete mailing address of responsible official to whom payment is to be sent;

• Name, title, phone number of person to notified in the event of a defective invoice; and,

• Period of performance or delivery date of goods or services provided.

d. MAILINGS: Invoices shall be submitted as follows:

1. ELECTRONIC MAIL: The contractor shall submit an electronic copy of the invoice to both of the following individuals:

• Contract Specialist – patrick.forgione1@cms.hhs.gov; and

• COR – charles.mathers1@cms.hhs.gov.

2. REGULAR MAIL: An original hard copy shall be submitted to the address below:

Centers for Medicare & Medicaid Services OFM/Division of Accounting Operations P.O. Box 7520 Baltimore, MD 21207-0520 mailto:CCRChanges@cms.hhs.gov mailto:patrick.forgione1@cms.hhs.gov mailto:charles.mathers1@cms.hhs.gov

3. OVERNIGHT MAIL: If the contractor chooses to use an overnight mail carrier, the original hard copy of the invoice shall be submitted to the address below:

Department of Health & Human Services Centers for Medicare & Medicaid Services OFM/Division of Accounting Operations 7500 Security Boulevard/Mailstop: C3-11-03

e. PAYMENTS: The Government shall make payment of all invoices in accordance with

• FAR 52.232-1 Payments, and

• FAR 52.212-4 Contract Terms and Conditions – Commercial Items (If applicable) upon acceptance by the Contracting Officer’s Representative (COR) in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer’s approval, as appropriate.

Reimbursement for invoices submitted under this contract shall be made not later than thirty (30) calendar days after receipt of an acceptable invoice from the Contractor requested at the paying office designated above. Any discrepancies determined as a result of the audit could delay the processing of the invoice and may result in the invoice being returned to the Contractor for corrections.

f. INTEREST ON OVERDUE PAYMENT

The Prompt Payment Act, Public Law 97-177 (96 Stat.85.31 U.S.C. 1801) is applicable to payments under this contract and requires the payment of interest on payments made more than 30 calendar days after receipt of an invoice by the Division of Accounting Operations.

Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and Office of Management and Budget Circular A-125.

3 PAYMENT SCHEDULE

The contractor shall be paid upon the completion of each iteration upon its acceptance and verification by the Contracting Officer's Representative (COR). Invoices shall be submitted at the end of each iteration in accordance with the delivery schedule as established in the Performance Work Statement.

4. TRAVEL

All related travel costs and per diem expenses associated with this Order are included in the price per Contract Line Item Number. No additional costs may be incurred for travel without prior approval of the Contracting Officer. Travel expenses are to be invoiced based upon the Federal Travel Regulations. Payment for travel is based on actual expenses incurred and the contractor is to maintain all receipts/vouchers for expense verification.

B. Block 19, 20, 21, 22, 23 and 24

As prescribed in FAR PART 52.216-1 “Type of Contract”, the Government intends to award a Firm- Fixed Price (FFP) task order. However, the Contracting Officer reserves the right to award any other type contract. The Firm-Fixed Price (FFP) of this task order is $TBD, as follows:

CLIN Description Period of

Performance Total FFP Total Funded

0001 Base Period September 8, 2017

– December 7, $TBD $TBD

TOTAL $TBD $TBD

II. CONTRACT CLAUSES

1. ADDENDA to 52.212-4 Contract Terms and Conditions -- Commercial Items (May 2015)

Invoices and vouchers will be paid in accordance with the CMS payment clauses in the above section (A.1 and A.2).

2. 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (Jun 2016)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015)

(2) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(3) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77, 108- 78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

___ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__X_ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C.

3509).

__X_ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

___ (4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract Awards (Oct 2015) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved]

___ (6) 52.204-14, Service Contract Reporting Requirements (Jan 2014) (Pub. L. 111-117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Jan 2014) (Pub. L. 111-117, section 743 of Div. C).

__X_ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Oct 2015) (31 U.S.C. 6101 note).

___ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

___ (10) [Reserved]

___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved]

___ (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

___ (ii) Alternate I (Nov 2011).

___ (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

___ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (Oct 2015) (15 U.S.C. 637 (d)(4)).

___ (ii) Alternate I (Oct 2001) of 52.219-9.

___ (iii) Alternate II (Oct 2001) of 52.219-9.

___ (iv) Alternate III (Oct 2015) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Nov 2011) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C.

637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011) (15 U.S.C. 657f).

___ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C.

632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

___ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

___ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

___ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Feb 2016) (E.O.

13126).

__X_ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

__X_ (28) 52.222-26, Equal Opportunity (Apr 2015) (E.O. 11246).

___ (29) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

___ (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

___ (31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

___ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

__X_ (33) (i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627).

___ (ii) Alternate I (Mar 2015) of 52.222-50, (22 U.S.C. chapter 78 and E.O. 13627).

___ (34) 52.222-54, Employment Eligibility Verification (Oct 2015). (E. O. 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

___ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (36) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O.13693).

___ (37) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

___ (38) (i) 52.223-13, Acquisition of EPEAT® -Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514

___ (ii) Alternate I (Oct 2015) of 52.223-13.

___ (39) (i) 52.223-14, Acquisition of EPEAT® -Registered Television (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-14.

___ (40) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C.

8259b).

___ (41) (i) 52.223-16, Acquisition of EPEAT® -Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-16.

___ (42) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging while Driving (Aug 2011) (E.O. 13513).

___ (43) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

___ (44) 52.223-21, Foams (Jun 2016) (E.O. 13696).

___ (45) 52.225-1, Buy American--Supplies (May 2014) (41 U.S.C. chapter 83).

___ (46) (i) 52.225-3, Buy American--Free Trade Agreements--Israeli Trade Act (May 2014) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C.

4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110- 138, 112-41, 112-42, and 112-43).

___ (ii) Alternate I (May 2014) of 52.225-3.

___ (iii) Alternate II (May 2014) of 52.225-3.

___ (iv) Alternate III (May 2014) of 52.225-3.

___ (47) 52.225-5, Trade Agreements (Feb 2016) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

___ (48) 52.225-13, Restrictions on Certain Foreign Purchases (Jun 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

___ (49) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Jul 2013) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

___ (50) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C.

5150).

___ (51) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

___ (52) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C. 4505), 10 U.S.C. 2307(f)).

___ (53) 52.232-30, Installment Payments for Commercial Items (Oct 1995) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

___ (54) 52.232-33, Payment by Electronic Funds Transfer— System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (55) 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (56) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

___ (57) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

___ (58) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631).

___ (ii) Alternate I (Apr 2003) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or executive orders applicable to acquisitions of commercial items:

___ (1) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495)

___ (2) 52.222-41, Service Contract Labor Standards (May 2014) (41 U.S.C. chapter 67.).

___ (3) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (4) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (Multiple Year and Option Contracts) (May 2014) (29 U.S.C.206 and 41 U.S.C.

chapter 67).

___ (5) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (6) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (7) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (8) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015) (E.O. 13658).

___ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792).

___ (10) 52.237-11, Accepting and Dispensing of $1 Coin (Sep 2008) (31 U.S.C. 5112(p)(1)).

(d) Comptroller General Examination of Record The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records -- Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)

(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c) and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C.

3509).

(ii) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $700,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(iii) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495). Flow down required in accordance with paragraph (1) of FAR clause 52.222-17.

(iv) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(v) 52.222-26, Equal Opportunity (Apr 2015) (E.O. 11246).

(vi) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

(vii) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C.

793).

(viii) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

(ix) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(x) 52.222-41, Service Contract Labor Standards (May 2014), (41 U.S.C. chapter 67).

(xi) __X__ (A) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C.

chapter 78 and E.O. 13627).

___ (B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 E.O. 13627).

(xii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67.)

(xiii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67)

(xiv) 52.222-54, Employment Eligibility Verification (Oct 2015) (E. O. 12989).

(xv) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015).

(xvi) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Jul 2013) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

(xvii) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xviii) 52.247-64, Preference for Privately-Owned U.S. Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

3. FAR 52.217-8 OPTION TO EXTEND SERVICES (Nov 1999) The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

4. FAR 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 60 days provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 12 months.

5. HHSAR Clauses Incorporated by Reference

352.203-70 ANTI-LOBBYING (DEC 2015)

352.211-13 PAPERWORK REDUCITON ACT (DEC 2015)

352.222-70 CONTRACTOR COOPERATION IN EQUAL EMPLOYMENT

OPPORTUNITY INVESTIGATIONS (DEC 2015)

352.224-70 PRIVACY ACT (DEC 2015)

352.224-71 CONFIDENTIAL INFORMATION (DEC 2015)

352.227-70 PUBLICATION AND PUBLICITY (DEC 2015)

352.239-73 ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY

(DEC 2015)

6. HHSAR 352.224-71 CONFIDENTIAL INFORMATION (DEC 2015)

(a) Confidential Information, as used in this clause, means information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization.

(b) Specific information or categories of information that the Government will furnish to the Contractor, or that the Contractor is expected to generate, which are confidential may be identified elsewhere in this contract. The Contracting Officer may modify this contract to identify Confidential Information from time to time during performance.

(c) Confidential Information or records shall not be disclosed by the Contractor until:

(1) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to release findings of studies or research, to which an agency response may be appropriate to protect the public interest or that of the agency.

(2) For information provided by or on behalf of the government,

(i) The publication or dissemination of the following types of information are restricted under this contract: None

(ii) The reason(s) for restricting the types of information identified in subparagraph (i) is/are:

Not Applicable

(iii) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to disseminate or publish information identified in subparagraph (2)(i).

The contractor shall not disseminate or publish such information without the written consent of the Contracting Officer.

Whenever the Contractor is uncertain with regard to the confidentiality of or a property interest in information under this contract, the Contractor should consult with the Contracting Officer prior to any release, disclosure, dissemination, or publication.

7. CONTRACTOR WORK PERFORMED OUTSIDE THE UNITED STATES AND ITS

TERRITORIES (APR 2016)

To comply with requirements of Homeland Security Presidential Directive -12 (HSPD-12) and Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple CMS information systems by efficiently verifying the claimed identity of individuals working on the contract. The Contractor and its subcontractor(s) shall not perform any activities under this contract, including the transmission of data or other information, outside of the United States (U.S.) and its Territories without the prior written approval of the

Contracting Officer. If work must be performed outside the U.S., the Contractor shall submit a request to the Contracting Officer, in writing, at least 45 calendar days prior to the work beginning.

The Contracting Officer will consider the following factors in making a decision whether to authorize the performance of work outside the U.S. and its Territories:

1. Statement of Work requirements, which are being requested to be completed outside the U.S. and its Territories;

2. Total projected dollar value of the work to be performed outside the U.S.;

3. The desired country/location where the work will be performed;

4. FAR Part 25, Foreign Acquisitions, and all other laws and regulations applicable to the performance of work outside the United States;

5. Whether the contractor and/or its subcontractor(s) have plans in place to adequately protect and secure CMS data, as well as abide by all applicable laws and regulations when work is performed outside of the U.S. and its Territories. Plans shall include -

a. Adequate contract terms regarding system security;

b. Adequate contract terms regarding the confidentiality and privacy requirements for information and data protection;

c. Adequate contract terms that are otherwise relevant, including the requirements of the

Statement of Work;

d. The Contractor’s corporate compliance plan and internal policies and procedures designed to prevent and detect violations of applicable law, regulations, rules and ethical standards by employees, agents and others; and,

6. Whether the approval would be in best interests of the United States.

The Contractor’s request for authorization to perform work outside the U.S. shall demonstrate that the performance of the work outside the U.S. satisfies all of the above factors. The Contracting Officer approval to perform work outside the U.S. may require additional Statement of Work requirements, additional contract terms and conditions and/or Federal Acquisition Regulation (FAR) clauses to be incorporated into the contract

8. GOVERNMENT REPRESENTATIVES AND RESPONSIBILITIES (JUL 2016)

Following are the Government Representatives and their respective roles and responsibilities on this contract:

a. Contracting Officer As defined in Federal Acquisition Regulation (FAR) 2.101, Definitions, and in accordance with FAR 1.602-1, Authority, “Contracting officers have authority to enter into, administer, and/or terminate contracts and make related determinations and findings.” There is no other authorized representative or any other Administrative Contracting Officer assigned to this contract to carry out a Contracting Officer’s duties, except for technical direction assigned to the Contracting Officer’s Representative, if applicable.

The Contracting Officer is:

Centers for Medicare & Medicaid Services Office of Acquisition & Grants Management Division of Medicare and Medicaid Information Technology Support Contracts ATTN: Lyandra Emmanuel 7500 Security Blvd. Mail-stop: B3-30-03

Phone: 410-786-5130 Email Address: Lyandra.Emmanuel@cms.hhs.gov

b. Contract Specialist

Notwithstanding any of the other provisions of this Contract, the Contract Specialist will assist the Contracting Officer with his/her responsibilities as defined in the FAR.

The Contract Specialist is:

Office of Acquisition & Grants Management Division of Medicare and Medicaid Information Technology Support Contracts ATTN: Patrick Forgione 7500 Security Blvd. Mail-stop: B3-30-03 Baltimore, MD 21244-1850 Phone: 410-786-5153 Email Address: Patrick.Forgione1@cms.hhs.gov

c. Contracting Officer’s Representative The Contracting Officer’s Representative (COR), as defined in FAR 2.101, Definitions, is:

Center of Clinical Standards and Quality Director, Division of Acquisition and Security ATTN: Charles Mathers 7500 Security Blvd. Mail-stop: C1-15-26 Baltimore, MD 21244-1850 Phone: 410-786-1084 Email Address: Charles.Mathers1@cms.hhs.gov

In accordance with FAR 1.602-2(d), Responsibilities, the COR’s delegated responsibilities are identified in the Contracting Officer’s appointment memorandum, a copy of which will be furnished to the contractor.

Technical direction must be within the general scope of the work stated in the contract. The term "technical direction" is defined to include, without limitation, the following:

Directions to the Contractor which direct the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual technical requirements as identified in the Statement of Work or Performance Work Statement; or Provision of information to the Contractor, which assists in the interpretation of drawings, specifications, or technical portions of the work description.

The COR does not have the authority to:

1. Make changes to contract terms and conditions;

2. Direct the contractor to perform work or make deliveries not specifically required under the contract;

mailto:Lyandra.Emmanuel@cms.hhs.gov mailto:Patrick.Forgione1@cms.hhs.gov mailto:Charles.Mathers1@cms.hhs.gov

3. Waive or relax the Government’s rights with regard to the Contractor’s compliance with the specifications, price, delivery or any other terms or conditions of the contract;

4. Make any commitments or approve any actions that would create any financial obligation on the part of the Government; or

5. Issue direction that constitutes a “change” as defined in:

FAR 52.243-1, Changes – Fixed Price;

FAR 52.243-2, Changes – Cost Reimbursement;

FAR 52.243-3, Changes – Time and Material and Labor Hour;

FAR 52.243-4, Changes; or, FAR 52.243-5, Changes and Changed Conditions.

All technical direction shall be issued in writing by the COR or, if issued verbally, shall be confirmed in writing by the COR within five (5) business days after issuance.

The Contractor shall proceed promptly with the performance of technical direction duly issued by the COR within the scope of his/her authority.

If, in the opinion of the Contractor, any instruction or direction issued by a Government representative constitutes a change to the contract or constitutes a “Change Order” as defined in FAR 2.101, Definitions, the Contractor shall follow the instructions identified in FAR 52.243-7 Notification of Changes.

9. CMS INFORMATION SECURITY (APR 2013)

All CMS information shall be protected from unauthorized access, use, disclosure, duplication, modification, diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, integrity, and availability of such information. Therefore, if this contract requires the contractor to provide services (both commercial and non-commercial) for Federal Information/Data, to include any of the following requirements:

• Process any Information/Data; or

• Store any Information/Data (includes “Cloud” computing services); or

• Facilitate the transport of Information/Data; or

• Host/maintain Information/Data (including software and/or infrastructure developer/maintainers);

or

• Have access to, or use of, Personally Identifiable Information (PII), including instances of remote access to, or physical removal of, such information beyond agency premises or control, The contractor shall become and remain compliant with the requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS- Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security- Contract-Clause-Provision.html. The requirements cover all CMS contracts and associated deliverables, which are required on a “per contractor” basis.

The contractor shall ensure that the following Federal information security standards are met for all of its CMS contracts:

• Federal Information Security Management Act (FISMA) – FISMA information can be found at http://csrc.nist.gov/groups/SMA/fisma/index.html. FISMA requires each Federal agency to develop, document, and implement an agency-wide program to provide https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source; and,

• Federal Risk and Authorization Management Program (FedRAMP) – FedRAMP information can be found at http://www.gsa.gov/portal/category/102371. The FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

The Contractor shall include in all awarded subcontracts the FISMA/FedRAMP compliance requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and- Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS- Information-Security-Contract-Clause-Provision.html

10. HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. § 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor's duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

"Business Associate'' shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS’ HIPAA-covered functions.

"Covered Entity" shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

"Secretary" shall mean the Secretary of the Department of Health & Human Services or the Secretary's designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

a. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or on behalf of, Covered Entity other than as permitted or required by https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html this Contract or as required by law;

b. Sell PHI; or,

c. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual for:

i. Filing a complaint under 45 CFR § 160.306;

ii.Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under 45 CFR Part 160; or

iii. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

a. Have a security official who will be responsible for development and implementation of its security policies and procedures, including workforce security measures, to ensure proper security awareness and training (including security incident response and reporting), and security incident procedures, in accordance with this Contract, including this HIPAA Business Associate Clause and the Contract’s clause entitled “CMS Information Security.”

b. Use administrative, physical and technical safeguards to prevent use or disclosure of

PHI created, received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as provided for by this Contract. In doing so, it shall implement policies and procedures to address the following and, where applicable, ensure that such policies and procedures are also in conformance with this Contract’s clause entitled “CMS Information Security:”

i. Prevent, detect, contain and correct security violations through the use of:

1. Risk analyses (including periodic technical and nontechnical evaluations);

2. Appropriate risk management strategies, including system activity review;

3. Information access procedures for approving individual’s access rights to PHI (including the implementation of workforce security measures to ensure continued appropriate role-based access to PHI), and technical policies and procedures to ensure compliance with grants of access (including unique user identification and tracking of users) and;

4. The imposition of sanctions for violations.

ii. Limit physical access to its electronic information systems and the facility or facilities in which they are housed.

iii. Implement policies, procedures and physical security measures that will limit access to

PHI through workstations and other devices, including access through mobile devices.

iv. Implement media controls covering the movement of devices containing PHI within or outside of the Business Associate’s facility as well as the disposal and reuse of media containing PHI.

v. Implement appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability (including the use of contingency plans) of any electronic protected health information ("EPHI") it creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, maintenance or transmission of such EPHI. In the establishment of such safeguards, Business Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, and its hardware and software security capabilities.

c. Assess, and implement, where appropriate, any addressable implementation specifications associated with applicable PHI security standards.

d. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

e. Comply with the following Incident Reporting:

(a) Report to Covered Entity any security incident/breach involving unsecured PHI, of which it becomes aware, including those of its agents and subcontractors. The Business Associate shall report any violation of the terms of this contract involving PHI and any security incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in accordance with the CMS Risk Management Handbook (RMH), specifically “RMH Vol II Procedure 7-2 Incident Handling Procedure” and “RMH Vol III Standard 7-1 Incident Handling.” These procedures can be found at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/InformationSecurity/Information-Security-Library.html In addition, the Business Associate will also notify the CMS Contracting Officer and the Contracting Officer’s Representative (COR) by email within one (1) hour of identifying such violation or incident.

(b) Upon Covered Entity's knowledge of any material security incident/breach by

Business Associate, Covered Entity will provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination clause of this Contract. See also paragraph D. Term of Clause below.

f. Ensure that any agent or subcontractor agrees through a written contract, or other legally enforceable arrangement, to the same restrictions and conditions that apply through this HIPAA Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or on behalf of, Covered Entity.

g. Upon Covered Entity’s request:

http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html

i. Provide the Covered Entity or its designee with access to the PHI created, received, maintained or transmitted by Business Associate from or on behalf of the Covered Entity in the course of contract performance in order to ensure Covered Entity’s ability to meet the requirements under 45 CFR § 164.524.

ii. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR §

164.526.

h. Make its facilities and any books, records, accounts, and any sources of PHI, including any policies and procedures, that are pertinent to ascertaining its own compliance with this contract or the Covered Entity’s compliance with the applicable HIPAA requirements, available to Covered Entity, or, in the context of an investigation or compliance review, to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the various rules implementing the HIPAA.

i. Document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

j. Provide to Covered Entity, or an individual identified by the Covered Entity, information collected under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45

CFR § 164.528.

k. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

d. Term of Clause

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of the PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity in accordance with “CMS Information Security” procedures. Business Associate shall not retain any PHI.

2. Security Incident/Breach:

Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall take action consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts – Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of Contracts, if the Business Associate does not cure the security incident/breach within the time specified by Covered Entity and/or cure is not possible; or, B. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

ii. Other Agreements –Covered Entity shall either:

A. Provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination terms of this Contract. Covered Entity may terminate this Contract for default if the Business Associate does not cure the breach or end the violation within the time specified by Covered Entity; or, B. Consistent with the terms of this Contract, terminate this Contract for default if

Business Associate has breached a material term of this Contract and cure is not possible; or, C. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

3. Returning or Destroying PHI:

Business Associate, as defined above, which includes subcontractors…