HSF Beds RFP October 8 2026.docx

Part I The Schedule

Section A: Solicitation/Contract Form.

A.1 Form

Please refer to attached SF-1449 for reference [a partially completed copy will be sent to the successful offeror for review and signature prior to award].

A.2 Table of Contents

Part I – The Schedule

Part II – Contract Clauses

Part III – List of Attachments

Part IV - Representations and Instructions

Section B: Supplies or Services and Prices/Costs

B.1 Solicitation Description

This combined synopsis/solicitation is a Request for Proposals (RFP), prepared in accordance with Federal Acquisition Regulation (FAR) Part 12 and 15 procedures. This announcement constitutes the only solicitation. Offers are being requested and a separate written solicitation will not be issued. This acquisition is performed as a full and open competition.

This solicitation incorporates provisions and clauses by reference. Except as specified otherwise, the full text of provisions and clauses may be accessed electronically at:

The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2026-01, effective March 13, 2026.

The purpose of this acquisition is to secure contractor support to provide Secure Care and Heightened Supervision Facility (HSF) care, capacity, and comprehensive residential services for Unaccompanied Alien Children (UAC) in the care and custody of the Department of Health and Human Services (HHS), Administration for Children and Families (ACF), Office of Refugee Resettlement (ORR), Unaccompanied Alien Children Bureau (UACB), who meet the respective placement criteria for these levels of care.

The Contractor shall operate state-licensed, nationally accredited or be in the process of receiving national accreditation, Secure Care and HSF programs within the contiguous United States and provide humane, secure residential care and comprehensive services for UAC ages 13 through 17. The requirement includes capacity for up to:

· 150 Secure Care beds; and

· 100 HSF beds.

The Contractor shall provide all appropriately cleared and qualified personnel, facilities, equipment, supplies, transportation, tools, materials, supervision, and other non-personal services necessary to perform the requirements of the Performance Work Statement (PWS). Required comprehensive services include, as applicable, residential care and supervision, healthcare, behavioral and mental health services, education, case management, counseling, recreation, nutrition, transportation, religious access, acculturation services, discharge planning, and support for transfer or safe release.

The Contractor shall provide the Secure Care and HSF bed increments specified at award and shall have the initial awarded increments available for UAC placement no later than 120 calendar days after award. The minimum initial capacity is 30 Secure Care beds and 30 HSF beds. The Contractor shall maintain the operational flexibility, facility capacity, and appropriately cleared staffing necessary to increase or decrease bed increments as directed by the Contracting Officer in accordance with the PWS.

Programs shall operate 24 hours a day, seven days a week, 365 days a year and shall be capable of accepting new admissions within 48 hours of referral by ORR.

B.2 Contract Type

The Government contemplates award of one (1) standalone contract under this solicitation. The resulting contract will utilize a hybrid pricing arrangement consisting primarily of Firm-Fixed-Price (FFP) and Firm-Fixed-Unit-Price (FFUP) Contract Line Item Numbers (CLINs), with a reimbursable travel CLIN subject to a Government-established Not-to-Exceed (NTE) ceiling.

The contract pricing structure consists of the following:

The Government intends to award a single contract to promote continuity of care and operational flexibility between the Secure Care and HSF levels of care. The Contractor may utilize one or more facilities or campuses in its proposed approach, provided all requirements of the solicitation and PWS are satisfied.

B.3 Contract Pricing

The Offeror shall propose prices in accordance with Attachment 5 – Pricing Worksheet and the pricing structure established in this section. Proposed prices shall include all costs necessary to perform the applicable PWS requirements, except for costs expressly identified as separately priced or reimbursable.

Offerors shall ensure that costs are proposed under the appropriate pricing component and are not duplicated among CLINs or other pricing elements.

B.3.1 Firm-Fixed Pricing

Offerors shall provide the pricing information required by Attachment 5 – Pricing Worksheet to support the proposed FFP for each applicable pricing element. Costs included in an FFP pricing element shall not also be included in the Daily Bed Rates or another separately priced or reimbursable CLIN.

B.3.2 Contract Pricing (Firm Fixed Unit Price)

The Offeror shall propose Daily Bed Rates for each level of care identified in Attachment 5 – Pricing Worksheet. Daily Bed Rates shall be established as Firm-Fixed-Unit-Prices (FFUP).

The applicable Daily Bed Rate shall include all personnel, supervision, supplies, equipment, comprehensive services, and other costs necessary to provide the applicable Secure Care or HSF bed and associated services in accordance with the PWS, except for costs expressly identified in this solicitation as separately priced or reimbursable.

Firm-Fixed-Unit-Prices will be established at award based on the Offeror's proposed Daily Bed Rates for each applicable level of care.

The Government will establish the initial Secure Care and HSF bed increments at contract award. Following award, the Contracting Officer may direct increases or decreases to the applicable bed increments in accordance with the PWS.

Following performance and Government inspection and acceptance of the associated services, the Government will pay the applicable Firm-Fixed-Unit-Prices in accordance with the contract and the pricing and invoicing requirements in Sections B and G.

B.3.3 Travel

Travel within the local area, as defined by the PWS, is considered a cost of doing business and shall not be separately reimbursed.

Authorized travel outside the local area shall be reimbursable under the applicable travel CLIN, subject to the Government-established Not-to-Exceed (NTE) ceiling for each period of performance identified Section B.5.

Travel must be necessary for contract performance and must be authorized in accordance with the PWS and the terms and conditions of the contract. All travel shall be approved in writing by the Contracting Officer, following COR review and recommendation, prior to the Contractor incurring travel-related expenses, except as otherwise provided for emergency or unanticipated travel in the PWS.

Reimbursement shall be made in accordance with the applicable travel requirements of the contract and shall not exceed the allowable rates specified therein. The Contractor shall provide appropriate supporting documentation for reimbursement.

Indirect costs and profit shall not be reimbursed as part of travel costs.

B.3.4 Price Inclusivity and Prevention of Duplicate Costs

Offerors shall ensure that all proposed costs are included under the appropriate pricing component and are not duplicated.

For purposes of preparing the price proposal:

a. Dedicated Key Personnel costs shall be included only in the applicable FFP pricing component;

b. Non-dedicated personnel and costs associated with providing comprehensive services shall be included, as applicable, in the Daily Bed Rates;

c. Facility costs designated by the PWS for inclusion in the Facility Fee shall be included only in the FFP Facility Fee;

d. Ramp-Up/Transition-In costs shall be included only in the applicable FFP Ramp-Up/Transition-In pricing component;

e. Local travel costs shall be included in the applicable FFP or FFUP pricing and shall not be separately reimbursed; and

f. Authorized non-local travel shall be invoiced only under the applicable reimbursable travel CLIN and shall be subject to the established NTE ceiling.

Costs included in one FFP, FFUP, or reimbursable pricing component shall not also be proposed or invoiced under another CLIN or pricing component.

B.3.5 Ceiling Price(s)

The not-to-exceed (NTE) ceiling price for travel for each period of performance is provided by the Government in Attachment 5 - Pricing Worksheet, and below in section B.5, which shall only be changed by a signed modification to the contract.

B.4 Contract Line-Item Number (CLIN) Structure

The CLIN schedule below applies to the contract contemplated by this solicitation. Prices for non-travel CLINs will be established from Attachment 5. Government-provided travel NTE amounts are stated for each period of performance.

The minimum guarantee for each period of performance is thirty (30) Secure Care beds and thirty (30) HSF beds. Bed quantities above the minimum guarantee may be ordered in the increments identified below, up to a maximum capacity of 150 Secure Care beds and 100 HSF beds.

Base Period

Base Period - Maximum Potential Total Value

See Attachment 5

Option Period 1

Option Period 1 - Maximum Potential Total Value

See Attachment 5

Option Period 2

Option Period 2 - Maximum Potential Total Value

See Attachment 5

Option Period 3

Option Period 3 - Maximum Potential Total Value

See Attachment 5

Option Period 4

Option Period 4 - Maximum Potential Total Value

See Attachment 5

B.5 Ceiling Price

The quantities provided in Attachment 5 are estimate provided solely for the for purposes of budgeting and evaluation of offers and will be the basis of creating a total ceiling price for firm fixed unit prices performed under this contract. Offerors are cautioned that specific quantities of services required under this contract may vary throughout performance. However, the Contractor shall not be obligated to continue performance, nor the Government be obligated to pay any amount in excess of the established ceiling price.

Section C Performance Work Statement (PWS).

Please refer to Attachment 2 - Performance Work Statement (PWS), ORR Secure Care and Heightened Supervision Facility (HSF) Bed Placement Services for Unaccompanied Alien Children (UAC).

Section D Package and Marking.

Except where the contract specifically requires the submission, storage, or shipment of paper records or other physical materials, deliverables shall be submitted electronically through Government-approved secure means to the Contracting Officer's Representative (COR).

D.1 Government Furnished Equipment/Property

The Contractor must provide all equipment and supplies necessary to perform the services required under this contract. The Government will not furnish any supplies or equipment.

Section E: Inspection and Acceptance

E.1 Inspection and Acceptance

Pursuant to RFO FAR clause 52.212-4 (July 2026) (Deviation), all work described in Section C and delivered under this contract is subject to final inspection and acceptance by an authorized representative of the Government.

The Contracting Officer's Representative (COR) is the authorized Government representative responsible for inspection and acceptance of the services, materials, or supplies provided by the Contractor.

The COR will conduct surveillance using the Government's Quality Assurance Surveillance Plan (QASP). The QASP is an internal Government surveillance tool and does not establish, modify, or supersede the performance or acceptance requirements of the Performance Work Statement (PWS).

E.2 Inspection and Acceptance Criteria

The Government shall conduct performance surveillance and review performance reports furnished by the Contractor to determine how the Contractor is performing against established performance standards. The primary methods of surveillance to be used by the Government include, but are not limited to:

· Routine Monitoring: The COR shall review project status and progress reports

· Random Inspection: The COR may request ad hoc performance reports from the Contractor to review performance outside the normal review cycle

· Customer Feedback: The Government may review customer satisfaction feedback from internal and external stakeholders. Stakeholder feedback can be obtained through multiple approaches, such as direct observation, general complaints, satisfaction surveys, etc.

· Scheduled or unscheduled monitoring and inspection of services and processes may be performed by the COR or other ORR representatives through direct observation either virtually or at the contractor’s place of performance.

E.3 General Acceptance Criteria

In addition to the inspection and acceptance requirements specified in the contract, general quality measures, as set forth below, will be applied to each work product received from the Contractor under this contract:

· Accuracy - Work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

· Clarity - Work products shall be clear and concise. Any/all diagrams shall be easy to understand and be relevant to the supporting narrative.

· Consistency to Requirements - All work products must satisfy the requirements of the Performance Work Statement (PWS).

· File Editing - All text and diagrammatic files shall be editable by the Government.

· Format - Work products shall be submitted electronically. The electronic copy must be in a format as indicated in the Deliverables Table of the PWS.

Section F: Deliveries or Performance

F.1 Period of Performance

The anticipated period of performance consists of one (1) twelve-month base period, four (4) twelve-month option periods, and the optional extension of up to six months under RFO FAR 52.217-8, if exercised. The total potential duration, including all options, is sixty six (66) months.

F.2 Place of Performance

Under this solicitation the offeror must offer state licensed facilities in the respective state where services under this contract are being offered. For an offeror operating in a state where licensing is not available, facilities and programs must operate in accordance with state licensing standards (see 45 C.F.R. 410.1302(a)). Facilities operated in a state where licensing is not available must be able to demonstrate existing experience and capacity to successfully operate special population levels and care and programs equivalent to the state licensing standards (see 45 C.F.R. 410.1302(a)); and shall satisfactorily meet all applicable federal, state, and local regulations, including state-licensing requirements and applicable ORR regulations.

F.3. Hours of Performance

Services under this contract shall be performed continuously, 24 hours perday, 7 days per week, 365 days per year, including weekends and Federal holidays, with no lapse in coverage for the population in the Contractor's care. See PWS Section 2.1.10 for applicable operational requirements and PWS Section 2.5.4.2.16 for staffing requirements.

F.4. Delivery Requirements

Physical deliveries (if required) to the Government under this solicitation shall be accomplished between the hours of 8:30 a.m. and 4:00 p.m. Eastern Time, Monday through Friday, unless authorized by the COR. No deliveries shall be made on Saturdays, Sundays, and days of government closure or Federal legal holidays found at: http://www.opm.gov/operating_status_schedules .

F.5 Performance Requirements Summary (PRS) and Quality Assurance Surveillance Plan (QASP)

The Performance Requirements Summary (PRS), in conjunction with the tasks, deliverables, performance standards, and Acceptable Quality Levels (AQLs) identified in the Performance Work Statement (PWS), establishes the performance requirements applicable to this contract. See the Delivery Schedule and Performance Requirements Summary in PWS Section 4.0. The Contractor shall perform all requirements in accordance with the terms and conditions of the contract.

The Government will conduct quality assurance and surveillance of Contractor performance in accordance with the contract and the Quality Assurance Surveillance Plan (QASP). The QASP is a Government surveillance tool used to assess Contractor performance and determine whether services and deliverables conform to contractual requirements.

The QASP does not establish or modify the Contractor's contractual requirements, performance standards, AQLs, deliverables, acceptance criteria, remedies, or other contractual obligations. Any change to the Contractor's contractual requirements or obligations must be authorized by the Contracting Officer and incorporated into the contract, as applicable.

Definitions:

· Performance Standard: The specific, measurable criteria for performance quality that the Contractor is required to meet or exceed.

· Acceptable Quality Level (AQL): The minimally acceptable level of performance and the maximum allowable deviation or error rate from the performance standard. An AQL establishes the allowable variance, when a variance is permitted, before performance is considered non-conforming.

Section G: Contract Administration Data

G.1 Authorities of Government Personnel

Notwithstanding the Contractor's responsibility for total management during the performance of the resulting contract, the administration will require maximum coordination between the Government and the resulting Contractor(s). The following individuals will be the Government's authorized officials during the performance:

Contracting Officer Emily Graham HHS/ASFR/Office of Mission Acquisition Solutions (OMAS) emily.graham@hhs.gov

All communications pertaining to contractual and/or administrative matters under this solicitation shall be sent to:

Administrative Contracting Officer Amber Harris HHS/ASFR/Office of Mission Acquisition Solutions (OMAS) amber.harris@hhs.gov

Contract Specialist Marvin Barnett HHS/ASFR/Office of Mission Acquisition Solutions (OMAS) marvin.barnett@hhs.gov

Note: The Contracting Officer is the only individual authorized to modify the resultant contract.

Contracting Officer's Representative (COR)

Name: [To Be Specified at time of Award] Email: [To Be Specified at time of Award]

G.2 Contracting Officer’s Representative (COR) Authority

a. Performance of work under the resultant contract is subject to the technical direction of the Contracting Officer's Representative identified above, or a representative designated in writing by the Contracting Officer that specifies limits of authority. The term "technical direction" includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

b. Technical direction must be within the scope of the specification(s)/work statement.

The Contracting Officer's Representative does not have authority to issue technical direction that:

1. Constitutes a change of assignment or additional work outside the specification(s)/statement of work;

2. Constitutes a change as defined in the clause entitled "Changes";

3. In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

4. Changes any of the terms, conditions, or specification(s)/work statement of the contract;

5. Interferes with the contractor's right to perform under the terms and conditions of the contract; or

6. Directs, supervises or otherwise controls the actions of the contractor's employees.

c. Technical direction may be oral or in writing. The Contracting Officer's Representative shall confirm oral direction in writing within five work days, with a copy to the Contracting Officer.

d. The contractor shall proceed promptly with performance resulting from the technical direction issued by the Contracting Officer’s Representative. If, in the opinion of the contractor, any direction of the Contracting Officer’s Representative, or his/her designee, falls within the limitations in (b), above, the contractor shall promptly notify the Contracting Officer no later than the beginning of the next Government work day.

e. Failure of the contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes."

G.3 Invoices

G.3.1 General Invoice Requirements

Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP)

• All Invoice submissions for goods and or services delivered to facilitate payments must be made electronically through the U.S. Department of Treasury’s Invoice Processing Platform System (IPP).

• Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 included in commercial items contracts. The IPP website address is: https://www.ipp.gov.

• The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 – 5 business days of the contract award for new contracts or date of modification for existing contracts.

· Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

· The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

• If your company is already registered to use IPP, you will not be required to re-register.

Additional Office of Mission Acquisition Solutions (OMAS) requirements:

a. The contractor shall submit invoices under this contract once per month.

b. Invoices must break-out price/cost by contract line-item number (CLIN) and sub-CLIN as specified in the pricing section of the contract.

c. Invoices submitted to IPP are limited to 10MB. Invoice supporting documentation must be sent to the contracting officer, contract specialist, and COR with a reference to the invoice number(s) the documentation supports prior to submission into IPP.

G.3.2 General Invoice Requirements

The contractor may include FFP and/or FFUP services in the same invoice. The invoice must be itemized by CLIN and sub-CLIN as required by Section G.5, Contract Line-Item Number (CLIN) Structure. The contractor shall not include any personally identifiable information or other potentially sensitive UAC-related information on the IPP invoice. All invoices shall have supporting documentation. Supporting documentation shall include back up documentation that identifies UAC A#, bed type, and dates for all services invoiced. All supporting documentation shall be submitted to the COR for review and approval prior to submission of the invoice into IPP.

G.3.2.1 Firm Fixed Unit Priced (FFUP) Invoicing Requirements

Invoices submitted under this contract for FFUP services, following completion of the service or phase of a service required by PWS must at a minimum:

· Identify the period in which the service began (Base Period, Option Period 1, etc.)

· Identify the item number (, service(s), quantities, and unit prices(s) invoiced as specified in the Pricing Worksheet.

G.4 Travel Related Costs

The Contractor will be reimbursed for domestic travel as described below, incurred directly and specifically in the performance of this contract, claimed by the Contractor and accepted by the Contracting Officer.

Domestic travel expenses incurred by the Contractor in direct performance of the contract shall be reimbursed at actual cost in accordance with the limitations set forth in RFO FAR 31.205-46 provided such travel is necessary for the performance of this contract and the cost does not exceed:

a. The lowest customary standard, coach, or equivalent airfare offered during normal business hours for air travel except when such accommodations: 1) require circuitous routing, 2) require travel during unreasonable hours, 3) excessively prolong travel, 4) result in increased costs that would offset transportation savings, 5) are not reasonably adequate for the physical or medical needs of the traveler, or 6) are not reasonably available to meet mission requirements. In order for costs in excess of customary standard or coach airfare to be considered allowable, the applicable exception must be documented and justified.

b. Costs of rail travel by most direct route, coach-class accommodations.

c. The prevailing mileage rate set forth in the Federal Travel Regulation (FTR) or reasonable actual expenses for travel by motor vehicle. Travel by motor vehicle, including rented automobile, shall be reimbursed on a reasonable actual expense basis, or at the Contractor's option, on a mileage basis at the prevailing FTR rate, plus any toll or ferry charges.

d. The prevailing rates set forth in the FTR for lodging, meals and incidental expenses.

G.5 Ceiling Amounts and Minimum Guarantee

The ceiling amounts under this contract are identified as “Not-to-Exceed Ceiling Amounts” listed in section B.

The minimum guarantee under this contract is 30 Secure Care beds and 30 HSF beds per period of performance, as reflected in the CLIN pricing structure in Section B.

Section H Special Contract Requirements

H.1 Prohibition Against Personal Services

The Contractor shall not perform personal services under this contract. Contractor personnel are employees of the Contractor or its subcontractors and shall remain under the control and supervision of the Contractor. A Contractor supervisor shall provide individual Contractor employee assignments and daily work direction. Government personnel shall not supervise or direct Contractor employees in the performance of their individual assignments.

If, at any time, the Contractor believes that a Government action, direction, or communication creates or may create the appearance of a personal services relationship between the Government and any Contractor employee, the Contractor shall notify the Contracting Officer in writing within twenty-four (24) hours of the action, direction, or communication.

The Contractor shall not perform inherently governmental functions under this contract. Contractor personnel shall not represent themselves, or give the appearance that they are, Government employees, agents, or representatives. Contractor personnel shall not state orally or in writing that they are acting on behalf of the Government or otherwise possess authority to bind or represent the Government.

The Contractor is responsible for ensuring that its employees and subcontractors performing under this contract understand and comply with the requirements of this section.

H.2 Key Personnel n accordance with the Key Personnel terms included in the contract, the following positions are designated as Key Personnel

H.2.1 Key Personnel – Minimum Qualifications

The following positions are designated as Key Personnel under this contract. Key Personnel shall meet the minimum education, experience, licensure, certification, and other qualification requirements identified below and in PWS Section 2.4.3.

The duties, responsibilities, and additional requirements applicable to each Key Personnel position are set forth in the corresponding PWS paragraph identified above.

H.3 352.204-71 Information and Information Systems Security (Feb 2024) (Deviation)

(a) Definitions. As used in this clause— Breach means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where—

(1) A person other than an authorized user accesses or potentially accesses personally identifiable information, or

(2) An authorized user accesses personally identifiable information for an other than authorized purpose.

Business associate (see 45 CFR 160.103), except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person who -

(1) On behalf of such covered entity or of an organized health care arrangement (as defined in this clause) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this contract or agreement, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or

(2) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in 45 CFR section 164.501), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.

(3) A covered entity may be a business associate of another covered entity.

(4) Business associate includes the following:

(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

(5) Business associate does not include:

(i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.

(ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of 45 CFR 164.504(f) apply and are met.

(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.

(iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.

Business associate agreement means the agreement, or other arrangement, as dictated by the HIPAA Privacy Rule (45 CFR 160), between an HHS covered entity and a business associate, which must be entered into in addition to the underlying contract for services and before any disclosure (see 45 CFR 160.103) of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of an HHS entity.

Controlled unclassified information (CUI) means information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.

Healthcare component means a component or combination of components of a hybrid entity designated by the hybrid entity in accordance with 45 CFR 164.105(a)(2)(iii)(D) (see 45 CFR 164.103). The Secretary of HHS has designated HHS as a covered entity (further designated as a “hybrid entity”), and has also designated four HHS divisions as healthcare components under HIPAA, including —

(1) The Centers for Medicare and Medicaid Services (CMS), insofar as it operates the fee-for-service Medicare program;

(2) The Program Support Center (PSC), Division of Commissioned Personnel, insofar as it operates a health plan for Commissioned Corps officers;

(3) The World Trade Center (WTC) Health Program; and,

(4) The Indian Health Service (IHS), insofar as it operates a health plan and a program providing healthcare that uses electronic transactions.

HHS Information Technology General Rules of Behavior means a set of HHS rules that describes the responsibilities and expected behavior of users of HHS information or information systems.

HHS sensitive information means all HHS data, on any storage media or in any form or format, which requires confidentiality, integrity, and availability protection due to the risk of harm that could result to interests of HHS, other agencies or entities, or individuals from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes—

(1) Information where the improper use or disclosure could adversely affect the ability of HHS to accomplish its mission, i.e., HHS proprietary information;

(2) Records about individuals requiring protection under laws and regulations such as the E-Government Act, Privacy Act and the HIPAA Privacy Rule, or based on a data use agreement or a promise or assurance of confidentiality; and

(3) Information that would be exempt from disclosure if requested under the Freedom of Information Act. Examples of HHS sensitive information include—

(i) Individually-identifiable medical, benefits, and personnel information;

(ii) Financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, security-sensitive, procurement-sensitive, investigatory, and law enforcement information;

(iii) Controlled unclassified information;

(iv) Information that would be confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and

(v) Other information which, if released, could result in a violation of law or agreement, could cause harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and part 164.

Incident means an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information systems; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable policies.

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Information system security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

Information technology (see FAR 2.101) also means Information and Communication Technology (ICT).

Information technology-related contracts means those contracts that include services (including support services), and related resources for information technology.

Organized health care arrangement (see 45 CFR 160.103) means:

(1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;

(2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities:

(i) Hold themselves out to the public as participating in a joint arrangement;

and

(ii) Participate in joint activities that include at least one of the following:

(A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;

(B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or

(C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.

(3) A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;

(4) A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or

(5) The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.

Privacy officer means the HHS official(s) with responsibility for implementing and oversight of privacy related policies and practices that impact a given HHS acquisition.

(b) General. Contractors, subcontractors, their employees, third-parties, and business associates with access to HHS information, information systems, or information technology (IT) or providing and accessing IT-related goods and services, shall adhere to the HHS Cybersecurity Program and the directives and handbooks, complete HHS security training prior to accessing HHS information (including HHS sensitive information and information systems security and privacy) and on an annual basis thereafter, as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, HHS Personnel Security and Suitability Program, which establishes HHS procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards, and guidance for protecting HHS information, information systems (see 302.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing HHS information or information systems.

(c) Access to HHS information and HHS information systems.

(1) Contractors are limited in their request for logical or physical access to HHS information or HHS information systems for their employees, subcontractors, third parties and business associates to the extent necessary to perform the services or provide the goods as specified in the contracts, agreements, task, delivery, or purchase orders.

(2) All Contractors, subcontractors, third parties, and business associates working with HHS information are subject to the same investigative requirements as those of HHS appointees or employees who have access to the same types of information.