HT940623Q0001.docx

HT940623Q0001

Section A - Solicitation/Contract Form

SECTION A

VENDOR TO COMPLETE THE FOLLOWING:

Vendor Name: ___________

Vendor Point of Contact:

Vendor Address: __________________________________________________

Vendor Phone:

Vendor Fax:

Vendor E-Mail:

CAGE:

Unique Entity ID (UEID): __________

Vendor to reference Open Market Quote HT940623Q0001 on all correspondence relating to this RFQ.

Naval Medical Center Portsmouth Contracting Point of Contact:

Melissa Peregrino E-Mail: melissa.peregrino-white.civ@health.mil (questions via e-mail only)

Payment in Arrears (Check One): ___ Monthly ___ Quarterly ___Semi-Annually ___Annually

Note: Vendor will be required to provide billing electronically via the WAWF Electronic Invoicing Method. For additional information, a review of the following web sites may be required: https://wawf.eb.mil http://wawftraining Email: wawf@med.navy.mil

PROMPT PAYMENT: For Prompt Payment Act purposes, this contract is:

Subject to the 7-calendar day constructive acceptance period.

This notice is hereby posted to state that the Government intends to make a sole source purchase of services listed in Section B from PerkinElmer Health Sciences, Inc.

Section B - Supplies or Services and Prices

PinAAcle 900Z W H2O Recir

FFP

Model: AAN3200060

S/N: PZAS17090601

Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support FOB: Destination J065

NET AMT

AA Software

Model: AASOFTWARE

S/N: PZAS17090601

Bronze Service Plan Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

OPTIMA5300DV

Model: OPTIMA5300DV S/N: 077C7091301 Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

S10AUTOSAMPLER

Model: S10AUTOSAMPLER S/N: 102S7093606 Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

POLYSCIENCE CHILLER

Model: POLYSCICHILLER S/N: 107900255 Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

ICP Software

Model: ICPSOFTWARE S/N: 077C7091301 Bronze Service Plan Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

PinAAcle 900Z THGA W H2O RECIR

Model: AAN360060

S/N: PZIVD16030902

Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

AA Software

Model: AASOFTWARE

S/N: PZIVD16030902

Bronze Service Plan Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

Chiller

Model: FURNACECOOLINGSYST S/N: 319S16011803 Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

NEXION 2000 MODEL C

Model: MASN8150015 S/N: 815N8032801C Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

Chiller - 1 HP 230V / 60HZ TP QUIET

Model: ICPN0772046 S/N: 1803-01707 Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

2DXX FAST Dual Rinse Autosampler

Model: MASN8150390

S/N: SC2-180461

Gold Service Plan with 1 Preventive Maintenance Visit Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

MAS Software

Model: MASSOFTWARE S/N: 815N8032801C Bronze Service Plan Unlimited Repair Service - Non-consumable Parts, Labor, Travel Phone / Remote Support

NET AMT

Section C - Descriptions and Specifications

SECTION C

Department of Defense Defense Health Agency Performance Work Statement

MAINTENANCE ON GOVERNMENT OWNED PERKIN ELMER EQUIPMENT

Navy Environmental and Preventive Medicine Unit 2

1.0 GENERAL INFORMATION

1.0 Scope of Work: The contractor shall provide maintenance and software support on the Comprehensive Industrial Hygiene Laboratory (CIHL) Norfolks, instrumentation listed below.

107900255 102S7093606

CHILLER-lHP 230V/60HZ Autosampler SCDX ICPM Software

815N8032801C 1803-01707 SC2-180461, 815N8032801C

*** This instrument is past its serviceable life. A replacement was requested in 2020. Perkin Elmer will use all reasonable efforts to provide service including a service engineer's travel and labor, but cannot guarantee that all parts, among other items necessary for continued support will be available. PerkinElmer will not make additional attempts to procure unavailable parts.

2.0 Background: The instruments that will be covered under this contract are esponsible for 80% of the laboratory's complete sample volume. The PinAAcle 900Z are responsible for patient testing consisting of blood lead analysis. This testing is completed per the OSHA 19100S.1025 Lead standard and per our COLA accreditation body. The remaining instruments are used in the analysis of multiple different metals in paint, swipe, and bulk samples. The work completed under the American Industrial

Hygiene Association Laboratory Accreditation Program for both the Environmental Lead Laboratory Accreditation Program and the Industrial Hygiene Laboratory Accreditation Program.

CONTRACTOR REQUIREMENTS

3.0 Technical Requirements/Tasks: The effort required here under should be performed in accordance with Statement of work and in accordance with all other terms and conditions set forth herein.

The contractor shall provide all services, materials and equipment necessary for the maintenance on model Pini\Acles, which includes AA softwares, furnace cooling chillers, and furnace auto samplers. This equipment is located in the NEPMU-2 Comprehensive Industrial Hygiene Laboratory Norfoik, VA

The contractor shall provide all services, materials and equipment necessary for the maintenance on OPTIMA 5300DV ICP with ICP software, Polyscience cooling chiller, and Autosampler model # SIOP.

This equipment is located in the NEPMU-2 Comprehensive Industrial Hygiene Laboratory Norfolk, VA

The scope of work performed under these specifications is defined by the Original Equipment Manufacmrer (OEM) service plan for the inspection, repair and preventive maintenance, of all equipment listed to ensure continuous operation at their designed efficiency and capacity.

3.1 THE CONTRACTOR SHALL PERFORM THE FOLLOWING FUNCTIONS:

Ensure that only FULLY QUALIFIED FIELD ENGINEERS AND TECHNICIANS, who have completed and passed the training from the OEM.

3.2. Perform routine and emergency maintenance on the Govt. owned instrument listed above. All maintenance shall be performed within the Principal Period of Maintenance, which is 0700-1600 hours, Monday through Friday, except on Government holiday.

Government holidays are:

New Year's Day (1 January) Martin Luther King Day (3rd Monday in January) Presidents' Day (3rd Monday in February) Memorial Day (last Monday in May) 4th of July Juneteenth Labor Day (1st Monday in September) Columbus Day (2nd Monday in October) Veterans' Day (11th of November) Thanksgiving Day (4th Thursday in November) Christmas Day (25th of December)

3 3 The contractor shall provide a contact phone number to the Comprehensive Industrial Hygiene Laboratory and to Purchasing Division immediately upon contract award. This phone number will be used to call in equipment failures.

3.4 All attempts shall be made to fully restore the equipment to full operational capability within the Principal Period of Maintenance at the location. If the equipment is not fully restored during the Principal Period of Maintenance, the contractor shall continue to perform the maintenance services on the next business day.

3 .5 Perform all maintenance to industry standards.

3.6 Make repairs to the extent necessary (as determined by inspection tests or disassembly) to ensure a functional sysrem that will efficiently serve its intended purpose.

3.7 The contractor shall perform the following maintenance (1) inspection, (2) corrective maintenance, (3) preventative maintenance and on-call maintenance with the OEM maintenance schedule.

3.7.l Corrective Maintenance: The contractor shall perform corrective maintenance, as required, on the system and its components in accordance with the original equipment m (OEM). The contractor shall ensure that the equipment do not remain unusable due to an equipment, through no fault or negligence of the Government for a period of 48 consecutive hours or more than 72 consecutive_hours during a seventy-two (72) hour period.

3.7.3 Provide only the work necessary to restore the equipment to a serviceable/operating condition by adjustments, replacement parts, or minor repairs.

3.8 Preventative Maintenance: The contractor shall provide preventative maintenance in accordance wi:i1 the Original Equipment Manufacturers' (OEM) manual by maintaining the equipment in a satisfactory operating condition. The contractor shall perform a systematic inspection, detection, and correction of potential failures either before they occur or before they develop into major defects.

3.8.1 Check, c!ean, adjust and calibrate operation and scanning functions regularly and according OEM maintenance schedule.

3.8.2 Replace worn, failed or doubtful components and parts including worn or frayed electrical wire or power corns. Where statistical data on similar equipment indicated failure point is approaching for any component, said corr,ponerr:: si",all be repaired or replace in advance to prevent system downtime/failure.

3.8.3 The contractor, shall provide the recommended engineering and maintenance practices in accordance with the manufacturer's guideline as the manufacture has already determined and cataloged the engineering and maintenance requirements

3.8.4 The contractor shall perform one scheduled Preventive Maintenance visits per year to ensure proper equipment function.

3.9 On Call Mainntenance: On-call maintenance shall be performed during laboratory operation hours from 0700 to 1600, Monday through Friday, except on Government holidays.

3.9.1 The contracwr personnel shall respond to service calls telephonically within 4 hours, and provide an on-site response within 2 to 3 business days if the problem cannot be resolved telephonically.

3.10 Sofcware Maintenance: The contractor shall provide free of charge during the warranty period all software upgrades whose purpose is to address operating discrepancies (bugs) at no additional cost to the Government.

4.0 The contractor shall install upgraded components and make system modification and improvements on a regular basis that is recommended by the manufacturer. Equipment improvements/modifications shall be made only or written approval and direction of the NEPMU-2 Comprehensive Industrial Hygiene Laboratory Norfolk.

4.1 Notify NEPMU-2 Comprehensive Industrial Hygiene Laboratory Norfolk immediately upon receipt or OEM or replacement parts/equipment safety recall notices.

4.2 Ensure that original design and functional capabilities will not be changed, modified, or altered unless the NEPMU-2 Comprehensive Industrial Hygiene Laboratory Norfolk authorizes such changes.

4.3 Provide suitable modem recommended repair equipment/tools required for the satisfactory execution of ail repairs made.

4.4 Furrdsh mar.u:acturer OEM approved lubricants and lubricate wear points within the equipment.

4.5 Insure that all work areas are properly cleaned of all repair/maintenance work residual immediately after completion of service call.

4.6 Exrend to the Government all commercial warranties on replacement parts, consistent with standard industry practices.

4.7 Pe.ns and Marerials: The contractor shall maintain an adequate spare parts inventory on parts with a history of high failure/replacement rates in an established service facility located geographically to permit 2 to 3 business day's service call response arrival at NEPMU-2 Comprehensive Industrial Hygiene Laboratory Norfolk. .

4.8 The total cost for all parts necessary for 100% readiness shall be included in the monthly price. The contractor shall provide a list of recommended spare parts and shall make recommendations for spare parts inventory.

5.0 SPECL\L CONDITIONS:

5.1 TITLE TO EQUIPMENT: The contractor shall not assume possession or control of any part of the equipment. The Government retains ownership to title thereof.

5.2 LIABILITY: The contractor shall not be liable for any loss, damage, or delay due to any cause beyond his reasonable control including, but not limited to, acts of government, strikes, lockouts, fire, explosion, theft, floods, riot, civil commotion, war, malicious mischief or acts of God.

5.3 UTILITIES: The contractor may use Government utilities, (electrical power, compressed air, and vacuum) that is available and required for any service provided.

5.4 ACCESS TO EQUIPMENT: Contractor personnel shall first report to the Department Head, CIHL, 0r designared representative, prior to commencement of any work under this contract.

5.4. 1 The contractor will be provided reasonable access to all equipment that is to be serviced and utility 0utlets required to the service.

5.4.2 The contractor will be free to start and stop all primary equipment incidentals to the operation of the maintained equipment after permission is received from Chemistry Team Leader, CII-IL, or his designated representative, responsible for such equipment.

6. COMPENSATION:

6.1 Labor: All compensation for labor is included in the contract price.

6.2 Parts and Material: All compensation for parts, and travel time is included in the contract price.

6.3 Parts/Supplies Quality: Parts and supplies provided under this contract shall be guaranteed to be equal in all respects, including performance, interchangeability, durability and quality to the OEM parts with new or as presently recommended by the manufacturer.

7.0 Deliverables / Schedule:

Key Deliverables

correction of potential failures either I before they occur or before they develop into major defects.

Per the original equipment manufacturers guidance. To be no less than once a year.

8.0 Travel: All travel of the technician is covered in the contract.

8.1 Contractor's Key Personnel: Only Perkin Elmer certified engineers may work on the instruments listed within this contract. All work must be done using Perkin Elmer manufactured parts.

8.2 Security Requirements: Technicians must schedule all visits with NEPMU-2 in order to secure transportation onto the base.

9.0 Data Rights: All data and information remains property of the government and may not be removed from the laboratory without permission and clearance.

(End of PWS)

Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (Jan 2017)

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This text applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation , which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

· SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

· Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

· Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

(End of clause)

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

Section F - Deliveries or Performance

DELIVERY INFORMATION

31-OCT-2023

NEPMU-2 / CIHL NORFOLK

1285 WEST D STREET BLDG U-238

NORFOLK VA 23511-3394

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

31-OCT-2023

N63117

Section G - Contract Administration Data

CLAUSES INCORPORATED BY FULL TEXT

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (DEC 2018)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

(Contracting Officer: Insert applicable invoice and receiving report document type(s) for fixed price line items that require shipment of a deliverable.)

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(Contracting Officer: Insert either “Invoice 2in1” or the applicable invoice and receiving report document type(s) for fixed price line items for services.)

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial item financing, submit a commercial item financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF “combo” document type to create some combinations of invoice and receiving report in one step.]

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

(*Contracting Officer: Insert applicable DoDAAC information. If multiple ship to/acceptance locations apply, insert “See Schedule” or “Not applicable.”) (**Contracting Officer: If the contract provides for progress payments or performance-based payments, insert the DoDAAC for the contract administration office assigned the functions under FAR 42.302(a)(13).)

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact.

(Contracting Officer: Insert applicable information or “Not applicable.”)

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

Section H - Special Contract Requirements

SECTION H

Base Access (NMCP)

Commander, Navy Installations Command (CNIC), has established the Navy Commercial Access Control System (NCACS), a standardized process for granting unescorted access privileges to vendors, contractors, suppliers and service providers not otherwise entitled to the issuance of a Common Access Card (CAC) who seek access to and can provide justification to enter Navy installations and facilities. Vendors visiting Naval Medical Center Portsmouth (NMCP) may obtain daily passes directly from Naval Station Norfolk (NSN) Pass and ID office, located at NSN (Bldg CD-9), 9040 Hampton Blvd, Norfolk, Virginia, 23505, by submitting identification credentials for verification and undergoing a criminal screening/ background check. Alternatively, if the vendor so chooses, it may voluntarily elect to obtain long-term credentials through enrollment, registration, background vetting, screening, issuance of credentials, and electronic validation of credentials at its own cost through one of the designated independent contractor NCACS service providers. Credentials will be issued every five years and access privileges will be reviewed / renewed on an annual basis. The costs incurred to obtain Navy installation access of any kind are not reimbursable, and the price(s) paid for obtaining long-term NCACS credentials will not be approved as a direct cost of this contract. Further information regarding NCACS can be found at http://cnic.navy.mil/CNIC_HQ_Site/index.htm.

(End of Base Access)

BUSINESS ASSOCIATE AGREEMENT

Privacy, Access, Use, and Disclosure of Protected Health Information

1. Introduction. In accordance with 45 C.F.R. §§ 164.502(e)(2) and 164.504(e), and DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, this document serves as a Business Associate Agreement (BAA) between the signatory Parties for purposes of the HIPAA and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA issuances (both defined below). The Parties are (1) a DoD Military Health System (MHS) component command such as a Navy Medicine Medical Treatment Facility (MTF) (Naval Medical center or Naval hospital), or special mission command (research, public health, other), acting as a HIPAA covered entity, and (2) another Federal or Government organization, civilian academic institution, or other civilian entity, acting as a HIPAA Business Associate (BA). The HIPAA Rules require BAAs between covered entities and BAs. Implementing this BAA requirement, the applicable DoD HIPAA issuances (DoDM 6025.18) provides that requirements applicable to BAs must be incorporated (or incorporated by reference) into the contract or agreement between the Parties.

2. Definitions:

a. Terms. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules (DoDM6025.18-): Data aggregation, designated record set, disclosure, health care operations, individual, minimum necessary, notice of privacy practices, protected health information (PHI), required by law, secretary, security incident, subcontractor, unsecured PHI, and use.

b. Breach. means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other Personally Identifiable Information (PII) (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of “Breach” in DoD Privacy Act issuances as defined herein.

c. BA. shall generally have the same meaning as the term “BA” in the DoD HIPAA issuances, and in reference to this BAA, shall mean the entity (another Government organization, civilian academic institution, or other civilian organization), entering into agreement with a Navy Medicine MTF or special mission command.

d. Agreement. means this BAA together with the documents or other arrangements under which the BA signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

e. Covered Entity. shall generally have the same meaning as the term “covered entity” in the DoD HIPAA issuances, and in reference to this BAA, shall mean a Navy Medicine MTF or special mission command under the Bureau of Medicine and Surgery.

f. DHA Privacy Office. means the Defense Health Agency (DHA) Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate.

g. DoD HIPAA Issuances. means the DoD issuances implementing the HIPAA Rules in the DoD MHS. These issuances are DoDM 6025.18 Implementation of the HIPAA Privacy Rule in DoD Health Care Programs,” March 13, 2019; DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs of December 2009, and DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs of August 2015.

h. DoD Privacy Act Issuances. means the DoD issuances implementing the Privacy Act, which are DoD Directive 5400.11, DoD Privacy Program of 29 October 2014, and DoD 5400.11-R, Department of Defense Privacy Program of 8 May 2007.

i. HIPAA Rules. means, collectively, the HIPAA privacy, security, breach and enforcement rules, issued by the United States (US) Department of Health and Human Services (HHS) and codified at 45 C.F.R. §§ 160 and 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and 45 C.F.R. § 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules which implemented the “HITECH Act” provisions of Publication L. 111-5. See 78 Federal Regulation 5566-5702 of 25 January 2013 (with corrections at 78 Federal Regulation 32464 of 7 June 2013. Additional HIPAA rules regarding electronic transactions and code sets (45 C.F.R. § 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

j. HHS Breach. means a breach that satisfies the HIPAA Breach Rule definition of “Breach” in 45 C.F.R. § 164.402.

k. Service-Level Privacy Office. means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

3. Obligations and Activities of BA:

a. The BA shall not access, use, or disclose PHI other than as permitted or required by this Agreement, the controlling Memorandum of Understanding (MOU) or training affiliation agreement, or as required by law.

b. The BA shall use appropriate safeguards and comply with the DoD HIPAA Rules with respect to electronic PHI to prevent use or disclosure of PHI other than as provided for by this Agreement, the controlling MOU, or law.

c. The BA shall report to the covered entity any Breach of which it becomes aware and shall proceed with breach response steps required by paragraph 7 (Breach Response) of this BAA. With respect to electronic PHI, the BA shall also respond to any security incident of which it becomes aware in accordance with any information assurance provisions of the Understanding. If at any point the BA becomes aware that a security incident involves a breach, the BA shall immediately initiate breach response as required by paragraph 7 (Breach Response) of this BAA.

d. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, as applicable, the BA shall ensure that any entities that create, receive, maintain, or transmit PHI on behalf of the BA agree to the same restrictions, conditions, and requirements that apply to the BA with respect to such PHI.

e. The BA shall make available PHI in a designated record set, to the covered entity or, as directed by the covered entity, to an Individual, as necessary to satisfy the covered entity obligations under 45 C.F.R. § 164.524.

f. The BA shall make any amendment(s) to PHI in a designated record set as directed or agreed to by the covered entity pursuant to 45 C.F.R. § 164.526, or take other measures as necessary to satisfy covered entity’s obligations under 45 C.F.R. § 164.526.

g. The BA shall maintain and make available the information required to provide an accounting of disclosures to the covered entity or an individual as necessary to satisfy the covered entity’s obligations under 45 C.F.R. § 164.528.

h. To the extent the BA is to carry out one or more of the covered entity’s obligation(s) under the HIPAA privacy rule, the BA shall comply with the requirements of HIPAA privacy rule that apply to the covered entity in the performance of such obligation(s).

i. The BA shall make its internal practices, books, and records available to the Secretary and the covered entity for purposes of audit and in determining compliance with the HIPAA Rules.

4. Permitted Uses and Disclosures by BA:

a. The BA may only use or disclose PHI as necessary to perform the services set forth in the Understanding or as required by law. The BA is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 C.F.R. § 164.514(a) through (c), nor is it permitted to use or disclose de-identified PHI except as provided by the Understanding or directed by the covered entity.

b. The BA agrees to use, disclose, and request PHI only in accordance with the HIPAA privacy rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA issuances.

c. The BA shall not use or disclose PHI in a manner that would violate the DoD HIPAA issuances or HIPAA privacy rules if done by the covered entity, except uses and disclosures for the BA’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs:

(1) Except as otherwise limited in the understanding, the BA may use PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(2) Except as otherwise limited in the Understanding, the BA may disclose PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA, provided that disclosures are required by law, or the BA obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the BA of any instances of which it is aware in which the confidentiality of the information has been breached.

(3) Except as otherwise limited in the Understanding, the BA may use PHI to provide Data Aggregation services relating to the covered entity’s health care operations.

5. Provisions for Covered Entity to Inform BA of Privacy Practices and Restrictions:

a. The covered entity shall provide the BA with the notice of privacy practices that the covered entity produces in accordance with 45 C.F.R.§ 164.520 and the corresponding provision of the DoD HIPAA issuances (DoDM 6025.18).

b. The covered entity shall notify the BA of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the BA’s use or disclosure of PHI.

c. The covered entity shall notify the BA of any restriction on the use or disclosure of PHI that the covered entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such changes may affect the BA’s use or disclosure of PHI.

6. Permissible Requests by Covered Entity. The covered entity shall not request the BA to use or disclose PHI in any manner that would not be permissible under the HIPAA privacy rule or any applicable Government regulations (including without limitation, DoD HIPAA issuances) if done by the covered entity, except for providing Data Aggregation services to the covered entity and for management and administrative activities of the BA as otherwise permitted by this BAA.

7. Breach Response:

a. General. Breach Response is designed to satisfy the DoD Privacy Act issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA issuances. In general, the BA shall report the breach to the covered entity, assess the breach incident, notify affected individuals, and take mitigating actions, as applicable. Because DoD defines “Breach” to include possible (suspected) as well as actual (confirmed) breaches, the BA shall implement these breach response requirements immediately upon the BA’s discovery of a possible breach. The following provisions set forth the BA’s Privacy Act and HIPAA breach response requirements for all breaches, including but not limited to HHS breaches (defined below). In the event of a breach of PII or PHI held by the BA, the BA shall follow the breach response requirements set forth under paragraphs 7, 8, and 9 of this BAA, which are designed to satisfy both the Privacy Act and HIPAA, as applicable.

(1) If a breach involves PII without PHI, then the BA shall comply with DoD Privacy Act issuance breach response requirements only.

(2) If a breach involves PHI (a subset of PII), then the BA shall comply with both Privacy Act and HIPAA breach response requirements.

(3) If a breach involves PHI, it may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the BA has no HIPAA breach response obligations. In such cases, the BA must still comply with breach response requirements under the DoD Privacy Act issuances.

b. HHS Breach. If the DHA Privacy Office determines that a breach is an HHS Breach, then the BA shall comply with both the HIPAA Breach Rule and DoD Privacy Act issuances, as directed by the DHA Privacy Office, regardless of where the breach occurs.

c. Non-HHS Breach. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the BA shall comply with DoD Privacy Act issuances, as directed by the applicable Service-Level Privacy Office.

d. Service-Level Privacy Office Point of Contact (POC). Brian Martin, who may be reached at Comm: 904-542-3559, DSN: 312-942-3559, or…