HT940623Q0011.pdf

SEE ADDENDUM

(No Collect Calls)

HT940624Q0011 28-Nov-2023

b. TELEPHONE NUMBER

910-450-4226

8. OFFER DUE DATE/LOCAL TIME

05:00 PM 07 Dec 2023

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

HT94069. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

LISA C WILK

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

0011958715

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

DHA CONTRACTING OFFICE TIDEWATER HT9406

7700 ARLINGTON BLVD

FALLS CHURCH VA 22042

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE HT0242 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

NAV MED CNT PORTSMOUTH VA - MM

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250

54 LEWIS MINOR STREET

PORTSMOUTH VA 23708-2297

TEL: FAX:

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$34,000,000

NAICS:

493110

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

HT940624Q0011

Section SF 1449 - CONTINUATION SHEET

SOLICITATION INFORMATION

CAGE: _____________________

UEI: _____________________

Vendor POC: _____________________

Vendor Phone: ____________________

Vendor E-mail: ____________________

Notes to Vendor:

-At a minimum, the SF1449 must be completed to be considered for this opportunity. Please respond to blocks 17a and 30a-c on page 1 and the vendor information on page 3, as well as provide your prices on the Contract Line Item Numbers (CLINs). Cursive font signatures will not be accepted.

-Offeror will provide all license agreements, End User License Agreements (EULA), Terms of Service (TOS), Federal Payment Plans, Extended Payment Plans, and other similar instruments or agreements, required to be signed, or agreed to, by the Government that the offeror or any of its suppliers or subcontractors (at any level) require. The Government may review to ensure terms and conditions are consistent with Federal law and otherwise satisfy the Government’s needs. Among terms and conditions that are not acceptable, which makes an offer ineligible for award, include: those such as Government indemnification of any party; choice of law or forum for disputes; mandatory arbitration; any language that would or might require the Government to renew or extend performance or usage of any item, product, or service; or any other feature that unduly puts a burden or restriction on the Government.

-Vendor to reference request for quotes number (RFQ#) HT940624Q0011 on all inquiries.

-All proposals should be inclusive of all costs (e.g. Shipping and Handling). Shipping should be included in the quote total, but NOT separately priced; shipping costs are always considered in the evaluation process. Only NEW product offers will be accepted.

-Award will be made on the basis of the lowest evaluated price and the capability to meet the requirement detailed in the Performance Work Statement.

PROMPT PAYMENT

For Prompt Payment Act purposes, this contract is subject to the 7 calendar day constructive acceptance period.

Billing / Payment in arrears

For all questions, POC:

Lisa Wilk Contract Specialist, Branch 5 Defense Health Agency Contracting Activity (DHACA) Southeastern Markets Contracting Division Email: lisa.c.wilk.civ@health.mil mailto:lisa.c.wilk.civ@health.mil

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 12 Months Climate Controlled Storage

FFP

Climate Controlled Storage for X-Ray files.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2024 - 31 March 2025.

FOB: Destination

PURCHASE REQUEST NUMBER: 0011958715

S215

NET AMT

0002 48 Each Delivery and Pick-up

FFP

Delivery and Pick-up of X-Ray Files.

Not to exceed 48 delivery and pick-ups.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2024 - 31 March 2025.

FOB: Destination

0003 1 Each Retrieval of X-Ray Files

FFP

This is a one time retrieval of X-Ray File boxes and delivery to new Climate Controlled Storage location.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2024 - 15 April 2024.

1001 12 Months Climate Controlled Storage

FFP

Climate Controlled Storage for X-Ray files.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2025 - 31 March 2026.

1002 48 Each Delivery and Pick-up

FFP

Delivery and Pick-up of X-Ray Files.

Not to exceed 48 delivery and pick-ups.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2025 - 31 March 2026.

2001 12 Months Climate Controlled Storage

FFP

Climate Controlled Storage for X-Ray files.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2026 - 31 March 2027.

2002 48 Each Delivery and Pick-up

FFP

Delivery and Pick-up of X-Ray Files.

Not to exceed 48 delivery and pick-ups.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2026 - 31 March 2027.

3001 12 Months Climate Controlled Storage

FFP

Climate Controlled Storage for X-Ray files.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2027 - 31 March 2028.

3002 48 Each Delivery and Pick-up

FFP

Delivery and Pick-up of X-Ray Files.

Not to exceed 48 delivery and pick-ups.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2027 - 31 March 2028.

4001 12 Months Climate Controlled Storage

FFP

Climate Controlled Storage for X-Ray files.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2028 - 31 March 2029.

4002 48 Each Delivery and Pick-up

FFP

Delivery and Pick-up of X-Ray Files.

Not to exceed 48 delivery and pick-ups.

See Performance Work Statement for more detailed information.

Period of Performance: 01 April 2028 - 31 March 2029.

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government 1001 Destination Government Destination Government 1002 Destination Government Destination Government 2001 Destination Government Destination Government 2002 Destination Government Destination Government 3001 Destination Government Destination Government 3002 Destination Government Destination Government 4001 Destination Government Destination Government 4002 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 01-APR-2024 TO

31-MAR-2025

N/A NAV MED CNT PORTSMOUTH VA - MM

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250

54 LEWIS MINOR STREET

PORTSMOUTH VA 23708-2297

HT0242

0002 POP 01-APR-2024 TO

31-MAR-2025

N/A (SAME AS PREVIOUS LOCATION)

0003 POP 01-APR-2024 TO

15-APR-2024

N/A (SAME AS PREVIOUS LOCATION)

1001 POP 01-APR-2025 TO

31-MAR-2026

N/A (SAME AS PREVIOUS LOCATION)

1002 POP 01-APR-2025 TO

31-MAR-2026

N/A (SAME AS PREVIOUS LOCATION)

2001 POP 01-APR-2026 TO

31-MAR-2027

N/A (SAME AS PREVIOUS LOCATION)

2002 POP 01-APR-2026 TO

31-MAR-2027

N/A (SAME AS PREVIOUS LOCATION)

3001 POP 01-APR-2027 TO

31-MAR-2028

N/A (SAME AS PREVIOUS LOCATION)

3002 POP 01-APR-2027 TO

31-MAR-2028

N/A (SAME AS PREVIOUS LOCATION)

4001 POP 01-APR-2028 TO

31-MAR-2029

N/A (SAME AS PREVIOUS LOCATION)

4002 POP 01-APR-2028 TO

31-MAR-2029

N/A (SAME AS PREVIOUS LOCATION)

CLAUSES INCORPORATED BY REFERENCE

52.201-1 Acquisition 360: Voluntary Survey SEP 2023 52.203-18 Prohibition on Contracting With Entities That Require Certain

Internal Confidentiality Agreements or Statements-- Representation

JAN 2017

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements

JAN 2017

52.204-3 Taxpayer Identification OCT 1998 52.204-6 Unique Entity Identifier OCT 2016 52.204-7 System for Award Management OCT 2018 52.204-8 Annual Representations and Certifications MAR 2023 52.204-8 Alt I Annual Representations and Certifications (MAR 2023)

Alternate I

MAR 2023

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards

JUN 2020

52.204-12 Unique Entity Identifier Maintenance OCT 2016 52.204-13 System for Award Management Maintenance OCT 2018 52.204-16 Commercial and Government Entity Code Reporting AUG 2020 52.204-17 Ownership or Control of Offeror AUG 2020 52.204-18 Commercial and Government Entity Code Maintenance AUG 2020 52.204-19 Incorporation by Reference of Representations and

Certifications.

DEC 2014

52.204-20 Predecessor of Offeror AUG 2020 52.204-22 Alternative Line Item Proposal JAN 2017 52.204-23 Prohibition on Contracting for Hardware, Software, and

Services Developed or Provided by Kaspersky Lab and Other Covered Entities

NOV 2021

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment

NOV 2021

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment

NOV 2021

52.204-26 Covered Telecommunications Equipment or Services-- Representation.

OCT 2020

52.204-27 Prohibition on a ByteDance Covered Application JUN 2023 52.209-2 Prohibition on Contracting with Inverted Domestic

Corporations--Representation

NOV 2015

52.209-10 Prohibition on Contracting With Inverted Domestic Corporations

NOV 2015

52.209-11 Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law

FEB 2016

52.211-2 Availability of Defense Specifications, Standards, and Data Item Descriptions in the Acquisition Streamlining and Standardization Information System (ASSIST) Website

SEP 2023

52.212-4 Contract Terms and Conditions--Commercial Products and Commercial Services

NOV 2023

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders--Commercial Products and Commercial Services

NOV 2023

52.214-34 Submission Of Offers In The English Language APR 1991 52.214-35 Submission Of Offers In U.S. Currency APR 1991 52.219-1 Alt I Small Business Program Representations (SEP 2023)

Alternate I

SEP 2015

52.219-4 Notice of Price Evaluation Preference for HUBZone Small Business Concerns

OCT 2022

52.219-28 Post-Award Small Business Program Rerepresentation SEP 2023 52.219-31 Notice of Small Business Reserve MAR 2020 52.219-32 Orders Issued Directly Under Small Business Reserves MAR 2020 52.219-33 Nonmanufacturer Rule SEP 2021 52.222-3 Convict Labor JUN 2003 52.222-18 Certification Regarding Knowledge of Child Labor for Listed

End Products

FEB 2021

52.222-22 Previous Contracts And Compliance Reports FEB 1999 52.222-25 Affirmative Action Compliance APR 1984 52.222-26 Equal Opportunity SEP 2016 52.222-50 Combating Trafficking in Persons NOV 2021 52.223-1 Biobased Product Certification MAY 2012 52.223-2 Affirmative Procurement of Biobased Products Under Service and Construction Contracts

SEP 2013

52.223-18 Encouraging Contractor Policies To Ban Text Messaging While Driving

JUN 2020

52.225-13 Restrictions on Certain Foreign Purchases FEB 2021 52.225-18 Place of Manufacture AUG 2018 52.225-20 Prohibition on Conducting Restricted Business Operations in

Sudan--Certification

AUG 2009

52.225-25 Prohibition on Contracting with Entities Engaging in Certain Activities or Transactions Relating to Iran-- Representation and Certifications.

JUN 2020

52.226-1 Utilization Of Indian Organizations And Indian-Owned Economic Enterprises

JUN 2000

52.232-18 Availability Of Funds APR 1984 52.232-23 Alt I Assignment of Claims (May 2014) - Alternate I APR 1984 52.232-28 Invitation to Propose Performance-Based Payments MAR 2000 52.232-33 Payment by Electronic Funds Transfer--System for Award

Management

OCT 2018

52.232-34 Payment By Electronic Funds Transfer--Other Than System for Award Management

JUL 2013

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.233-4 Applicable Law for Breach of Contract Claim OCT 2004 52.237-2 Protection Of Government Buildings, Equipment, And

Vegetation

APR 1984

52.237-3 Continuity Of Services JAN 1991 52.242-15 Stop-Work Order AUG 1989 52.244-6 Subcontracts for Commercial Products and Commercial

Services

NOV 2023

52.249-4 Termination For Convenience Of The Government (Services) (Short Form)

APR 1984

52.252-1 Solicitation Provisions Incorporated By Reference FEB 1998 52.252-5 Authorized Deviations In Provisions NOV 2020 52.252-6 Authorized Deviations In Clauses NOV 2020 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights DEC 2022 252.204-7003 Control Of Government Personnel Work Product APR 1992 252.204-7007 Alternate A, Annual Representations and Certifications MAY 2021 252.204-7012 Safeguarding Covered Defense Information and Cyber

Incident Reporting

JAN 2023

252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support

JAN 2023

252.204-7016 Covered Defense Telecommunications Equipment or Services -- Representation

DEC 2019

252.204-7017 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services -- Representation

MAY 2021

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services

JAN 2023

252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements MAR 2022 252.204-7020 NIST SP 800-171 DoD Assessment Requirements JAN 2023 252.204-7022 Expediting Contract Closeout MAY 2021 252.204-7024 Notice on the Use of the Supplier Performance Risk System MAR 2023 252.209-7993 (Dev) Representation by Corporations Regarding an Unpaid

Delinquent Tax Liability or a Felony Conviction under any Federal Law -- Fiscal Year 2014 Appropriations (Deviation)

FEB 2014

252.215-7014 Exception from Certified Cost or Pricing Data Requirements for Foreign Military Sales Indirect Offsets.

DEC 2022

252.215-7015 Program Should-Cost Review NOV 2019 252.215-7998 (Dev) Pilot Program to Accelerate Contracting and Pricing

Processes. (DEVIATION 2023-O0004)

JAN 2023

252.223-7997 (Dev) Prohibition on Procurement of Certain Items Containing Perfluorooctane Sulfonate or Perfluorooctanoic Acid - Representation (DEVIATION 2022-O0010)

SEP 2022

252.223-7998 (Dev) Prohibition on Procurement of Certain Items Containing Perfluorooctane Sulfonate or Perfluorooctanoic Acid

(DEVIATION 2022-O0010)

SEP 2022

252.225-7001 Buy American And Balance Of Payments Program--Basic JAN 2023 252.225-7002 Qualifying Country Sources As Subcontractors MAR 2022 252.225-7048 Export-Controlled Items JUN 2013 252.225-7053 Representation Regarding Prohibition on Use of Certain

Energy Sourced from Inside the Russian Federation

AUG 2021

252.225-7054 Prohibition on Use of Certain Energy Sourced from Inside the Russian Federation

JAN 2023

252.225-7055 Representation Regarding Business Operations with the Maduro Regime

MAY 2022

252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime

JAN 2023

252.225-7059 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region - Representation

JUN 2023

252.225-7060 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region

JUN 2023

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006 252.232-7015 Performance-Based Payments--Representation DEC 2022 252.232-7016 Notice of Progress Payments or Performance-Based Payments APR 2020 252.233-7001 Choice of Law (Overseas) JUN 1997 252.237-7010 Prohibition on Interrogation of Detainees by Contractor

Personnel

JAN 2023

252.239-7001 Information Assurance Contractor Training and Certification JAN 2008 252.243-7001 Pricing Of Contract Modifications DEC 1991 252.244-7000 Subcontracts for Commercial Products or Commercial

Services

JAN 2023

252.247-7023 Transportation of Supplies by Sea JAN 2023

CLAUSES INCORPORATED BY FULL TEXT

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 3 months.

(End of clause)

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 7 months provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 5 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months.

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

FAR Clauses http://acquisition.gov/far DFARS Clauses http://www.acq.osd.mil/dpap/dars/dfars/index.htm

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232- 7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

http://acquisition.gov/far http://www.acq.osd.mil/dpap/dars/dfars/index.htm https://www.sam.gov/ https://wawf.eb.mil/ https://wawf.eb.mil/

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

________INVOICE TYPE: Receiving Report (Combo) _______________________________

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

____________Invoice_2 in 1 Service _____________________________________

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF “combo” document type to create some combinations of invoice and receiving report in one step.]

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table* Field Name in WAWF Data to be entered in WAWF Pay Official DoDAAC HQ0490 Issue By DoDAAC HT9406 Admin DoDAAC HT9406 Inspect By DoDAAC N/A Ship To Code HT0242 Ship From Code N/A Mark For Code N/A Service Approver (DoDAAC) HT0242 Service Acceptor (DoDAAC) HT0242 Accept at Other DoDAAC N/A LPO DoDAAC N/A DCAA Auditor DoDAAC N/A Other DoDAAC(s) N/A

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact.

Edward Gollon, 757-953-5755, edward.r.gollon.civ@health.mil

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

PERFORMANCE WORK STATEMENT

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Climate controlled storage of physical X-Ray files for Navy Medical Center Portsmouth (NMCP) and Norfolk Navy Shipyard Branch Medical Clinic (NNSYBMC).

1.1.1 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Climate Controlled storage of Asbestosis X-Ray files as defined in this Performance Work Statement (PWS).

1.1.2 Background: The Radiology Department file room does not have the capacity to store existing large oversize Asbestosis X-Ray files. NMCP is currently acquiring climate-controlled storage services under contract N0018318P0895.

1.1.3 Scope: The contractor shall store existing films for the NMCP and the NNSY BMC in a dry, climate-controlled facility. Consolidate files and retrieve files upon request. Pick-up and deliver files at NMCP and NNSYBMC locations when requested.

1.1.4 Period of Performance (PoP): This contract will consist of a base year and 4 option years.

- Base Year: 01April2024 – 31March2025

- Option Year 1: 01April2025 – 31March2026

- Option Year 2: 01April2026 – 31March2027

- Option Year 3: 01April2027 – 31March2028

- Option Year 4: 01April2028 – 31March2029 mailto:edward.r.gollon.civ@health.mil

1.2 Administrative specifications

1.2.1 Place of performance: The delivery/pick up locations are the Navy Medical Center Portsmouth and Norfolk Navy Shipyard Branch Medical Clinic. Contractor’s storage facility must be within 50 miles radius from NMCP.

NMCP Address: Building 2, Radiology Department, File Room 160220, 620 John Paul Jones Circle, Portsmouth, VA 23708-2197

Norfolk Navy Shipyard Branch Medical Clinic Address: Building 277, Room 117, 400 Mayo Avenue; Portsmouth, Va 23704

1.2.2 Recognized Federal holidays: The contractor is not required to perform during federal Holidays.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.2.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.3 Contractor Identification

1.3.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the Governemnt understands that the person is contractor support personnel.

2.0 SPECIFIC TASKS

2.1 Existing Boxes Pickup

2.1.1 The winning contractor shall pick up the 759 existing boxes from the current storage location- 4555 Progress Road, Norfolk, VA 23502-1910 and store at the winning contractor’s storage facility if other than the current incumbent. The existing boxes are 16 inches tall x 19 inches deep x 7 ½ inches wide, totaling 1274.9 cft to be stored.. The Government, incumbent, and the winning contractor, if other than the incumbent, shall schedule the retrieval of the file boxes.

2.2 Delivery/Pick up of X-Ray Files

2.2.1 Files will be delivered to and picked up from NMCP or NNSYBMC. Frequency of delivery/pick up will be at the discretion of NMCP and NNSYBMC but shall not occur more than 48 times per period of performance (12 months). The contractor shall be able to accommodate all delivery and pick up schedules within a 24-hour window, excluding weekends and holidays.

2.2.2 The contractor is responsible for retrieving files upon request and consolidating the file boxes as the files are retrieved. Each box must be at its full storage capacity. Files will be retrieved at the end of designated retention periods, which will be established by NMCP.

2.2.3 While transporting the X-Ray files, the files should be stored in a cool, locked insulated bag or box.

2.3 Storage of X-Ray Files

2.3.1 The contractor shall provide climate-controlled storage services for X-Ray files. The storage facility must have the appropriate environment to store, preserve, and protect physical X- Ray files. The storage facility must be clean, protected from light, protected from pest, with temperature between 50 and 70 degrees Fahrenheit (10 and 21 degrees Celsius) and humidity levels between 30% and 50% to preserve physical X-Ray files. Extremes in temperature and humidity can affect the film’s chemical composition and physical integrity. The files shall be stored in the boxes on shelving with a minimum 4-ft wide aisle to permit ease of access.

2.3.2 The contractor storage facility shall be located within a 50-mile driving radius from NMCP for ready accessibility to NMCP personnel. NMCP Address: 620 John Paul Jones Circle - Building 2- Radiology Department- file room, Portsmouth, VA 23708-2197

2.3.3 The contractor must be familiar with and understand filing system. Shall be able to read the file jackets information and pull the correct X-Ray jacket as requested.

2.4 Facilities Access

2.4.1 To access Government facilities, the delivery/pick up contractor personnel must have or be able to acquire a Defense Biometric Identification (DBID) badge per location before the period of performance start date.

2.5 DHA Procedures, Guidance, and Information (PGI) 224 – Protection of Privacy and Freedom of Information

2.5.1 General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and

Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office.

The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2.5.2 Records Management

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

2.5.3 Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

2.5.4 Privacy Impact Assessment (PIA)

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

2.5.5 Data Sharing Agreement (DSA) (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

• DSA for De-Identified Data

• DSA for PHI

• DSA for PII Without PHI

• DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

2.5.6 Privacy Act and HIPAA Training

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Point of Contact (POC) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

2.5.7 HIPAA Business Associate Provisions

Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for the-MHS. b.i. and (3)b.ii.

2.5.8 Breach Response

This paragraph 2.5.8 is inoperative, and all references herein to shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference.

2.5.8.1 Definitions Related to Breach response

Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for another than authorized purpose. The foregoing definition is based on the definition of breach in DoDM

6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

• How the event was discovered;

• Did the information stay within the covered entity’s control;

• Was the information actually accessed/viewed; and

• Ability to ensure containment (e.g., recovered, destroyed, or deleted).

A confirmed breach is an incident in which it is known that unauthorized access could occur.

For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred).

If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

An HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e., the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;

The unauthorized person who used the PHI or to whom the disclosure was made; Whether the PHI was actually acquired or viewed; and

The extent to which the risk to the PHI has been mitigated.

2.5.8.2 General

The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

The contractor shall establish internal processes for carrying out the procedures set forth below.

These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA

Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency Readiness Team (US-CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below.

The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirements.

Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery. The time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours) under paragraph 9.3.2. If a cybersecurity incident is involved, the contractor’s deadline for US-CERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall report directly to US-CERT and the DHA Privacy Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

Contractors shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome. Investigations identifying unauthorized disclosures must be logged for HIPAA and Privacy Act disclosure accounting purposes, whether or not individual notification is required under the HIPAA Breach Rule.

Contractors, when acting as HIPAA-covered entities, and not as business associates, are not subject to the breach response requirements herein. However, such contractors are subject to both the HIPAA Breach Rule (applicable to them in their capacity as covered entities) and DoD cybersecurity requirements (applicable to them in their capacity as DoD contractors).

2.5.8.3 Reporting Provisions

Immediately upon discovery of a possible or confirmed breach or cybersecurity incident, the contractor shall initiate an investigation. If the incident involves electronic PII/PHI, and if the investigation finds a confirmed breach or cybersecurity incident, the contractor shall report it, within 1 hour of confirmation, to the US-CERT Incident Reporting System at https://forms.us-cert.gov/report/, as required by the Department of Homeland Security (DHS).

Note: DHS no longer requires US-CERT reporting of non-cyber breaches or unconfirmed electronic breaches. However, DHS permits US-CERT reporting of unconfirmed cyber-related incidents on a voluntary basis. Thus, if a contractor is uncertain whether a possible cyber-related incident should be treated as confirmed and thus reportable, the contractor may voluntarily report the incident.

Before submission to US-CERT, the contractor shall save a copy of the on-line report. After submitting the report, the contractor shall record the US-CERT incident reporting number, which shall be included in the initial report to the DHA Privacy Office as described in paragraph 9.3.2.

Note: Regardless of whether or not an incident is confirmed as a breach, the contractor must also investigate whether or not the incident impacts data integrity or availability of PII/PHI. If such impact is confirmed, then the incident is reportable to US-CERT as a cybersecurity incident. For guidance on investigating the impact on data integrity and availability, refer to DoD cybersecurity and NIST guidance.

The contractor shall provide any updates to the initial US-CERT report by email to soc@us-cert.gov, with the Reporting Number in the subject line.