HT940624Q0042 - 0002.docx

HT940624Q0042

Section SF 1449 - CONTINUATION SHEET

VENDOR/CUSTOMER/PAYMENT

CAGE: _____________________

UEI: _____________________

Vendor POC: _____________________

Vendor Phone: ____________________

Vendor E-mail: ____________________

Notes to Vendor:

-At a minimum, the SF1449 must be completed to be considered for this opportunity. Please respond to blocks 17a and 30a-c on page 1 and the vendor information on page 3, as well as provide your price(s) on the Contract Line Item Number(s) (CLINs). Cursive font signatures will not be accepted.

-Offeror will provide all license agreements, End User License Agreements (EULA), Terms of Service (TOS), Federal Payment Plans, Extended Payment Plans, and other similar instruments or agreements, required to be signed, or agreed to, by the Government that the offeror or any of its suppliers or subcontractors (at any level) require. The Government may review to ensure terms and conditions are consistent with Federal law and otherwise satisfy the Government’s needs. Among terms and conditions that are not acceptable, which makes an offer ineligible for award, include: those such as Government indemnification of any party; choice of law or forum for disputes; mandatory arbitration; any language that would or might require the Government to renew or extend performance or usage of any item, product, or service; or any other feature that unduly puts a burden or restriction on the Government.

-Vendor to reference request for quotes number (RFQ#) HT940624Q0042 on all inquiries.

-All proposals should be inclusive of all costs (e.g. Shipping and Handling). Shipping should be included in the quote total, but NOT separately priced; shipping costs are always considered in the evaluation process. Only NEW product offers will be accepted.

-For competitive service buys, type: Award will be made on the basis of the lowest evaluated price and the capability to meet the requirement detailed in the Performance Work Statement.

PROMPT PAYMENT

For Prompt Payment Act purposes, this contract is subject to the 7 calendar day constructive acceptance period.

Billing / Payment in arrears

For all questions, POC:

Cynthia.e.scharnowske.civ@health.mil

Mass Warning & Notifciation System

FFP

Service to be provided annually for personnel at Naval Medical Center Portsmouth in accordance with the Performace Work Statement (PWS).

POP: 01 Jul 2024 - 30 Jun 2025 FOB: Destination

PURCHASE REQUEST NUMBER: 0012092411

DA10

NET AMT

FFP

Service to be provided annually for personnel at Naval Medical Center Portsmouth in accordance with the Performace Work Statement (PWS).

POP: 01 Jul 2025 - 30 Jun 2026 FOB: Destination

NET AMT

FFP

Service to be provided annually for personnel at Naval Medical Center Portsmouth in accordance with the Performace Work Statement (PWS).

POP: 01 Jul 2026 - 30 Jun 2027

NET AMT

FFP

Service to be provided annually for personnel at Naval Medical Center Portsmouth in accordance with the Performace Work Statement (PWS).

POP: 01 Jul 2027 - 30 Jun 2028

NET AMT

FFP

Service to be provided annually for personnel at Naval Medical Center Portsmouth in accordance with the Performace Work Statement (PWS).

POP: 01 Jul 2028 -30 Jun 2029

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

DELIVERY INFORMATION

30-JUN-2025

BARTON ALLEN

ATTN SUPPLY OFFICER BLDG 250

54 LEWIS MINOR STREET

PORTSMOUTH VA 23708-2297

757-953-9541

HT0242

30-JUN-2026

HT0242

30-JUN-2027

HT0242

30-JUN-2028

HT0242

30-JUN-2029

HT0242

CLAUSES INCORPORATED BY REFERENCE

CLAUSES INCORPORATED BY FULL TEXT

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 3 months.

(End of clause)

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 7 months provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 5 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months.

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

FAR Clauses http://acquisition.gov/far DFARS Clauses http://www.acq.osd.mil/dpap/dars/dfars/index.htm

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

________INVOICE TYPE: Receiving Report (Combo) _______________________________

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

____________Invoice_2 in 1 Service _____________________________________

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF “combo” document type to create some combinations of invoice and receiving report in one step.]

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact.

edward.r.gollon.civ@health.mil; charles.k.lovell2.civ@health.mi

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

PWS

Department of Defense Defense Health Agency Performance Work Statement

Mass Warning and Notification System

6 March 24

NMRTC Portsmouth

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide The contractor shall provide software support, licenses, software updates, software upgrades, and replace software that may get mistakenly deleted or remove by the end users and provide a toll free telephone support for software services on all deliverable items

1.1.1 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the necessary service for the Mass warning notification system for Naval Medical Center Portsmouth. The capability shall be provided through the contractor’s facilities and shall enable Naval Medical Center Portsmouth staff to operate the mass warning notification system system from any internet capable device as defined in this Performance Work Statement (PWS).

1.1.2 Background: The mass warning notification system will be used by Emergency Management (EM) and command leadership to communicate with all hands required in the event of a natural or man-made disaster where the entire command would need to be notified to prevent further casualties or loss of life. The contractor shall provide remote support and non-personal services necessary to perform maintenance services and preventative maintenance as defined in this PWS. The contractor will perform to the standards in this contract. The current contract is scheduled to end on 30 June 2024.

1.1.3 Scope: Navy Medicine Readiness and Training Command Portsmouth requires a mass warning notification System that enables communications with all staff via SMS text, email, and digital text-to-voice telephone calls. It will be used by aprox 5,500 personel to include the Emergency Management staff, departmental representive, and NMCP command leadership to communicate with all hands in support of disaster mitigation, preparedness, response, and recovery. The contractor shall provide software support, licenses, updates, upgrades, and replacement software that may get mistakenly deleted or removed by the end users and provide toll-free telephone support for software services on the mass notification system. The requirements shall accomplish on-site maintenance service to include corrective repairs, which will be conducted during regular working hours of 8:00 a.m. to 4:00 p.m., Monday through Friday, excluding Federal holidays. The contractor will respond within 24 hours of Government notification of a service request.

1.1.4 Period of Performance (PoP): Base Year: 01 July 2024 - 30 June 2025

1.2 Administrative specifications

1.2.1 Place of performance: The work shall be performed at

Navy Medicine Readiness and Training Command Portsmouth 620 John Paul Jones Circle Portsmouth Va 23708

1.2.2 Recognized Federal holidays:

Independence Day

1.2.3 Hours of operation: The contractor is responsible for conducting business Monday through Friday, working hours 0730-1600, except on Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar government-directed facility closings. The contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.2.4 Emergency Services:. On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.3 Contractor Identification

1.3.1 Contracted personnel performing services in a contractors capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. This will ensure that all those with whom the person interacts in any face-to-face dealings while supporting the Governemnt understands that the person is contractor support personnel.

2.0 SPECIFIC TASKS

2.1 Mass Warning Notification (MWN) System. Provide a single source web-based solution that enables communications with all staff via SMS text, email, and digital text-to-voice telephone call, and meets or exceeds the functional capabilities cited in the subparagraphs below. The MWN system must:

2.1.1. Be able to alert staff, partners, installation residents, and others as assigned.

2.1.2. Be web-based and accessible from any web-enabled computer, tablet, or phone without the need to install any hardware to any device.

2.1.3 Be operable from any modern cellphone, not brand specific, through the web or via an application provided by the contractor.

2.1.4. Deliver high-speed notifications to recipients via digital text-to-voice telephone call, email, and SMS text.

2.1.5. Not require NHB to install, maintain, or upgrade any new hardware or software to use the solution, other than a cell-phone application.

2.1.6. Send mass notifications to up to 10,000 participants within 5 minutes.

2.1.7. Allow MWN administrators to craft and send massages quickly, efficiently, and reliably in both routine and emergency situations.

2.1.8. Have the ability to initiate notifications using pre-templated messages.

2.1.9. Be able to assign contact profiles to a group or multiple groups in support of notifying one or more subsets of the all-hands contact base. For example: Petty Officer Smith lives in the barracks, works a normal job in the hospital, and is also assigned to the Auxiliary Security Force (ASF). Incident Management Team members using the MWN solution must be able to designate PO Smith to receive all hands messages, those meant only for barracks occupants, and activation alerts intended only for personnel assigned to the ASF. These example subsets must be able to be tailored by system operators at this command, as any given contact profile may belong to several groups.

2.1.10. Be fully accessible by all authorized personnel using the electronic and automated data processing equipment currently used (e.g., personal computers, telephones, etc.).

2.1.11. Have backup/redundancies in place to ensure uninterrupted functionality during high demand times or a real emergency. Such as:

2.1.11.1. Real time failover

2.1.11.2. Fully automatic daily backups

2.1.11.3. Provide a minimum of 99.1% up time

2.1.12. Have an upload mechanism to allow customer to load employees’ names and contact information.

2.1.13. Enable administrators at this command to download a roster of all contact profiles and their associated phone, address, and email information into a Microsoft Excel spreadsheet.

2.1.14. Allow recipients to confirm receipt of messages via email, phone, or SMS text.

2.1.15. Allow command administrators to build customized responses to notifications.

2.1.16. Keep a user-accessible record of recipient responses.

2.1.17. Be equipped with single click RESEND notification capability and provide the option to modify the existing notification before sending.

2.1.18. Be able to determine and allow for RESEND to the following recipient groups:

2.1.18.1. All recipients

2.1.18.2. Only recipients that have responded

2.1.18.3. Only recipients that have not responded

2.1.19. Allow for all contacts to have specifically defined user access privileges.

2.1.20. Allow command administrators to customize fields within contact records in support of designating profiles as part of a group or groups.

2.1.21. Be wholly and completely administered, managed, implemented, and supported by a single vendor. The vendor shall:

2.1.21.1 Administer the system servers and database servers.

2.1.21.2 Seamlessly manage any upgrades to the system.

2.1.21.3. Ensure multiple servers at geographically dispersed locations provide redundant access to the system.

2.1.22. Provide 24/7/365 telephone support via personnel located within the United States.

2.1.23. Provide online training resources in support of training new users.

2.1.24. Provide the following minimum contact data security characteristics:

2.1.24.1. 256-bit end-to-end TLS/SSL (SSL) encryption

2.1.24.2. Database encryption minimums: Blowfish, DES, or Triple DES

2.1.24.3. Maintain current database of Admins/Logins/Contacts

2.2. The MWN system will allow communication with all hands required in the event of a natural or man-made disaster where the entire command would need to be notified to prevent further casualties or loss of life. The contractor shall provide all maintenance services testing, and repairs. The contractor will furnish all materials and provide labor and replacement parts necessary to keep the system in satisfactory working condition. Required material will be maintained in accordance with the manufacturer's specifications, to include software updates. Only manufacturer parts or equivalents, either new or refurbished, of equal or better quality shall be used.

2.2.1 The contractor is required to provide a help desk telephone capability for service calls and troubleshooting assistance between 7:00 AM and 3:30 PM during the regular business week, Monday through Friday, except Federal holidays.

2.2.2 The contractors will provide same-day on-site maintenance if the help desk telephone support or remote support does not resolve the trouble. The contractor shall provide on-site maintenance support no later than one business day after receipt of a trouble call that cannot be resolved by telephone or remotely.

2.2.3 The service provider must be an authorized representative of mass notification system. The government shall maintain the right to see proof of certification prior to award and anytime during contract period of performance.

2.3 Contractor Responsibility: The contractor shall be responsible for repairing or replacing damaged Government-owned equipment and property due to their representatives' negligence. All such replacement or repair shall be at the contractor's expense and shall be inspected to the satisfaction of the Contracting Officer or appointed representative.

2.3.1 Contractor Qualifications: All technicians performing maintenance on the system shall have been trained on the system. The contractor shall be an Original Equipment Manufacturer (OEM) authorized dealer, authorized distributor, or authorized reseller for the proposed equipment/system such that OEM warranty and service are provided and maintained by the OEM. The vendor shall be required to provide documentation from the manufacturer stating the vendor is an authorized service provider on the necessary equipment/system. All software licensing, warranty, and service associated with the equipment/system shall be by the OEM terms and conditions.

2.3.2 Base Access: This text applies to contractor employees requiring physical access to any area of a federally controlled base, facility, or activity and needing access to a DoN or DoD computer/network/system to perform specific unclassified sensitive duties. This clause also applies to contractor employees who access the Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties identified as National Security Positions, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance. Each contractor employee providing services at a Navy Command under this contract is required to obtain the Defense Biometric Identification System (DBIDS) card, which is an identification authentication and force protection tool that is fully operational on military bases throughout the world.

3.0 Qualifications/Considerations

3.1 Special Qualifications/Considerations: Software and/or hardware must be a product pre-approved by the Defense Health Agency (DHA) and authorized to be used on the DHA network. (Currently being used on DHA network)

4.0 Points of Contact

4.1 Points of Contact: Upon arrival to Naval Medical Center Portsmouth contractors will check-in with Barton Allen, barton.e.allen.civ@health.mil, 757-953-4220.

Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (Jan 2017)

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This text applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation , which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. TheContractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

PRIVACY & SECURITY OF PHI

Personally Identifiable Information, Protected Health Information, and Federal Information Requirements (Revised 10/27/2020)

1. General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007 HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA)

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

• DSA for De-Identified Data

• DSA for PHI

• DSA for PII Without PHI

• DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option 2 year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (Applies if contract requirements may include human subject research)

This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C.