HT940624Q00850001 AUDITORIUM RFQ.docx

HT940624Q0085

Section A - Solicitation/Contract Form

SECTION A

***This is Set-Aside Exclusively for only those ALL VENDORS MUST HAVE A VALID/UP TO DATE SAM.GOV REGISTRATION Quotes from other than these Vendors will not be considered.*** It is mandatory that vendors attend the Site Visit of the area of installation scheduled for FRIDAY, 30 AUG 2024 at 1300 EST (1:00 Pm) at Naval Medical Center, Portsmouth, VA (NMCP) before quoting. At this time, there are no additional site visits scheduled. Contractors interested in attending the site visit must have base access and due to time constraints we will not process base entry applications. Please notify the Contract Specialist with the following information:

Company’s Name & Attendees Full Name and POC information:

This information must be sent via e-mail to the Contract Specialist, Luis Zeno at luis.a.zeno-pimentel.civ@health.mil, no later than 1500 EST (3:00 pm) on Tuesday, 27 August 2024. Only contractors who respond timely with the above information will be allowed to participate in the site visit.

***DUE TO THE NATURE OF THE WORK, IT IS MANDATORY THAT ALL INTERESTED VENDORS ATTEND THE SITE VISIT TO EXAMINE WORK CONDITIONS, TAKE MEASUREMENTS, & PLACEMENT OF EXISTING EQUIPMENT.*** Selected vendor will be required to supply the suggested items (or better/equal items), install all supplied items, & offer a trade-in allowance on items being removed/disposed. Also, presentation of vendor's products will be conducted. Note that the Government shall retain the right to determine capability. Additionally, the Government will make the award based on a "Best Value" determination. Evaluation factors are as follows and arranged in level of importance: 1. Technical (design layout, products, etc.) 2. Price., 3. Past Performance. If there are any questions, please contact Luis Zeno via email

VENDOR TO COMPLETE THE FOLLOWING:

POINTS FO CONTACT

Naval Medical Center Portsmouth Points of Contact:

Name: LUIS ZENO Phone: 757-953- 6084 E-Mail: luis.a.zeno-pimentel.civ@health.mil

REQUEST FOR QUOTE INFORMATION & EVALUATUION FACTORS

Vendor to reference Request for Quotation (RFQ) Number HT940624Q0085 on all correspondence relating to this RFQ

The government will make an award based on an “All or None” evaluation and/or based on the “Best Value” proposed for this requirement in terms of technical capabilities/approach, past performance, and price. Vendors must provide all of the below to be considered a “responsive vendor”. The solicitation and contract award is in accordance with FAR 52.211-6 Brand Name or Equal.

Quote Evaluation factors for Best Value will be rated as follows (in order of importance):

Technical capabilities/technical approach

· Vendor to provide technical capabilities statement/technical approach for completing the services per the Performance Work Statement or Statement of Work (see Section C)

· Must be a separate “unpriced” document Price evaluation

· Vendor to provide a published price list (not a GSA contract price list) or two invoices for the same or similar services or supplies.

Past Performance

· Vendor to provide a minimum of three (3) references for similar services provided during the past 24 months

· Company Name

· Contract Award Number

· Total Contract Award Amount

· Period of Performance

· Point of Contact (POC)

· Email address and phone number of the POC

· Description of services provided and relevance.

**Note to vendors for FAR 52.211-6 Brand Name of Equal: Salient Characteristics of the item can be found in Section C of this document.

Section B - Supplies or Services and Prices

AUDIOVISUAL EQUIPMENT FOR AUDITORIUM

FFP

please refer to pws for more information NOTE: The requirements in DFARS 252.211-7003, Item Identification and Valuation, are applicable for this line item. The contractor shall provide DoD unique identification or a DoD recognized unique identification equivalent.

FOB: Destination

DE01

NET AMT

Section C - Descriptions and Specifications

PWS

PERFORMANCE WORK STATEMENT (PWS)

FOR MULTIMEDIA INSTALLATION AT NAVAL MEDICAL CENTER PORTSMOUTH (NMCP)

PART 1

SCOPE OF WORK

This contract is for the procurement, installation and programming of Audio Visual (AV) system equipment. The contract also requires for the removal and disposal of existing AV system equipment as required or if needed for Naval Medical Center main Auditorium located at 620 John Paul Jones Circle Portsmouth, Virginia 23708, building 3, 2nd floor. This contract requires fully operational equipment and systems that meets the government requirements and interface with existing government provided equipment. All equipment must be TAA compliant. The contract requires a system design/drawing that will include any changes, recommendations, wiring, with the new installation. All components or equipment installed must be new and fully operational prior to government testing and acceptance. This contract requires operational training for staff members at installation location. No refurbished equipment will be used for this installation. A one-year equipment replacement warranty is required for all newly installed equipment.

GENERAL: This is a non-personal services contract to provide AV system equipment installation. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform AV system installation as defined in this PWS except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

Background: The installation and digital programming of multimedia equipment, along with the removal and disposal of current multimedia equipment.

Objectives:

a. Installation of new equipment

b. Programming if needed of all digital components

c. Provide a one-year equipment replacement warranty

d. Provide training to the staff at the installation location

Scope: The installation and programming of AV systems equipment. The contractor shall accomplish the installation of new AV system equipment and perform all programming as require for all digital component or systems.

Period of Performance: Not applicable for the PWS. The period of performance shall be for one (1) Base Year and four (4) Option Years. The Period of Performance reads as follows:

Option Year I

Option Year II

Option Year II I

GENERAL INFORMATION

Quality Control: Not applicable for this PWS. The contractor shall develop and maintain an effective QCP to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is how the contractor assures that the work performance complies with the contract requirements of the contract. After acceptance of the QAP the contractor shall receive the KO’s acceptance in writing of any proposed change to the QC system.

Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

Recognized Holidays: This will include all Federal Holidays.

Hours of Operation: The contractor is responsible for conducting business, between the hours of 0730 a.m. to 4:30 p.m. Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

Place of Performance: The work to be performed under this contract will be performed at Naval Medical Center Portsmouth 620 John Paul Jones Circle, Portsmouth, Virginia 23708, main Auditorium building 3, 2nd floor.

Type of Contract: The government will award a FFP Contract.

PHYSICAL Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured

Key Control: If required/needed. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the KO.

In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

Lock Combinations: Not applicable. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s QCP

Special Qualifications: The contractor is responsible for ensuring that employees are certified for digital programming.

Contracting Officer Representative (COR): The COR will be identified by COR Appointment letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements; including Government drawings; designs; specifications; monitor Contractor's performance and notify both the KO and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the contract

Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

Contractor Travel Not applicable: Contractor will be required to travel CONUS during the performance of this contract to attend meetings, conferences, and training. The contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this PWS: Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires Government approval/authorization and notification to the COR.

Other Direct Costs: N/A for this installation: This category includes travel, reproduction, and shipping expenses associated with training activities and visits to contractor facilities.

Data Rights: N/A for this installation. The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Organizational Conflict of Interest: It is the contractor’s responsibility to notify the KO of any potential Organizational Conflict of Interest (OCI). If an OCI exist the contractor shall propose a Mitigation plan that shall be review and accepted by the KO prior to continuance of the work that presents an OCI. Should the proposed Mitigation Plan not be accepted by the KO, the Government may terminate this contract, disqualify the Contractor from subsequent contractual efforts, and pursue any remedies as may be permitted by the law or this contract.

PART 2

DEFINITIONS & ACRONYMS

DEFINITIONS AND ACRONYMS:

DEFINITIONS:

CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the government. This is the only individual who can legally bind the government.

CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of a product or service meet contract requirements.

SUBCONTRACTOR. One that enters a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

WORKDAY. The number of hours per day the Contractor provides services in accordance with the contract.

WORK WEEK. Monday through Friday, unless specified otherwise.

ACRONYMS:

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The government will provide access to all locations for new installations. The government will be support for base access as needed.

GOVERNMENT FURNISHED ITEMS AND SERVICES:

The Government will provide access to all locations for AV system installation.

Government will assist contractor personnel with base access.

PART 4

CONTRACTOR FURNISHED ITEMS AND SPECIFIC TASKS

The Contractor will submit a package for programming and installation of AV system equipment Naval Medical Center Portsmouth, 620 John Paul Jones Circle, Portsmouth, Virginia 23708, main auditorium building 3, 2nd floor. This package must include a design plan and equipment listing. This design shall include any changes and recommendations required to interface with existing government provided equipment. All components installed must be fully operational prior to government testing and acceptance. This is a turn-key installation with a two-equipment replacement warranty requirement.

CONTRACTOR RESPONSIBILITIES AND SPECIFIC TASKS:

Basic Services. The contractor shall provide services for installation and programming AV system equipment

The Contractor shall:

Purchase, install and program all requested AV equipment for NMCP Task Heading.

1. Purchase requested AV equipment

2. Installation of all newly purchased equipment

3. Programming of all digital components or systems

4. Test all install equipment and ensuring that it interface with existing government equipment

5. This is a turn-key installation in which requires a walk-through

6. Provide training to staff members at installation location

7. One year equipment replacement warranty

PART 5

APPLICABLE PUBLICATIONS

APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

BASE ACCESS (NMCP)

Commander, Navy Installations Command (CNIC), has established the Navy Commercial Access Control System (NCACS), a standardized process for granting unescorted access privileges to vendors, contractors, suppliers and service providers not otherwise entitled to the issuance of a Common Access Card (CAC) who seek access to and can provide justification to enter Navy installations and facilities. Vendors visiting Naval Medical Center Portsmouth (NMCP) may obtain daily passes directly from Naval Station Norfolk (NSN) Pass and ID office, located at NSN (Bldg CD-9), 9040 Hampton Blvd, Norfolk, Virginia, 23505, by submitting identification credentials for verification and undergoing a criminal screening/ background check. Alternatively, if the vendor so chooses, it may voluntarily elect to obtain long-term credentials through enrollment, registration, background vetting, screening, issuance of credentials, and electronic validation of credentials at its own cost through one of the designated independent contractors NCACS service providers. Credentials will be issued every five years and access privileges will be reviewed / renewed on an annual basis. The costs incurred to obtain Navy installation access of any kind are not reimbursable, and the price(s) paid for obtaining long-term NCACS credentials will not be approved as a direct cost of this contract. Further information regarding NCACS can be found at: http://cnic.navy.mil/CNIC_HQ_Site/index.htm.

(End

PART 6

ATTACHMENT/TECHNICAL EXHIBIT LISTING

Attachment List: N/A

Attachment 1– Quality Assurance Surveillance Plan (QASP Attachment 2– Deliverables Schedule

NMCP Auditorium AV Equipment

DriveCore 4-Channel Amplifier QUANTITY 1

• Flexible input routing

• Convection cooled

• Universal power supply

• Integrated Life-Safety Features

• Up to 8 x 125W in 1U chassis with no fan

• Patented feedback and protection Circuits

• DriveCore technology provides >90% efficiency with no compromise in performance

• Amplifier is stable for 2Ω - 16Ω loads

• XFMR 4/8 needed for 70V/100V applications

• Flexible input routing

1 Line Array Column Loudspeaker QUANTITY 6

• 70cm J-shaped coaxial line array with 16x1” tweeters

• 4x5” woofers plus patent-pending Constant Beamwidth Technology circuitry A/V

• Asymmetrical Switchable Vertical Coverage: Narrow 25 ° asymmetrical, 45 ° asymmetrical

• Equalization: Music (flat) / Speech

• Tap Setting: 8 ohms

• Frequency: 60 Hz- 20 kHz

• Sensitivity: 98dB

• Power Handling: 500W

• Max SPL: 125 dB (133 cB peak)

• Pattern Control Frequency: 800Hz

• Mounting: 10 x M6 insert points, wall bracket included

• Dimensions: 695 x 168 x 235 mm/ 27.4 x 606 x 9.3 in

Line Array Extension Speaker QUANTITY 2

• Components: Four 130mm (5in) LF drivers

• Frequency range: 45 Hz- 700 Hz

• Sensitivity: 90 dB full space, 96 dB half-space (65 Hz- 300 Hz)

• Nominal Impedance: 8 ohms

• Power Capacity: 500 W (2000 W peak) 2 hrs, 350 W (1400 W peak), 100 hrs

• Max SPL: 117 dB

• Net weight: 8.2 kg (18 lb)

HDMI Matrix Switch QUANTITY 1

• High performance switching of HDMI video and audio signals with two audio outputs

• Size: 16 x 8

• Supports computer and video resolutions up to 4K/60 @ 4:4:4

• Supported HDMI 2.0b specification features include data rates up to 18 Gbps, HDR, Deep color up to 12-bit, 3D, HD lossless audio formats, and CEC

• HDMI audio de-embedding with digital S/PDIF and analog stereo audio outputs

• CEC- Consumer Electronics Control capability

• Output volume control

• HDCP 2.3 compliant

High Performance Control Processor QUANTITY 1

• 4-Series control system with 2 GB SDRAM and 8 GB flash memory

• Embedded 4-Series multicore CPU processor

• iPhone, iPad, and Android device control app support

• XPanel computer and web-based control

• Modular programming architecture

• Onboard IR/serial, COM, I/O, relay, and high-speed gigabit Ethernet control ports

• High-speed USB 2.0 host port memory card

• Enterprise-class network security and authentication

• SNMP V3 remote IT management support

• Native BACnet network/ IP support

• Installer setup via software, web browser, and cloud

• IPv6 ready

• Integrates with Apple HomeKit technology

• Rack mountable

• Dimensions: H 1.7 in, W 17.28 in, D 6.56 in

Tabletop 7-inch Touch Panel QUANTITY 1

• 7 in. (178mm) widescreen active-matrix color display

• 1280 x 800 WXGA display resolution

• Capacitive touch screen display

• Custom-programmable virtual control buttons

• Built-in speakers

• Supports HTML5 and Smart Graphics software custom user projects

• H.265, H.264, or MJPEG streaming video display

• Built-in web browsing

• Single wire Ethernet connection with PoE or PoE+ power

• USB 2.0 port

• Enterprise grade security and authentication

• Web or device-based configuration

Tabletop 10-inch Touch Panel QUANTITY 1

• 10.1 in. (257mm) widescreen active-matrix color display

• 1920 x 1200 WUXGA display resolution

• Capacitive touch screen display

• Custom-programmable virtual control buttons

• Built-in speakers

• Supports HTML5 and Smart Graphics software custom user projects

• H.265, H.264, or MJPEG streaming video display

• Built-in web browsing

• Single wire Ethernet connection with PoE or PoE+ power

• USB 2.0 port

• Enterprise grade security and authentication

• Web or device-based configuration

24-Port POE Switch QUANTITY 1

• 24-port gigabit Ethernet unmanaged PoE+ switch providing power and data from a single cable

HDMI Transmitter and receiver QUANTITY 10

• Digital HDMI Extender/ receiver by single CAT 5E/6/7

• Full HD 1080P with deep color

• EDID copy

Converge Pro 880T/8l Professional Bundle Conferencing System QUANTITY 1

• Dimensions: L 17.25 x D 10.25 x H 1.75 inches

• Full bandwidth acoustical noise cancellation (20 Hz – 22 kHz)

• Microphone Preamp Stage > 0- 56 dB in 7 dB increments

• Integrated Ethernet and USB connections

• Drag/drop A/V and channel objects

• 20 Hz- 22 kHz bandwidth for full-range audio response for mic delivering clear audio to the far end

• Built-in telephone interface and 10W amplifier

• Mic-Line inputs 1-8

• Power input range 100-240 VAC; 50/60 Hz

Web cameras QUANTITY 1

• With HDBaseT Technology

• Use Cat-5e/6e cable for power, control, and sending video signals

• HDMI signal up to 100 meters (329 feet)

• WDR (wide dynamic range) for clear detail in high-contrast, bright lighting conditions

• Tri-synchronous motion technology allows camera to pan, tilt, and zoom simultaneously

• Simultaneous HDBaseT, HDMI, and IP streaming

• Power connector: 12VDC, 3.0 amp

HDMI and Audio to USB Scaling Bridge Port QUANTITY 1

• Seamlessly integrates pro AV sources

• USB 2.0 device connection

• Video scaling provides USB output from 320x180 to 1080p/15

• Integrated audio DSP with AEC reference output

• HDMI input with HDCP-compliant loop through

Lectern QUANTITY 1

• Dimensions: W 24 7/8, D 25 1/4, H 45 1/4

• Flat or wedge top pod option to suit your interface requirements

• Rear door with innovative hidden lock for full access to equipment from audience side as well as locking keyboard door

• Interior space with 14U 19” rack frame (21”D)

• Hide away locking front pocket door

• FAN Quiet cooling 120mm fan

• Heavy duty casters (2 locking)

• Thermowrapped lectern with choice finishes

• Ships assembled

LED sign QUANTITY 1

• Dimensions: L 49” x H 6.25”

• Display Array: 80 x 7 pixels

• Clarity up to 200 feet away

• 13 minimum characters one line or 22 in condensed mode

• Pixel size 0.35”

• Character size 4.0

• 8 bright LED colors and 3 rainbow effects

• Character sets: Block (san serif), decorative (serif), upper/lower case, slim/wide

• Capacity for 96 different messages to be stored and displayed

• Power: 120 VAC or 230 VAC

• Power cord length 10 ft

Equipment Rack QUANTITY 1

• Fully welded construction

• 2,500 lbs weight capacity

• Seismic certified

• 22” OD width, 20”, 25”, or 28” OD depth

• 12’. ¾”. 1” & 1-1/2” electrical knockouts on removable split rear plates top and bottom

• Standard front, optional rear 11-gauge 10-31 threaded, dully adjustable rack rail with numbered rack space increments

• Optional front doors

• Durable black textured powder coat finish

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLAUSES INCORPORATED BY REFERENCE

CLAUSES INCORPORATED BY FULL TEXT

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (DEC 2018)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

____________COMBO FOR SUPPLIES________________________________________________

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial item financing, submit a commercial item financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F.

(g) WAWF point of contact. Jeffrey.a.weddle.civ@health.mil

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact. usn.detrick.navmedlogcomftdmd.list.nmlc-wawf@mail.mil (2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

Section F - Deliveries or Performance

HOURS OF DELIVERY

Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DELIVERY INFORMATION

Section G - Contract Administration Data

Section H - Special Contract Requirements

PRIVACY AND SECURITY

BUSINESS ASSOCIATE AGREEMENT

Privacy, Access, Use, and Disclosure of Protected Health Information

1. Introduction. In accordance with 45 C.F.R. §§ 164.502(e)(2) and 164.504(e), and DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, this document serves as a Business Associate Agreement (BAA) between the signatory Parties for purposes of the HIPAA and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA issuances (both defined below). The Parties are (1) a DoD Military Health System (MHS) component command such as a Navy Medicine Medical Treatment Facility (MTF) (Naval Medical center or Naval hospital), or special mission command (research, public health, other), acting as a HIPAA covered entity, and (2) another Federal or Government organization, civilian academic institution, or other civilian entity, acting as a HIPAA Business Associate (BA). The HIPAA Rules require BAAs between covered entities and BAs. Implementing this BAA requirement, the applicable DoD HIPAA issuances (DoDM 6025.18) provides that requirements applicable to BAs must be incorporated (or incorporated by reference) into the contract or agreement between the Parties.

2. Definitions:

a. Terms. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules (DoDM6025.18-): Data aggregation, designated record set, disclosure, health care operations, individual, minimum necessary, notice of privacy practices, protected health information (PHI), required by law, secretary, security incident, subcontractor, unsecured PHI, and use.

b. Breach. means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other Personally Identifiable Information (PII) (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of “Breach” in DoD Privacy Act issuances as defined herein.

c. BA. shall generally have the same meaning as the term “BA” in the DoD HIPAA issuances, and in reference to this BAA, shall mean the entity (another Government organization, civilian academic institution, or other civilian organization), entering into agreement with a Navy Medicine MTF or special mission command.

d. Agreement. means this BAA together with the documents or other arrangements under which the BA signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

e. Covered Entity. shall generally have the same meaning as the term “covered entity” in the DoD HIPAA issuances, and in reference to this BAA, shall mean a Navy Medicine MTF or special mission command under the Bureau of Medicine and Surgery.

f. DHA Privacy Office. means the Defense Health Agency (DHA) Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate.

g. DoD HIPAA Issuances. means the DoD issuances implementing the HIPAA Rules in the DoD MHS. These issuances are DoDM 6025.18 Implementation of the HIPAA Privacy Rule in DoD Health Care Programs,” March 13, 2019; DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs of December 2009, and DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs of August 2015.

h. DoD Privacy Act Issuances. means the DoD issuances implementing the Privacy Act, which are DoD Directive 5400.11, DoD Privacy Program of 29 October 2014, and DoD 5400.11-R, Department of Defense Privacy Program of 8 May 2007.

i. HIPAA Rules. means, collectively, the HIPAA privacy, security, breach and enforcement rules, issued by the United States (US) Department of Health and Human Services (HHS) and codified at 45 C.F.R. §§ 160 and 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and 45 C.F.R. § 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules which implemented the “HITECH Act” provisions of Publication L. 111-5. See 78 Federal Regulation 5566-5702 of 25 January 2013 (with corrections at 78 Federal Regulation 32464 of 7 June 2013. Additional HIPAA rules regarding electronic transactions and code sets (45 C.F.R. § 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

j. HHS Breach. means a breach that satisfies the HIPAA Breach Rule definition of “Breach” in 45 C.F.R. § 164.402.

k. Service-Level Privacy Office. means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

3. Obligations and Activities of BA:

a. The BA shall not access, use, or disclose PHI other than as permitted or required by this Agreement, the controlling Memorandum of Understanding (MOU) or training affiliation agreement, or as required by law.

b. The BA shall use appropriate safeguards and comply with the DoD HIPAA Rules with respect to electronic PHI to prevent use or disclosure of PHI other than as provided for by this Agreement, the controlling MOU, or law.

c. The BA shall report to the covered entity any Breach of which it becomes aware and shall proceed with breach response steps required by paragraph 7 (Breach Response) of this BAA. With respect to electronic PHI, the BA shall also respond to any security incident of which it becomes aware in accordance with any information assurance provisions of the Understanding. If at any point the BA becomes aware that a security incident involves a breach, the BA shall immediately initiate breach response as required by paragraph 7 (Breach Response) of this BAA.

d. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, as applicable, the BA shall ensure that any entities that create, receive, maintain, or transmit PHI on behalf of the BA agree to the same restrictions, conditions, and requirements that apply to the BA with respect to such PHI.

e. The BA shall make available PHI in a designated record set, to the covered entity or, as directed by the covered entity, to an Individual, as necessary to satisfy the covered entity obligations under 45 C.F.R. § 164.524.

f. The BA shall make any amendment(s) to PHI in a designated record set as directed or agreed to by the covered entity pursuant to 45 C.F.R. § 164.526, or take other measures as necessary to satisfy covered entity’s obligations under 45 C.F.R. § 164.526.

g. The BA shall maintain and make available the information required to provide an accounting of disclosures to the covered entity or an individual as necessary to satisfy the covered entity’s obligations under 45 C.F.R. § 164.528.

h. To the extent the BA is to carry out one or more of the covered entity’s obligation(s) under the HIPAA privacy rule, the BA shall comply with the requirements of HIPAA privacy rule that apply to the covered entity in the performance of such obligation(s).

i. The BA shall make its internal practices, books, and records available to the Secretary and the covered entity for purposes of audit and in determining compliance with the HIPAA Rules.

4. Permitted Uses and Disclosures by BA:

a. The BA may only use or disclose PHI as necessary to perform the services set forth in the Understanding or as required by law. The BA is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 C.F.R. § 164.514(a) through (c), nor is it permitted to use or disclose de-identified PHI except as provided by the Understanding or directed by the covered entity.

b. The BA agrees to use, disclose, and request PHI only in accordance with the HIPAA privacy rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA issuances.

c. The BA shall not use or disclose PHI in a manner that would violate the DoD HIPAA issuances or HIPAA privacy rules if done by the covered entity, except uses and disclosures for the BA’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs:

(1) Except as otherwise limited in the understanding, the BA may use PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(2) Except as otherwise limited in the Understanding, the BA may disclose PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA, provided that disclosures are required by law, or the BA obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the BA of any instances of which it is aware in which the confidentiality of the information has been breached.

(3) Except as otherwise limited in the Understanding, the BA may use PHI to provide Data Aggregation services relating to the covered entity’s health care operations.

5. Provisions for Covered Entity to Inform BA of Privacy Practices and Restrictions:

a. The covered entity shall provide the BA with the notice of privacy practices that the covered entity produces in accordance with 45 C.F.R.§ 164.520 and the corresponding provision of the DoD HIPAA issuances (DoDM 6025.18).

b. The covered entity shall notify the BA of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the BA’s use or disclosure of PHI.

c. The covered entity shall notify the BA of any restriction on the use or disclosure of PHI that the covered entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such changes may affect the BA’s use or disclosure of PHI.

6. Permissible Requests by Covered Entity. The covered entity shall not request the BA to use or disclose PHI in any manner that would not be permissible under the HIPAA privacy rule or any applicable Government regulations (including without limitation, DoD HIPAA issuances) if done by the covered entity, except for providing Data Aggregation services to the covered entity and for management and administrative activities of the BA as otherwise permitted by this BAA.

7. Breach Response:

a. General. Breach Response is designed to satisfy the DoD Privacy Act issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA issuances. In general, the BA shall report the breach to the covered entity, assess the breach incident, notify affected individuals, and take mitigating actions, as applicable. Because DoD defines “Breach” to include possible (suspected) as well as actual (confirmed) breaches, the BA shall implement these breach response requirements immediately upon the BA’s discovery of a possible breach. The following provisions set forth the BA’s Privacy Act and HIPAA breach response requirements for all breaches, including but not limited to HHS breaches (defined below). In the event of a breach of PII or PHI held by the BA, the BA shall follow the breach response requirements set forth under paragraphs 7, 8, and 9 of this BAA, which are designed to satisfy both the Privacy Act and HIPAA, as applicable.

(1) If a breach involves PII without PHI, then the BA shall comply with DoD Privacy Act issuance breach response requirements only.

(2) If a breach involves PHI (a subset of PII), then the BA shall comply with both Privacy Act and HIPAA breach response requirements.

(3) If a breach involves PHI, it may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the BA has no HIPAA breach response obligations. In such cases, the BA must still comply with breach response requirements under the DoD Privacy Act issuances.

b. HHS Breach. If the DHA Privacy Office determines that a breach is an HHS Breach, then the BA shall comply with both the HIPAA Breach Rule and DoD Privacy Act issuances, as directed by the DHA Privacy Office, regardless of where the breach occurs.

c. Non-HHS Breach. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the BA shall comply with DoD Privacy Act issuances, as directed by the applicable Service-Level Privacy Office.

d. Service-Level Privacy Office Point of Contact (POC). Brian Martin, who may be reached at Comm: 904-542-3559, DSN: 312-942-3559, or via E-mail: brian.k.martin4.civ@mail.mil, or usn.ncr.bumedfchava.list.bumed-pii-rpt@mail.mil.

8. Breach Reporting Provisions:

a. The BA shall report the breach within 1 business day of discovery to the US Computer Emergency Readiness Team (US-CERT) and within 24 hours of discovery to the DHA Privacy Office and the other Parties set forth below. The BA is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer, or other agent of the BA.

b. The BA shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report. Before submission to US-CERT, the BA shall save a copy of the on-line report. After submission, the BA shall record the US-CERT Reporting Number. Although only limited information about the breach may be available as of the 1 hour deadline for submission, the BA shall submit the US-CERT report by the deadline. The BA shall e-mail updated information as it is obtained, following the instructions at: http://www.us-cert.gov/pgp/email.html. The BA shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office and the applicable Service-Level Privacy Office, if requested by either.

BA questions about US-CERT reporting shall be directed to the DHA or Service-Level Privacy Office, not the US-CERT office.

c. The BA report due within 24 hours shall be submitted by completing the New Breach Reporting Form DD 2959 at the Breach Response page on the DHA Privacy Office web site and emailing that form to, as applicable, the DHA Privacy Office, the Service-Level Privacy Office, the Contracting Officer (CO) and Contracting Officer’s Representative (COR) (if the Understanding is not a contract, delete these references to the CO and COR), and the BA’s DoD POC unless the POC specifies another addressee for breach reporting. Encryption is not required, because Breach Report Forms should not contain PII or PHI. The email address for notices to the DHA Privacy Office is provided at the Privacy Office web site breach response page. If electronic mail is not available, telephone notification is also acceptable, but all notifications and reports delivered telephonically must be confirmed by email as soon as technically feasible.

d. If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances. The BA shall inform the DHA Privacy Office as soon as possible if it believes that “single event” breach response is appropriate; the DHA Privacy Office will determine how the BA shall proceed and, if appropriate, consolidate separately reported breaches for purposes of BA report updates, beneficiary notification, and mitigation.

e. When a Breach Report Form initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the BA shall submit a revised form or forms, stating the updated status and previous report date(s) and showing any revisions or additions in red text. Examples of updated information the BA shall report include, but are not limited to:

(1) Confirmation on the exact data elements involved.

(2) Root cause of the incident.

(3) Any mitigation actions to include, sanctions, training, incident containment, follow-up, etc. The BA shall submit these report updates promptly after the new information becomes available. Prompt reporting of updates is required to allow the DHA Privacy Office to make timely final determinations on any subsequent notifications or reports.