Amended Solicitation - HT940625QE029.pdf

WOMEN-OWNED SMALL

BUSINESS (WOSB)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

REQUEST

FOR QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8(A)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30.

Solicitation/Contract Form

Camino Compact Portable Neuromonitors

Product Service Code: 6515 Date: 12 Sep 2025

HT940625QE029

Supplies or Services & Prices or Costs

Additional Information/Notes

Item Supplies / Services Quantity Unit Unit Price Amount

Camino Compact Portable Neuromonitor (ICP and ICT)

Part Number Description: CAM03 Pricing Arrangement: Firm Fixed Price

2 Each

Ext Cable (Fiberoptic Catheters to Camino Monitors)

Part Number Description: CAMCABL Pricing Arrangement: Firm Fixed Price

1 Each

Description/Specifications/Statement of Work

Requirements Camino Compact Portable Neuromonitors (ICP and ICT) and Ext Cables (Fiberoptic Catheters to Camino Monitors)

Product Service Code: 6515

North American Industry Classification System (NAICS): 221122

Product Service Code: 6515

North American Industry Classification System (NAICS): 221122

Product Service Code: 6515

North American Industry Classification System (NAICS): 221122

Product Service Code: 6515

North American Industry Classification System (NAICS): 221122

Packaging and Marking

Inspection and Acceptance

Overall Contract Inspection/Acceptance Locations

Inspection and Acceptance Location

Both Destination Instructions: In accordance with the terms and conditions of this contract.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Arlene Gonzales Email: arlene.m.gonzales5.mil@health.mil Telephone: 757-953-3134

Inspection and Acceptance Location

Both Destination Instructions: In accordance with the terms and conditions of this contract.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Arlene Gonzales Email: arlene.m.gonzales5.mil@health.mil Telephone: 757-953-3134

Deliveries or Performance

Delivery On Or Before Delivery Date 31 Oct 2025

Contractor Destination

Line Item Delivery Schedule Quantity Address and POC Special Handling/Notes

Delivery On Or Before Delivery Date 31 Oct

2 Each Ship To DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS

MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

FoB Details Contractor Destination

Delivery On Or Before Delivery Date 31 Oct

1 Each Ship To DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS

MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

FoB Details Contractor Destination

Contract Administration Data

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports. Dec 2018

DFARS Clauses Incorporated by Full Text

252.232-7006 Wide Area WorkFlow Payment Instructions. (Jan 2023)

WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) As used in this clause- Definitions.

"Department of Defense Activity Address Code (DoDAAC)" is a six position code that uniquely identifies a unit, activity, or organization.

"Document type" means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

"Local processing office (LPO)" is the office responsible for payment certification when payment certification is done external to the entitlement system.

"Payment request" and "receiving report" are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as Electronic invoicing.

authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) To access WAWF, the Contractor shall- WAWF access.

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice WAWF training.

Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the "Web Based Training" link on the WAWF home page at https://wawf.eb.mil/

(e) Document submissions may be via web entry, Electronic Data Interchange, or File Transfer WAWF methods of document submission.

Protocol.

(f) The Contractor shall use the following information when submitting payment requests and receiving reports WAWF payment instructions.

in WAWF for this contract or task or delivery order:

(1) The Contractor shall submit payment requests using the following document type(s): Document type.

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items-

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

(Contracting Officer: Insert applicable invoice and receiving report document type(s) for fixed price line items that require shipment of a deliverable.)

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(Contracting Officer: Insert either "Invoice 2in1" or the applicable invoice and receiving report document type(s) for fixed price line items for services.)

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) ) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF "combo" document type to create some combinations of invoice and receiving report in one step.]

(3) The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in Document routing.

WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC HQ0490

Issue By DoDAAC HT9406

Admin DoDAAC HT9406

Inspect By DoDAAC N/A

Ship To Code HT0242

Ship From Code N/A

Mark For Code N/A

Service Approver (DoDAAC) HT0242

Service Acceptor (DoDAAC) HT0242

Accept at Other DoDAAC N/A

LPO DoDAAC N/A

DCAA Auditor DoDAAC N/A

Other DoDAAC(s) N/A

(*Contracting Officer: Insert applicable DoDAAC information. If multiple ship to/acceptance locations apply, insert "See Schedule" or "Not applicable.")

(**Contracting Officer: If the contract provides for progress payments or performance-based payments, insert the DoDAAC for the contract administration office assigned the functions under FAR 42.302(a)(13).)

(4) The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in Payment request.

accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F. Receiving report.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

usn.ncr.bumedfchva.list.bumed-piee-support@health.mil

(Contracting Officer: Insert applicable information or "Not applicable.")

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

Special Contract Requirements

Contractor Unclassified Access to Federally ControlledFacilities, Sensitive Information, Information Technology (IT) Systems orProtected Health Information (Jan 2017)

Homeland Security Presidential Directive(HSPD)-12, requires government agencies to develop and implement Federalsecurity standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-TypeMemorandum (DTM) 08-006 - "DoD Implementation of Homeland Security PresidentialDirective - 12 (HSPD-12)" dated November 26, 2008 (or its subsequent DoDinstruction) directs implementation of HSPD-12.

This clause is in accordance with HSPD-12 and its implementingdirectives.

APPLICABILITY

This text applies to contractor employeesrequiring physical access to any area of a federally controlled base, facilityor activity and/or requiring access to a DoN or DoD computer/network/system toperform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Actand Protected Health Information, provide support associated with fiduciaryduties, or perform duties that have been identified as NationalSecurity Position, as advised by the command security manager. It is the responsibility of theresponsible security officer of the command /facility where the work isperformed to ensure compliance.

Each contractor employee providing servicesat a Navy Command under this contract is required to obtain a Department ofDefense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, thecontract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, allcontractor employees working at a federally controlled base, facility oractivity under this clause will require a DoD CAC. When access to a base, facility or activityis required contractor employees shall in-process with the Command's SecurityManager upon arrival to the Command and shall out-process prior to theirdeparture at the completion of the individual's performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30,contractor employees who require access to DoN or DoD networks are categorizedas IT-I, IT-II, or IT-III.

The IT-IIlevel, defined in detail in SECNAV M-5510.30, includes positions which requireaccess to information protected under the Privacy Act, to include ProtectedHealth Information (PHI). All contractoremployees under this contract who require access to Privacy Act protectedinformation are therefore categorized no lower than IT-II. IT Levels are determined by the requiringactivity's Command Information Assurance Manager.

Contractor employees requiring privileged orIT-I level access, (when specified by the terms of the contract) require aSingle Scope Background Investigation (SSBI) or T5 or T5R equivalentinvestigation , which is a higher level investigation than the National AgencyCheck with Law and Credit (NACLC)/T3/T3R described below. Due to the privilegedsystem access, an investigation suitable for High Risk national securitypositions is required.

Individuals who have access to system control,monitoring, or administration functions (e.g. system administrator, databaseadministrator) require training and certification to Information AssuranceTechnical Level 1, and must be trained and certified on the Operating System orComputing Environment they are required to maintain.

Access to sensitiveIT systems is contingent upon a favorably adjudicated backgroundinvestigation. When access to IT systemsis required for performance of the contractor employee's duties, such employeesshall in-process with the Navy Command's Security Manager and InformationAssurance Manager upon arrival to the Navy command and shall out-process priorto their departure at the completion of the individual's performance under thecontract. Completion and approval of aSystem Authorization Access Request

Navy (SAAR-N) form is required for allindividuals accessing Navy Information Technology resources. The decision to authorize access to agovernment IT system/network is inherently governmental. The contractor supervisor is not authorizedto sign the SAAR-N; therefore, the government employee with knowledge of thesystem/network access required or the COR shall sign the SAAR-N as the"supervisor".

The SAAR-N shall beforwarded to the Command's Security Manager at least 30 days prior to theindividual's start date. Failure toprovide the required documentation at least 30 days prior to the individual'sstart date may result in delaying the individual's start date.

When required tomaintain access to required IT systems or networks, the contractor shall ensurethat all employees requiring access complete annual Information Assurance (IA)training, and maintain a current requisite background investigation. The Contractor's Security Representativeshall contact the Command Security Manager for guidance when reinvestigationsare required.

INTERIM ACCESS

The Command'sSecurity Manager may authorize issuance of a DoD CAC and interim access to aDoN or DoD unclassified computer/network upon a favorable review of theinvestigative questionnaire and advance favorable fingerprint results. When the results of the investigation arereceived and a favorable determination is not made, the contractor employeeworking on the contract under interim access will be denied access to thecomputer network and this denial will not relieve the contractor of his/herresponsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potentialconsequences of any requirement under this clause including denial ortermination of physical or system access in no way relieves the contractor fromthe requirement to execute performance under the contract within the timeframesspecified in the contract.

Contractorsshall plan ahead in processing their employees and subcontractor employees. Thecontractor shall insert this clause in all subcontracts when the subcontractoris permitted to have unclassified access to a federally controlled facility,federally-controlled information system/network and/or to governmentinformation, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employeeto serve as the Contractor's Security Representative. Within three work days after contract award,the contractor shall provide to the requiring activity's Security Manager andthe Contracting Officer, in writing, the name, title, address and phone numberfor the Contractor's Security Representative. The Contractor's Security Representative shall be the primary point ofcontact on any security matter. TheContractor's Security Representative shall not be replaced or removed withoutprior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS ANDSECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO

NATIONAL SECURITYPOSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policyrequires that all positions be given a sensitivity value based on level of riskfactors to ensure appropriate protective measures are applied. Contractor employees under this contract arerecognized as Non-Critical Sensitive [ADP/IT-II] positions when the contractscope of work require physical access to a federally controlled base, facilityor activity and/or requiring access to a DoD computer/network, to performunclassified sensitive duties. Thisdesignation is also applied to contractor employees who access Privacy Act andProtected Health Information (PHI), provide support associated with fiduciaryduties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee mustbe a US citizen and have a favorably completed NACLC or T3 or T3R equivalentinvestigation to obtain a favorable determination for assignment to anon-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint checkplus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-IIposition is required to complete:

- SF-86 Questionnairefor National Security Positions (or equivalent OPM investigative product)

- Two FD-258 ApplicantFingerprint Cards (or an electronic fingerprint submission)

- Original SignedRelease Statements

Failure to providethe required documentation at least 30 days prior to the individual's startdate shall result in delaying the individual's start date. Background investigations shall bereinitiated as required to ensure investigations remain current (not older than10 years) throughout the contract performance period. The Contractor's Security Representativeshall contact the Command Security Manager for guidance when reinvestigationsare required.

Regardless of theirduties or IT access requirements ALL contractor employees shall in-process withthe Command's Security Manager upon arrival to the command and shallout-process prior to their departure at the completion of the individual'sperformance under the contract. Employees requiring IT access shall also check-in and check-out with theNavy Command's Information Assurance Manager.

Completion and approval of a System Authorization Access Request Navy(SAAR-N) form is required for all individuals accessing Navy InformationTechnology resources. The SAAR-N shallbe forwarded to the Navy Command's Security Manager at least 30 days prior tothe individual's start date. Failure toprovide the required documentation at least 30 days prior to the individual'sstart date shall result in delaying the individual's start date.

The contractor shallensure that each contract employee requiring access to IT systems or networkscomplete annual Information Assurance (IA) training, and maintain a currentrequisite background investigation. Contractoremployees shall accurately complete the required investigative forms prior tosubmission to the Command Security Manager. The Command's Security Manager will review the submitted documentationfor completeness prior to submitting it to the Office of Personnel Management(OPM); Potential suitability or security issues identified mayrender the contractor employee ineligible for the assignment. An unfavorable determination is final(subject to SF-86 appeal procedures) and such a determination does not relievethe contractor from meeting any contractual obligation under the contract. The Command's Security Manager will forwardthe required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPMto the DoD Central Adjudication Facility (CAF) for a determination.

If the contractoremployee already possesses a current favorably adjudicated investigation, thecontractor shall submit a Visit Authorization Request (VAR) via the JointPersonnel Adjudication System (JPAS) or a hard copy VAR directly from thecontractor's Security Representative. Although the contractor will take JPAS "Owning" role over the contractoremployee, the Command will take JPAS "Servicing" role over thecontractor employee during the hiring process and for the duration ofassignment under that contract.

Thecontractor shall include the IT Position Category per SECNAV M-5510.30 for eachemployee designated on a VAR. The VARrequires annual renewal for the duration of the employee's performance underthe contract.

(End of Clause)

BUSINESSASSOCIATE AGREEMENT

Privacy,Access, Use, and Disclosure of Protected Health Information

1. Introduction. In accordance with 45 C.F.R. (S)(S) 164.502(e)(2)and 164.504(e), and DoDM 6025.18,"Implementation of the Health Insurance Portability and Accountability Act(HIPAA) Privacy Rule in DoD Health Care Programs," March 13, 2019, thisdocument serves as a Business Associate Agreement (BAA) between the signatoryParties for purposes of the HIPAA and the "HITECH Act" amendments thereof, asimplemented by the HIPAA Rules and DoD HIPAA issuances (both definedbelow). The Parties are (1) a DoDMilitary Health System (MHS) component command such as a Navy Medicine MedicalTreatment Facility (MTF) (Naval Medical center or Naval hospital), or specialmission command (research, public health, other), acting as a HIPAA coveredentity, and (2) another Federal or Government organization, civilian academicinstitution, or other civilian entity, acting as a HIPAA Business Associate(BA). The HIPAA Rules require BAAsbetween covered entities and BAs. Implementing this BAA requirement, the applicable DoD HIPAA issuances(DoDM 6025.18) provides that requirements applicable to BAs must beincorporated (or incorporated by reference) into the contract or agreementbetween the Parties.

2. Definitions:

a. . Except as provided otherwise in this BAA, the following terms used inthis BAA shall have the same meaning as those Terms terms in the DoD HIPAA Rules(DoDM6025.18-): Data aggregation,designated record set, disclosure, health care operations, individual, minimumnecessary, notice of privacy practices, protected health information (PHI),required by law, secretary, security incident, subcontractor, unsecured PHI,and use.

b. . means actual or possible loss of control, unauthorized disclosure of orunauthorized access to PHI or other Personally Breach Identifiable Information (PII)(which may include, but is not limited to PHI), where persons other thanauthorized users gain access or potential access to such information for anypurpose other than authorized purposes, where one or more individuals will beadversely affected. The foregoingdefinition is based on the definition of "Breach" in DoD Privacy Act issuancesas defined herein.

c. . BA shall generally have the same meaning as theterm "BA" in the DoD HIPAA issuances, and in reference to this BAA, shall meanthe entity (another Government organization, civilian academic institution, orother civilian organization), entering into agreement with a Navy Medicine MTFor special mission command.

d. . Agreement means this BAA together with the documents orother arrangements under which the BA signatory performs services involvingaccess to PHI on behalf of the MHS component signatory to this BAA.

e. . shall generally have thesame meaning as the term "covered entity" in the DoD HIPAA issuances, and CoveredEntity inreference to this BAA, shall mean a Navy Medicine MTF or special missioncommand under the Bureau of Medicine and Surgery.

f. . means the DefenseHealth Agency (DHA) Privacy and Civil Liberties Office. DHAPrivacy Office The DHA Privacy Office Director is the HIPAAPrivacy and Security Officer for DHA, including the National Capital RegionMedical Directorate.

g. . means the DoD issuances implementing theHIPAA Rules in the DoD MHS. Theseissuances are DoDM DoD HIPAA Issuances

6025.18 Implementation of the HIPAA Privacy Rule in DoDHealth Care Programs," March 13, 2019; DoD Instruction 6025.18, Privacy ofIndividually Identifiable Health Information in DoD Health Care Programs ofDecember 2009, and DoD Instruction 8580.02, Security of IndividuallyIdentifiable Health Information in DoD Health Care Programs of August 2015.

h. . means the DoD issuances implementing thePrivacy Act, which are DoD Directive 5400.11, DoD DoD Privacy Act Issuances Privacy Program of 29 October2014, and DoD 5400.11-R, Department of Defense Privacy Program of 8 May 2007.

i. HIPAA Rules. means, collectively, the HIPAA privacy,security, breach and enforcement rules, issued by the United States (US) Department of Health and Human Services (HHS) and codified at 45 C.F.R. (S)(S) 160and 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and 45C.F.R. (S) 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Ruleswhich implemented the "HITECH Act" provisions of Publication L. 111-5. See 78 Federal Regulation 5566-5702 of 25January 2013 (with corrections at 78 Federal Regulation 32464 of 7 June2013. Additional HIPAA rules regardingelectronic transactions and code sets (45 C.F.R. (S) 162) are not addressed inthis BAA and are not included in the term HIPAA Rules.

j. . means a breach thatsatisfies the HIPAA Breach Rule definition of "Breach" in 45 C.F.R. (S) 164.402. HHSBreach

k. Service-Level Privacy Office. means one or more offices within the militaryservices (Army, Navy, or Air Force) with oversight authority over Privacy Actand HIPAA privacy compliance.

3. Obligations and Activities of BA:

a. TheBA shall not access, use, or disclose PHI other than as permitted or requiredby this Agreement, the controlling Memorandum of Understanding (MOU) ortraining affiliation agreement, or as required by law.

b. TheBA shall use appropriate safeguards and comply with the DoD HIPAA Rules withrespect to electronic PHI to prevent use or disclosure of PHI other than asprovided for by this Agreement, the controlling MOU, or law.

c. TheBA shall report to the covered entity any Breach of which it becomes aware andshall proceed with breach response steps required by paragraph 7 (BreachResponse) of this BAA. With respect toelectronic PHI, the BA shall also respond to any security incident of which itbecomes aware in accordance with any information assurance provisions of theUnderstanding. If at any point the BAbecomes aware that a security incident involves a breach, the BA shallimmediately initiate breach response as required by paragraph 7 (BreachResponse) of this BAA.

d. Inaccordance with 45 C.F.R. (S)(S) 164.502(e)(1)(ii)) and 164.308(b)(2),respectively, as applicable, the BA shall ensure that any entities that create,receive, maintain, or transmit PHI on behalf of the BA agree to the samerestrictions, conditions, and requirements that apply to the BA with respect tosuch PHI.

e. The BA shall make available PHI ina designated record set, to the covered entity or, as directed by the coveredentity, to an Individual, as necessary to satisfy the covered entityobligations under 45 C.F.R. (S) 164.524.

f. TheBA shall make any amendment(s) to PHI in a as directed or agreed to by the covered entity pursuant designatedrecord set to 45C.F.R. (S) 164.526, or take other measures as necessary to satisfy coveredentity's obligations under 45 C.F.R. (S) 164.526.

g. TheBA shall maintain and make available the information required to provide anaccounting of disclosures to the covered entity or an individual as necessaryto satisfy the covered entity's obligations under 45 C.F.R. (S) 164.528.

h. Tothe extent the BA is to carry out one or more of the covered entity'sobligation(s) under the HIPAA privacy rule, the BA shall comply with therequirements of HIPAA privacy rule that apply to the covered entity in theperformance of such obligation(s).

i. TheBA shall make its internal practices, books, and records available to theSecretary and the covered entity for purposes of audit and in determiningcompliance with the HIPAA Rules.

4. Permitted Uses and Disclosures byBA:

a. TheBA may only use or disclose PHI as necessary to perform the services set forthin the Understanding or as required by law. The BA is not permitted to de-identify PHI under DoD HIPAA issuances orthe corresponding 45 C.F.R. (S) 164.514(a) through (c), nor is it permitted touse or disclose de-identified PHI except as provided by the Understanding ordirected by the covered entity.

b. TheBA agrees to use, disclose, and request PHI only in accordance with the HIPAAprivacy rule "minimum necessary" standard and corresponding DHA policies andprocedures as stated in the DoD HIPAA issuances.

c. TheBA shall not use or disclose PHI in a manner that would violate the DoD HIPAAissuances or HIPAA privacy rules if done by the covered entity, except uses anddisclosures for the BA's own management and administration and legalresponsibilities or for data aggregation services as set forth in the followingthree paragraphs:

(1) Except as otherwise limited in theunderstanding, the BA may use PHI for the proper management and administrationof the BA or to carry out the legal responsibilities of the BA. The foregoing authority to use PHI does notapply to disclosure of PHI, which is covered in the next paragraph.

(2) Except as otherwise limited in theUnderstanding, the BA may disclose PHI for the proper management andadministration of the BA or to carry out the legal responsibilities of the BA,provided that disclosures are required by law, or the BA obtains reasonableassurances from the person to whom the PHI is disclosed that it will remainconfidential and used or further disclosed only as required by law or for thepurposes for which it was disclosed to the person, and the person notifies theBA of any instances of which it is aware in which the confidentiality of theinformation has been breached.

(3) Except as otherwise limited in theUnderstanding, the BA may use PHI to provide Data Aggregation services relatingto the covered entity's health care operations.

5. Provisions for Covered Entity toInform BA of Privacy Practices and Restrictions:

a. Thecovered entity shall provide the BA with the notice of privacy practices thatthe covered entity produces in accordance with 45 C.F.R.(S) 164.520 and thecorresponding provision of the DoD HIPAA issuances (DoDM 6025.18).

b. Thecovered entity shall notify the BA of any changes in, or revocation of, thepermission by an Individual to use or disclose his or her PHI, to the extentthat such changes affect the BA's use or disclosure of PHI.

c. Thecovered entity shall notify the BA of any restriction on the use or disclosureof PHI that the covered entity has agreed to or is required to abide by under45 C.F.R. (S) 164.522, to the extent that such changes may affect the BA's use ordisclosure of PHI.

6. Permissible Requests by CoveredEntity. The covered entity shall notrequest the BA to use or disclose PHI in any manner that would not bepermissible under the HIPAA privacy rule or any applicable Governmentregulations (including without limitation, DoD HIPAA issuances) if done by thecovered entity, except for providing Data Aggregation services to the coveredentity and for management and administrative activities of the BA as otherwisepermitted by this BAA.

7. Breach Response:

a. . General Breach Response is designed to satisfy theDoD Privacy Act issuances and the HIPAA Breach Rule as implemented by the DoDHIPAA issuances. In general, the BAshall report the breach to the covered entity, assess the breach incident,notify affected individuals, and take mitigating actions, as applicable. Because DoD defines "Breach" to includepossible (suspected) as well as actual (confirmed) breaches, the BA shallimplement these breach response requirements immediately upon the BA'sdiscovery of a possible breach. Thefollowing provisions set forth the BA's Privacy Act and HIPAA breach responserequirements for all breaches, including but not limited to HHS breaches(defined below). In the event of abreach of PII or PHI held by the BA, the BA shall follow the breach responserequirements set forth under paragraphs 7, 8, and 9 of this BAA, which aredesigned to satisfy both the Privacy Act and HIPAA, as applicable.

(1) If a breach involves PII without PHI,then the BA shall comply with DoD Privacy Act issuance breach responserequirements only.

(2) If a breach involves PHI (a subset ofPII), then the BA shall comply with both Privacy Act and HIPAA breach responserequirements.

(3) If a breach involves PHI, it may ormay not constitute an HHS Breach. If abreach is not an HHS Breach, then the BA has no HIPAA breach responseobligations. In such cases, the BA muststill comply with breach response requirements under the DoD Privacy Actissuances.

b. . If the DHA Privacy Officedetermines that a breach is an HHS Breach, then the BA shall comply with boththe HHSBreach HIPAA Breach Rule and DoD Privacy Act issuances, as directed by the DHAPrivacy Office, regardless of where the breach occurs.

c. . If the DHA Privacy Officedetermines that the breach does not constitute an HHS Breach, then the BA Non-HHSBreach shallcomply with DoD Privacy Act issuances, as directed by the applicableService-Level Privacy Office.

d. . Brian Martin, who may be reached atComm: 904-542-3559, DSN: 312- Service-Level Privacy Office Point of Contact (POC) 942-3559, or via E-mail: brian.k.martin4.civ@mail.mil, orusn.ncr.bumedfchava.list.bumed-pii-rpt@mail.mil.

BRIAN K. MARTIN

CODE M31 PRIVACYOFFICE

BUMED DETACHMENTJACKSONVILLE

H2005 KNIGHTLANE

PO BOX 140

NAVAL AIRSTATION JACKSONVILLE FL 32212

8. Breach Reporting Provisions:

a. TheBA shall report the breach within 1 business day of discovery to the USComputer Emergency Readiness Team (US- CERT) and within 24 hours of discovery tothe

DHAPrivacy Office and the other Parties set forth below. The BA is deemed to have discovered a breachas of the time a breach (suspected or confirmed) is known, or by exercisingreasonable diligence would have been known, to any person (other than theperson committing it) who is an employee, officer, or other agent of the BA.

b. TheBA shall submit the US-CERT report using the online form athttps://forms.us-cert.gov/report. Beforesubmission to US- CERT, the BA shall save a copy of the on-line report. After submission, the BA shall record theUS-CERT Reporting Number. Although onlylimited information about the breach may be available as of the 1 hour deadlinefor submission, the BA shall submit the US-CERT report by the deadline. The BA shall e-mail updated information as itis obtained, following the instructions at: http://www.us-cert.gov/pgp/email.html. The BA shall provide a copy of the initial or updated US-CERT report tothe DHA Privacy Office and the applicable Service-Level Privacy Office, ifrequested by either.

BAquestions about US-CERT reporting shall be directed to the DHA or Service-LevelPrivacy Office, not the US-CERT office.

c. TheBA report due within 24 hours shall be submitted by completing the New BreachReporting Form DD 2959 at the Breach Response page on the DHA Privacy Officeweb site and emailing that form to, as applicable, the DHA Privacy Office, theService- Level Privacy Office, the Contracting Officer (CO) and ContractingOfficer's Representative (COR) (if the Understanding is not a contract, deletethese references to the CO and COR), and the BA's DoD POC unless the POCspecifies another addressee for breach reporting. Encryption is not required, because BreachReport Forms should not contain PII or PHI. The email address for notices tothe DHA Privacy Office is provided at the Privacy Office web site breachresponse page. If electronic mail is notavailable, telephone notification is also acceptable, but all notifications andreports delivered telephonically must be confirmed by email as soon astechnically feasible.

d. Ifmultiple beneficiaries are affected by a single event or related set of events,then a single reportable breach may be deemed to have occurred, depending onthe circumstances. The BA shall inform the DHA Privacy Office as soon aspossible if it believes that "single event" breach response is appropriate; theDHA Privacy Office will determine how the BA shall proceed and, if appropriate, consolidate separately reported breaches for purposes of BA report updates,beneficiary notification, and mitigation.

e. Whena Breach Report Form initially submitted is incomplete or incorrect due tounavailable information, or when significant developments require an update,the BA shall submit a revised form or forms, stating the updated status and previousreport date(s) and showing any revisions or additions in red text. Examples of updated information the BA shallreport include, but are not limited to:

(1) Confirmation on the exact dataelements involved.

(2) Root cause of the incident.

(3) Any mitigation actions toinclude, sanctions, training, incident containment, follow-up, etc. The BA shall submit these report updatespromptly after the new information becomes available. Prompt reporting of updates is required toallow the DHA Privacy Office to make timely final determinations on anysubsequent notifications or reports. TheBA shall provide updates to the same Parties as required for the initial BreachReporting Form. The BA is responsiblefor reporting all information needed by the DHA Privacy Office to make timelyand accurate determinations on reports to HHS as required by the HHS BreachRule and reports to the Defense Privacy and Civil Liberties Office as requiredby DoD Privacy Act issuances.

f. Inthe event the BA is uncertain on how to apply the above requirements, the BAshall consult with the DHA privacy office or service-level privacy office whendeterminations on applying the above requirements are needed.

9. Breach - Individual NotificationProvisions:

a. . If theDHA Privacy Office determines that individual notification is required, the Determineif Notification is Required BAshall provide written notification to individuals affected by the breach assoon as possible, but no later than 60 working days after the breach isdiscovered and the identities of the individuals ascertained. The 60-day period begins when the BA is ableto determine the identities (including addresses) of the individuals whoserecords were impacted.

b. . The BA'sproposed notification to be issued to the affected individuals shall besubmitted to the DraftProposed Notification Parties to which reports are submitted under paragraph 7(breach response) for their review and for approval by the DHA PrivacyOffice.

Upon request, the BA shallprovide the DHA Privacy Office with the final text of the notification lettersent to the affected individuals.

Ifdifferent groups of affected individuals receive different notificationletters, then the BA shall provide the text of the letter for each group. PII shall not be included with the text ofthe letter(s) provided. Copies offurther correspondence with affected individuals need not be provided unlessrequested by the Privacy Office. TheBA's notification to the individuals, at a minimum, shall include thefollowing:

(1) . The individual(s) must be advised of whatspecific data was involved. It isinsufficient to simply state that PII has Identify PII Lost been lost. Where names, Social Security Numbers (SSNs)or truncated SSNs, and Dates of Birth are involved, it is critical to advisethe individual that these data elements potentially have been breached.

(2) . The affected individual(s) must be informedof the facts and circumstances surrounding the breach. The description shouldbe Inform sufficiently detailed so that the individual clearly understands how thebreach occurred.

(3) . The affected individual(s) must be informedof what protective actions the BA is taking or the individual can take Protective Actions tomitigate against potential future harm. The notice must refer the individual to the current Federal TradeCommission (FTC) web site pages on identity theft and the FTC's Identity TheftHotline: Toll Free: 1-877-ID-THEFT (438-4338), TTY:1-866-653-4261.

(4) . The individual(s) must also be informed ofany mitigating support services (e.g., 1 year of free credit monitoring,Credit Monitoring identification of fraud expense coverage for affected individuals, provision ofcredit freezes, etc.) that the BA may offer affected individuals, the processto follow to obtain those services, the period of time the services will bemade available, and contact information (including a phone number, eitherdirect or toll-free, e-mail address and postal address) for obtaining moreinformation.

(5) . BAs shall ensure any envelope containingwritten notifications to affected individuals are clearly labeled to alert therecipient Labeling to the importance of its contents (e.g., "Data Breach InformationEnclosed") and that the envelope is marked with the identity of the BA orsubcontractor organization that suffered the breach. The letter must alsoinclude contact information for a designated POC to include, phone number, email address, and postal address.

c. If the BA determines that it cannot readilyidentify, or will be unable to reach, some affected Notification within 60 Days.

individuals within the60-day period after discovering the breach, the BA shall so indicate in theinitial or updated Breach Report Form. Within the 10-day period, the BA shall provide the approved notificationto those individuals who can be reached. Other individuals must be notified within 60 days after identities andaddresses are ascertained. The BA shallconsult with the DHA Privacy Office, which will determine which media notice ismost likely to reach the population not otherwise identified or reached. The BA shall issue a generalized medianotice(s) to that population in accordance with Privacy Office approval.

d. . The BA shall, at no cost to the government, bear any costs associatedwith a breach of PII or PHI that the BA has caused or is Costs otherwise responsiblefor addressing.

e. . Breaches arenot to be confused with security incidents (often referred to as cyber SecurityIncident versus Breach securityincidents when electronic information is involved), which may or may notinvolve a breach of PII or PHI. In theevent of a security incident not involving a PII or PHI breach, the BA shallfollow applicable DoD Information Assurance requirements under itsUnderstanding. If at any point the BAfinds that a cyber security incident involves a PII or PHI breach (suspected orconfirmed), the BA shall immediately initiate the breach response proceduresset forth herein. The BA shall alsocontinue to follow any required cyber security incident response procedures tothe extent needed to address security issues, as determined by DoD/DHA.

10. Termination:

a. Termination. Noncompliance by the BA (or any of its staff,agents, or subcontractors) with any requirements in this BAA may subject the BAto termination under any applicable default or other termination provision ofthe Understanding.

b. Effect of Termination.

(1) If the Understanding has recordsmanagement requirements, the BA shall handle such records in accordance withthe records management requirements. Ifthe Understanding does not have records management requirements, the recordsshould be handled in accordance with subparagraphs

(2) and (3) below. If the Understanding has provisions fortransfer of records and PII or PHI to a successor BA or if DHA gives directionsfor such transfer, the BA shall handle such records and information inaccordance with such Understanding provisions or DHA direction.

(2) If theUnderstanding does not have records management requirements, except as providedin the following paragraph (3), upon termination of the Understanding, for anyreason, the BA shall return or destroy all PHI received from the coveredentity, or created or received by the BA on behalf of the covered entity thatthe BA still maintains in any form. Thisprovision shall apply to PHI that is in the possession of subcontractors oragents of the BA. The BA shall retain nocopies of the PHI.

(3)If the Understanding does not have records management provisions and the BAdetermines that returning or destroying the PHI is infeasible, the BA shallprovide to the covered entity notification of the conditions that make returnor destruction infeasible.

Upon mutualagreement of the covered entity and the BA that return or destruction of PHI isinfeasible, the BA shall extend the protections of the Understanding to suchPHI and limit further uses and disclosures of such PHI to those purposes thatmake the return or destruction infeasible, for so long as the BA maintains suchPHI.

11. Miscellaneous:

a. Survival. The obligations of BA under the "Effect ofTermination" provision of this BAA shall survive the termination of theUnderstanding.

b. Interpretation. Any ambiguity in the Understanding shall beresolved in favor of a meaning that permits the covered entity and the BA tocomply with HIPAA and the DoD HIPAA Rules.

(End of Clause)

Contract Clauses

FAR Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

52.204-13 System for Award Management Maintenance. Oct 2018 52.204-18 Commercial and Government Entity Code Maintenance. Aug 2020 52.209-10 Prohibition on Contracting with Inverted Domestic Corporations. Nov 2015 52.212-4 Contract Terms and Conditions-Commercial Products and Commercial Services. Nov 2023

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

252.203-7000 Requirements Relating to Compensation of Former DoD Officials. Sep 2011 252.203-7002 Requirement to Inform Employees of Whistleblower Rights. Dec 2022

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

(DEVIATION 2024-O0013 REVISION 1)

May 2024 Deviation 2024-O0013 May 2024

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

Jan 2023

252.211-7008 Use of Government-Assigned Serial Numbers. Sep 2010 252.223-7008 Prohibition of Hexavalent Chromium. Jan 2023 252.225-7001 Buy American and Balance of Payments Program. Feb 2024 252.225-7002 Qualifying Country Sources as Subcontractors. Mar 2022 252.225-7048 Export-Controlled Items. Jun 2013 252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime. Jan 2023

252.225-7060 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region.

Jun 2023

252.232-7010 Levies on Contract Payments. Dec 2006 252.237-7007 Termination for Default. Dec 1991 252.243-7001 Pricing of Contract Modifications. Dec 1991 252.244-7000 Subcontracts for Commercial Products or Commercial Services. Nov 2023 252.244-7001 Contractor Purchasing System Administration. (Alternate I) Jan 2025 Alternate I Jan 2025 252.246-7007 Contractor Counterfeit Electronic Part Detection and Avoidance System. Jan 2023 252.246-7008 Sources of Electronic Parts. Jan 2023 252.247-7023 Transportation of Supplies by Sea. Oct 2024

FAR Clauses Incorporated by Full Text

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders- Commercial Products and Commercial Services.

(Jan 2025)

CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS-COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES (JAN 2025)

The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by (a) reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (section 743 of Division E, Title (1) (JAN 2017) VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (2) (DEC (Section 1634 of Pub. L. 115-91).2023)

52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Section (3) (NOV 2021) 889(a)(1)(A) of Pub. L. 115-232).

52.209-10, Prohibition on Contracting with Inverted Domestic Corporations .(4) (NOV 2015)

52.232-40, Providing Accelerated Payments to Small Business Subcontractors (31 U.S.C. 3903 and 10 U.S.C. 3801).(5) (MAR 2023)

52.233-3, Protest After Award (31 U.S.C. 3553).(6) (AUG 1996)

52.233-4, Applicable Law for Breach of Contract Claim (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).(7) (OCT 2004)

The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this (b) contract by reference to implement provisions of law or Executive orders applicable to acquisitions of…