HT940627QE006.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30. 1. REQUISITION NUMBER

HT02420012495586

PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER 5. SOLICITATION NUMBER

HT940627QE006

6. SOLICITATION ISSUE DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME Kimberly Bunn

b. TELEPHONE NUMBER (no collect calls) 7579535740

8. OFFER DUE DATE/

LOCAL TIME

24 Nov 2026

09:00 AM

9. ISSUED BY CODE: HT9406

DEFENSE HEALTH AGENCY

HCD SOUTHEAST, 808 SCHREIDER STREET

FREDERICK, MD 21702

UNITED STATES

Kimberly Bunn, Email: kimberly.p.bunn.civ@health.mil Telephone: 7579535740 Melissa Peregrino-White, Email: melissa.peregrino-white.civ@health.mil Telephone:

7579534038

10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR: 100

SMALL BUSINESS WOMEN-OWNED SMALL

BUSINESS (WOSB)

NORTH AMERICAN

INDUSTRY

CLASSIFICATION

STANDARD (NAICS):

238210

HUBZONE SMALL

BUSINESS

ECONOMICALLY

DISADVANTAGED WOMEN-

OWNED SMALL BUSINESS

(EDWOSB)

SIZE STANDARD:

USD 19,000,000.00

SERVICE-DISABLED

VETERAN-OWNED SMALL

BUSINESS (SDVOSB)

8(A)

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS 13a.THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM-DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

REQUEST FOR

QUOTE (RFQ)

INVITATION

FOR BID (IFB)

REQUEST FOR

PROPOSAL (RFP)

15. DELIVER TO CODE: HT0242

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

16. ADMINISTERED BY CODE:

17a. CONTRACTOR/

OFFERER

CODE FACILITY

CODE:

TELEPHONE NUMBER

18a. PAYMENT WILL BE MADE BY CODE:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT

PRICE

24.

AMOUNT

See Schedule (Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

See Section G - Contract Administration Data

26. TOTAL AWARD AMOUNT (For Government Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR

52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN COPIES TO

ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH

OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT TO THE

TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER DATED . YOUR

OFFER ON SOLICITATION (BLOCK 5), INCLUDING ANY ADDITIONS OR

CHANGES WHICH ARE SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS: See Schedule

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

31c. DATE SIGNED

COMPUTER GENERATED STANDARD FORM 1449 (REV. 11/2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

Created On:

10 Nov 2026, 10:15 AM Eastern Standard Time

Solicitation/Contract Form

ELECTRICAL WIRING INSTALL

ELECTRICAL WIRING INSTALL

Product Service Code: J059

HT940627QE006

Supplies or Services & Prices or Costs Additional Information/Notes

Item Supplies / Services Quantity Unit Unit Price Amount

Product Service Description:

Electrical Wiring Installation

Pricing Arrangement: Firm Fixed Price 1 Job

Description/Specifications/Statement of Work Department of Defense Defense Health Agency Performance Work Statement

Dedicated Emergency Electrical Branch Circuits Installation (Panel EL9 to Rooms 9.2-122 & 9.2-129) for MagVenture TMS Equipment Installation / DMH

Naval Medical Center Portsmouth (NMCP)

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide electrical infrastructure installation, conduit routing above drop ceilings under hospital air quality controls, emergency panelboard circuit breaker integration, and receptacle terminations to support newly acquired Government clinical equipment.

1.1.1 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform install dedicated emergency backup branch circuits from emergency panel EL9 to Rooms 9.2-122 and 9.2-129 located in the Mental Health Department (9th Floor Psychiatric Wing) at Naval Medical Center Portsmouth (NMCP). The project includes above-ceiling conduit pathways, dedicated branch circuit conductors, single receptacles, and panelboard breakers as defined in this Performance Work Statement (PWS).

1.1.2 Background:

The Defense Health Agency has procured a MagVenture Transcranial Magnetic Stimulation (TMS) Therapy System under separate contract HT940626PE079 (Requisition Number: HT02420012413628) from MagVenture, Inc. The acquired clinical system includes:

MagPro R30 Magnetic Stimulator (Item 9016E0721) Isolation Transformer MagPro X/R System (Item 9016D0031) Coil Cooler for Cool Coils (Item 9016B0151) Motorized Procedure Chair with neckrest and cloth cover (Item 9016B0081) Head Stabilizer System (Vac-lock Pillow and Evacuation Pump) (Item 9016B0253) Flow Arm, XH Trolley, Cool-B65 Coils, and associated accessories While Contract HT940626PE079 includes on-site uncrating, physical assembly, vendor installation, and clinical user training, it explicitly excludes facility electrical modifications, pathway construction, and branch circuit installation from the facility emergency distribution system. In the absence of this requirement, the newly acquired TMS therapy system cannot be connected to the facility emergency backup system or placed into clinical operation. This PWS establishes the requirements for a licensed electrical contractor to install dedicated 120V emergency backup circuits from Panel EL9 to the destination clinical treatment rooms.

1.1.3 Scope:

The contractor shall provide complete electrical installation services to establish two (2) dedicated, code-compliant emergency backup branch circuits from facility distribution panel EL9 to Room 9.2-122 and Room 9.2-129 (Mental Health / 9th Floor Psychiatric Wing). Services include:

Performing on-site pre-installation site surveys and pathway verification.

Supplying and installing 300+ linear feet of 3/4" Electrical Metallic Tubing (EMT) conduit and associated hardware above the drop ceiling grid while strictly adhering to hospital air quality protocols (limiting ceiling tile removal to no more than two [2] tiles simultaneously per work area).

Supplying and pulling dedicated copper conductors (#10 THHN Black, #12 THHN Black, and #12 THHN Green insulated ground) from Panel EL9 to destination rooms.

Supplying and installing two (2) 20-amp, 1-pole bolt-on circuit breakers in existing Emergency Panelboard EL9.

Supplying, roughing-in, and terminating two (2) 20A, 125V, 3-wire single receptacles (NEMA 5-20R) with matching single-gang faceplates (one [1] dedicated receptacle per room in Room 9.2-122 and Room 9.2-129) positioned to interface with the MagVenture Isolation Transformer and system trolley.

Implementing healthcare Infection Control Risk Assessment (ICRA) Type-A (Low Risk) procedures throughout all above-ceiling and room work.

Conducting circuit continuity, voltage validation, ground verification, and panel schedule directory updates.

1.1.4 Period of Performance (PoP): 1 DEC 2026-31 DEC 2026

1.2 Administrative specifications

1.2.1 Place of performance: The work shall be performed at:

Facility / MTF: Naval Medical Center Portsmouth (NMCP)

Address: 620 John Paul Jones Circle, Portsmouth, VA 23708-2297 Specific Clinical Wing / Floor: Mental Health Department, 9th Floor Psychiatric Wing Specific Locations: Panel EL9 electrical closet, interstitial/above-ceiling pathways, and Rooms 9.2-122 and 9.2-129.

1.2.2 Recognized Federal holidays:

The contractor is not required to perform services on Federal holidays.

New Year's Day Labor Day Martin Luther King Jr.'s Birthday Columbus Day President's Day Veteran's Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.2.3 Hours of operation: The contractor is responsible for conducting business Monday thru Sunday, preferably during downtimes in the wards and clinics, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

Scheduled Panel Tie-Ins / Outages: Any electrical panel tie-in or utility interruption associated with Emergency Panel EL9 that impacts active hospital operations must be scheduled a minimum of ten (10) business days in advance and coordinated through the COR and NMCP Facilities Management Department (FMD).

Behavioral Health / Psychiatric Wing Sensitivities: Work in the 9th Floor Psychiatric Wing requires heightened security and tool inventory controls. Contractor personnel shall maintain strict tool accountability (e.g., tethered or locked tool containers) and coordinate all room access directly with nursing staff, Mental Health Department points of contact, and the COR.

1.2.4 Emergency Services:. (If applicable) On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

(Keep in mind that if the contract does not have a CLIN for payment of emergency services, then 1.2.4 must be deleted.)

(Not Applicable - No emergency CLIN is established for this requirement).

1.3 Contractor Identification

1.3.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the Government understand that the person is contractor support personnel.

2.0 SPECIFIC TASKS

(This section is the heart of the PWS. All of the services to be performed under the contract should be described in sufficient detail here. This includes all general performance tasks required by the Government.)

The contractor shall execute all electrical services described below in compliance with the National Electrical Code (NFPA 70), Standard for Electrical Safety in the Workplace (NFPA 70E), Healthcare Facilities Code (NFPA 99), OSHA 29 CFR 1910 Subpart S, OSHA 29 CFR 1910.147 (Lockout/Tagout), and Unified Facilities Criteria

(UFC 3-520-01).

2.1 Task 1: Site Survey, Material Verification, and Inter-Contractor Coordination

2.1.1 Pre-Installation Pathway & Panel Survey: Within five (5) business days following contract award, the contractor shall verify the physical pathway above the acoustical drop ceiling from Panel EL9 to Rooms 9.2-122 and 9.2-129 on the 9th Floor Psychiatric Wing. The contractor shall confirm available breaker spaces in Panel EL9 and coordinate the exact drop locations in each room with the COR and Mental Health POC.

2.1.2 Material Verification: The contractor shall supply the specific materials listed in Section 2.3.1 (Contractor Furnished Materials) and submit product cut-sheets for all proposed circuit breakers, conduit/raceways, copper conductors, junction boxes, and receptacles to the COR for technical verification prior to installation.

2.1.3 Inter-Contractor Equipment Alignment: The contractor shall coordinate the physical mounting height, wall orientation, and interface requirements for the single receptacles in Rooms 9.2-122 and 9.2-129 to match the power input requirements of the MagVenture TMS Therapy System's Isolation Transformer (Item 9016D0031) and Coil Cooler (Item 9016B0151) as procured under Contract HT940626PE079.

2.2 Task 2: Above-Ceiling Conduit and Pathway Installation (Air Quality Controlled) The contractor shall furnish and install all raceways, conduit fittings, and mechanical supports required to route the emergency circuits from Panel EL9 to the destination rooms.

2.2.1 Conduit Routing, Sizing & Support Hardware: The contractor shall furnish and install 300+ linear feet of 3/4" Electrical Metallic Tubing (EMT) above the drop ceiling grid. All conduits shall be assembled using 3/4" stainless steel setscrew/compression connectors and 3/4" stainless steel couplings. Raceways shall be secured and supported using:

3/4" steel 1-hole straps.

1/2" or 3/4" snap-close conduit clips with 1/4-20 threaded holes.

1/2" or 3/4" conduit and box supports with 9/32" mounting holes.

1/4" threaded rod (plated) and 1/4-20 plated steel hex nuts.

Hammer-on flange clips to 1/4" flange with 1/4" threaded rod hangers.

Fasteners including #10 x 1" pan-head self-tapping screws and #8 x 1/2" wafer head self-tapping stud screws (12-gauge).

Conduit shall be supported directly from the building structure and shall NOT rest on or be attached to suspended ceiling grid wires, HVAC ductwork, or medical piping.

2.2.2 Drop Ceiling Air Quality Protocol (Strict Requirement): In strict compliance with NMCP environmental safety and hospital air quality mandates, the contractor shall open no more than two (2) ceiling tiles simultaneously per work zone at any time during conduit installation and wire pulling. As work progresses along the pathway, previously opened ceiling tiles shall be completely re-seated before opening subsequent tiles.

2.2.3 Junction Boxes and Rough-In: The contractor shall install 4" x 1-1/2" square boxes with combination knockouts, 4" square single-gang plaster rings (5/8" rise) for receptacle locations, 4" square blank covers for pull/splice locations, and ground screws with insulated #12 leads for equipment grounding.

2.2.4 Wall Penetrations and Firestopping: Where conduit penetrates fire-rated smoke barriers or partition walls along the 9th floor run, the contractor shall properly seal all annular penetrations with UL-listed intumescent firestop sealant (ASTM E814 / UL 1479) to restore wall assemblies to their original fire rating.

2.3 Task 3: Dedicated Emergency Branch Circuits and Receptacle Terminations The contractor shall furnish, pull, terminate, and protect two (2) dedicated emergency branch circuits from Panel EL9.

2.3.1 Contractor-Furnished Materials List

The contractor shall provide and install the following specific materials (or approved technical equivalents):

1. Raceway & Fittings:

o 3/4" Conduit - EMT (300+ linear feet) o 3/4" Connectors SS STL - EMT o 3/4" Couplings SS STL - EMT o 3/4" 1-Hole Straps - EMT - Steel o 1/2" or 3/4" Conduit Snap Close Clips w/ 1/4-20 Threaded Hole o 1/2" or 3/4" Conduit + Box Supports w/ 9/32" Mounting Hole

2. Conductors & Wiring Supplies:

o #10 AWG THHN Copper Solid/Stranded Conductor - Black (for long-run voltage drop mitigation across the 300+ ft run) o #12 AWG THHN Copper Conductor - Black (phase/ungrounded conductors) o #12 AWG THHN Copper Conductor - Green (equipment grounding conductors) o Wire Connectors - Red (UL-listed twist-on wire nuts) o Ground Screws with Insulated #12 Lead

3. Boxes, Plaster Rings & Covers:

o 4" x 1-1/2" Square Boxes (Combination Knockouts) o 4" Square Single-Gang Plaster Rings (5/8" rise) o 4" Square Blank Covers

4. Hanging, Support & Fastening Hardware:

o 1/4" Threaded Rod - Plated o 1/4-20 Hex Nuts - Plated Steel o #10 x 1" Pan-Head Self-Tapping Screws o #8 x 1/2" Wafer Head Self-Tapping Stud Screws - 12G o Hammer-On Clips to 1/4" Flange w/ 1/4" Threaded Rod Hangers

5. Overcurrent Protection & Devices:

o (2) 20A, 1-Pole Bolt-On Circuit Breakers (compatible with Panel EL9) o (2) 20A, 125V, 3-Wire Single Receptacles - Brown (Straight Blade, NEMA 5-20R) o (2) 1-Gang Single Receptacle Plates - Plastic Ivory

2.3.2 Panel EL9 Breaker Installation: The contractor shall install the two (2) 20A 1-pole bolt-on breakers into active Panel EL9. The contractor shall update the panel directory card with typed entries indicating "Room 9.2-122 Dedicated TMS Receptacle" and "Room 9.2-129 Dedicated TMS Receptacle."

2.3.3. Branch Circuit Wiring: The contractor shall pull dedicated branch circuits using #10 and #12 THHN conductors and #12 green ground wire. Each circuit shall maintain an individual neutral and ground. Shared neutrals are strictly prohibited.

2.3.4 Receptacle Installation: The contractor shall rough-in and terminate one (1) 20A 125V 3-wire single receptacle (NEMA 5-20R) with an ivory single-gang faceplate in Room 9.2-122 and one (1) in Room 9.2-129. Receptacles shall be permanently labeled with the source panel and circuit number (e.g., "EL9-[Ckt#]").

2.3.5 Drywall Restoration Exclusion: In accordance with the contractor's project scope, structural drywall patching and cosmetic painting are excluded from this electrical scope of work. Any drywall penetrations beyond standard electrical box cut-ins must be coordinated in advance with the COR and NMCP Facilities Management Department.

2.4 Task 4: Testing, Verification, and Cleanliness

2.4.1 Electrical Testing & Polarity Verification: Prior to final acceptance, the contractor shall test all conductors for circuit continuity, equipment ground integrity, line voltage under no-load, and correct hot/neutral/ground polarity at both single receptacles.

2.4.2 Housekeeping and Debris Control: Daily and upon completion of work in each room/corridor, the contractor shall clean up all wire clippings, metal shavings, packaging, and ceiling dust. Work areas shall be left in a clean state suitable for psychiatric wing clinical operations.

2.5 Task 5: Deliverables

The contractor shall provide the following closeout deliverables to the COR prior to final invoice approval:

2.5.1 Submittal Cut Sheets: Technical data sheets for breakers, conduit, wire, and receptacles delivered within five (5) business days of award.

2.5.2 Electrical Test Log: Written record showing voltage, polarity, and circuit continuity readings for both circuits.

2.5.3 As-Built Conduit Redlines: One (1) marked-up plan set reflecting the final routing of the 300+ feet of conduit from Panel EL9 to Rooms 9.2-122 and 9.2-129.

3.0 Qualifications/Considerations

3.1 Special Qualifications / Considerations

3.1.1 Electrician Licensing: All electrical rough-in, panel integration, and terminations shall be executed by or under the direct, continuous, on-site supervision of an active, licensed Journeyman or Master Electrician in good standing within the Commonwealth of Virginia.

3.1.2 Healthcare Infection Control Risk Assessment (ICRA) - Type-A Procedures: The contractor shall strictly adhere to NMCP ICRA Type-A (Low Risk) infection control procedures throughout the duration of performance:

o Conducting work by methods that minimize dust generation from construction activities.

o Ensuring ceiling tiles are inspected, handled carefully, and immediately replaced if damaged.

o Maintaining the strict rule of opening no more than two (2) ceiling tiles simultaneously per work area to prevent disturbance of ceiling air plenum spaces.

o Utilizing HEPA-filtered vacuum equipment for clean-up of any loose dust or debris generated during work.

3.1.3 Life Safety & Smoke Barrier Compliance: All penetrations through smoke or fire barrier walls along the 300+ foot run must be fire stopped with approved UL-listed assemblies prior to the conclusion of the work shift.

3.1.4 Lockout / Tagout (LOTO) Compliance: All work inside or adjacent to Emergency Panel EL9 shall strictly comply with OSHA 29 CFR 1910.147 and NFPA 70E. Panel connections shall be made in an electrically de-energized and locked-out state unless an energized electrical work permit is formally approved by NMCP Safety and the

COR.

3.1.5 Psychiatric Wing Safety and Security Protocols: The contractor shall comply with all NMCP security protocols governing patient-care areas in the Psychiatric Wing, including ensuring tools, ladders, and loose materials are never left unattended.

WALK THROUGH

A one-time site-visit walk through of the spaces will be conducted on Friday November 20th, 2026 @ 12:30 PM EST All interested vendors are required to be present and participate in the scheduled site visit. Vendors not attending this scheduled one-time group site visit may be considered ineligible for contract award.

Contractors interested in attending the site visit must notify the Contract Specialist, Kimberly Bunn via e-mail kimberly.p.bunn.civ@health.mil no later than 10:00am of your company's intentions to participate in the site visit walk-through. Only contractors who have notified the Contract Specialist (Eastern Time) on Monday, 16th 2026 will be allowed to participate in the site visit. Vendors' technical and pricing proposals are due by close of business on Tuesday, 24 June 2026.

Department: Mental Health Department

Command: Naval Medical Center Portsmouth (NMCP)

NMCP Facilities Management Department (FMD) Organization / Command: Naval Medical Center Portsmouth (NMCP) Department: Facilities Management Department / BOMI Address: 620 John Paul Jones Circle, Portsmouth, VA 23708

Requirements FY27 One-Time Contract: Electrical Wiring Installation for TMS Equipment, in support of Mental Health

Product Service Code: J065

Packaging and Marking

Inspection and Acceptance Overall Contract Inspection/Acceptance Locations

Acceptance Location

Acceptance Destination Instructions: See Statement of Work (SOW) or Performance Work Statement (PWS) for Acceptance/inspection criteria.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Deliveries or Performance

Line Item Delivery Schedule Quantity Address and POC

Delivery Schedule From date of lead time event to beginning of performance 1 Month Date of Award

1 Job Service Performance Site DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Period of Performance From 01 Dec 2026 To 31 Dec 2026

Contract Administration Data

VENDOR TO COMPLETE THE FOLLOWING:

COMPANY NAME: ______________________

CAGE: ___________________

UEI: ___________________

Vendor POC: ____________________ Phone: ____________________ Fax: ____________________ Vendor email: _________________________________

Defense Health Agency Contracting Activity (DHACA)

POC:

Phone:

Email:

Product/Services for: Naval Medical Center Portsmouth VA 620 John Paul Jones Circle Portsmouth VA 23708-2297 Department:

Phone:

Vendor to reference RFQ Number: on all inquiries. HT940627QE006

PAYMENT INFORMATION

Payment in Arrears (Check One): __ __Monthly ____Quarterly ____Semi-Annually ____Annually X *Please ensure that quoted price matches the choice above and is evenly divisible depending on the selection

PROMPT PAYMENT

For Prompt Payment Act Purposes, this contract is:

Subject to the 7-calender day constructive acceptance period.

DISCOUNTS

The vendor's initial response to this RFQ should reflect the Vendors' best price including all allowable discounts that are available to the Federal Government. Please identify all discounts that are being offered as part of the vendor's quote submission. The government does not intend to go out for a best and final offer.

EMAIL QUOTES/PROPOSALS TO: kimberly.p.bunn.civ@health.mil DO NOT forward via U.S. Mail service. It is the Contractor's responsibility to confirm receipt of quote/proposal.

DFARS Clauses Incorporated by Reference

Number Title Effective Date Alternate/ Deviation

Variation Effective Date

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports. Dec 2018

DFARS Clauses Incorporated by Full Text

252.232-7006 Wide Area WorkFlow Payment Instructions. (Jan 2023)

WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) As used in this clause- Definitions.

"Department of Defense Activity Address Code (DoDAAC)" is a six position code that uniquely identifies a unit, activity, or organization.

"Document type" means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

"Local processing office (LPO)" is the office responsible for payment certification when payment certification is done external to the entitlement system.

"Payment request" and "receiving report" are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Electronic invoicing.

Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) To access WAWF, the Contractor shall- WAWF access.

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before WAWF training.

submitting payment requests through WAWF. Both can be accessed by selecting the "Web Based Training" link on the WAWF home page at https://wawf.eb.mil/

(e) Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol. WAWF methods of document submission.

(f) The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this WAWF payment instructions.

contract or task or delivery order:

(1) The Contractor shall submit payment requests using the following document type(s): Document type.

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items-

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

(Contracting Officer: Insert applicable invoice and receiving report document type(s) for fixed price line items that require shipment of a deliverable.)

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(Contracting Officer: Insert either "Invoice 2in1" or the applicable invoice and receiving report document type(s) for fixed price line items for services.)

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) ) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF "combo" document type to create some combinations of invoice and receiving report in one step.]

(3) The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment Document routing.

requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC ____

Issue By DoDAAC ____

Admin DoDAAC ____

Inspect By DoDAAC ____

Ship To Code ____

Ship From Code ____

Mark For Code ____

Service Approver (DoDAAC) ____

Service Acceptor (DoDAAC) ____

Accept at Other DoDAAC ____

LPO DoDAAC ____

DCAA Auditor DoDAAC ____

Other DoDAAC(s) ____

(*Contracting Officer: Insert applicable DoDAAC information. If multiple ship to/acceptance locations apply, insert "See Schedule" or "Not applicable.")

(**Contracting Officer: If the contract provides for progress payments or performance-based payments, insert the DoDAAC for the contract administration office assigned the functions under FAR 42.302(a)(13).)

(4) The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with Payment request.

the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F. Receiving report.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

(Contracting Officer: Insert applicable information or "Not applicable.")

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

Special Contract Requirements

BUSINESS ASSOCIATE AGREEMENT

Privacy, Access, Use, and Disclosure of Protected Health Information

1. Introduction. In accordance with 45 C.F.R. (S)(S) 164.502(e)(2) and 164.504(e), and DoDM 6025.18, "Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs," March 13, 2019, this document serves as a Business Associate Agreement (BAA) between the signatory Parties for purposes of the HIPAA and the "HITECH Act" amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA issuances (both defined below). The Parties are (1) a DoD Military Health System (MHS) component command such as a Navy Medicine Medical Treatment Facility (MTF) (Naval Medical center or Naval hospital), or special mission command (research, public health, other), acting as a HIPAA covered entity, and (2) another Federal or Government organization, civilian academic institution, or other civilian entity, acting as a HIPAA Business Associate (BA). The HIPAA Rules require BAAs between covered entities and BAs.

Implementing this BAA requirement, the applicable DoD HIPAA issuances (DoDM 6025.18) provides that requirements applicable to BAs must be incorporated (or incorporated by reference) into the contract or agreement between the Parties.

2. Definitions:

a. Terms. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules (DoDM6025.18-): Data aggregation, designated record set, disclosure, health care operations, individual, minimum necessary, notice of privacy practices, protected health information (PHI), required by law, secretary, security incident, subcontractor, unsecured PHI, and use.

b. Breach. means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other Personally Identifiable Information (PII) (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of "Breach" in DoD Privacy Act issuances as defined herein.

c. BA. shall generally have the same meaning as the term "BA" in the DoD HIPAA issuances, and in reference to this BAA, shall mean the entity (another Government organization, civilian academic institution, or other civilian organization), entering into agreement with a Navy Medicine MTF or special mission command.

d. Agreement. means this BAA together with the documents or other arrangements under which the BA signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

e. Covered Entity. shall generally have the same meaning as the term "covered entity" in the DoD HIPAA issuances, and in reference to this BAA, shall mean a Navy Medicine MTF or special mission command under the Bureau of Medicine and Surgery.

f. DHA Privacy Office. means the Defense Health Agency (DHA) Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate.

g. DoD HIPAA Issuances. means the DoD issuances implementing the HIPAA Rules in the DoD MHS. These issuances are DoDM 6025.18 Implementation of the HIPAA Privacy Rule in DoD Health Care Programs," March 13, 2019; DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs of December 2009, and DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs of August 2015.

h. DoD Privacy Act Issuances. means the DoD issuances implementing the Privacy Act, which are DoD Directive 5400.11, DoD Privacy Program of 29 October 2014, and DoD 5400.11-R, Department of Defense Privacy Program of 8 May 2007.

i. HIPAA Rules. means, collectively, the HIPAA privacy, security, breach and enforcement rules, issued by the United States (US) Department of Health and Human Services (HHS) and codified at 45 C.F.R. (S)(S) 160 and 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and 45 C.F.R. (S) 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules which implemented the "HITECH Act" provisions of Publication L. 111-5. See 78 Federal Regulation 5566-5702 of 25 January 2013 (with corrections at 78 Federal Regulation 32464 of 7 June 2013. Additional HIPAA rules regarding electronic transactions and code sets (45 C.F.R. (S) 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

j. HHS Breach. means a breach that satisfies the HIPAA Breach Rule definition of "Breach" in 45 C.F.R. (S) 164.402.

k. Service-Level Privacy Office. means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

3. Obligations and Activities of BA:

a. The BA shall not access, use, or disclose PHI other than as permitted or required by this Agreement, the controlling Memorandum of Understanding (MOU) or training affiliation agreement, or as required by law.

b. The BA shall use appropriate safeguards and comply with the DoD HIPAA Rules with respect to electronic PHI to prevent use or disclosure of PHI other than as provided for by this Agreement, the controlling MOU, or law.

c. The BA shall report to the covered entity any Breach of which it becomes aware and shall proceed with breach response steps required by paragraph 7 (Breach Response) of this BAA. With respect to electronic PHI, the BA shall also respond to any security incident of which it becomes aware in accordance with any information assurance provisions of the Understanding. If at any point the BA becomes aware that a security incident involves a breach, the BA shall immediately initiate breach response as required by paragraph 7 (Breach Response) of this BAA.

d. In accordance with 45 C.F.R. (S)(S) 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, as applicable, the BA shall ensure that any entities that create, receive, maintain, or transmit PHI on behalf of the BA agree to the same restrictions, conditions, and requirements that apply to the BA with respect to such PHI.

e. The BA shall make available PHI in a designated record set, to the covered entity or, as directed by the covered entity, to an Individual, as necessary to satisfy the covered entity obligations under 45 C.F.R. (S) 164.524.

f. The BA shall make any amendment(s) to PHI in a designated record set as directed or agreed to by the covered entity pursuant to 45 C.F.R. (S) 164.526, or take other measures as necessary to satisfy covered entity's obligations under 45 C.F.R. (S) 164.526.

g. The BA shall maintain and make available the information required to provide an accounting of disclosures to the covered entity or an individual as necessary to satisfy the covered entity's obligations under 45 C.F.R. (S) 164.528.

h. To the extent the BA is to carry out one or more of the covered entity's obligation(s) under the HIPAA privacy rule, the BA shall comply with the requirements of HIPAA privacy rule that apply to the covered entity in the performance of such obligation(s).

i. The BA shall make its internal practices, books, and records available to the Secretary and the covered entity for purposes of audit and in determining compliance with the HIPAA Rules.

4. Permitted Uses and Disclosures by BA:

a. The BA may only use or disclose PHI as necessary to perform the services set forth in the Understanding or as required by law. The BA is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 C.F.R. (S) 164.514(a) through (c), nor is it permitted to use or disclose de-identified PHI except as provided by the Understanding or directed by the covered entity.

b. The BA agrees to use, disclose, and request PHI only in accordance with the HIPAA privacy rule "minimum necessary" standard and corresponding DHA policies and procedures as stated in the DoD HIPAA issuances.

c. The BA shall not use or disclose PHI in a manner that would violate the DoD HIPAA issuances or HIPAA privacy rules if done by the covered entity, except uses and disclosures for the BA's own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs:

(1) Except as otherwise limited in the understanding, the BA may use PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(2) Except as otherwise limited in the Understanding, the BA may disclose PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA, provided that disclosures are required by law, or the BA obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the BA of any instances of which it is aware in which the confidentiality of the information has been breached.

(3) Except as otherwise limited in the Understanding, the BA may use PHI to provide Data Aggregation services relating to the covered entity's health care operations.

5. Provisions for Covered Entity to Inform BA of Privacy Practices and Restrictions:

a. The covered entity shall provide the BA with the notice of privacy practices that the covered entity produces in accordance with 45 C.F.R.(S) 164.520 and the corresponding provision of the DoD HIPAA issuances (DoDM 6025.18).

b. The covered entity shall notify the BA of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the BA's use or disclosure of PHI.

c. The covered entity shall notify the BA of any restriction on the use or disclosure of PHI that the covered entity has agreed to or is required to abide by under 45 C.F.R.

(S) 164.522, to the extent that such changes may affect the BA's use or disclosure of PHI.

6. Permissible Requests by Covered Entity. The covered entity shall not request the BA to use or disclose PHI in any manner that would not be permissible under the

HIPAA privacy rule or any applicable Government regulations (including without limitation, DoD HIPAA issuances) if done by the covered entity, except for providing Data Aggregation services to the covered entity and for management and administrative activities of the BA as otherwise permitted by this BAA.

7. Breach Response:

a. General. Breach Response is designed to satisfy the DoD Privacy Act issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA issuances. In general, the BA shall report the breach to the covered entity, assess the breach incident, notify affected individuals, and take mitigating actions, as applicable. Because DoD defines "Breach" to include possible (suspected) as well as actual (confirmed) breaches, the BA shall implement these breach response requirements immediately upon the BA's discovery of a possible breach. The following provisions set forth the BA's Privacy Act and HIPAA breach response requirements for all breaches, including but not limited to HHS breaches (defined below). In the event of a breach of PII or PHI held by the BA, the BA shall follow the breach response requirements set forth under paragraphs 7, 8, and 9 of this BAA, which are designed to satisfy both the Privacy Act and HIPAA, as applicable.

(1) If a breach involves PII without PHI, then the BA shall comply with DoD Privacy Act issuance breach response requirements only.

(2) If a breach involves PHI (a subset of PII), then the BA shall comply with both Privacy Act and HIPAA breach response requirements.

(3) If a breach involves PHI, it may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the BA has no HIPAA breach response obligations. In such cases, the BA must still comply with breach response requirements under the DoD Privacy Act issuances.

b. HHS Breach. If the DHA Privacy Office determines that a breach is an HHS Breach, then the BA shall comply with both the HIPAA Breach Rule and DoD Privacy Act issuances, as directed by the DHA Privacy Office, regardless of where the breach occurs.

c. Non-HHS Breach. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the BA shall comply with DoD Privacy Act issuances, as directed by the applicable Service-Level Privacy Office.

d. Service-Level Privacy Office Point of Contact (POC). Brian Martin, who may be reached at Comm: 904-542-3559, DSN: 312-942-3559, or via E-mail:

brian.k.martin4.civ@mail.mil, or usn.ncr.bumedfchava.list.bumed-pii-rpt@mail.mil.

BRIAN K. MARTIN

CODE M31 PRIVACY OFFICE

BUMED DETACHMENT JACKSONVILLE

H2005 KNIGHT LANE

PO BOX 140

NAVAL AIR STATION JACKSONVILLE FL 32212

8. Breach Reporting Provisions:

a. The BA shall report the breach within 1 business day of discovery to the US Computer Emergency Readiness Team (US-CERT) and within 24 hours of discovery to the DHA Privacy Office and the other Parties set forth below. The BA is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer, or other agent of the BA.

b. The BA shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report. Before submission to US-CERT, the BA shall save a copy of the on-line report. After submission, the BA shall record the US-CERT Reporting Number. Although only limited information about the breach may be available as of the 1 hour deadline for submission, the BA shall submit the US-CERT report by the deadline. The BA shall e-mail updated information as it is obtained, following the instructions at:

http://www.us-cert.gov/pgp/email.html. The BA shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office and the applicable Service-Level Privacy Office, if requested by either.

BA questions about US-CERT reporting shall be directed to the DHA or Service-Level Privacy Office, not the US-CERT office.

c. The BA report due within 24 hours shall be submitted by completing the New Breach Reporting Form DD 2959 at the Breach Response page on the DHA Privacy Office web site and emailing that form to, as applicable, the DHA Privacy Office, the Service-Level Privacy Office, the Contracting Officer (CO) and Contracting Officer's Representative (COR) (if the Understanding is not a contract, delete these references to the CO and COR), and the BA's DoD POC unless the POC specifies another addressee for breach reporting. Encryption is not required, because Breach Report Forms should not contain PII or PHI. The email address for notices to the DHA Privacy Office is provided at the Privacy Office web site breach response page. If electronic mail is not available, telephone notification is also acceptable, but all notifications and reports delivered telephonically must be confirmed by email as soon as technically feasible.

d. If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances. The BA shall inform the DHA Privacy Office as soon as possible if it believes that "single event" breach response is appropriate; the DHA Privacy Office will determine how the BA shall proceed and, if appropriate, consolidate separately reported breaches for purposes of BA report updates, beneficiary notification, and mitigation.

e. When a Breach Report Form initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the BA shall submit a revised form or forms, stating the updated status and previous report date(s) and showing any revisions or additions in red text. Examples of updated information the BA shall report include, but are not limited to:

(1) Confirmation on the exact data elements involved.

(2) Root cause of the incident.

(3) Any mitigation actions to include, sanctions, training, incident containment, follow-up, etc. The BA shall submit these report updates promptly after the new information becomes available. Prompt reporting of updates is required to allow the DHA Privacy Office to make timely final determinations on any subsequent notifications or reports.

The BA shall provide updates to the same Parties as required for the initial Breach Reporting Form. The BA is responsible for reporting all information needed by the DHA Privacy Office to make timely and accurate determinations on reports to HHS as required by the HHS Breach Rule and reports to the Defense Privacy and Civil Liberties Office as required by DoD Privacy Act issuances.

f. In the event the BA is uncertain on how to apply the above requirements, the BA shall consult with the DHA privacy office or service-level privacy office when determinations on applying the above requirements are needed.

9. Breach - Individual Notification Provisions:

a. Determine if Notification is Required. If the DHA Privacy Office determines that individual notification is required, the BA shall provide written notification to individuals affected by the breach as soon as possible, but no later than 60 working days after the breach is discovered and the identities of the individuals ascertained. The 60-day period begins when the BA is able to determine the identities (including addresses) of the individuals whose records were impacted.

b. Draft Proposed Notification. The BA's proposed notification to be issued to the affected individuals shall be submitted to the Parties to which reports are submitted under paragraph 7 (breach response) for their review and for approval by the DHA Privacy Office. Upon request, the BA shall provide the DHA Privacy Office with the final text of the notification letter sent to the affected individuals. If different groups of affected individuals receive different notification letters, then the BA shall provide the text of the letter for each group. PII shall not be included with the text of the letter(s) provided. Copies of further correspondence with affected individuals need not be provided unless requested by the Privacy Office. The BA's notification to the individuals, at a minimum, shall include the following:

(1) Identify PII Lost. The individual(s) must be advised of what specific data was involved. It is insufficient to simply state that PII has been lost. Where names, Social Security Numbers (SSNs) or truncated SSNs, and Dates of Birth are involved, it is critical to advise the individual that these data elements potentially have been breached.

(2) Inform. The affected individual(s) must be informed of the facts and circumstances surrounding the breach. The description should be sufficiently detailed so that the individual clearly understands how the breach occurred.

(3) Protective Actions. The affected individual(s) must be informed of what protective actions the BA is taking or the individual can take to mitigate against potential future harm. The notice must refer the individual to the current Federal Trade Commission (FTC) web site pages on identity theft and the FTC's Identity Theft Hotline: Toll Free:

1-877-ID-THEFT (438-4338), TTY: 1-866-653-4261.

(4) Credit Monitoring. The individual(s) must also be informed of any mitigating support services (e.g., 1 year of free credit monitoring, identification of fraud expense coverage for affected individuals, provision of credit freezes, etc.) that the BA may offer affected individuals, the process to follow to obtain those services, the period of time the services will be made available, and contact information (including a phone number, either direct or toll-free, e-mail address and postal address) for obtaining more information.

(5) Labeling. BAs shall ensure any envelope containing written notifications to affected individuals are clearly labeled to alert the recipient to the importance of its contents (e.g., "Data Breach Information Enclosed") and that the envelope is marked with the identity of the BA or subcontractor organization that suffered the breach. The letter must also include contact information for a designated POC to include, phone number, email address, and postal address.

c. Notification within 60 Days. If the BA determines that it cannot readily identify, or will be unable to reach, some affected individuals within the 60-day period after discovering the breach, the BA shall so indicate in the initial or updated Breach Report Form. Within the 10-day period, the BA shall provide the approved notification to those individuals who can be reached. Other individuals must be notified within 60 days after identities and addresses are ascertained.