OPEN_MARKET_CLAUSES_FOR_SERVICES_Provisions.docx

CLAUSES INCORPORATED BY REFERENCE

SERVICES

I. Federal Acquisition Regulations (FAR) (48 CFR Chapter 1) Clauses

And Reinvestment Act of 2009

Content Paper

Subcontract Awards

24.

Commercial Items

28. 52.212-5 Contract Terms and Conditions March 2016 Required to implement statutes Or Executive Orders-Commercial Items Corporations

(Multiple Year and Option Contracts)

Data (Alternate I)

Representation and Certifications

II. FAR Clauses Incorporated by Full Text FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS--COMMERCIAL ITEMS (DEVIATION 2013-O0019) (Jan 2014)

(a) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (a) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records -- Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(b)

(1) Notwithstanding the requirements of any other clause in this contract, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (b)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Apr 2010) (Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 note)).

(ii) 52.219-8, Utilization of Small Business Concerns (Dec 2010) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $650,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(iii) 52.222-17, Non-displacement of Qualified Workers (Jan 2013) (E.O. 13495). Flow down required in accordance with paragraph (1) of FAR clause 52.222-17.

(iv) 52.222-26, Equal Opportunity (Mar 2007) (E.O. 11246).

(v) 52.222-35, Equal Opportunity for Veterans (Sep 2010) (38 U.S.C. 4212).

(vi) 52.222-36, Affirmative Action for Workers with Disabilities (Oct 2010) (29 U.S.C. 793).

(vii) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(viii) 52.222-41, Service Contract Act of 1965, (Nov 2007), (41 U.S.C. 351, et seq.)

(ix) 52.222-50, Combating Trafficking in Persons (Feb 2009) (22 U.S.C. 7104(g)).

Alternate I (Aug 2007) of 52.222-50 (22 U.S.C. 7104(g)).

(x) 52.222-51, Exemption from Application of the Service Contract Act to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (Nov 2007) (41 U.S.C. 351, et seq.).

(xi) 52.222-53, Exemption from Application of the Service Contract Act to Contracts for Certain Services--Requirements (Feb 2009) (41 U.S.C. 351, et seq.)

(xii) 52.222-54, Employment Eligibility Verification (Jul 2012).

(xiii) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (Mar 2009) (Pub. L. 110-247). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xiv) 52.247-64, Preference for Privately-Owned U.S.- Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of Clause)

Alternate I (2013-O0019) (Jan 2014). As prescribed in 12.301(b)(4), delete paragraph (a) from the basic clause, redesignate paragraph (b)(1) as paragraph (a), and redesignate paragraphs (b)(1)(i) through (b)(1)(xiv) as paragraphs (a)(1) through (a)(14) and redesignate paragraph (b)(2) as paragraph (b).

Alternate II (2013-O0019) (Jan 2014). As prescribed in 12.301(b)(4)(ii), substitute the following paragraphs (a)(1) and (b)(1) for paragraphs (a)(1) and (b)(1) of the basic clause as follows:

(a)

(1) The Comptroller General of the United States, an appropriate Inspector General appointed under section 3 or 8G of the Inspector General Act of 1978 (5 U.S.C. App.), or an authorized representative of either of the foregoing officials shall have access to and right to—

(i) Examine any of the Contractor’s or any subcontractors’ records that pertain to, and involve transactions relating to, this contract; and

(ii) Interview any officer or employee regarding such transactions.

(b)

(1) Notwithstanding the requirement of any other clause in this contract, the Contractor is not required to flow down any FAR clause in a subcontract for commercial items, other than—

(i) Paragraph (a) of this clause. This paragraph flows down to all subcontracts, except the authority of the Inspector General under paragraph (a)(1)(ii) does not flow down; and

(ii) Those clauses listed in this paragraph (b)(1). Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(A) 52.203-13, Contractor Code of Business Ethics and Conduct (Apr 2010) (Pub. L. 110-252, Title VI, Chapter1 (41 U.S.C. 251 note)).

(B) 52.203-15, Whistleblower Protections Under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5).

(C) 52.219-8, Utilization of Small Business Concerns (Dec 2010) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $650,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219–8 in lower tier subcontracts that offer subcontracting opportunities.

(D) 52.222-26, Equal Opportunity (Mar 2007) (E.O. 11246).

(E) 52.222-35, Equal Opportunity for Veterans (Sep 2010) (38 U.S.C. 4212).

(F) 52.222-36, Affirmative Action for Workers with Disabilities (Oct 2010) (29 U.S.C. 793).

(G) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(H) 52.222-41, Service Contract Act of 1965 (Nov 2007) (41 U.S.C. 351, et seq.).

(I) 52.222-50, Combating Trafficking in Persons (Feb 2009) (22 U.S.C. 7104(g)).

(J) 52.222-51, Exemption from Application of the Service Contract Act to Contracts for Maintenance, Calibration, of Repair of Certain Equipment-Requirements (Nov 2007) (41 U.S.C. 351, et seq.).

(K) 52.222-53, Exemption from Application of the Service Contract Act to Contracts for Certain Services-Requirements (Feb 2009) (41 U.S.C. 351, et seq.).

(L) 52.222-54, Employment Eligibility Verification (Jan 2009).

(M) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (Mar 2009) (Pub. L. 110-247). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(N) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

* Contracting Officer insert the dollar value(s) of standard coverage(s) prevailing within the local community as to the specific medical specialty, or specialties, concerned, or such higher amount as the Contracting Officer deems necessary to protect the Government’s interests.

II. Health and Human Services Acquisition Regulation Full Text Clauses

352.202-1 Definitions.

As prescribed in FAR 2.201, the Contracting Officer shall insert the clause in FAR 52.202-1, Definitions, as revised by 302.201:

Definitions (January 2006)

(a) In accordance with 52.202–1(a)(1), substitute the following as paragraph (a): ‘‘(a) The term ‘‘Secretary’’ or ‘‘Head of the Agency’’ (also called ‘‘Agency Head’’) means the Secretary, Deputy Secretary, or any Assistant Secretary, Administrator or Commissioner of the Department of Health and Human Services; and the term ‘‘his/her duly authorized representative’’ means any person, persons, or board authorized to act for the Secretary.’’

(b) In accordance with 52.202–1(a)(1), add the following paragraph (h):

‘‘(h) The term ‘‘Contracting Officer’s Technical Representative” means the person who monitors the technical aspects of contract performance. The Contracting Officer’s Technical Representative is not authorized to issue any instructions or directions which cause any increase or decrease in the Statement of Work/Performance Work Statement/Specifications which would result in the increase or decrease in the price of this contract, or changes in the delivery schedule or period of performance of this contract. If applicable, the Contracting Officer’s Technical Representative is not authorized to receive or act upon any notification or revised cost estimate provided by the Contractor in accordance with the Limitation of Cost or Limitation of Funds clauses of this contract.’’ 352.203-70 Anti-lobbying.

As prescribed in 303.808-70, the Contracting Officer shall insert the following clause:

Anti-Lobbying (January 2006) Pursuant to the current HHS annual appropriations act, except for normal and recognized executive-legislative relationships, the Contractor shall not use any HHS contract funds for (i) publicity or propaganda purposes; (ii) the preparation, distribution, or use of any kit, pamphlet, booklet, publication, radio, television or video presentation designed to support or defeat legislation pending before the Congress or any State legislature, except in presentation to the Congress or any State legislature itself; or (iii) payment of salary or expenses of the Contractor, or any agent acting for the Contractor, related to any activity designed to influence legislation or appropriations pending before the Congress or any State legislature.

(End of clause) 352.215-1 Instructions to offerors--competitive acquisition.

As prescribed in 315.209, the Contracting Officer shall insert the following paragraph (e) in the provision in FAR 52.215-1, Instructions to Offerors – Competitive Acquisition:

(e) Restriction on disclosure and use of data.

(1) The proposal submitted in response to this request may contain data (trade secrets; business data (e.g., commercial information, financial information, cost and pricing data); and technical data) which the offeror, including its prospective subcontractor(s), does not want used or disclosed for any purpose other than for evaluation of the proposal. The use and disclosure of any data may be so restricted; provided, that the Government determines that the data is not required to be disclosed under the Freedom of Information Act, 5 U.S.C. 552, as amended, and the offeror marks the cover sheet of the proposal with the following statements, specifying the particular portions of the proposal which are to be restricted:

‘‘Unless disclosure is required by the Freedom of Information Act, 5 U.S.C. 552, as amended, (the Act) as determined by Freedom of Information (FOI) officials of the Department of Health and Human Services (HHS), data contained in the portions of this proposal which the offeror has specifically identified by page number, paragraph, etc. as containing restricted information shall not be used or disclosed except for evaluation purposes.

The offeror acknowledges that HHS may not be able to withhold a record (e.g., data, document, etc.) nor deny access to a record requested pursuant to the Act and that the HHS’ FOI officials must make that determination. The offeror hereby agrees that the Government is not liable for disclosure if HHS has determined that disclosure is required by the Act.

If a contract is awarded to the offeror as a result of, or in connection with, the submission of this proposal, the Government shall have the right to use or disclose the data to the extent provided in the contract. Proposals not resulting in a contract remain subject to the Act.

The offeror also agrees that the Government is not liable for disclosure or use of unmarked data and may use or disclose the data for any purpose, including the release of the information pursuant to requests under the Act. The data subject to this restriction are contained in pages (insert page numbers, paragraph designations, etc. or other identification).’’

(2) In addition, the offeror must mark each page of data it wishes to restrict with the following statement:

‘‘Use or disclosure of data contained on this page is subject to the restriction on the cover sheet of this proposal or quotation.’’

(3) Offerors are cautioned that proposals submitted with restrictive statements or statements differing in substance from those cited above may not be considered for award. The Government reserves the right to reject any proposal submitted with nonconforming statement(s).

352.222-70 Contractor cooperation in equal employment opportunity investigations.

As prescribed in 322.810(h), the Contracting Officer shall insert the following clause:

Contractor Cooperation in Equal Employment Opportunity Investigations (January 2010)

(a) In addition to complying with the clause in FAR 52.222-26, Equal Opportunity, the Contractor shall, in good faith, cooperate with the Department of Health and Human Services (Agency) in investigations of Equal Employment Opportunity (EEO) complaints processed pursuant to 29 C.F.R. Part 1614. For purposes of this clause, the following definitions apply:

(1) “Complaint” means a formal or informal complaint that has been lodged with Agency management, Agency EEO officials, the Equal Employment Opportunity Commission (EEOC), or a court of competent jurisdiction.

(2) “Contractor employee” means all current Contractor employees who work or worked under this contract. The term also includes current employees of subcontractors who work or worked under this contract. In the case of Contractor and subcontractor employees, who worked under this contract, but who are no longer employed by the Contractor or subcontractor, or who have been assigned to another entity within the Contractor’s or subcontractor’s organization, the Contractor shall provide the Agency with that employee’s last known mailing address, e-mail address, and telephone number, if that employee has been identified as a witness in an EEO complaint or investigation.

(3) “Good faith cooperation” cited in paragraph (a) includes, but is not limited to, making Contractor employees available for: (i) formal and informal interviews by EEO counselors or other Agency officials processing EEO complaints; (ii) formal or informal interviews by EEO investigators charged with investigating complaints of unlawful discrimination filed by federal employees; (iii) reviewing and signing appropriate affidavits or declarations summarizing statements provided by such Contractor employees during the course of EEO investigations; (iv) producing documents requested by EEO counselors, EEO investigators, Agency employees, or the EEOC in connection with a pending EEO complaint; and (v) preparing for and providing testimony in hearings before the EEOC and U.S. District Court.

(b) The Contractor shall include the provisions of this clause in all subcontract solicitations and subcontracts awarded at any tier under this contract.

(c) Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause may be grounds for the Contracting Officer to terminate this contract for default.

(End of clause)

352.223-70 Safety and health.

As prescribed in 323.7002(a), the Contracting Officer shall insert the following clause:

Safety and Health (January 2006)

(a) To help ensure the protection of the life and health of all persons, and to help prevent damage to property, the Contractor shall comply with all federal, State, and local laws and regulations applicable to the work being performed under this contract. These laws are implemented or enforced by the Environmental Protection Agency, Occupational Safety and Health Administration (OSHA) and other regulatory/enforcement agencies at the federal, State, and local levels.

(1) In addition, the Contractor shall comply with the following regulations when developing and implementing health and safety operating procedures and practices for both personnel and facilities involving the use or handling of hazardous materials and the conduct of research, development, or test projects:

(i) 29 CFR 1910.1030, Bloodborne pathogens; 29 CFR 1910.1450, Occupational exposure to hazardous chemicals in laboratories; and other applicable occupational health and safety standards issued by OSHA and included in 29 CFR Part 1910. These regulations are available at http://www.osha.gov/.

(ii) Nuclear Regulatory Commission Standards and Regulations, pursuant to the Energy Reorganization Act of 1974 (42 U.S.C. 5801 et seq.). The Contractor may obtain copies from the U.S. Nuclear Regulatory Commission, Washington, DC 20555–0001.

(2) The following Government guidelines are recommended for developing and implementing health and safety operating procedures and practices for both personnel and facilities:

(i) Biosafety in Microbiological and Biomedical Laboratories, CDC. This publication is available at http://www.cdc.gov/biosafety/publications/index.htm.

(ii) Prudent Practices for Safety in Laboratories (1995), National Research Council, National Academy Press, 500 Fifth Street, NW., Lockbox 285, Washington, DC 20055 (ISBN 0–309–05229– 7). This publication is available at http://www.nap.edu/catalog/4911.html.

(b) Further, the Contractor shall take or cause to be taken additional safety measures as the Contracting Officer, in conjunction with the Contracting Officer’s Technical Representative or other appropriate officials, determines to be reasonably necessary. If compliance with these additional safety measures results in an increase or decrease in the cost or time required for performance of any part of work under this contract, the Contracting Officer will make an equitable adjustment in accordance with the applicable ‘‘Changes’’ clause set forth in this contract.

(c) The Contractor shall maintain an accurate record of, and promptly report to the Contracting Officer, all accidents or incidents resulting in the exposure of persons to toxic substances, hazardous materials or hazardous operations; the injury or death of any person; or damage to property incidental to work performed under the contract and all violations for which the Contractor has been cited by any federal, State or local regulatory/enforcement agency. The report shall include a copy of the notice of violation and the findings of any inquiry or inspection, and an analysis addressing the impact these violations may have on the work remaining to be performed. The report shall also state the required action(s), if any, to be taken to correct any violation(s) noted by the federal, State or local regulatory/enforcement agency and the time frame allowed by the agency to accomplish the necessary corrective action.

(d) If the Contractor fails or refuses to comply with the federal, State or local regulatory/enforcement agency’s directive(s) regarding any violation(s) and prescribed corrective action(s), the Contracting Officer may issue an order stopping all or part of the work until satisfactory corrective action (as approved by the federal, State or local regulatory/enforcement agencies) has been taken and documented to the Contracting Officer. No part of the time lost due to any stop work order shall be subject to a claim for extension of time or costs or damages by the Contractor.

(e) The Contractor shall insert the substance of this clause in each subcontract involving toxic substances, hazardous materials, or hazardous operations. The Contractor is responsible for the compliance of its subcontractors with the provisions of this clause.

(End of clause)

352.224-70 Privacy Act.

As prescribed in 324.103(b)(2), the Contracting Officer shall insert the following clause:

Privacy Act (January 2006) This contract requires the Contractor to perform one or more of the following:

(a) design;

(b) develop; or

(c) operate a federal agency system of records to accomplish an agency function in accordance with the Privacy Act of 1974 (Act) [5 U.S.C. 552a(m)(1)] and applicable agency regulations. The term ‘‘system of records’’ means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. Violations of the Act by the Contractor and/or its employees may result in the imposition of criminal penalties [5 U.S.C. 552a(i)]. The Contractor shall ensure that each of its employees knows the prescribed rules of conduct and that each employee is aware that he/she is subject to criminal penalties for violation of the Act to the same extent as Department of Health and Human Services employees. These provisions also apply to all subcontracts the Contractor awards under this contract which require the design, development or operation of the designated system(s) of records [5 U.S.C. 552a(m)(1)]. The contract work statement: (a) identifies the system(s) of records and the design, development, or operation work the Contractor is to perform; and (b) specifies the disposition to be made of such records upon completion of contract performance.

(End of clause) HHSAR 352.224-70 Confidentiality of Information The following clause is covered by the policy set forth in subpart 324.70 and is to be used in accordance with the instructions set forth in 324.7704.

CONFIDENTIALITY OF INFORMATION (MAR 2005)

(a) Confidential information, as used in this clause, means (1) information or data of a personal nature about an individual, or (2) proprietary information or data submitted by or pertaining to an institution or organization.

(b) In addition to the types of confidential information described in (a)(1) and (2) above, information which might require special consideration with regard to the timing of its disclosure may derive from studies or research, during which public disclosure of preliminary unvalidated findings could create erroneous conclusions which might threaten public health or safety if acted upon.

(c) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such information from time to time during the performance of the contract. Failure to agree will be settled pursuant to the “Disputes” Clause.

(d) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, the Contractor will follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(e) Confidential information, as defined in (a)(1) and (2) above, that is information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization, shall not be disclosed without the prior written consent of the individual, institution , or organization.

(f) Written advance notice of at least 45 days will be provided to the Contracting Officer of the Contractor’s intent to release findings of studies or research, which have the possibility of adverse effects on the public or the Federal agency, as described in (b) above. If the Contracting Officer does not pose any objections in writing within the 45-day period, the Contractor may proceed with disclosure. Disagreements not resolved by the Contractor and the Contracting Officer will be settled pursuant to the “Disputes” clause.

(g) Whenever the Contractor is uncertain with regard to the proper handling of material under the contract, or if the materials in question is subject to the Privacy Act or is confidential information subject to the provisions of this clause, the Contractor should obtain a written determination from the Contracting Officer prior to any release, disclosure, dissemination, or publication.

Contracting Officer determinations will reflect the results of internal coordination with appropriate program and legal officials.

The provisions of paragraph (e) of this clause shall not apply when the information is subject to conflicting or overlapping provisions in other Federal, State or local laws.

(End of clause)

352.231.71 Pricing of Adjustments Jan 2001

When costs are a factor in determination of a contract price adjustment pursuant to the “Changes” clause or any provision of this contract, the applicable cost principles and procedures set forth below shall form the basis for determining such costs:

Indian Tribal governments.

(End of clause)

352.237-70 Pro-Children Act.

As prescribed in 337.103-70(a), the Contracting Officer shall insert the following clause:

Pro-Children Act (January 2006)

(a) Public Law 103–227, Title X, Part C, also known as the Pro-Children Act of 1994 (Act), 20 U.S.C. 7183, imposes restrictions on smoking in facilities where certain federally funded children’s services are provided. The Act prohibits smoking within any indoor facility (or portion thereof), whether owned, leased, or contracted for, that is used for the routine or regular provision of (i) kindergarten, elementary, or secondary education or library services or (ii) health or day care services that are provided to children under the age of 18. The statutory prohibition also applies to indoor facilities that are constructed, operated, or maintained with Federal funds.

(b) By acceptance of this contract or order, the Contractor agrees to comply with the requirements of the Act. The Act also applies to all subcontracts awarded under this contract for the specified children’s services. Accordingly, the Contractor shall ensure that each of its employees, and any subcontractor staff, is made aware of, understand, and comply with the provisions of the Act. Failure to comply with the Act may result in the imposition of a civil monetary penalty in an amount not to exceed $1,000 for each violation and/or the imposition of an administrative compliance order on the responsible entity. Each day a violation continues constitutes a separate violation.

(End of clause)

352.237-71 Crime Control Act—reporting of child abuse.

As prescribed in 337.103-70(b), the Contracting Officer shall insert the following clause:

Crime Control Act of 1990—Reporting of Child Abuse (January 2006)

(a) Public Law 101–647, also known as the Crime Control Act of 1990 (Act), imposes responsibilities on certain individuals who, while engaged in a professional capacity or activity, as defined in the Act, on federal land or in a federally-operated (or contracted) facility, learn of facts that give the individual reason to suspect that a child has suffered an incident of child abuse.

(b) The Act designates ‘‘covered professionals’’ as those persons engaged in professions and activities in eight different categories including, but not limited to, physicians, dentists, medical residents or interns, hospital personnel and administrators, nurses, health care practitioners, chiropractors, osteopaths, pharmacists, optometrists, podiatrists, emergency medical technicians, ambulance drivers, alcohol or drug treatment personnel, psychologists, psychiatrists, mental health professionals, child care workers and administrators, and commercial film and photo processors. The Act defines the term ‘‘child abuse’’ as the physical or mental injury, sexual abuse or exploitation, or negligent treatment of a child.

(c) Accordingly, any person engaged in a covered profession or activity under an HHS contract or subcontract, regardless of the purpose of the contract or subcontract, shall immediately report a suspected child abuse incident in accordance with the provisions of the Act. If a child is suspected of being harmed, the appropriate State Child Abuse Hotline, local child protective services (CPS), or law enforcement agency shall be contacted. For more information about where and how to file a report, the Childhelp USA, National Child Abuse Hotline (1–800–4–A–CHILD) shall be called. Any covered professional failing to make a timely report of such incident shall be guilty of a Class B misdemeanor.

(d) By acceptance of this contract or order, the Contractor agrees to comply with the requirements of the Act. The Act also applies to all applicable subcontracts awarded under this contract. Accordingly, the Contractor shall ensure that each of its employees, and any subcontractor staff, is made aware of, understand, and comply with the provisions of the Act.

(End of clause)

352.237-72 Crime Control Act—requirement for background checks.

As prescribed in 337.103-70(c), the Contracting Officer shall insert the following clause:

Crime Control Act of 1990—Requirement for Background Checks (January 2006)

(a) Public Law 101–647, also known as the Crime Control Act of 1990 (Act), requires that all individuals involved with the provision of child care services to children under the age of 18 undergo a criminal background check. ‘‘Child care services’’ include, but are not limited to, social services, health and mental health care, child (day) care, education (whether or not directly involved in teaching), and rehabilitative programs. Any conviction for a sex crime, an offense involving a child victim, or a drug felony, may be grounds for denying employment or for dismissal of an employee providing any of the services listed above.

(b) The Contracting Officer will provide the necessary information to the Contractor regarding the process for obtaining the background check. The Contractor may hire a staff person provisionally prior to the completion of a background check, if at all times prior to the receipt of the background check during which children are in the care of the newly-hired person, the person is within the sight and under the supervision of a previously investigated staff person.

(c) By acceptance of this contract or order, the Contractor agrees to comply with the requirements of the Act. The Act also applies to all applicable subcontracts awarded under this contract. Accordingly, the Contractor shall ensure that each of its employees, and any subcontractor staff, is made aware of, understand, and comply with the provisions of the Act.

(End of clause)

352.239-70 Standard for security configurations.

As prescribed in 339.101(d)(1), the Contracting Officer shall insert the following clause:

Standard for Security Configurations (January 2010)

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://usgcb.nist.gov/) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level. (Note: FDCC is applicable to all computing systems using Windows XP™ and Windows Vista™, including desktops and laptops—regardless of function—but not including servers.)

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply: (NOTE: The Contracting Officer shall specify applicable security configuration requirements in solicitations and contracts based on information provided by the Project Officer, who shall consult with the OPDIV/STAFFDIV Chief Information Security Officer.)

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings – see http://scap.nist.gov/validation/. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

352.239-72 Security requirements for federal information technology resources.

As prescribed in 339.7103, the Contracting Officer shall insert the following clause:

Security Requirements for Federal Information Technology Resources (January 2010)

(a) Applicability. This clause applies whether the entire contract or order (hereafter “contract”), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS’ mission. The term “information technology (IT)”, as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting federal information and federal information systems in order to ensure their—

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of federal information and federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer’s (OCIO) website.

(c) Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP) – due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor’s bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

(i) The Contractor’s IT-SP shall comply with applicable federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (PDF) (Title III of the E-Government Act of 2002, Public Law 107-347), and the following federal and HHS policies and procedures:

(A) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

(B) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18 (PDF), Guide for Developing Security Plans for Federal Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(C) HHS-OCIO Information Systems Security and Privacy Policy.

(ii) After resolution of any comments provided by the Government on the draft IT-SP, the Contracting Officer shall accept the IT-SP and incorporate the Contractor’s final version into the contract for Contractor implementation and maintenance. On an annual basis, the Contractor shall provide to the Contracting Officer verification that the IT-SP remains valid.

(2) IT Risk Assessment (IT-RA) – due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor’s final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment) – due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor’s final version into the contract.

(4) IT Security Certification and Accreditation (IT-SC&A) – due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems – see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer’s Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems; and NIST SP 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provide it to the Contracting Officer for review, comment, and acceptance.

(i) After resolution of any comments provided by the Government on the draft IT-SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor’s final version into the contract as a compliance requirement.

(ii) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of (A) annual testing of the system contingency plan and (B) the performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer’s Technical Representative (COTR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions.