Section I.pdf

PART II – CONTRACT CLAUSES

SECTION I - CONTRACT CLAUSES

I.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at the following Internet address: http://www.arnet.gov/far/.

52.202-1 DEFINITIONS (JUN 2020)

52.203-3 GRATUITIES (APR 1984)

52.203-5 COVENANT AGAINST CONTINGENT FEES (MAY 2014)

52.203-6 RESTRICTIONS ON SUBCONTRACTOR SALES TO THE

GOVERNMENT (SEP 2006)

52.203-7 ANTI-KICKBACK PROCEDURES (JUN 2020)

52.203-8 CANCELLATION, RESCISSION, AND RECOVERY OF FUNDS FOR

ILLEGAL OR IMPROPER ACTIVITY (MAY 2014)

52.203-10 PRICE OR FEE ADJUSTMENT FOR ILLEGAL OR IMPROPER

ACTIVITY (MAY 2014)

52.203-12 LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL

TRANSACTIONS (JUN 2020)

52.203-13 CONTRACTOR CODE OF BUSINESS ETHICS AND CONDUCT (NOV

2021)

52.203-14 DISPLAY OF HOTLINE POSTER(S) (NOV 2021)

52.203-16 PREVENTING PERSONAL CONFLICTS OF INTEREST (JUN 2020)

52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS (NOV 2023)

52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL

CONFIDENTIALITY AGREEMENTS OR STATEMENTS (JAN 2017)

52.204-2 SECURITY REQUIREMENTS (MAR 2021)

52.204-2 SECURITY REQUIREMENTS (MAR 2021) – ALTERNATE I

52.204-4 PRINTED/COPIED DOUBLE-SIDED ON RECYCLED PAPER (MAY

2011)

52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR

PERSONNEL (JAN 2011)

52.204-10 REPORTING EXECUTIVE COMPENSATION AND FIRST-TIER

SUBCONTRACT AWARDS (JUN 2020)

52.2024-12 UNIQUE ENTITY IDENTIFIER MAINTENANCE (OCT 2016)

52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE.

(OCT 2018)

52.204-15 SERVICE CONTRACT REPORTING REQUIREMENTS FOR

INDEFINITE-DELIVERY CONTRACTS (OCT 2016)

52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND

CERTIFICATIONS (DEC 2014)

52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR

INFORMATION SYSTEMS (NOV 2021)

52.204-23 PROHIBITION ON CONTRACTING FOR HARDWARE, SOFTWARE,

AND SERVICES DEVELOPED OR PROVIDED BY KASPERSKY LAB

AND OTHER COVERED ENTITIES (DEC 2023)

52.204-25 PROHIBITION ON CONTRACTING FOR CERTAIN

TELECOMMUNICATIONS AND VIDEO SURVEILANCE SERVICES

OR EQUIPMENT (NOV 2021)

52.204-27 PROHIBITION ON A BYTEDANCE COVERED APPLICATION (JUN

2023)

52.204-28 GOVERNMENTWIDE ACQUISITION CONTRACTS (DEC 2023)

52.204-30 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS

– PROHIBITION (DEC 2023)

52.207-3 RIGHT OF FIRST REFUSAL OF EMPLOYMENT (MAY 2006)

52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS (APR

2010)

52.209-6 PROTECTING THE GOVERNMENT’S INTEREST WHEN

SUBCONTRACTING WITH CONTRACTORS DEBARRED,

SUSPENDED, OR PROPOSED FOR DEBARMENT (NOV 2021)

52.209-9 UPDATES OF PUBLICLY AVAILABLE INFORMATION

REGARDING RESPONSIBILITY MATTERS (OCT 2018)

52.209-10 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC

CORPORATIONS (NOV 2015)

52.210-1 MARKET RESEARCH (NOV 2021)

52.213-4 TERMS AND CONDITIONS – SIMPLIFIED ACQUISITIONS (OTHER

THAN COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

(NOV 2024)

52.215-2 AUDIT AND RECORDS—NEGOTIATION (JUN 2020)

52.215-8 ORDER OF PRECEDENCE - UNIFORM CONTRACT FORMAT (OCT

1997)

52.215-10 PRICE REDUCTION FOR DEFECTIVE COST OR PRICING DATA

(AUG 2011)

52.215-11 PRICE REDUCTION FOR DEFECTIVE COST OR PRICING DATA-

MODIFICATIONS (JUN 2020)

52.215-12 SUBCONTRACTOR COST OR PRICING DATA (JUN 2020)

52.215-13 SUBCONTRACTOR COST OR PRICING DATA – MODIFICATIONS

(JUN 2020)

52.215-14 INTEGRITY OF UNIT PRICES (NOV 2021)

52.215-15 PENSION ADJUSTMENTS AND ASSET REVERSIONS (OCT 2010)

52.215-18 REVERSION OR ADJUSTMENT OF PLANS FOR POSTRETIREMENT

BENEFITS (PRB) OTHER THAN PENSIONS (JUL 2005)

52.215-19 NOTIFICATION OF OWNERSHIP CHANGES (OCT 1997)

52.215-20 REQUIREMENTS FOR COST OR PRICING DATA OR

INFORMATION OTHER THAN COST OR PRICING DATA (OCT 2010)

ALT IV (OCT 2010)

52.215-21 REQUIREMENTS FOR COST OR PRICING DATA OR

INFORMATION OTHER THAN COST OR PRICING DATA --

MODIFICATIONS (NOV 2021) - ALTERNATE III (OCT 1997)

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

52.217-6 NOTICE OF TOTAL SMALL BUSINESS SET-ASIDE (NOV 2020)

52.219-8 UTILIZATION OF SMALL BUSINESS CONCERNS (NOV 2016)

52.219-9 SMALL BUSINESS SUBCONTRACTING PLAN (SEP 2023) –

ALTERNATE II (NOV 2016)

52.219-14 LIMITATIONS ON SUBCONTRACTING (OCT 2022)

52.219-16 LIQUIDATED DAMAGES – SUBCONTRACTING PLAN (SEP 2021)

52.219-28 POST-AWARD SMALL BUSINESS PROGRAM

REREPRESENTATION (FEB 2024)

52.222-1 NOTICE TO THE GOVERNMENT OF LABOR DISPUTES (FEB 1997)

52.222-3 CONVICT LABOR (JUN 2003)

52.222-4 CONTRACT WORK HOURS AND SAFETY STANDARDS —

OVERTIME COMPENSATION (MAY 2018)

52.222-21 PROHIBITION OF SEGREGATED FACILITIES (APR 2015)

52.222-26 EQUAL OPPORTUNITY (SEPT 2016)

52.222-35 EQUAL OPPORTUNITY FOR VETERANS (JUN 2020)

52.222-36 EQUAL OPPORTUNITY FOR WORKERS WITH DISABILITIES (JUN

2020)

52.222-37 EMPLOYMENT REPORTS ON VETERANS (JUN 2020

52.222-40 NOTIFICATION OF EMPLOYEE RIGHTS UNDER THE NATIONAL

LABOR RELATIONS ACT (DEC 2010)

52.222-41 SERVICE CONTRACT LABOR STANDARDS (AUG 2018)

52.222-42 STATEMENT OF EQUIVALENT RATES FOR FEDERAL HIRES

52.222-44 FAIR LABOR STANDARDS ACT AND SERVICE CONTRACT

LABOR STANDARDS—PRICE ADJUSTMENT (MAY 2014)

52.222-50 COMBATING TRAFFICKING IN PERSONS (NOV 2021)

52.222-54 EMPLOYMENT ELIGIBILITY VERIFICATION (MAY 2022)

52.222-55 MINIMUM WAGES UNDER EXECUTIVE ORDER 13658 (JAN 2022)

52.222-62 PAID SICK LEAVE UNDER EXECUTIVE ORDER 13706 (JAN 2022)

52.223-23 SUSTAINABLE PRODUCTS AND SERVICES (MAY 2024)

52.224-1 PRIVACY ACT NOTIFICATION (APR 1984)

52.224-2 PRIVACY ACT (APR 1984)

52.224-3 PRIVACY TRAINING (JAN 2017)

52.225-13 RESTRICTIONS ON CERTAIN FOREIGN PURCHASES (FEB 2021)

52.226-1 UTILIZATION OF INDIAN ORGANIZATIONS AND INDIAN-OWNED

ECONOMIC ENTERPRISES (JUN 2000)

52.226-7 DRUG-FREE WORKPLACE (MAY 2024)

52.226-8 ENCOURAGING CONTRACTOR POLICIES TO BAN TEXT

MESSAGING WHILE DRIVING (MAY 2024)

52.227-1 AUTHORIZATION AND CONSENT (DEC 2007)

52.227-2 NOTICE AND ASSISTANCE REGARDING PATENT AND

COPYRIGHT INFRINGEMENT (DEC 2007)

52.227-11 PATENT RIGHTS – OWNERSHIP BY THE CONTRACTOR (MAY

2014)

52.227-14 RIGHTS IN DATA – GENERAL (MAY 2014)

52.227-17 RIGHTS IN DATA - SPECIAL WORKS (DEC 2007)

52.227-23 RIGHTS TO PROPOSAL DATA (TECHNICAL) (JUN 1987)

52.230-2 COST ACCOUNTING STANDARDS (JUN 2020)

52.230-3 DISCLOSURE AND CONSISTENCY OF COST ACCOUNTING

PRACTICES (JUN 2020)

52.230-5 COST ACCOUNTING STANDARDS—EDUCATIONAL INSTITUTION

(JUN 2020)

52.230-6 ADMINISTRATION OF COST ACCOUNTING STANDARDS (JUN

2010)

52.232-17 INTEREST (MAY 2014)

52.232-18 AVAILABILITY OF FUNDS (APR 1984)

52.232-23 ASSIGNMENT OF CLAIMS (MAY 2014)

52.232-25 PROMPT PAYMENT (JAN 2017)

52.232-33 PAYMENT BY ELECTRONIC FUNDS TRANSFER-SYSTEM FOR

AWARD MANAGEMENT (OCT 2018)

52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUN

2013)

52.232-40 PROVIDING MAR 2023)

52.233-1 DISPUTES (MAY 2014)

52.233-3 PROTEST AFTER AWARD (AUG 1996)

52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (OCT

2004)

52.237-3 CONTINUITY OF SERVICES (JAN 1991)

52.239-1 PRIVACY OR SECURITY SAFEGUARDS (AUG 1996)

52.242-1 NOTICE OF INTENT TO DISALLOW COSTS (APR 1984)

52.242-5 PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS (JAN 2017)

52.242-13 BANKRUPTCY (JUL 1995)

52.243-7 NOTIFICATION OF CHANGES (JAN 2017)

52.244-2 SUBCONTRACTS (JUN 2020)

52.244-5 COMPETITION IN SUBCONTRACTING (DEC 1996)

52.244-6 SUBCONTRACTS FOR COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (NOV 2024)

52.245-1 GOVERNMENT PROPERTY (SEP 2021)

52.245-9 USE AND CHARGES (APR 2012)

52.246-25 LIMITATION OF LIABILITY - SERVICES (FEB 1997)

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

52.252-4 ALTERATIONS IN CONTRACT (APR 1984)

52.253-1 COMPUTER GENERATED FORMS (JAN 1991)

THE FOLLOWING CLAUSES ARE APPLICABLE TO THE COST TYPE

ORDERS ONLY:

52.215-2 AUDIT AND RECORDS—NEGOTIATION (JUN 2020) ALTERNATE II

(AUG 2016)

52.215-22 LIMITATIONS ON PASS-THROUGH CHARGES – IDENTIFICATION

OF SUBCONTRACTOR EFFORT (OCT 2009)

52.215-23 LIMITATIONS ON PASS-THROUGH CHARGES (JUN 2020)

52.216-7 ALLOWABLE COST AND PAYMENT (AUG 2018)

52.216-8 FIXED FEE (JUN 2011)

52.222-2 PAYMENT FOR OVERTIME PREMIUMS (JULY 1990)

52.227-1 AUTHORIZATION AND CONSENT (DEC 2007)

52.232-20 LIMITATION OF COST (APR 1984)

52.232-22 LIMITATION OF FUNDS (APR 1984)

52.232-25 PROMPT PAYMENT (FEB 2017) ALTERNATE I (FEB 2002)

52.233-3 PROTEST AFTER AWARD (AUG 1996) ALTERNATE I (DEC 1991)

52.242-3 PENALTIES FOR UNALLOWABLE COSTS (DEC 2022)

52.242-4 CERTIFICATION OF FINAL INDIRECT COSTS (JAN 1997)

52.243-2 CHANGES - COST-REIMBURSEMENT (AUG 1987) - ALTERNATE I

(APR 1984)

52.244-2 SUBCONTRACTS (JUN 2020) ALTERNATE I (JUN 2020)

52.249-6 TERMINATION (COST-REIMBURSEMENT) (MAY 2004)

52.249-14 EXCUSABLE DELAYS (APR 1984)

52.250-1 INDEMNIFICATION UNDER PUBLIC LAW 85-804 (APR 1984)

ALTERNATE I (APR 1984)

THE FOLLOWING CLAUSES ARE APPLICABLE TO THE TIME AND

MATERIAL (T&M)/LABOR HOUR ORDERS ONLY:

52.216-7 ALLOWABLE COST AND PAYMENT (AUG 2018)

52.222-43 FAIR LABOR STANDARDS ACT AND SERVICE CONTRACT

LABOR STANDARDS—PRICE ADJUSTMENT (MULTIPLE YEAR

AND OPTION CONTRACTS) (AUG 2018)

52.232-7 PAYMENTS UNDER TIME-AND-MATERIALS AND LABOR-HOUR

CONTRACTS (NOV 2021)

52.232-25 PROMPT PAYMENT (JAN 2017) ALTERNATE I (FEB 2002)

52.233-3 PROTEST AFTER AWARD (AUG 1996)

52.242-3 PENALTIES FOR UNALLOWABLE COSTS (DEC 2022)

52.242-4 CERTIFICATION OF FINAL INDIRECT COSTS (JAN 1997)

52.243-3 CHANGES - TIME-AND-MATERIALS OR LABOR-HOURS (SEP 2000)

52.249-6 TERMINATION (COST-REIMBURSEMENT) (MAY 2004) --

ALTERNATE IV (SEP 1996)

52.249-14 EXCUSABLE DELAYS (APR 1984)

THE FOLLOWING CLAUSES ARE APPLICABLE TO THE FIRM-FIXED PRICE

ORDERS ONLY:

52.217-2 CANCELLATION UNDER MULTI-YEAR CONTRACTS (OCT 1997)

52.217-6 OPTION FOR INCREASED QUANTITY (MAR 1989)

52.222-43 FAIR LABOR STANDARDS ACT AND SERVICE CONTRACT

LABOR STANDARDS—PRICE ADJUSTMENT (MULTIPLE YEAR

AND OPTION CONTRACTS) (AUG 2018)

52.227-1 AUTHORIZATION AND CONSENT (JUN 2020)

52.227-3 PATENT INDEMNITY (APR 1984)

52.227-19 COMMERCIAL COMPUTER SOFTWARE LICENSE (DEC 2007)

52.228-5 INSURANCE- WORK ON A GOVERNMENT INSTALLATION (JAN

1997)

52.229-3 FEDERAL, STATE, AND LOCAL TAXES (FEB 2013)

52.232-1 PAYMENTS (APR 1984)

52.232-8 DISCOUNTS FOR PROMPT PAYMENT (FEB 2002)

52.232-11 EXTRAS (APR 1984)

52.233-3 PROTEST AFTER AWARD (AUG 1996)

52.237-3 CONTINUITY OF SERVICES (JAN 1991)

52.243-1 CHANGES - FIXED-PRICE (AUG 1987) -- ALTERNATE I (APR 1984)

52.249-2 TERMINATION FOR CONVENIENCE OF THE GOVERNMENT

(FIXED-PRICE) (APR 2012)

52.249-8 DEFAULT (FIXED-PRICE SUPPLY AND SERVICE) (APR 1984)

I.2 DEPARTMENT OF HEALTH AND HUMAN SERVICES ACQUISITION

REGULATIONS (HHSAR) CLAUSES INCORPORATED BY REFERENCE (JAN

2016)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were provided in full text. Upon request, the Contracting Officer will provide the information in full text. The full text of a clause is also available electronically at http://www.hhs.gov/policies/hhsar/.

352.203-70 ANTI-LOBBYING (DEC 2015)

352.204-70 PREVENTION AND PUBLIC HEALTH FUND-REPORTING

REQUIREMENTS (DEC 2015)

352.208-70 PRINTING AND DUPLICATION (DEC 2015)

352.211-1 PUBLIC ACCOMMODATIONS AND COMMERCIAL FACILITIES

(DEC 2015)

352.211–2 CONFERENCE SPONSORSHIP REQUEST AND CONFERENCE

MATERIALS DISCLAIMER (DEC 2015)

352.211-3 PAPERWORK REDUCTION ACT (DEC 2015)

352.219-71 MENTOR-PROTÉGÉ PROGRAM REPORTING REQUIREMENTS

(JAN 2010)

352.222-70 CONTRACTOR COOPERATION IN EQUAL EMPLOYMENT

OPPORTUNITY INVESTIGATIONS (DEC 2015)

352.227-70 PUBLICATIONS AND PUBLICITY (DEC 2015)

352.231-70 SALARY RATE LIMITATION (DEC 2015)

352.233-71 LITIGATION AND CLAIMS (DEC 2015)

352.237-71 CRIME CONTROL ACT—REPORTING OF CHILD ABUSE (DEC

2015)

I.3 HHSAR 352.224-71 CONFIDENTIAL INFORMATION (DEC 2015)

(a) Confidential Information, as used in this clause, means information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization.

(b) Specific information or categories of information that the Government will furnish to the Contractor, or that the Contractor is expected to generate, which are confidential may be identified elsewhere in this contract. The Contracting Officer may modify this contract to identify Confidential Information from time to time during performance.

(c) Confidential Information or records shall not be disclosed by the Contractor until:

(1) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to release findings of studies or research, to which an agency response may be appropriate to protect the public interest or that of the agency.

(2) For information provided by or on behalf of the government,

(i) The publication or dissemination of the following types of information are restricted under this contract:

Patient Personally Identifiable Information (PII) and Health

Information beyond the scope of Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. § 1320d);

Participant information such as trade secrets, and proprietary and business financial information;

Payer information such as trade secrets, and proprietary and business financial information;

Practitioner information such as trade secrets, and proprietary and business financial information;

Information on policies and models that CMS or HHS have not finalized through rule or publication and shared with the contractor for the purposes of model evaluation, implementation, or design;

and

(ii) The reason(s) for restricting the types of information identified in subparagraph (i) is/are: to protect against patient invasion of personal privacy, to protect trade secrets and confidential commercial or financial information, to protect information that may be subject to change during final clearance, and/or to prevent adverse effects to the marketplace, such as giving an unfair advantage to a firm, population, or other entity.

(iii) Written advance notice of at least 45 days shall be provided to the

Contracting Officer of the Contractor's intent to disseminate or publish information identified in subparagraph (2)(i). The contractor shall not disseminate or publish such information without the written consent of the Contracting Officer.

(d) Whenever the Contractor is uncertain with regard to the confidentiality of or a property interest in information under this contract, the Contractor should consult with the Contracting Officer prior to any release, disclosure, dissemination, or publication.

I.4 HHSAR ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY

(DECEMBER 18, 2015)

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) supplies and services developed, acquired, or maintained under this contract or order must comply with the “Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR part 1194. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards.

(b) The Section 508 accessibility standards applicable to this contract or order are identified in the Statement of Work or Specification or Performance Work Statement. The contractor must provide any necessary updates to the submitted HHS Product Assessment Template(s) at the end of each contract or order exceeding the simplified acquisition threshold (see FAR 2.101) when the contract or order duration is one year or less. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(c) The Section 508 accessibility standards applicable to this contract are:

Electronic Content Technical Criteria:

(iii) E205.1 General - Electronic content shall comply with E205.

(iv) E205.2 Public Facing - Electronic content that is public facing shall conform to the accessibility requirements specified in E205.4.

(v) 602 Support Documentation -

(vi) 603 Support Services -

(vii) 302 Functional Performance Criteria -

ICT Support and Services Technical Criteria:

E208.1 General -

Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

E601.1 Scope - The technical requirements in Chapter 6 shall apply to ICT support documentation and services where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

E602.1 General - Documentation that supports the use of ICT shall conform to 602.

E602.2 Accessibility and Compatibility Features - Documentation shall list and explain how to use the accessibility and compatibility features required by Chapters 4 and 5. Documentation shall include accessibility features that are built-in and accessibility features that provide compatibility with assistive technology.

E602.3 Electronic Support Documentation - Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

E602.4 Alternate Formats for Non-Electronic Support Documentation - Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

E602.3 Electronic Support Documentation - Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

E602.4 Alternate Formats for Non-Electronic Support Documentation - Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

E603.1 General - ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

E603.2 Information on Accessibility and Compatibility Features - ICT support services shall include information on the accessibility and compatibility features required by 602.2.

E603.3 Accommodation of Communication Needs - Support services shall be provided directly to the user or through a referral to a point of contact. Such ICT support services shall accommodate the communication needs of individuals with disabilities.

Functional Performance Criteria:

301.1 Scope - The requirements of Chapter 3 shall apply to ICT where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

302.1 Without Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color - Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

302.5 With Limited Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech - Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

302.7 With Limited Manipulation - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities - ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

(d) In the event of a modification(s) to this contract or order, which adds new EIT supplies or services or revises the type of, or specifications for, supplies or services, the Contracting Officer may require that the contractor submit a completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist the Government in determining that the EIT supplies or services conform to Section 508 accessibility standards. Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found under Section 508 policy on the HHS website: (http://www.hhs.gov/web/508). If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(e) If this is an Indefinite Delivery contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the task/delivery order requests that include EIT supplies or services will define the specifications and accessibility standards for the order. In those cases, the Contractor may be required to provide a completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist the Government in determining that the EIT supplies or services conform to Section 508 accessibility standards. Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found at http://www.hhs.gov/web/508. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the provided documentation, remediation of the supplies or services to the level of conformance specified in the contract will be the

I.5 ORDERING FAR 52.216-18 (OCT 1995)

(a) Any supplies and services to be furnished under this contract shall be ordered by issuance of Task Orders by the individuals or activities designated in the Schedule. Such orders may be issued from the final effective date of the contract.

(b) All orders or Task Orders are subject to the terms and conditions of this contract. In the event of conflict between a delivery order or Task Order and this contract, the contract shall control.

(c) If mailed, an order or Task Order is considered "issued" when the Government deposits the order in the mail. Orders may be issued orally, by facsimile, or by electronic commerce methods only if authorized in the Schedule.

I.6 ORDERING LIMITATIONS FAR 52.216-19 (OCT 1995)

(a) Minimum order. When the Government requires supplies or services covered by this contract in an amount of less than $25,000 the Government is not obligated to purchase, nor is the Contractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The Contractor is not obligated to honor –

(1) Any order for a single item in excess of $20 Million

(2) Any order for a combination of items in excess of $50 Million, or

(3) A series of orders from the same ordering office within 5 days that together call for quantities exceeding the limitation in subparagraph (b) (1) or (2) of this section.

(c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-21 of the Federal Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the Contractor if that requirement exceeds the maximum-order limitations in paragraph (b) of this section.

(d) Notwithstanding paragraphs (b) and (c) of this section, the Contractor shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within 3 days after issuance, with written notice stating the Contractor’s intent not to ship the item (or items) called for and the reasons.

Upon receiving this notice, the Government may acquire the supplies or services from another source.

I.7 INDEFINITE QUANTITY FAR 52.216-22 (OCT 1995)

(a) This is an indefinite-quantity contract for the supplies or services specified, and effective for the period stated, in the Schedule. The quantities of supplies and services specified in the Schedule are estimates only and are not purchased by this contract.

(b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. The Contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the "maximum." The Government shall order at least the quantity of supplies or services designated in the Schedule as the "minimum."

(c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, there is no limit on the number of orders that may be issued. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations.

(d) Any order issued during the effective period of this contract and not completed within that period shall be completed by the Contractor within the time specified in the order. The contract shall govern the Contractor’s and Government’s rights and obligations with respect to that order to the same extent as if the order were completed during the contract’s effective period; provided, that the Contractor shall not be required to make any deliveries under this contract after 120 months from contract expiration.

I.8 ALTERATIONS IN CONTRACT FAR 52.252-4 (APR 1984)

Portions of this contract are altered as follows: None at this time.

I.9 FAR 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR

2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 60 days provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 6 months.

I.10 HHSAR 352.239-79 Information and Communication Technology Accessibility (Feb 2024) (Deviation)

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all information and communication technology (ICT) supplies, products, platforms, information, documentation, and services support developed, acquired, maintained or delivered under this contract or order must comply with the Revised 508 Standards, which are located at 36 C.F.R. 1194.1 and Appendices A, B, and C, and are available at https://www.access-board.gov/ict/.

Information about Section 508 is available at https://www.hhs.gov/web/section- 508/index.html.

(b) Additional Section 508 accessibility standards applicable to this contract or order may be identified in the specification, statement of work, or performance work statement.

If it is determined by the Government that ICT supplies, products, platforms, information, documentation, and services support provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(c) In the event of a modification(s) to this contract or order, which adds new ICT supplies or services or revises the type of, or specifications for, supplies, products, platforms, information, documentation, or services support, the Contracting Officer shall require that the Contractor submit a completed HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an Accessibility Conformance Report (ACR) (based on the Voluntary Product Accessibility Template (VPAT) see https://www.itic.org/policy/accessibility/vpat), and any other additional information necessary to assist the Government in determining that the ICT supplies or services conform to Section 508 accessibility standards. If it is determined by the Government that ICT supplies, products, platforms, information, documentation, and services support provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the

(d) If this is an Indefinite-Delivery type contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the task/delivery order requests that include ICT supplies, products, platforms, information, documentation, or services support will define the specifications and accessibility standards for the order. In those cases, the Contractor shall be required to provide a completed HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an ACR (based on the VPAT see https://www.itic.org/policy/accessibility/vpat), and any other additional information necessary to assist the Government in determining that the ICT supplies, products, platforms, information, documentation, or services support conform to Section 508 accessibility standards. If it is determined by the Government that ICT supplies and services provided by the Contractor do not conform to the described accessibility standards in the provided documentation, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(e) The contractor shall identify to the Contracting Officer any perceived exception or exemption to Section 508 requirements.

I.11 HHSAR 352.224-70 Notification of System of Records Notice (Feb 2024) (Deviation)

(a) This contract provides for the design, development, or operation of a system of records about individuals from which information about an individual is retrieved by the individual’s name or by some other identifying particular assigned to the individual.

(b) The System of Records Notice(s) (SORN(s)) that is applicable to this contract is/are: A new or revised SORN will be developed accordingly.

(c) The System of Records design, development, or operation work the Contractor is to perform will be determined at the task order level, if applicable.

(d) The disposition to be made of the Privacy Act records upon completion of contract performance will be determined at the task order level, if applicable.

(e) Subcontract flow down. The Contractor is required to include this clause in all subcontracts at any tier performing work under the prime contract involving design, development, or operation work involving a System of Records.

I.12 HHSAR 352.239-78 Information and Communication Technology Accessibility (Feb 2024) (Deviation)

(a) Any offeror responding to this solicitation must comply with established HHS Information and Communication Technology (ICT) accessibility standards. Information about Section 508 is available at https://www.hhs.gov/web/section-508/index.html.

(b) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239-79 Information and Communication Technology Accessibility. In order to facilitate the Government’s determination whether proposed ICT supplies, products, platforms, information, and documentation meet applicable Section 508 accessibility standards, offerors must submit an appropriate HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an Accessibility

Conformance Report (ACR) (based on the Voluntary Product Accessibility Template (VPAT) see https://www.itic.org/policy/accessibility/vpat), in accordance with the completion instructions. The purpose of the checklists and conformance reports are to assist HHS acquisition and program officials in determining whether proposed ICT supplies, products, platforms, information, and documentation conform to applicable Section 508 accessibility standards. Checklists and ACRs evaluate—in detail—whether the ICT conforms to specific Section 508 accessibility standards and identifies remediation efforts needed to address conformance issues.

(c) If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies, products, platforms, information, documentation, or services support delivered do not conform to the described accessibility standards, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(d) In order to facilitate the Government's determination whether proposed ICT supplies meet applicable Section 508 accessibility standards, offerors must submit an Accessibility Conformance Report, in accordance with its completion instructions and tailored to the requirements in the solicitation. The purpose of the Report is to assist HHS acquisition and program officials in determining whether proposed ICT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and document, in detail, whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available at https://Section508.gov/.

(e) In order to facilitate the Government's determination whether proposed ICT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the ICT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(f) Respondents to this solicitation must identify any inability to conform to Section 508 requirements. If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(g) Items delivered as electronic content must be accessible to HHS acceptance criteria.

Checklist for various formats are available at http://508.hhs.gov/. Materials, other than items incidental to contract management, that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Contracting Officer’s Representative.

I.13 52.204-29 Federal Acquisition Supply Chain Security Act Orders—Representation and Disclosures

(a) Definitions. As used in this provision, Covered article, FASCSA order, Intelligence community, National security system, Reasonable inquiry, Sensitive compartmented information, Sensitive compartmented information system, and Source have the meaning provided in the clause 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition.

(b) Prohibition. Contractors are prohibited from providing or using as part of the performance of the contract any covered article, or any products or services produced or provided by a source, if the prohibition is set out in an applicable Federal Acquisition Supply Chain Security Act (FASCSA) order, as described in paragraph (b)(1) of FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition.

(c) Procedures.

(1) The Offeror shall search for the phrase “FASCSA order” in the System for Award Management (SAM)( https://www.sam.gov) for any covered article, or any products or services produced or provided by a source, if there is an applicable FASCSA order described in paragraph (b)(1) of FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition.

(2) The Offeror shall review the solicitation for any FASCSA orders that are not in SAM, but are effective and do apply to the solicitation and resultant contract (see FAR 4.2303(c)(2)).

(3) FASCSA orders issued after the date of solicitation do not apply unless added by an amendment to the solicitation.

(d) Representation. By submission of this offer, the offeror represents that it has conducted a reasonable inquiry, and that the offeror does not propose to provide or use in response to this solicitation any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by an applicable FASCSA order in effect on the date the solicitation was issued, except as waived by the solicitation, or as disclosed in paragraph (e).

(e) Disclosures. The purpose for this disclosure is so the Government may decide whether to issue a waiver. For any covered article, or any products or services produced or provided by a source, if the covered article or the source is subject to an applicable

FASCSA order, and the Offeror is unable to represent compliance, then the Offeror shall provide the following information as part of the offer:

(1) Name of the product or service provided to the Government;

(2) Name of the covered article or source subject to a FASCSA order;

(3) If applicable, name of the vendor, including the Commercial and Government Entity code and unique entity identifier (if known), that supplied the covered article or the product or service to the Offeror;

(4) Brand;

(5) Model number (original equipment manufacturer number, manufacturer part number, or wholesaler number);

(6) Item description;

(7) Reason why the applicable covered article or the product or service is being provided or used;

(f) Executive agency review of disclosures. The contracting officer will review disclosures provided in paragraph (e) to determine if any waiver may be sought. A contracting officer may choose not to pursue a waiver for covered articles or sources otherwise subject to a FASCSA order and may instead make an award to an offeror that does not require a waiver.

I.14 HHSAR 352.239-77 Cloud Computing Services (Feb 2024) (Deviation)

(a) Responsibilities. This clause is applicable to all or any part of the contract that includes cloud computing services. The Contractor shall be responsible for the following privacy and security requirements on this contract—

(1) Federal Risk and Authorization Management Program (FedRAMP) compliant authorization to operate. Compliance with FedRAMP Assessment and Authorization (A&A) requirements and ensure the information system/service (see HHSAR 302.101, Definitions) under this contract has an approved FedRAMP compliant authority to operate (ATO) in accordance with Federal Information Processing Standard (FIPS) Publication 199 defined security categorization. If a FedRAMP compliant ATO has not been granted, the Contractor must submit a plan to obtain a FedRAMP compliant ATO by (See SOO/PWS).

(i) Implement applicable FedRAMP baseline controls commensurate with the agency-defined security categorization and the applicable FedRAMP security control baseline available at fedramp.gov. The HHS Policy for Information Security and Privacy Protection (IS2P) and HHS Cloud Computing and Federal Risk and Authorization Management Program (FedRAMP) Guidance further define the baseline policies as well as roles and responsibilities. The Contractor shall implement additional controls identified by the agency in this contract.

(ii) A security control assessment must be conducted by a FedRAMP third- party assessment organization (3PAO) for the initial ATO and annually thereafter, or when there is a significant change to the system's security posture in accordance with the FedRAMP Continuous Monitoring Plan.

(2) Data jurisdiction. The Contractor shall store all information within the security authorization boundary, data at rest, or data backup, within the Continental United States or its territories, when applicable.

(3) Service Level Agreements (SLAs). When applicable, the Contractor shall understand the terms of the service agreements that define the legal relationships between cloud customers and the cloud service provider and work with the Contracting Officer’s Representative (COR) to develop and maintain an SLA, as provided in the contract.

(4) Interconnection Agreements/Memorandum of Agreements. When applicable and identified in this contract, the Contractor shall establish and maintain interconnection agreements and or memorandum of agreements/understanding in accordance with HHS policies.

(b) Protection of information in a cloud environment.

(1) If Contractor personnel shall remove any information from the primary work area, they shall protect it to the same extent they would the proprietary data and/or company trade secrets and in accordance with HHS policies, available at https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/index.html.

(2) HHS will retain unrestricted rights to federal data handled under this contract.

Specifically, HHS retains ownership of any user created/loaded data and applications collected, maintained, used, or operated on behalf of HHS and hosted on Contractor’s infrastructure, as well as maintains the right to request full copies of these at any time. If requested, data shall be made available to HHS, at no additional cost, within one (1) business day from the date of the request, or within the timeframe otherwise specified.

(3) The Contractor shall ensure that the facilities that house the network infrastructure are physically and logically secure in accordance with FedRAMP requirements and HHS policies.

(4) The Contractor shall comply with NARA-approved records schedule(s) and protection requirements for federal agency electronic records in accordance with 36 CFR 1236.20 and

1236.22 (ref. a), including but not limited to —

(i) Maintenance of links between records and metadata; and

(ii) Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

(5) The disposition of all HHS data shall be at the written direction of the COR. This may include documents returned to HHS control, destroyed, or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the COR.

(i) If the system involves the design, development, or operation of a system of records on individuals, the Contractor shall comply with the Privacy Act requirements as detailed in the Privacy act section above.

(c) Assessment and Authorization (A&A) process.

(1) The Contractor shall comply with HHS and FedRAMP requirements as mandated by federal laws, regulations, privacy policies, and HHS policies, including making available any documentation, physical access, and logical access needed to support the A&A requirement. The level of effort for the A&A is based on the system’s FIPS 199 security categorization and HHS security policies. (See SOO/PWS).

(i) In addition to the FedRAMP compliant ATO, the Contractor shall complete and maintain an agency A&A package to obtain agency ATO prior to system deployment/service implementation (See SOO/PWS). The agency ATO must be approved by the HHS authorizing official (AO) prior to implementation of system and/or service being acquired.

(ii) Cloud Service Provider (CSP) systems categorized as FIPS 199 High, Moderate or Low are recommended but not required to leverage a FedRAMP accredited Third Party Assessment Organization (3PAO). A CSP’s agency partner may choose to use their own Independent Verification and Validation (IV&V) organization or 3PAO to assess the system. If an agency chooses to use their own IV&V team or an unaccredited 3PAO, they must submit an attestation regarding the team’s independence to the agency and the FedRAMP PMO, and the IV&V / 3PAO team must use FedRAMP templates for the assessment and follow all FedRAMP requirements.

(iii) For all cloud services, the A&A package must contain the following documentation: (See SOO/PWS).

(iv) Following the initial ATO, the Contractor shall review and maintain the ATO in accordance with HHS policies. The following templates and timelines are applicable: (See SOO/PWS).

(2) HHS reserves the right to perform penetration testing on all systems operated on behalf of the agency. If the Contracting Officer exercises this right, the Contractor shall allow HHS employees (and/or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with HHS requirements. Review activities include, but are not limited to—

(i) Scanning operating systems, web applications, wireless scanning;

(ii) Network device scanning to include routers, switches, and firewall, and IDS/IPS; and,

(iii) Databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

(3) The Contractor shall identify any gaps between required FedRAMP Security Control Baseline/Continuous Monitoring controls and the Contractor's implementation status as documented in the Security Assessment Report and related Continuous Monitoring artifacts.

In addition, the Contractor shall document and track all gaps for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the risks, HHS may require remediation at the Contractor's expense before HHS issues an ATO.

(4) The Contractor shall mitigate security risks for which they are responsible, including those identified during A&A and continuous monitoring activities. All vulnerabilities and findings shall be remediated in accordance with timelines specified in the HHS POA&M Standard from discovery—

(i) Critical vulnerabilities no later than fifteen (15) days;

(ii) High within thirty (30) days;

(iii) Medium within ninety (90) days; and

(iv) Low vulnerabilities no later than three hundred and sixty (360) days, unless otherwise specified.

(v) In the event a vulnerability or other risk finding cannot be mitigated within the prescribed timelines above, they must be added to the designated POA&M and mitigated within the newly designated timelines described above. HHS will determine the risk rating of vulnerabilities using FedRAMP baselines.

(5) Revocation of a cloud service. HHS has the right to take action in response to the CSP’s lack of compliance and/or increased level of risk. In the event the CSP fails to meet HHS and FedRAMP security and privacy requirements and/or there is an incident involving sensitive information (see HHSAR 302.101, Definitions), HHS may suspend or revoke an existing agency ATO (either in part or in whole) and/or cease operations. If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the CSP to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor information system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the internet, other networks, or applying additional security controls.

(d) Reporting and continuous monitoring.

(1) Following the initial ATOs, the Contractor shall perform the minimum ongoing continuous monitoring activities, submit required deliverables by the specified due dates, and meet with the system/service owner and other relevant stakeholders to discuss the ongoing continuous monitoring activities, findings, and other relevant matters. The CSP will work with the agency to schedule ongoing continuous monitoring activities. The minimum ongoing continuous monitoring activities include— (See SOO/PWS).

(2) At a minimum, the Contractor shall provide the following artifacts/deliverables on a monthly basis— (See SOO/PWS):

(i) Operating system, database, Web application, and network vulnerability scan results;

(ii) Updated POA&Ms;

(iii) Any updated authorization package documentation as required by the annual attestation/assessment/review or as requested by the System Owner or AO, and;

(iv) Any configuration changes to the system and/or system components or CSP's cloud environment, that may impact HHS security posture. Changes to the configuration of the system, its components, or environment that may impact the security posture of the system under this contract shall be approved by the agency.

(e)…