Solicitation - 75FCMC25RJ041.pdf

31b. NAME OF CONTRACTING OFFICER (Type or print) 30c. DATE SIGNED

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30. 1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON 12. DISCOUNT TERMS

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

13a. THIS CONTRACT IS A

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

8(A)

13b. RATING

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

BOARD (FOB) DESTINATION RATED ORDER UNDER 14. METHOD OF SOLICITATION

REQUEST

SAL

17a. CONTRACTOR/

OFFEROR

CODE FACILITY

CODE

18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

OFFER BELOW IS CHECKED SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print)

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

UNLESS BLOCK IS MARKED

SEE SCHEDULE

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

REQUEST

FOR QUOTE

(RFQ)

INVITATION FOR

FOR BID PROPO

(IFB) (RFP)

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

75FCMC25RJ041

Solicitation/Contract Form

Medicare.gov Transformation

(End Of Section)

Supplies or Services and Prices/Cost

Item Supplies/Service Dates Quantity Unit

Base Period

Product Service Code: DA01 Severability: Yes Firm Fixed Price

Period of Performance From

30 SEP 2025

To

10 DEC 2025

1.0 Each

Additional Information/Notes

Purpose: This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with the format in subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

This requirement has no set-aside restrictions. The North American Industry Classification System (NAICS) code for this procurement is 541613.

The solicitation document, the incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2023-04, Effective 09/23/2025.

This is a Non-Competitive (Notice of Intent) combined Synopsis Solicitation to Award a Contract or Purchase Order without providing for full or open competition (including Brand-Name).

This sole source is being conducted pursuant to the authority of 10 U.S.C. 3204(a)(2) or 41 U.S.C. 3304(a)(2), as implemented by FAR 6.302-2, "Unusual and Compelling Urgency." The justification/rationale for Other Than Full and Open Competition is Unusual and Compelling Urgency. All responsible sources may submit a capability statement, proposal, or quotation, which shall be considered by the agency.

All responsible sources may submit a capability statement, proposal, or quotation, which shall be considered by the agency.

Description of Requirement: The Government anticipates award of a firm-fixed-price delivery order for this requirement. The Centers for Medicare and Medicaid Services (CMS) intends to negotiate with TripTK on a sole source basis. All proposals must submit a Performance Work Statement (PWS).

The period of performance of this contract is estimated for one (10) ten week base period, as follows:

Base Period: September 30, 2025 - December 10, 2025.

Delivery shall be to: Delivery shall be made effective September 30, 2025.

Additional contract requirement(s) or terms and conditions: See all Sections and Sub-sections of the Terms and Conditions below.

https://www.acquisition.gov/far/part-12#FAR_Subpart_12_6

Defense Priorities and Allocations System (DPAS) is not applicable.

Complete proposals/quotes shall be submitted electronically no later than 3:00 P.M. ET on September 25, 2025 to the Contract Specialist, Kim Engles (Kimberly.Engles@cms.hhs.gov) and Contracting Officer, Aaron Blackshire (Aaron.Blackshire@cms.

hhs.gov). An offeror's initial proposal should contain the offeror's best terms from a price and technical standpoint. The Government reserves the right to conduct exchanges with offerors if the Contracting Officer determines them to be necessary.

All questions concerning the solicitation for this requirement shall be submitted via electronic mail (email) to the Government representatives named below as soon as possible.

Offerors shall direct all communications to the attention of the following Government representative(s):

Name: Aaron Blackshire, Contracting Officer, Aaron.Blackshire@cms.hhs.gov

Kim Engles, Contract Specialist, Kimberly.Engles@cms.hhs.gov

Please note CMS is issuing this solicitation contingent upon the availability of appropriated funds from which payment for contract purposes can be made. CMS is not committed to reimburse any costs associated with the preparation or submission of a proposal nor to procure or contract for the services described herein. In addition, the Contracting Officer is the only individual who can legally commit the Government to the expenditures of public funds in connection with the proposed procurement.

(End of Section)

Description/Specifications/Statement of Work

Requirements

This requirement encompasses mixed-methods research to understand complex user journeys, develop actionable user personas, and create detailed experience maps that will inform the strategic redesign of Medicare.gov.

This requirement encompasses mixed-methods research to understand complex user journeys, develop actionable user personas, and create detailed experience maps that will inform the strategic redesign of Medicare.gov.

Specific Services Required:

Mixed-Methods User Research: Combination of qualitative ethnographic research and quantitative analysis using advanced research platforms to reach diverse Medicare user populations

User Persona Development: Creation of comprehensive user personas representing the full spectrum of Medicare users, including varying digital literacy levels, health complexity, and caregiver relationships

Experience Journey Mapping: End-to-end mapping of user touchpoints across digital and offline interactions within the Medicare ecosystem

Strategic Recommendations: Actionable insights and recommendations that account for government platform constraints and capabilities

Real-time Analysis and Synthesis: Live research readouts and dynamic insight generation throughout the research process

Research Scope:

Geographic coverage across multiple markets for representative sampling Qualitative research with 50-2000 participants across diverse demographics Quantitative research reaching at least 500+ participants (Beneficiaries, Patients, Caregivers, Providers, etc.)

Integration of secondary stakeholder interviews (Brokers, SHIP/Support personnel, 1-800-MEDICARE call center representatives, and internal OC team members)

Expected Outcomes: This research will establish the foundational understanding necessary to increase user engagement, improve task completion rates, and create seamless pathways for Medicare users to access critical healthcare information and services.

mailto:Colin.Hahn@cms.hhs.gov mailto:Tonya.Anderson@cms.hhs.gov mailto:Tonya.Anderson@cms.hhs.gov

The deliverables will directly inform Medicare.gov platform's modernization efforts and serve as Phase 1 of the broader digital transformation initiative.

(End of Section)

Packaging and Marking

(End of Section)

Inspection and Acceptance

(End of Section)

Deliveries or Performance

Line Item 0001

Performance

Period of Performance

Period of Performance From

30 SEP 2025

To

10 DEC 2025

(End of Section)

Contract Administration Data

Department of Health and Human Services Acquisition Regulations (HHSAR) Clauses Incorporated by Reference

Number Title Effective Date

352.232-71 Electronic Submission of Payment Requests Feb 2022

Additional Regulation or Supplement Clauses Incorporated by Full Text

G. CONTRACTOR PAST PERFORMANCE EVALUATION(S) (OCT 2014)

a. General:

In accordance with Federal Acquisition Regulation (FAR) 42.15, Contractor Performance Information, past performance evaluations shall be prepared at least annually and at the time the work under a contract or order is completed. Additional interim performance evaluations may be prepared at Contracting Officer discretion, as necessary.

CMS will utilize the Contractor Performance Assessment Reporting System (CPARS), the Government-wide evaluation reporting tool for all past performance reports on contracts and orders, as appropriate. CPARS is a secure Internet website located at .https://www.cpars.gov

b. CPARS Process:

1. CPARS Training: Contractors may obtain CPARS training material and register for on-line training https://www.

.cpars.gov

2. Post-Award Contract Registration: CMS is responsible for registering the contract in CPARS within 30 calendar days of contract award. The Contractor shall:

i. Designate at least one (1) point of contact that will be responsible for serving as the Contractor's Representative (CR). Additional CRs may also be identified; and,

ii. Provide the CMS Contract Specialist with the name(s) and email address(es) of the CPARS point(s) of contact.

Once CMS registers the contract in CPARS, the CR(s) will receive an automated CPARS email message that contains User IDs and instructions for creating a password for future past performance evaluation processing.

3. Interim, Annual and Final Past Performance Evaluation Reports:

a. Issuing the Evaluation: Once the CMS Assessing Official (AO) issues an evaluation to the Contractor in CPARS, the CR(s) will receive an email instructing them to login to CPARS to review the evaluation.

b. Contractor Comments: The CR has the option to provide comments on the evaluation, indicate if they concur or do not concur with the evaluation, sign, and then return the evaluation to the AO. The CR has a total of 60 days following the AO's evaluation signature date to submit comments. If the CR submits comments within the first 14 days following the AO's signature date and the AO closes the evaluation, the evaluation will become available in CPARS within 1 day.

On day 15 following the AO's evaluation signature date, the evaluation will become available in CPARS with or without CR comments and whether or not it has been closed by the AO. If no CR comments have been sent and the evaluation has not been closed, it will be marked as "Pending" in

CPARS.

If the CR sends comments at any time prior to 61 days following the AO's evaluation signature date, those comments will be reflected in CPARS within 1 day. On day 61 following the AO's evaluation signature date, the CR will be "locked out" of the evaluation and may no longer send comments.

G. Contractor Work Performed Outside the United States and its Territories (January 2021)

To comply with requirements of Homeland Security Presidential Directive -12 (HSPD-12) and Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple CMS information systems by efficiently verifying the claimed identity of individuals working on the contract. The Contractor and its subcontractor

(s) shall not perform any activities under this contract, including the transmission of data or other information, outside of the https://www.cpars.gov https://www.cpars.gov https://www.cpars.gov

United States (U.S.) and its Territories without the prior written approval of the Contracting Officer. If work must be performed outside the U.S., the Contractor shall submit a request to the Contracting Officer, in writing, at least 45 calendar days prior to the work beginning.

The Contracting Officer will consider the following factors in making a decision whether to authorize the performance of work outside the U.S. and its Territories:

1. The necessity of the work to be performed outside the United States and its territories;

2. The Statement of Work under contract that will be performed outside the U.S. and its Territories;

3. Total projected dollar value of the work to be performed outside the U.S.;

4. Total projected number of labor hours and length of time to be performed for each individual employee working outside the U.S.;

5. The desired country/location where the work will be performed;

6. FAR Part 25, Foreign Acquisitions, and all other laws and regulations applicable to the performance of work outside the U.S.;

7. The contractor and/or its subcontractor(s) plans to adequately protect and secure CMS data, as well as abide by all applicable laws and regulations when work is performed outside of the U.S. and its Territories. Plans shall include -

a. Adequate contract terms regarding system security;

b. Adequate contract terms regarding the confidentiality and privacy requirements for information and data protection;

c. Adequate contract terms that are otherwise relevant, including the requirements of the Statement of Work;

d. The Contractor's corporate compliance plan and internal policies and procedures designed to prevent and detect violations of applicable law, regulations, rules and ethical standards by employees, agents and others; and,

8. The necessity of Government Furnished Equipment (GFE) or Contractor Owned/Contractor Operated (COCO) devices to be used outside the U.S. and verification of a secure VPN access.

9. Compliance with Executive Order 13940 Aligning Federal Contracting and Hiring Practices With the Interests of American Workers. Determine if approval will reduce opportunities for the United States contractor workers performing in the United States and if this would cause any potential effects to national security.

10. Conformance with Section 889 "Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment", of Public Law115-232.

11. Determination that approval is in best interest of the Government.

The Contractor's request for authorization to perform work outside the U.S. shall include supplemental information to demonstrate that the performance of the work outside the U.S. satisfies all of the above factors. Contracting Officer approval to perform work outside the U.S. may require additional Statement of Work requirements, additional contract terms and conditions and/or Federal Acquisition Regulation (FAR) clauses to be incorporated into the contract.

G. GOVERNMENT REPRESENTATIVES AND RESPONSIBILITIES (NOV 2024)

Following are the Government Representatives and their respective roles and responsibilities on this contract:

a. Contracting Officer

As defined in Federal Acquisition Regulation (FAR)2.101, Definitions, and in accordance with FAR 1.602-1, Authority, "Contracting officers have authority to enter into, administer, and/or terminate contracts and make related determinations and findings." There is no other authorized representative or any other Administrative Contracting Officer assigned to this contract to carry out a Contracting Officer's duties, except for technical direction assigned to the Contracting Officer's Representative, if applicable.

The Contracting Officer is:

Centers for Medicare & Medicaid Services

Centers for Medicare & Medicaid Services

Office of Acquisition & Grants Management

Information Technology Contracts Group

Division of Medicare and Medicaid IT Support Contracts

ATTN: Aaron Blackshire

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-8204

Email Address: aaron.blackshire@cms.hhs.gov

b. Contract Specialist

Notwithstanding any of the other provisions of this Contract, the Contract Specialist will assist the Contracting Officer with his/her responsibilities as defined in the FAR.

The Contract Specialist is:

Centers for Medicare & Medicaid Services

Office of Acquisition & Grants Management

Information Technology Contracts Group

Division of Medicare and Medicaid IT Support Contracts

ATTN: Kimberly Engles

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-1150

Email Address:kimberly.engles@cms.hhs.gov

c. Contracting Officer's Representative

The Contracting Officer's Representative (COR), as defined in FAR 2.101, Definitions, is:

Centers for Medicare & Medicaid Services

Office of the Administrator

ATTN: Elizabeth Eakle

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-5625

Email Address: elizabeth.eakle@cms.hhs.gov

In accordance with FAR 1.602-2(d), Responsibilities, the COR's delegated responsibilities are identified in the Contracting Officer's appointment memorandum, a copy of which will be furnished to the contractor.

The COR will serve as the primary liaison between the Contractor and the Contracting Officer and perform duties within the limitations of the COR's responsibilities in accordance with FAR 1.602-2(d).

Technical direction must be within the general scope of the work stated in the contract. The term "technical direction" is defined to include, without limitation, the following:

(1) Directions to the Contractor which direct the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual technical requirements as identified in the Statement of Work or Performance Work Statement; or

(2) Provision of information to the Contractor, which assists in the interpretation of drawings, specifications, or technical portions of the work description.

Technical direction within the scope of the contract, shall be "in writing" whenever possible and routed through the CO prior to release to the Contractor. If technical direction is verbally communicated, the COR must immediately confirm its direction in writing. Where doubt exists as to whether proposed technical direction is within or outside the scope of the contract, the CO shall be contacted.

If, in the opinion of the Contractor, any instruction or direction issued by a Government representative constitutes a change to the contract or constitutes a "Change Order" as defined in FAR 2.101, Definitions, the Contractor shall follow the instructions identified in FAR 52.243-7 Notification of Changes.

The COR "has no authority to make any commitments or changes that affect price, quality, quantity, delivery, or other terms and conditions of the contract nor in any way direct the contractor or its subcontractors to operate in conflict with the contract terms and conditions." See FAR1.602-2(d)(5). The COR's authority is not re-delegable and the COR may be personally liable for unauthorized acts in accordance with FAR 1.602-(d)(7)(iv) and (v). For example, the COR does not have the authority to:

1. Make changes to contract terms and conditions;

2. Direct the contractor to perform work or make deliveries not specifically required under the contract;

3. Waive or relax the Government's rights with regard to the Contractor's compliance with the specifications, price, delivery or any other terms or conditions of the contract;

4. Make any commitments or approve any actions that would create any financial obligation on the part of the Government; or

5. Issue direction that constitutes a "change" as defined in:

FAR 52.243-1, Changes - Fixed Price;

FAR 52.243-2, Changes - Cost-Reimbursement;

FAR 52.243-3, Changes - Time-and-Materials or Labor-Hours;

FAR 52.243-4, Changes; or, FAR 52.243-5, Changes and Changed Conditions.

In addition to the above responsibilities, the COR and/or Contractor shall immediately notify the Contracting Officer of any contractual concerns related to the following:

1. Personal Services: FAR37.104(a) provides that, "[a] personal services contract is characterized by the employer-employee relationship it creates between the Government and the contractor's personnel. The Government is normally required to obtain its employees by direct hire under competitive appointment or other procedures required by the civil service laws. Obtaining personal services by contract, rather than by direct hire, circumvents those laws unless Congress has specifically authorized acquisition of the services by contract."

Under this contract, the services to be performed do not require the Contractor or the Contractor's personnel to exercise personal judgement and discretion on behalf of the Government. Rather, the Contractor's personnel will act and exercise personal judgement and discretion on behalf of the Contractor. The services to be performed under this contract are not for personal services as defined by FAR 37.104.

Both the Government and the Contractor have a responsibility to monitor contract activities. The CO must be notified immediately if at any time during contract performance the interaction between the Government representative and Contractor personnel constitutes or is perceived to constitute personal services. Both the Government and Contractor personnel must exercise caution to ensure that service contracts not personal in nature avoid even the appearance of a personal services contract.

2. Inherently Governmental Functions: The agency shall not use contractors for the performance of inherently governmental functions unless issued under statutory authority See FAR 7.5 Inherently Governmental Functions. As defined in FAR 2.101, "Inherently Governmental Function" means, as a matter of policy, a function that is so intimately related to the public interest as to mandate performance by Government employees. An inherently governmental function includes activities that require either the exercise of discretion in applying Government authority, or the making of value judgments in making decisions for the Government. Inherently governmental functions DO NOT normally include gathering information for or providing advice, opinions, recommendations, or ideas to Government officials.

FAR 7.503(c) provides a list of examples of functions considered to be inherently governmental functions or which shall be treated as such.

To this effect, during contract performance, care should be taken to ensure that any change or expansion in scope of the requirement does not include inherently governmental functions. Further, due to the nature of a given requirement, there is a potential for close working relationships to develop between Government and Contractor personnel; however, care should be taken to ensure that any familiarity established between the Government and Contractor personnel never promotes or fosters an environment that allows for the assignment of inherently governmental functions to contractor employee(s).

3. Unauthorized Commitments: In carrying out your duties, you are reminded that in accordance with FAR (d)(5), the COR "[h]as no authority to make any commitments or changes that affect price, 1.602-2 quality, quantity, delivery, or other terms and conditions of the contract, or in any way direct the Contractor, or its Subcontractors, to operate in conflict with the contract terms and conditions." Doing so constitutes an "unauthorized commitment." The Contracting Officer is the only individual with the authority to enter into an agreement on behalf of the Government. An unauthorized commitment is defined as "an agreement that is not binding solely because the Government representative who made it lacked the authority to enter into that agreement on behalf of the Government." FAR 1-602-3(a). Examples of unauthorized commitments include, but are not limited to, the following:

• Orders placed with a Contractor without a valid contractual instrument in place.

• Directing any Contractor to do additional work, in excess of the contract value, or work beyond the Period of Performance.

https://www.acquisition.gov/far/part-1

• Authorize new work to a contract without notifying the Contracting Officer (CO) or Contract Specialist(CS) and having a modification in place for the new work.

• Directing the Contractor, in any way that could change the terms and conditions of the contractual instrument or be deemed outside the Scope of the Statement of Work.

Unauthorized commitments are a serious matter and may result in personal liability on the part of the employee who committed the unauthorized commitment. Ratification, is "the act of approving an unauthorized commitment by an official who has the authority to do so." FAR 1.602-3(a).

G PAYMENTS - INVOICES - ( September 2024 )

a. GENERAL: Effective August 31, 2020, the Contractor/ Vendor shall create an invoice within the Invoice Processing Platform (IPP), a secure Web-based service for federal agencies and their vendors to manage government invoicing from purchase order (PO) through payment notification. Note: All invoice terms and conditions are contract specific and may vary from contract to contract.

b. CONTENT OF INVOICE: FAR 32.905 Payment Documentation and Process, provides the required content for a proper invoice. In addition to the requirements of FAR 32.905, the following items shall also be included on the invoice to be considered proper:

• Line item number (i.e. CLIN/SLIN as applicable)

• Contractor /Vendor's Unique Entity Identifier (UEI) Number;

• Period of Performance (PoP) or delivery date of goods or services provided;

• Attachments and applicable support documentation requested by the CO ;

• The first page of the PDF invoice or PDF SF-1034 shall include :

1. Contractor /Vendor name and address;

2. Bill to: CMS, P.O. Box 7520, Baltimore, MD 21207;

3. Full CMS contract number and task order number;

4. Summary of charges by CLIN/SLIN (if applicable) with a grand total. CLIN/SLIN( S) on the PDF shall be identical to what is entered in IPP;

5. Invoice number shall be identical to what is entered in IPP. Each Contractor/Vendor invoice number must be unique across all CMS contracts awarded to the Contractor /Vendor. For example, If Contractor /Vendor A has 5 CMS contracts, Contractor /Vendor A cannot use the same invoice number on any of the 5 contracts they have with CMS. If using a dash in IPP then the dash must be used on the PDF. IPP does not allow any special characters (i.e.*, # , _ );

6. Within IPP, the " Bill Period Start " and "Bill Period End " dates should align with the " Service From " and " Service To " dates (this is not the entire POP dates);

7. Date of Delivery or Service dates shown on the PDF should: ( i ) F all within the contract POP (unless contract indicates otherwise) ( ii ) Align with the " Bill Period Start " and "Bill Period End " dates and " Service From " and " Service To " dates, and ( iii ) Note when the work was performed;

8. Date invoice was prepared;

9. The total invoice amount on the first page of the invoice or SF-1034 must be a debit. A credit may be shown on the first page of the invoice or SF-1034 if the credit falls within the Period Of Performance and is for the same CLIN as the debit. CMS does not accept credit vouchers or process refunds in IPP or the Invoice Submission Box. Credits in excess of $5.01 must be submitted via Pay.gov (For questions surrounding Pay.gov, contact pay.gov.

clev@clev.frb.org or 1-800-624-1373 (Option 2)). Credits sent to Pay.gov shall be copied to the CO, CS and COR. Credits valued at or less than $5.01 must be submitted via Credit Gateway; however, it is preferred that the Contractor/Vendor wait until a dollar amount is accumulated in order to submit the refund through Pay.gov (For questions surrounding Credit Gateway, contact customer.care@usbank.com or 1-877-815-1206);

• When an invoice has been resubmitted, an "R" should be added after the invoice number on the PDF and in IPP; this will ensure that the original invoice number is not duplicated in IPP. If a resubmitted invoice is rejected again, each subsequent resubmission requires an additional "R" added after the invoice number (i.e. "RR" );

• The " final " designation should only be used when the contract is being closed out by OAGM. Do not use for the end of POP or Option Year;

• Contractor/ Vendor must maintain active registration in SAM .gov. If your SAM account is about to expire, wait until it is updated before submitting your invoice; and,

• Banking or address changes must be submitted via email to CCRchanges@cms.hhs.gov.

c. INVOICE SUBMISSION: The Contractor/ Vendor shall create an invoice from the Purchase Order (PO)/Contract via the IPP website http://www.ipp.gov/. For questions, call IPP Customer Support at (866) 973-3131 or email the IPP Customer Support at IPPCustomerSupport@fiscal.treasury.gov. Only one PDF invoice per submission is allowed in IPP.

d. PAYMENTS: The Government shall make payment of all proper invoices in accordance with the following clauses, as applicable and included in the respective TO/PO/contract:

• FAR 52.232-33 Payments by Electronic Funds Transfer - System for Award Management,

• FAR 52.232-1 Payments

• FAR 52.212-4 Contract Terms and Conditions - Commercial Items (If applicable)

• FAR 52.216-7 Allowable Cost and Payment

• FAR 52.232-7 Payments under Time-and-Materials and Labor-Hour Contracts

Payment shall be made upon acceptance by the Contracting Officer's Representative (COR) in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer's approval, as appropriate.

Reimbursement for invoices submitted under this contract shall be made no later than 30 calendar days after receipt of a proper invoice from the Contractor requested at the paying office designated above.

Contracts with a 15- day payment term are not subject to interest payments until after day 30.

e. INTEREST ON OVERDUE PAYMENT: The Prompt Payment Act, Public Law 97-177 (96 Stat.85.31 U.S.C.

1801) is applicable to payments under this contract and requires the payment of interest on payments made more than 30 calendar days after receipt of a proper invoice in IPP. Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and 5 CFR 1315.

(End of Section)

Special Contract Requirements

Department of Health and Human Services Acquisition Regulations (HHSAR) Clauses Incorporated by Full Text

352.204-71 Information and Information Systems Security (Feb 2024) Deviation

(a) As used in this clause—Definitions.

means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence Breach where—

(1) A person other than an authorized user accesses or potentially accesses personally identifiable information, or

(2) An authorized user accesses personally identifiable information for an other than authorized purpose.

Business associate (see 45 CFR 160.103), except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person who -

(1) On behalf of such covered entity or of an organized health care arrangement (as defined in this clause) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this contract or agreement, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at , billing, benefit 42 CFR 3.20 management, practice management, and repricing; or

(2) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in 45 CFR section ), management, administrative, 164.501 accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.

(3) A covered entity may be a business associate of another covered entity.

(4) includes the following: Business associate

(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

(5) does not include:Business associate

(i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.

(ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of 45 CFR apply and are met. 164.504(f)

(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-3/subpart-A/section-3.20 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.501 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504#p-164.504(f) health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.

(iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.

Business associate agreement means the agreement, or other arrangement, as dictated by the HIPAA Privacy Rule (45 CFR 160), between an HHS covered entity and a business associate, which must be entered into in addition to the underlying contract for services and before any disclosure (see 45 CFR 160.103) of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of an HHS entity.

means information that laws, regulations, or Government-wide policies require to Controlled unclassified information (CUI) have safeguarding or dissemination controls, excluding classified information.

means a component or combination of components of a hybrid entity designated by the hybrid entity in Healthcare component accordance with 45 CFR 164.105(a)(2)(iii)(D) (see 45 CFR 164.103). The Secretary of HHS has designated HHS as a covered entity (further designated as a "hybrid entity"), and has also designated four HHS divisions as healthcare components under HIPAA, including —

(1) The Centers for Medicare and Medicaid Services (CMS), insofar as it operates the fee-for-service Medicare program;

(2) The Program Support Center (PSC), Division of Commissioned Personnel, insofar as it operates a health plan for Commissioned Corps officers;

(3) The World Trade Center (WTC) Health Program; and,

(4) The Indian Health Service (IHS), insofar as it operates a health plan and a program providing healthcare that uses electronic transactions.

HHS Information Technology General Rules of Behavior means a set of HHS rules that describes the responsibilities and expected behavior of users of HHS information or information systems.

means all HHS data, on any storage media or in any form or format, which requires confidentiality, HHS sensitive information integrity, and availability protection due to the risk of harm that could result to interests of HHS, other agencies or entities, or individuals from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes—

(1) Information where the improper use or disclosure could adversely affect the ability of HHS to accomplish its mission, i.e., HHS proprietary information;

(2) Records about individuals requiring protection under laws and regulations such as the E-Government Act, Privacy Act and the HIPAA Privacy Rule, or based on a data use agreement or a promise or assurance of confidentiality; and

(3) Information that would be exempt from disclosure if requested under the Freedom of Information Act. Examples of HHS sensitive information include—

(i) Individually-identifiable medical, benefits, and personnel information;

(ii) Financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, security-sensitive, procurement-sensitive, investigatory, and law enforcement information;

(iii) Controlled unclassified information;

(iv) Information that would be confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege;

and

(v) Other information which, if released, could result in a violation of law or agreement, could cause harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and part 164.

Incident means an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information systems; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable policies.

means a discrete set of information resources organized for the collection, processing, maintenance, use, Information system sharing, dissemination, or disposition of information.

means a formal document that provides an overview of the security requirements for an Information system security plan information system or an information security program and describes the security controls in place or planned for meeting those requirements.

(see FAR 2.101) also means Information and Communication Technology (ICT).Information technology means those contracts that include services (including support services), and related Information technology-related contracts resources for information technology.

(see 45 CFR 160.103) means:Organized health care arrangement

(1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;

(2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities:

(i) Hold themselves out to the public as participating in a joint arrangement; and

(ii) Participate in joint activities that include at least one of the following:

(A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;

(B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or

(C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.

(3) A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;

(4) A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or

(5) The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.

Privacy officer means the HHS official(s) with responsibility for implementing and oversight of privacy related policies and practices that impact a given HHS acquisition.

(b) . Contractors, subcontractors, their employees, third-parties, and business associates with access to HHS information, General information systems, or information technology (IT) or providing and accessing IT-related goods and services, shall adhere to the HHS Cybersecurity Program and the directives and handbooks, complete HHS security training prior to accessing HHS information (including HHS sensitive information and information systems security and privacy) and on an annual basis thereafter, as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, HHS , which establishes HHS procedures, Personnel Security and Suitability Program responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards, and guidance for protecting HHS information, information systems (see 302.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing HHS information or information systems.

(c) .Access to HHS information and HHS information systems

(1) Contractors are limited in their request for logical or physical access to HHS information or HHS information systems for their employees, subcontractors, third parties and business associates to the extent necessary to perform the services or provide the goods as specified in the contracts, agreements, task, delivery, or purchase orders.

(2) All Contractors, subcontractors, third parties, and business associates working with HHS information are subject to the same investigative requirements as those of HHS appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors to access HHS information and HHS information systems shall be in accordance with HHS Personnel Security and Suitability

. Program

(3) Contractors, subcontractors, third parties, and business associates who require access to national security programs must have a valid security clearance.

(4) The Contractor (and/or any subcontractor) must comply with , Executive Order 13556 Controlled Unclassified part 2002 when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the Information, (implemented at 3 CFR, ) term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components.

All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation /contract, must be -

(i) Marked appropriately;

(ii) Disclosed to authorized personnel on a need-to-know basis;

(iii) Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information applicable baseline if handled by a Contractor system operated on behalf of Systems and Organizations the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal if handled by internal Contractor system; andInformation Systems and Organizations

(iv) Returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

(5) HIPAA . Under the HIPAA Privacy and Security Rules (see 45 CFR 164), business associate agreements pursuant to 45 CFR 164.502(e)(1), a covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor of a covered entity's business associate. Additionally, a business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR , that the subcontractor will appropriately 164.504(e)(1)(i) safeguard the information. The satisfactory assurances required by 45 CFR 45 CFR 164.504(e)(1) of this section shall be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of 45 CFR . The contracts shall also include breach 164.504(e) reporting policies and procedures for suspected or confirmed breaches of protected health information. The contract https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504#p-164.504(e)(1)(i) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504#p-164.504(e) shall impose a duty to cooperate with the healthcare component and/or HHS breach investigation and response and must require all subcontractors to comply with the same HIPAA Rules requirements as a condition of receiving government data.

(i) Contractors or entities required to execute business associate agreements for contracts and other Business associate agreements are issued by HHS or may agreements become HHS business associates.

be issued by other HHS programs in support of HHS. The HIPAA Privacy Rule requires HHS to execute compliant business associate agreements with persons or entities that create, receive, maintain, or transmit HHS PHI or that will store, generate, access, exchange, process, or utilize such PHI in order to perform certain activities, functions or services to, for, or on behalf of HHS. There may be other HHS components or staff offices which also provide certain services and support to HHS and must receive PHI in order to do so. If these components award contracts or enter into other agreements, purchase/delivery orders, modifications and issue governmentwide purchase card transactions to help in the delivery of these services to HHS, they will also fall within the requirement to obtain a satisfactory assurance from these contractors by executing a business associate agreements.

(ii) A prime contractor required to execute Business associate agreement flow down to subcontractors.

a business associate agreement shall also obtain a satisfactory assurance, in the form of a business associate agreement, of its subcontractors who will also create, receive, maintain, or transmit PHI or that will store, generate, access, exchange, process, or utilize such PHI will comply with HIPAA Rules requirements to the same degree as the Contractor. A contractor employing a subcontractor who creates, receives, maintains, or transmits PHI or that will store, generate, access, exchange, process, or utilize such PHI under a contract or agreement is required to execute a business associate agreement with each of its subcontractors which also obligates the subcontractor (i.e., also a business associate) to provide the same protections and safeguards and agree to the same disclosure restrictions to PHI that is required of the covered entity and the prime contractor.

(d) Custom software development and outsourced operations must be Contractor operations required to be in United States.

located in the U.S. to the maximum extent practicable. If such services are proposed to be performed outside the continental United States, and are not otherwise disallowed by other Federal law, regulations or policy, or other HHS policy or other mandates as stated in the contract, specifications, statement of work or performance work statement (including applicable business associate agreements), the Contractor/subcontractor must state in its proposal where all non-U.S. services are provided.

At a minimum, the Contractor/subcontractor must include a detailed Information System Security Plan, for review and approval by the Contracting Officer,…