Solicitation - 75FCMC26Q0064.pdf

31b. NAME OF CONTRACTING OFFICER (Type or print) 30c. DATE SIGNED

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30. 1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON 12. DISCOUNT TERMS

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

13a. THIS CONTRACT IS A

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

8(A)

13b. RATING

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

BOARD (FOB) DESTINATION RATED ORDER UNDER 14. METHOD OF SOLICITATION

REQUEST

SAL

17a. CONTRACTOR/

OFFEROR

CODE FACILITY

CODE

18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

OFFER BELOW IS CHECKED SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print)

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

UNLESS BLOCK IS MARKED

SEE SCHEDULE

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

REQUEST

FOR QUOTE

(RFQ)

INVITATION FOR

FOR BID PROPO

(IFB) (RFP)

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

Solicitation/Contract Form

Meeting Support- Transcripts, Recommendations, and Reports

(End Of Section)

Supplies or Services and Prices/Cost

Item Supplies/Service Dates Quantity Unit

Base Period

Severability: Yes

Period of Performance From

01 JUN 2026

To

31 MAY 2027

0001AA

CDLT and HOP Meetings (Audio Minutes)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2026

To

31 MAY 2027

900.0 Minutes

0001AB

Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2026

To

31 MAY 2027

150.0 Minutes

0001AC

Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2026

To

31 MAY 2027

150.0 Minutes

0001AD

Panel Related Support Documents (Hours)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2026

To

31 MAY 2027

16.0 Minutes

Option Period 1

Severability: Yes

Period of Performance From

01 JUN 2027

To

31 MAY 2028

0002AA

(Option

Period 1) CDLT and HOP Meetings (Audio Minutes)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2027

To

31 MAY 2028

600.0 Minutes

0002AB

(Option

Period 1) Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2027

To

31 MAY 2028

150.0 Minutes

0002AC

(Option

Period 1) Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2027

To

31 MAY 2028

150.0 Minutes

0002AD

(Option) Panel Related Support Documents

(Hours)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2027

To

31 MAY 2028

16.0 Minutes

(Option

Period 2) Option Period 2

Severability: Yes

Period of Performance From

01 JUN 2028

To

31 MAY 2029

0003AA

(Option

Period 2) CDLT and HOP Meetings (Audio Minutes)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2028

To

31 MAY 2029

600.0 Minutes

0003AB

(Option

Period 2) Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2028

To

31 MAY 2029

150.0 Minutes

0003AC

(Option

Period 2) Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2028

To

31 MAY 2029

150.0 Minutes

0003AD

(Option

Period 2) Panel Related Support Documents (Hours)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2028

To

31 MAY 2029

16.0 Minutes

(Option

Period 3) Option Period 3

Severability: Yes

Period of Performance From

01 JUN 2029

To

31 MAY 2030

0004AA

(Option

Period 3) CDLT and HOP Meetings (Audio Minutes)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2029

To

31 MAY 2030

900.0 Minutes

0004AB

(Option

Period 3) Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2029

To

31 MAY 2030

150.0 Minutes

0004AC

(Option

Period 3) Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2029

To

31 MAY 2030

150.0 Minutes

0004AD

(Option

Period 3) Panel Related Support Documents (Hours)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2029

To

31 MAY 2030

16.0 Minutes

(Option

Period 4) Option Period 4

Severability: Yes

Period of Performance From

01 JUN 2029

To

31 MAY 2030

0005AA

(Option

Period 4) CDLT and HOP Meetings (Audio Minutes)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2030

To

31 MAY 2031

600.0 Minutes

0005AB

(Option

Period 4) Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2030

To

31 MAY 2031

150.0 Minutes

0005AC

(Option

Period 4) Additional Meeting Minutes (Audio Minutes Optional)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2030

To

31 MAY 2031

150.0 Minutes

0005AD

(Option

Period 4) Panel Related Support Documents (Hours)

Severability: Yes Firm Fixed Price

Period of Performance From

01 JUN 2030

To

31 MAY 2031

16.0 Minutes

Additional Information/Notes

Payment will be based on the negotiated amounts set forth in the Price Summary. Under no circumstances will the payment amount in the "Total Price" column of Supplies or Services and Prices/Cost Summary be exceeded for any CLIN and/or SLIN under this task order.

SLIN 000XAAA. - The contractor shall bill for the number of Audio Minutes that have been completed during the billing period specified on the subject invoice, at the amount identified in the "Unit Price" column. This SLIN will capture all work for each meeting including all deliverables.

As part of their invoice, the contractor shall provide the quantity of audio minutes completed, the unit price per audio minutes, and the total amount billed for the subject SLIN. The contractor must also indicate which meeting each invoice is for. The contractor cannot bill for this SLIN until the Final Verbatim Transcript is accepted by the COR for each meeting. The invoice shall note the date deliverables were accepted by CMS.

SLIN 000XAB (Optional) and SLIN 000XAC (Optional) B. - If exercised, the contractor shall bill for the number of Audio Minutes that have been completed during the billing period specified on the subject invoice, at the amount identified in the "Unit Price" column.

As part of their invoice, the contractor shall provide the quantity of audio minutes completed, the unit price per audio minutes, and the total amount billed for the subject SLIN. The contractor must also indicate which meeting each invoice is for. The contractor cannot bill for this SLIN until the Final Verbatim Transcript is accepted by the COR for each meeting.

SLIN 000XADC. The term "Level of Effort Units" within SLIN 000[#]AD represents increments of level of effort provided by the Contractor, in the performance of Panel Related Support Documents (Task 4). The use of "Level of Effort Units" within SLIN 000[#]AD accounts for the variance in the scale and content of the requested tasks, and ensures that payment for these deliverables is fair and reasonable.

In accordance with Task 4 Panel Related Support Documents, this purchase order outlines the process for initiating Ad Hoc Requests, including the requirement for the Contractor to provide a level of effort estimate for approval by the Contracting Officer's Representative before performing any ad hoc tasks.

Upon each submission and acceptance of Task 4 Panel Related Support Documents the Contractor shall bill for the quantity of "Level of Effort Units" associated with the subject ad hoc task, at the amount identified in the "Unit Price" column for SLIN 000

[#]AD.

(End of Section)

Description/Specifications/Statement of Work

Requirements

The purpose of this procurement is to obtain the services of a contractor to provide verbatim transcripts, lists of recommendations, and meeting reports for two congressionally mandated advisory panels: the Medicare Advisory Panel on Clinical Diagnostic Laboratory Tests (CDLT) and the Medicare Advisory Panel on Hospital Outpatient Payment (HOP).

(End of Section)

Packaging and Marking

(End of Section)

Inspection and Acceptance

(End of Section)

Deliveries or Performance

Line Item 0001

Performance

Period of Performance

Period of Performance From

01 JUN 2026

To

31 MAY 2027

Line Item 0001AA

Performance

Period of Performance

Period of Performance From

01 JUN 2026

To

31 MAY 2027

Line Item 0001AB

Performance

Period of Performance

Period of Performance From

01 JUN 2026

To

31 MAY 2027

Line Item 0001AC

Performance

Period of Performance

From

01 JUN 2026

To

31 MAY 2027

Line Item 0001AD

Performance

Period of Performance

Period of Performance From

01 JUN 2026

To

31 MAY 2027

Line Item 0002

Performance

Period of Performance

Period of Performance From

01 JUN 2027

To

31 MAY 2028

Line Item 0002AA (Option Period 1)

Performance

Period of Performance

Period of Performance From

01 JUN 2027

To

31 MAY 2028

Line Item 0002AB (Option Period 1)

Period of Performance

Period of Performance From

01 JUN 2027

To

31 MAY 2028

Line Item 0002AC (Option Period 1)

Performance

Period of Performance

Period of Performance From

01 JUN 2027

To

31 MAY 2028

Line Item 0002AD (Option)

Performance

Period of Performance

Period of Performance From

01 JUN 2027

To

31 MAY 2028

Line Item 0003 (Option Period 2)

Performance

From

01 JUN 2028

To

31 MAY 2029

Line Item 0003AA (Option Period 2)

Performance

Period of Performance

Period of Performance From

01 JUN 2028

To

31 MAY 2029

Line Item 0003AB (Option Period 2)

Performance

Period of Performance

Period of Performance From

01 JUN 2028

To

31 MAY 2029

Line Item 0003AC (Option Period 2)

Performance

Period of Performance

Period of Performance From

01 JUN 2028

To

31 MAY 2029

Line Item 0003AD (Option Period 2)

Period of Performance From

01 JUN 2028

To

31 MAY 2029

Line Item 0004 (Option Period 3)

Performance

Period of Performance

Period of Performance From

01 JUN 2029

To

31 MAY 2030

Line Item 0004AA (Option Period 3)

Performance

Period of Performance

Period of Performance From

01 JUN 2029

To

31 MAY 2030

Line Item 0004AB (Option Period 3)

Performance

01 JUN 2029

To

31 MAY 2030

Line Item 0004AC (Option Period 3)

Performance

Period of Performance

Period of Performance From

01 JUN 2029

To

31 MAY 2030

Line Item 0004AD (Option Period 3)

Performance

Period of Performance

Period of Performance From

01 JUN 2029

To

31 MAY 2030

Line Item 0005 (Option Period 4)

Performance

Period of Performance

Period of Performance From

01 JUN 2029

To

31 MAY 2030

Line Item 0005AA (Option Period 4)

Period of Performance From

01 JUN 2030

To

31 MAY 2031

Line Item 0005AB (Option Period 4)

Performance

Period of Performance

Period of Performance From

01 JUN 2030

To

31 MAY 2031

Line Item 0005AC (Option Period 4)

Performance

Period of Performance

Period of Performance From

01 JUN 2030

To

31 MAY 2031

Line Item 0005AD (Option Period 4)

Performance

01 JUN 2030

To

31 MAY 2031

(End of Section)

Contract Administration Data

Department of Health and Human Services Acquisition Regulations (HHSAR) Clauses Incorporated by Reference

Number Title Effective Date

352.232-71 Electronic Submission of Payment Requests Feb 2022

Additional Regulation or Supplement Clauses Incorporated by Full Text

G.1 GOVERNMENT REPRESENTATIVES AND RESPONSIBILITIES (Nov 2024)

Following are the Government Representatives and their respective roles and responsibilities on this contract:

a. Contracting Officer

As defined in Federal Acquisition Regulation (FAR) 2.101, Definitions, and in accordance with FAR 1.602-1, Authority, “Contracting officers have authority to enter into, administer, and/or terminate contracts and make related determinations and findings.” There is no other authorized representative or any other Administrative Contracting Officer assigned to this contract to carry out a Contracting Officer’s duties, except for technical direction assigned to the Contracting Officer’s Representative, if applicable.

The Contracting Officer is:

Centers for Medicare & Medicaid Services

Office of Acquisition & Grants Management

Acquisition Support Group

Division of Quality Contracts

ATTN: Heather Parr-Stewart Lang

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-3286

Email Address: Heather.Parr-StewartLang@cms.hhs.gov

b. Contract Specialist

Not with standing any of the other provisions of this Contract, the Contract Specialist will assist the Contracting Officer with his/her responsibilities as defined in the FAR.

The Contract Specialist is:

Centers for Medicare & Medicaid Services

Office of Acquisition & Grants Management

Division of Quality Contracts

Acquisition Support Group

ATTN: Tennille Coombs

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-3472

Email Address: Tennille.Coombs@cms.hhs.gov

c. Contracting Officer’s Representative

The Contracting Officer’s Representative (COR), as defined in FAR 2.101, Definitions, is:

Centers for Medicare & Medicaid Services

Center for Medicare

Hospital & Ambulatory Policy Group

Division of Outpatient Care

ATTN: Au'Sha Washington

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-3736

Email Address: Ausha.Washington@cms.hhs.gov

In accordance with FAR 1.602-2(d), Responsibilities, the COR’s delegated responsibilities are identified in the Contracting Officer’s appointment memorandum, a copy of which will be furnished to the contractor.

The COR will serve as the primary liaison between the Contractor and the Contracting Officer and perform duties within the limitations of the COR’s responsibilities in accordance with FAR 1.602-2(d).

Technical direction must be within the general scope of the work stated in the contract. The term "technical direction" is defined to include, without limitation, the following:

(1) Directions to the Contractor which direct the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual technical requirements as identified in the Statement of Work or Performance Work Statement; or

(2) Provision of information to the Contractor, which assists in the interpretation of drawings, specifications, or technical portions of the work description.

Technical direction within the scope of the contract, shall be “in writing” whenever possible and routed through the CO prior to release to the Contractor. If technical direction is verbally communicated, the COR must immediately confirm its direction in writing. Where doubt exists as to whether proposed technical direction is within or outside the scope of the contract, the CO shall be contacted.

If, in the opinion of the Contractor, any instruction or direction issued by a Government representative constitutes a change to the contract or constitutes a “Change Order” as defined in FAR 2.101, Definitions, the Contractor shall follow the instructions identified in FAR 52.243-7 Notification of Changes.

The COR “has no authority to make any commitments or changes that affect price, quality, quantity, delivery, or other terms and conditions of the contract nor in any way direct the contractor or its subcontractors to operate in conflict with the contract terms and conditions.” See FAR 1.602-2(d)(5). The COR’s authority is not re-delegable and the COR may be personally liable for unauthorized acts in accordance with FAR 1.602-(d)(7)(iv) and (v). For example, the COR does not have the authority to:

1. Make changes to contract terms and conditions;

2. Direct the contractor to perform work or make deliveries not specifically required under the contract;

3. Waive or relax the Government’s rights with regard to the Contractor’s compliance with the specifications, price, delivery or any other terms or conditions of the contract;

4. Make any commitments or approve any actions that would create any financial obligation on the part of the Government; or

5. Issue direction that constitutes a “change” as defined in:

FAR 52.243-1, Changes – Fixed Price;

FAR 52.243-2, Changes – Cost-Reimbursement;

FAR 52.243-3, Changes –Time-and-Materials or Labor-Hours;

FAR 52.243-4, Changes; or, FAR 52.243-5, Changes and Changed Conditions.

In addition to the above responsibilities, the COR and/or Contractor shall immediately notify the Contracting Officer of any contractual concerns related to the following:

1. Personal Services: FAR 37.104(a) provides that, “[a] personal services contract is characterized by the employer-employee relationship it creates between the Government and the contractor’s personnel. The Government is normally required to obtain its employees by direct hire under competitive appointment or other procedures required by the civil service laws. Obtaining personal services by contract, rather than by direct hire, circumvents those laws unless Congress has specifically authorized acquisition of the services by contract."

Under this contract, the services to be performed do not require the Contractor or the Contractor’s personnel to exercise personal judgement and discretion on behalf of the Government. Rather, the Contractor’s personnel will act and exercise personal judgement and discretion on behalf of the Contractor. The services to be performed under this contract are not for personal services as defined by FAR 37.104.

Both the Government and the Contractor have a responsibility to monitor contract activities. The CO must be notified immediately if at any time during contract performance the interaction between the Government representative and Contractor personnel constitutes or is perceived to constitute personal services. Both the Government and Contractor personnel must exercise caution to ensure that service contracts not personal in nature avoid even the appearance of a personal services contract.

2. Inherently Governmental Functions: The agency shall not use contractors for the performance of inherently governmental functions unless issued under statutory authority See FAR 7.5 Inherently Governmental Functions. As defined in FAR 2.101, “Inherently Governmental Function” means, as a matter of policy, a function that is so intimately related to the public interest as to mandate performance by Government employees. An inherently governmental function includes activities that require either the exercise of discretion in applying Government authority, or the making of value judgments in making decisions for the Government. Inherently governmental functions DO NOT normally include gathering information for or providing advice, opinions, recommendations, or ideas to Government officials.

FAR 7.503(c) provides a list of examples of functions considered to be inherently governmental functions or which shall be treated as such.

To this effect, during contract performance, care should be taken to ensure that any change or expansion in scope of the requirement does not include inherently governmental functions. Further, due to the nature of a given requirement, there is a potential for close working relationships to develop between Government and Contractor personnel; however, care should be taken to ensure that any familiarity established between the Government and Contractor personnel never promotes or fosters an environment that allows for the assignment of inherently governmental functions to contractor employee(s).

3. Unauthorized Commitments: In carrying out your duties, you are reminded that in accordance with FAR1.602-2 (d)(5), the COR “[h]as no authority to make any commitments or changes that affect price, quality, quantity, delivery, or other terms and conditions of the contract, or in any way direct the Contractor, or its Subcontractors, to operate in conflict with the contract terms and conditions.” Doing so constitutes an “unauthorized commitment.”

The Contracting Officer is the only individual with the authority to enter into an agreement on behalf of the Government. An unauthorized commitment is defined as “an agreement that is not binding solely because the Government representative who made it lacked the authority to enter into that agreement on behalf of the Government.” FAR 1-602-3(a). Examples of unauthorized commitments include, but are not limited to, the following:

Orders placed with a Contractor without a valid contractual instrument in place.

Directing any Contractor to do additional work, in excess of the contract value, or work beyond the Period of Performance.

Authorize new work to a contract without notifying the Contracting Officer (CO) or Contract Specialist (CS) and having a modification in place for the new work.

Directing the Contractor, in any way that could change the terms and conditions of the contractual instrument or be deemed outside the Scope of the Statement of Work.

Unauthorized commitments are a serious matter and may result in personal liability on the part of the employee who committed the unauthorized commitment. Ratification, is “the act of approving an unauthorized commitment by an official who has the authority to do so.” FAR 1.602-3(a).

G.2 PAYMENTS - INVOICES - ( September 2024 )

a. GENERAL: Effective August 31, 2020, the Contractor/ Vendor shall create an invoice within the Invoice Processing Platform (IPP), a secure Web-based service for federal agencies and their vendors to manage government invoicing from purchase order (PO) through payment notification. Note: All invoice terms and conditions are contract specific and may vary from contract to contract.

b. CONTENT OF INVOICE: FAR 32.905 Payment Documentation and Process, provides the required content for a proper invoice. In addition to the requirements of FAR 32.905, the following items shall also be included on the invoice to be considered proper:

• Line item number (i.e. CLIN/SLIN as applicable)

• Contractor /Vendor's Unique Entity Identifier (UEI) Number;

• Period of Performance (PoP) or delivery date of goods or services provided;

• Attachments and applicable support documentation requested by the CO ;

• The first page of the PDF invoice or PDF SF-1034 shall include :

1. Contractor /Vendor name and address;

2. Bill to: CMS, P.O. Box 7520, Baltimore, MD 21207;

3. Full CMS contract number and task order number;

4. Summary of charges by CLIN/SLIN (if applicable) with a grand total. CLIN/SLIN( S) on the PDF shall be identical to what is entered in IPP;

5. Invoice number shall be identical to what is entered in IPP. Each Contractor/Vendor invoice number must be unique across all CMS contracts awarded to the Contractor /Vendor. For example, If Contractor /Vendor A has 5 CMS contracts, Contractor /Vendor A cannot use the same invoice number on any of the 5 contracts they have with CMS. If using a dash in IPP then the dash must be used on the PDF. IPP does not allow any special characters (i.e.*, # , _ );

6. Within IPP, the " Bill Period Start " and "Bill Period End " dates should align with the " Service From " and " Service To " dates (this is not the entire POP dates);

7. Date of Delivery or Service dates shown on the PDF should: ( i ) F all within the contract POP (unless contract indicates otherwise) ( ii ) Align with the " Bill Period Start " and "Bill Period End " dates and " Service From " and " Service To " dates, and ( iii ) Note when the work was performed;

8. Date invoice was prepared;

9. The total invoice amount on the first page of the invoice or SF-1034 must be a debit. A credit may be shown on the first page of the invoice or SF-1034 if the credit falls within the Period Of Performance and is for the same CLIN as the debit. CMS does not accept credit vouchers or process refunds in IPP or the Invoice Submission Box. Credits in excess of $5.01 must be submitted via Pay.gov (For questions surrounding Pay.gov, contact pay.gov.

clev@clev.frb.org or 1-800-624-1373 (Option 2)). Credits sent to Pay.gov shall be copied to the CO, CS and COR. Credits valued at or less than $5.01 must be submitted via Credit Gateway; however, it is preferred that the Contractor/Vendor wait until a dollar amount is accumulated in order to submit the refund through Pay.gov (For questions surrounding Credit Gateway, contact customer.care@usbank.com or 1-877-815-1206);

• When an invoice has been resubmitted, an "R" should be added after the invoice number on the PDF and in IPP; this will ensure that the original invoice number is not duplicated in IPP. If a resubmitted invoice is rejected again, each subsequent resubmission requires an additional "R" added after the invoice number (i.e. "RR" );

• The " final " designation should only be used when the contract is being closed out by OAGM. Do not use for the end of POP or Option Year;

• Contractor/ Vendor must maintain active registration in SAM .gov. If your SAM account is about to expire, wait until it is updated before submitting your invoice; and,

• Banking or address changes must be submitted via email to CCRchanges@cms.hhs.gov.

c. INVOICE SUBMISSION: The Contractor/ Vendor shall create an invoice from the Purchase Order (PO)/Contract via the IPP website http://www.ipp.gov/. For questions, call IPP Customer Support at (866) 973-3131 or email the IPP Customer Support at IPPCustomerSupport@fiscal.treasury.gov. Only one PDF invoice per submission is allowed in IPP.

d. PAYMENTS: The Government shall make payment of all proper invoices in accordance with the following clauses, as applicable and included in the respective TO/PO/contract:

• FAR 52.232-33 Payments by Electronic Funds Transfer - System for Award Management,

• FAR 52.232-1 Payments

• FAR 52.212-4 Contract Terms and Conditions - Commercial Items (If applicable)

• FAR 52.216-7 Allowable Cost and Payment

• FAR 52.232-7 Payments under Time-and-Materials and Labor-Hour Contracts

Payment shall be made upon acceptance by the Contracting Officer's Representative (COR) in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer's approval, as appropriate.

Reimbursement for invoices submitted under this contract shall be made no later than 30 calendar days after receipt of a proper invoice from the Contractor requested at the paying office designated above.

Contracts with a 15- day payment term are not subject to interest payments until after day 30.

e. INTEREST ON OVERDUE PAYMENT: The Prompt Payment Act, Public Law 97-177 (96 Stat.85.31 U.S.C.

1801) is applicable to payments under this contract and requires the payment of interest on payments made more than 30 calendar days after receipt of a proper invoice in IPP. Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and 5 CFR 1315.

G.3 Contractor Work Performed Outside the United States and its Territories (January 2021)

To comply with requirements of Homeland Security Presidential Directive -12 (HSPD-12) and Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple CMS information systems by efficiently verifying the claimed identity of individuals working on the contract. The Contractor and its subcontractor

(s) shall not perform any activities under this contract, including the transmission of data or other information, outside of the United States (U.S.) and its Territories without the prior written approval of the Contracting Officer. If work must be performed outside the U.S., the Contractor shall submit a request to the Contracting Officer, in writing, at least 45 calendar days prior to the work beginning.

The Contracting Officer will consider the following factors in making a decision whether to authorize the performance of work outside the U.S. and its Territories:

1. The necessity of the work to be performed outside the United States and its territories;

2. The Statement of Work under contract that will be performed outside the U.S. and its Territories;

3. Total projected dollar value of the work to be performed outside the U.S.;

4. Total projected number of labor hours and length of time to be performed for each individual employee working outside the U.S.;

5. The desired country/location where the work will be performed;

6. FAR Part 25, Foreign Acquisitions, and all other laws and regulations applicable to the performance of work outside the U.S.;

7. The contractor and/or its subcontractor(s) plans to adequately protect and secure CMS data, as well as abide by all applicable laws and regulations when work is performed outside of the U.S. and its Territories. Plans shall include -

a. Adequate contract terms regarding system security;

b. Adequate contract terms regarding the confidentiality and privacy requirements for information and data protection;

c. Adequate contract terms that are otherwise relevant, including the requirements of the Statement of Work;

d. The Contractor's corporate compliance plan and internal policies and procedures designed to prevent and detect violations of applicable law, regulations, rules and ethical standards by employees, agents and others; and,

8. The necessity of Government Furnished Equipment (GFE) or Contractor Owned/Contractor Operated (COCO) devices to be used outside the U.S. and verification of a secure VPN access.

9. Compliance with Executive Order 13940 Aligning Federal Contracting and Hiring Practices With the Interests of American Workers. Determine if approval will reduce opportunities for the United States contractor workers performing in the United States and if this would cause any potential effects to national security.

10. Conformance with Section 889 "Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment", of Public Law115-232.

11. Determination that approval is in best interest of the Government.

The Contractor's request for authorization to perform work outside the U.S. shall include supplemental information to demonstrate that the performance of the work outside the U.S. satisfies all of the above factors. Contracting Officer approval to perform work outside the U.S. may require additional Statement of Work requirements, additional contract terms and conditions and/or Federal Acquisition Regulation (FAR) clauses to be incorporated into the contract.

(End of Section)

Special Contract Requirements

Department of Health and Human Services Acquisition Regulations (HHSAR) Clauses Incorporated by Full Text

352.239-74 Electronic and Information Technology Accessibility. (FEB 2024) DEVIATION

INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE (FEB 2024) (DEVIATION)

(a) Definitions. As used in this clause—

Assessment and Authorization (A&A) means the process used to ensure information systems including Major Applications and General Support Systems have effective security safeguards which have been implemented, planned for, and documented in an Information Technology Security Plan. The A&A process per applicable HHS policies and procedures is the mechanism by which HHS provides an Authorization to Operate (ATO), the official management decision given by the HHS to authorize operation of an information system.

Information system security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

(b) Hosting, operation, maintenance, or use at non-HHS facilities. For information systems that are hosted, operated, maintained, or used on behalf of HHS at non-HHS facilities, Contractors/subcontractors are fully responsible and accountable for ensuring compliance with all applicable Health Insurance Portability and Accountability (HIPAA) Act of 1996 (HIPAA) regulations, the Privacy Act and other required HHS confidentiality statutes included in HHS mandatory yearly training and privacy policy, Federal Information Security Modernization Act (FISMA), National Institutes of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), and HHS security and privacy policy. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The Contractor's security and privacy control procedures must be equivalent to or exceed, those procedures used to secure HHS systems. A Privacy Impact Assessment (PIA) (if the system includes Personally Identifiable Information (PII)) or a Privacy Threshold Analysis (to determine if the system includes PII) must also be provided to the Contracting Officer Representative (COR) and approved by HHS Senior Agency Official for Privacy (SAOP) or designee prior to ATO. All external Internet connections to HHS network involving HHS information must be in accordance with the

Trusted Internet Connections (TIC) Reference Architecture and reviewed and approved by HHS prior to implementation. For Cloud Services hosting, the Contractor shall also ensure compliance with the Federal Risk and Authorization Management Program (FedRAMP).

(c) Collecting, processing, transmitting, and storing of PII. Adequate security and privacy controls for collecting, processing, transmitting, and storing of PII, as determined by the HHS SAOP or designee, must be in place, tested, and approved by HHS prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of HHS. These security and privacy controls are to be assessed and stated within the PIA, Information System Security Plan, Information System Privacy Plan, Security Control Assessment Report, and/or Privacy Control Assessment Report, as agreed upon by the Contractor, COR, and the Operating Division Senior Official for Privacy. If these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

(d) Annual FISMA security controls assessment. The Contractor/subcontractor's system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the Contracting Officer for entry into HHS Plan of Action & Milestones (POA&M) management process. The Contractor/subcontractor must use HHS POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes specified by the HHS in the performance work statement or statement of work, or in the approved remediation plan through the HHS POA&M process. Contractor /subcontractor procedures are subject to periodic, unannounced assessments by HHS officials, including the HHS Office of Inspector General. The physical security aspects associated with Contractor/subcontractor activities must also be subject to such assessments. The results of an annual review or a major change in the cybersecurity posture at any time may indicate the need for reassessment and reauthorization of the system. If major changes to the system occur that may affect the privacy or security of the data or the system, the A&A of the system may need to be reviewed, retested and re-authorized per HHS Rules of Behavior for the Use of HHS Information and IT Resources Policy. Major changes introducing new privacy risks require an updated and reapproved PIA.

(e) Annual self-assessment. The Contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COR. HHS reserves the right to conduct such an assessment using government personnel or another Contractor/subcontractor. The Contractor /subcontractor must take appropriate and timely action, as may be specifically addressed in the contract, to correct or mitigate any weaknesses discovered during such testing, at no additional cost to the Government to correct Contractor/subcontractor systems and outsourced services.

(f) Prohibition of installation and use of personally-owned or Contractor-owned equipment or software on HHS networks. HHS prohibits the installation and use of personally-owned or Contractor/subcontractor-owned equipment or software on HHS networks. If non-HHS owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, performance work statement, statement of work, or contract. All of the security controls required for government furnished equipment must also be utilized in approved other equipment (OE) at the Contractor’s expense. All remote systems must be equipped with, and use, an HHS-approved antivirus software and a personal (host-based or enclave based) firewall that is configured with an HHS-approved configuration. Software must be kept current, including all critical updates and patches.

Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-HHS owned OE.

(g) Disposal or return of electronic storage media on non-HHS leased or non-HHS owned IT equipment. All electronic storage media used on non-HHS leased or non-HHS owned IT equipment that is used to store, process, or access HHS information must be handled in adherence with disposition instructions upon—

(1) Completion or termination of the contract; or

(2) Disposal or return of the IT equipment by the Contractor/subcontractor or any person acting on behalf of the Contractor /subcontractor, whichever is earlier. Media (e.g., hard drives, optical disks, CDs, back-up tapes) used by the Contractors /subcontractors that contain HHS information must be returned to the HHS for sanitization or destruction or the Contractor /subcontractor must self-certify that the media has been disposed of per disposition instructions. This must be completed within 30 days of termination of the contract.

(h) Bio-Medical devices and other equipment or systems. Bio-Medical devices and other equipment or systems containing media (e.g., hard drives, optical disks) with HHS sensitive information will not be returned to the Contractor at the end of lease, for trade-in, or other purposes. For purposes of these devices and protection of HHS sensitive information the devices may be provided back to the Contractor under one of three scenarios—

(1) The Contractor must accept the system without the drive;

(2) A spare drive must be installed in place of the original drive at time of turn-in if HHS initial medical device purchase included a spare drive; or

(3) The Contractor may request reimbursement for the drive at a reasonable open market replacement cost to be separately negotiated by the Contracting Officer and the Contractor at time of contract closeout.

(End of clause)

352.239-75 Security Controls Compliance Testing (Feb 2024) Deviation

On a periodic basis, HHS, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy controls implemented by the Contractor under the clauses contained within the contract. With 10 working-days' notice, at the request of the government, the Contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein HHS information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of HHS, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice, to include unannounced assessments, as determined by HHS in the event of an incident or a breach, or at any other time.

(End of clause)

Additional Regulation or Supplement Clauses Incorporated by Full Text

H.1 HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. 160.103, that is relevant to this Contract, shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor's duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

"Business Associate" shall mean the Contractor (and/or the Contractor's subcontractors or agents) if/when it uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS' HIPAA-covered functions.

"Covered Entity" shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

"Secretary" shall mean the Secretary of the Department of Health & Human Services or the Secretary's designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or on behalf of, Covered Entity other than as permitted or required by this Contract or as required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual for:

A. Filing a complaint under 45 CFR 160.306;

B. Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under 45 CFR Part 160; or

C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its security policies and procedures, including workforce security measures, to ensure proper security awareness and training (including security incident response and reporting), and security incident procedures, in accordance with this Contract, including this HIPAA Business Associate Clause and the Contract's clause entitled "CMS Information Security."

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI created, received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as provided for by this Contract. In doing so, it shall implement policies and procedures to address the following and, where applicable, ensure that such policies and procedures are also in conformance with this Contract's clause entitled "CMS Information Security:"

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual's access rights to PHI (including the implementation of workforce security measures to ensure continued appropriate role-based access to PHI), and technical policies and procedures to ensure compliance with grants of access (including unique user identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities in which they are housed.

C. Implement policies, procedures and physical security measures that will limit access to PHI through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or outside of the Business Associate's facility as well as the disposal and reuse of media containing PHI.

E. Implement appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability (including the use of contingency plans) of any electronic protected health information ("EPHI") it creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, maintenance or transmission of such EPHI. In the establishment of such safeguards, Business Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, and its hardware and software security capabilities.

iii. Assess, and implement, where appropriate, any addressable implementation specifications associated with applicable PHI security standards.

iv. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

v. Comply with the following Incident Reporting:

A. Report to Covered Entity any security incident/breach involving unsecured PHI, of which it becomes aware, including those of its agents and subcontractors. The Business Associate shall report any violation of the terms of this contract involving PHI and any security incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in accordance with the CMS Risk Management Handbook (RMH), specifically "RMH Vol II Procedure 7-2 Incident Handling Procedure" and "RMH Vol III Standard 7-1 Incident Handling." These procedures can be found at http://www.cms.gov/Research- Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity /Information-Security-Library.html In addition, the Business Associate will also notify the CMS Contracting Officer and the Contracting Officer's Representative (COR) by email within one (1) hour of identifying such violation or incident.

B. Upon Covered Entity's knowledge of any material security incident/breach by Business Associate, Covered Entity will provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination clause of this Contract. See also paragraph D. Term of Clause below.

vi. Ensure that any agent or subcontractor agrees through a written contract, or other legally enforceable arrangement, to the same restrictions and conditions that apply through this HIPAA Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or on behalf of, Covered Entity.

vii. Upon Covered Entity's request:

A. Provide the Covered Entity or its designee with access to the PHI created, received, maintained or transmitted by Business Associate from or on behalf of the Covered Entity in the course of contract performance in order to ensure Covered Entity's ability to meet the requirements under 45 CFR 164.524.

B. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR 164.526.

viii. Make its facilities and any books, records, accounts, and any sources of PHI, including any policies and procedures, that are pertinent to ascertaining its own compliance with this contract or the Covered Entity's compliance with the applicable HIPAA requirements, available to Covered Entity, or, in the context of an investigation or compliance review, to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the various rules implementing the HIPAA.

ix. Document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528.

x. Provide to Covered Entity, or an individual identified by the Covered Entity, information collected under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528.

xi. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an…