Solicitation Amendment W91YTZ26QA0080001 SF 30.pdf

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER.

If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

16C. DATE SIGNED

Previous edition unusable STANDARD FORM 30 (REV. 11/2016) Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE PAGE OF PAGES

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than Item 6) CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X) 9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

CODE FACILITY CODE

SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

Purpose of this amendment is to:Block 14 (Description of Amendment/Modification):

A. Addresses questions from industry. Responses to questions from industry will also be available on a separate document.

B. Extend solicitation response date and time.

See summary of changes.

Solicitation/Contract Form Continuation

The following changes have been made:

INFORMATION FROM TO

Response Due Time 10:00 AM 11:00 AM Response Due Date 05 Dec 2025 10 Dec 2025

Miscellaneous text in this section has been added to:

QUESTIONS & ANSWERS RECEIVED IN RESPONSE TO RFQ

Fort Gordon, GA Federal Medical Records Storage and Shredding (RFQ1786461)

# PDF Page Number

Solicitation Section Question Answer

SF1449; Block 5

Addendum to 52.212-1; Volume I; Paragraph i

Block 5 of the SF1449 lists the solicitation number as W91YTZ26QA008. The instructions state that "When submitting your offer via email please annotate the subject line as "Quote for W81K00-26-Q- A008".

Please clarify.

W81K00 will be corrected to W91YTZ in the Addendum to 52.212-1; Volume I;

Paragraph i.

W91YTZ26QA0080001

2 3-5

Continuation of Supplies or Services and Prices/Costs

Both Items X001 and X002 have similar descriptions of Supplies /Services. Each include the destruction and retirement/shipment of records to the Federal Records Center AMEDD Records Processing Center in St. Louis, MO.

Please clarify which Items/CLINs should Offerors include their costs for shipping records to the Federal Records Center AMEDD Records Processing Center.

The items will be returned to DDEAMC for shipping to the Federal Records Center AMEDD Records Processing Center.

3-5

Supplies or Services and Prices/Costs;

Item X002

PWS; 1.4.9

Controlled Unclassified Information (CUI)

The solicitation includes information for handling CUI and states that "The facility is required to store classified documents in a separate and secured type of environment that meet regulatory requirements."

For planning and pricing purposes, and to ensure appropriate space allocation and compliance with all applicable laws and regulations, could the Government clarify what percentage of the 760 cartons anticipated for storage will contain Controlled Unclassified Information (CUI)?

Approximately 100%

3-5

Supplies or Services and Prices/Costs

PWS; 1.9 Invoicing

Per the tables in the Continuation of Supplies or Services and Prices/Costs on pages 3-5, pricing is Firm Fixed Price based on a set monthly cost.

However, Section 1.9, Invoicing, on page 34 states: "This contract will be a pay-per-use contract. The government shall only pay for services rendered."

This language seems incompatible with a Firm Fixed Price contract with the required CLIN structure.

Can the government clarify how the "pay-per-use" contract will work and how the government will calculate the amounts to be paid for services rendered?

Pay per use verbiage is an oversight and will be removed, this will be a firm-fixed price contract.

5 31 PWS; 1.2 Scope

The PWS states, "Records are also destroyed and retired to Federal Records Center AMEDD Records Processing Center, St. Louis, MO." The PWS also quantifies the amount of records for destruction as "approximately 1,500 units per year."

a. Could you please define "unit?"

Is it a single record? A standard 1.2 cubic foot records carton?

b. Could you provide the estimated /historic annual number of "units" that will be retired and shipped to Federal Records Center AMEDD Records Processing Center?

c. Does the Government expect the units to be retired in a single consolidated effort, or will retirements occur incrementally in smaller batches throughout the year?

There is no historical data recorded to reference.

6 31

PWS; 1.3

Requirements

The PWS states, "Approximately 760-

1.2 cubic feet (or equivalent) cartons for storage."

Could you please clarify whether (A) this is an annual number of cartons anticipated for storage or an initial (B) volume that will decrease over the life of the contract as materials are destroyed or relocated to the Federal Records Center AMEDD Records Processing Center?

Both- number of cartons will fluctuate based on storage and destruction.

The PWS states, "A trained representative of the vendor must be able to physically respond to the site within 2 hours of notice who can provide in-service, answer questions, and assist with troubleshooting from 8:

00 am to 8:00 pm EST, Monday through Friday, excluding Holidays with average response time of eight (8) business hours."

A. Not limited to physically- unless a request for urgent bulk-shredding. Telephonic assistance is allowed.

7 31

PWS; 1.3

Requirements

a. What is the required physical on-site response time? Is the expectation 2 hours for each service request within the 8:00 am-8:00 pm coverage window?

b. How should the "average response time of eight (8) business hours" be interpreted? Does this refer to a different type of response (e.g., remote support, resolution time, or non-urgent issues)? Or should the average response time also be 2 hours?

c. If the two metrics serve different purposes, could the Government please specify the conditions under which each applies?

B. Normal working hours from 8:00 a.m. to 3:30 p.m. Monday through Friday.

C. See response to A.

34-35

Requirements

PWS; 2.4

Could you please clarify whether the contractor's service hours are "the (A) normal working hours from 8:00 a.m.

to 3:30 p.m. Monday through Friday."

(Section 2.4) or "A trained (B) representative of the vendor must be able to physically respond to the site within 2 hours of notice who can provide in-service, answer questions, and assist with troubleshooting from 8:

00 am to 8:00 pm EST, Monday through Friday, excluding Holidays."

(Section 1.3)

See answers to Items 7.

Requirements

PWS; 1.5 Support

PWS; 1.6 Delivery & Pick-Up

PWS; 1.7 Receiving and Entry of Records for Storage

Could you please clarify whether the contractor would be expected to "physically respond to the site within 2 hours of notice" (Sections 1.5, 1.7) outside of the customer service hours of "8:00 am to 8:00pm EST, Monday through Friday, excluding Holidays" (Section 1.3) and the listed pickup /delivery "normal working hours" (Section 2.4) of "8:00 AM - 3:30 PM.

Monday through Friday, except on government holidays." (Section 1.6)?

Not required outside of business hours.

34-35 PWS; 2.4

10 31 PWS; 1.4 Training

The PWS states, "Contractor personnel performing work under this contract shall maintain the level of security required for the life of the contract."

What level of security is required for personnel on this contract (public-trust, secret, other)?

Public Trust

11 33 PWS; 1.5 Support

The PWS states "A wide variety of shapes and sizes of cartons should be provided to adequately protect documents outlined in the contract."

Please clarify if the Contractor is responsible for supplying said cartons, or if these will be provided by the government.

The vendor supplies the cartons.

12 33 PWS; 1.7 Receiving and Entry of Records for Storage

The PWS states that "The service provider shall contact the contractor for pickup and transport to the contractor's facility."

a. Is it expected for the contract to pick-up the 760 cartons for storage within the initial 30 days of contract award?

b. How many pickups are expected annually in the base year?

c. How many pickups are expected annually in the option years?

A. Yes

B. Twice, monthly or as needed basis for bulk items.

C. Twice, monthly or as needed basis for bulk items.

13 33 PWS; 1.7 Receiving and Entry of Records for Storage

The PWS states, "The contractor shall provide delivery service directly to the customer requesting the carton(s)..."

a. How many deliveries are expected annually?

A. This is on an as needed basis and not a set number.

B. Usually one carton being delivered on

b. What, on average, is the quantity of each delivery?

c. Does the government expect deliveries outside of Augusta, Georgia?

If so, where and how frequently?

scheduled shred day. No special delivery required.

C. No.

14 33-34

PWS; 1.8

Destruction of Records

a. How will the government identify which records should be recycled and which should be securely shredded?

b. Is recycling limited to electronic waste?

A. Each department that sends files for storage /destruction should have a destruction date.

B. No recycling- only secure shredding.

15 33-34

PWS; 1.8

Destruction of Records

The PWS states, "The contractor will furnish the security console and/or gallon cart container(s) to house the material until time of destruction."

Does the government expect locked shred bins on-site at all times in multiple locations to collect materials for destruction?

Yes.

16 33-34

PWS; 1.8

Destruction of Records

Is material with CUI expected to be destroyed separately from other materials?

No.

17 35 PWS; 2.4.3

Could you please provide an estimated timeframe for "short notice to shred"?

Scheduled timeframe coordinated by the vendor/customer during normal business-usually within 2 hours of request.

18 47 Solicitation Provisions; 52.212-1

Provision 52.212-1(a) identifies NAICS 541519 as being applicable to this solicitation.

As the solicitation was released under GSA MAS SIN 493110RM with an

GSA MAS SIN

493110RM was the closest category to solicit under. NAICs on Solicitation 518210 was associated size standard of $34M, please confirm that NAICS 541519 is not applicable to this RFQ.

approved by SBA to be utilized for this requirement.

19 50

Addendum to 52.212-1, Instructions to Offerors

The solicitation states that "The Contracting Officer is required to make a determination of responsibility IAW

FAR 9.1."

Are offerors required to submit information to support this determination, and if so, where should this be provided in the proposal?

This is a KO responsibility; no information is required from offerors.

20 N/A N/A

Will the government provide an extension through 12/12/25 to allow Offerors time to incorporate any additional information or solicitation edits based on the government's responses to questions?

An extension will be applied through 12/10

/2025 @ 11 AM CST.

21 N/A N/A Does the contractor need a clearance to bid on this project?

No

22 N/A N/A Does the contractor need a facility clearance to be awarded the contract?

No

23 N/A N/A Please define classified documents?

The documents placed in the shredding bins are

PII/PHI- HIPAA

mandated.

24 N/A N/A Has your agency determined these documents to be Top Secret, Secret or Confidential?

The documents placed in the shredding bins are

PII/PHI- HIPAA

mandated.

25 N/A N/A Will contractor employees be required to have to have a clearance?

No, must pass a background check to access Fort Gordon Installation.

List of Contract Documents, Exhibits, or Attachments

Miscellaneous text in this section has been modified to:

PERFORMANCE WORK STATEMENT

1.1 General. This requirement is for record Storage support and Shredding services for Dwight D.

Eisenhower Army Medical Center, Fort Gordon, GA.

1.2 Scope. The records storage contract will store media records (paper, diskettes, tapes, videotapes, CD Rom's, X-Rays, micrographic and electronic records), to include classified documents - designated as confidential - to include privacy/protected- protected health information/ personally identifiable information (PHI/PII) adhering to HIPAA rules; and on-site shredding- approximately 1,500 units per year for destruction. Records are also destroyed and retired to Federal Records Center AMEDD Records Processing Center, St. Louis, MO. The service agreement shall comply with standard Army regulatory requirements described in AR 25-400-2 and Air Force regulatory requirements described in AFI 33-322, and National Archives and Records Administration.

1.3. Requirements. The contractor shall pick up, store, retrieve, re-file, destroy, and ship records to other Federal Records Centers. The contractor shall have a climate controlled secured storage facility that houses media records (paper, diskettes, tapes, videotapes, CD Rom's, X-Rays, micrographic and electronic records). The facility is required to store classified documents in a separate and secured type of environment that meet regulatory requirements. Approximately 760- 1.2 cubic feet (or equivalent) cartons for storage. Due to the 24-hour mission of Dwight D. Eisenhower, a customer service phone number must be available 24 hours a day, 7 days a week. A trained representative of the vendor must be able to physically respond to the site within 2 hours of notice who can provide in-service, answer questions, and assist with troubleshooting from 8:00 am to 8:00 pm EST, Monday through Friday, excluding Holidays with average response time of eight (8) business hours.

1.4. Training. maintain the level of Contractor personnel performing work under this contract shall security required for the life of the contract.

1.4.1 All contractor employees performing work on site shall report to the Security office and obtain vendor credentials for the duration of the work. Contractor employees shall always wear their badge credentials while on site.

1.4.2 Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within a DHA controlled installation, facility, or area.

Contractor and all associated sub-contractors' employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost

Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, DHHQ and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.4.2.1. For contractors that do not require CAC but require access to a DoD facility or installation.

Contractor and all associated sub-contractors' employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB), applicable installation, facility and area commander installation /facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

1.4.3 The contractor shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 15 calendar days of new contract employees' commencing performance, with the results reported to the COR no later than 45 calendar days after contract award.

1.4.4 All contractor employees with access to a government information system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services and must successfully complete the DoD Information Assurance Awareness training prior to access to the information system and then annually thereafter.

1.4.5 AT level 1 (general) all contractor employees requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The contractor shall submit certificates of completion for each affected contractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 15 calendar days after completion of training by all employees and subcontractor personnel.

1.4.6 For contracts that require a formal OPSEC program. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per DHA-AI 5200.03.

1.4.7 For Cyber Awareness (Information Assurance (IA)/information Technology (IT) training. All contractor employees and associated subcontractor employees must complete the DoD Cyber Awareness training before issuance of network access and annually thereafter. All contractor employees working IA /IT functions must comply with DoD requirements DoD 8570.01 and DoD 8570.01-M within six months of appointment to IA/IT functions. DoD Cyber Awareness Challenge Training is available at the following website: https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf?ORG=NAVSEA , DOD Course US1364-22 DOD Cyber Awareness Challenge 2022.

1.4.8 For Cyber (Information assurance (IA)/information technology (IT) certification. Per DoD 8570.01- M , DFARS 252.239.7001, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

1.4.9 Controlled Unclassified Information (CUI). Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171. Also include DFARS provision 252.204-2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn't show a medium- or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

1.4.10 Threat Awareness Reporting Program. For all contractors with security clearances. Per DHA-AI 097, Insider Threat Program, contractor employees must receive annual Insider Threat Awareness training within 30 days of initial employment, and refresher training annually either through instructor-led or computer-based.

1.5. Support. Due to the 24- hour mission of Dwight D. Eisenhower, a customer service phone number must be provided 24 hours a day, 7 days a week for support. A trained representative of the vendor must be able to physically respond to the site within 2 hours of notice who can provide in-services, answer questions, and assist with troubleshooting. Online ordering via the internet, telephone, fax and or email is required to allow a quick and easy access for all the records stored in the facility. Local point(s) of contract and phone numbers are required for quick response and assistance. A wide variety of shapes and sizes of cartons should be provided to adequately protect documents outlined in the contract.

1.6. Delivery & Pick-Up. The contractor shall pickup and/deliver cartons between the hours 8:00 AM - 3:30 PM. Monday through Friday, except on government holidays. Timeframes will be coordinated with the COR.

1.7. Receiving and Entry of Records for Storage. The contractor shall scan the records by bar-coding, assigning a location and capturing the descriptive information from service provider documentation (Standard Form 135, Records Receipt and Transmittal). The contractor shall furnish the service provider with barcode labels and transmittal forms. The service provider shall complete one transmittal form for each new carton to be stored at the facility with the information required to property index the records. The service provider shall enter the customer identification number on the barcode label. The service provider shall affix the barcode to each carton in the area marked Accession Number.

The service provider shall place a copy of the transmittal form inside the first carton and on top of each carton for each shipment. The service provider shall contact the contractor for pickup and transport to the contractor's facility. The contractor shall match the bar-coding on the transmittal with their corresponding cartons. The contractor shall furnish a listing of all the records received and entered their system to the service provider. The contractor shall retrieve the cartons when requested by the service provider. The service provider shall provide the contractor with the barcode and box number of the carton to be retrieved by email and/or by telephone. The contractor shall provide delivery service directly to the customer requesting the carton(s) and pickup for re-file of the carton(s). The contractor shall provide delivery service based on mission requirement needs (immediate/rush delivery, within 2 hours and/or next day delivery). Upon pickup of the carton for re-file, the service provider shall re-file the carton in the same storage location as retrieved.

1.8. Destruction of Records. The contractor shall destroy records in either one of two ways: Recycling and Secure Shredding. The contractor shall destroy records in the facility, on-call, offsite and/or onsite.

The contractor will pick up and transport from the location site and/or by utilization of the state-of-art-mobile shredding vehicles at the customer's site(s). The contractor will furnish the security console and /or gallon cart container(s) to house the material until time of destruction. Operational requirements need to be available to modify from time-to-time, regarding container, pickup-up volumes and similar matters.

An additional requirement is to retrieve and permanently withdraw records from storage.

1.9. Invoicing. A monthly invoice is required (a separate and a consolidated invoice for each customer) which identifies the invoice date, invoice number(s), customer number, contract line-item number, lists each type of transaction, the total quantity of each type of transaction, and the total amount. A separate detailed billing transaction report is required listing the same items mentioned above, but to include the order number, order date, the customer who requested the transaction, the description of the transaction, the storage date, the quantity, the unit, the rate and total amount for each line entry. Once the invoice has been approved, it must be submitted into WAWF as a 2-in-1 invoice. The government shall only pay for services rendered.

PERFORMANCE MEASUREMENTS

2.1. Outcome. The contractor shall provide Dwight D. Eisenhower Army Medical Center with hardware and software maintenance including delivery, pick-up, training, maintenance, 24/7 technical support, and a vendor representative.

2.2. Standards. Acceptable measures include: the pick-up of all media records within 24 hours after notification, on-going and continuous services, 24/7 availability of technical support and pick-up within 24 hours after notification. Other performance factors, which may be monitored and are not quantified by numerical measurements include: the Contractor's relationship with hospital staff/government personnel and accurate and timely invoicing.

2.3. How measured. The Contracting Officer's Representative and or Technical Representative will monitor contractor performance by verifying timely delivery and pick-up; Monitor Computerized reporting includes an inventory, with supplemental reporting as requested, activity reports, preliminary destruction and destruction listings, on-site visit reporting and any periodic and special reporting requirements needed by the customer to track and manage records; Verify the availability of technical support and the vendor representative; Monitor invoices received and the general business relationship between the Contractor's staff and Government personnel; Conduct an audit/reviewing room for an internal review of records by the customer. This service includes retrieval of records along with documentation for each record retrieved and storage of the records within this area until the process is completed by the customer; Monitor retrieval, packing, labeling and shipping records to other agencies and/or federal record centers, utilizing the required GSA standard box for letter and/or legal records;

Ensure that a Disaster Recovery Plan is in place.

SPECIFIC TASK

2.4. The Contractor shall provide services during the normal working hours from 8:00 a.m. to 3:30 p.m.

Monday through Friday.

2.4.1 Contractor shall insure that drivers comply with all standards applicable to the installation.

2.4.2 Customer may require a 2 hour notice escorted pickup from record storage area.

2.4.3 Customer may require short notice to shred within the Fort Gordon area.

2.4.4 A monthly Invoice is required with a separate detailed billing transaction listing description.

SUPPLEMENT TO THE PERFORMANCE WORK STATEMENT

1. GOVERNMENT HOLIDAYS

The following Government Holidays are observed:

New Year's Day

Martin Luther King Jr.'s Birthday

President's Day

Memorial Day

Juneteenth Day

Independence Day

Labor Day

Columbus Day

Veteran's Day

Thanksgiving Day

Christmas Day

Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contractor is scheduled to perform maintenance is closed due to a holiday declared by an Executive Order and the contractor is not required to report in, contractor shall service equipment on the available day staff will be present. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

2. Invoicing and Payment

The contractor shall submit monthly, in arrears, itemized invoices in accordance with DFARS 252.232- 7003 & 252.232-7006, for services rendered under this contract. Information regarding Wide Area Workflow is available on the Internet at https://piee.eb.mil

3. TOBACCO FREE MEDICAL CAMPUS (TFMC)

The Contractor shall ensure that all contract personnel comply with the U.S. Army Medical Command and MTF smoking policies while performing services under this contract. Smoking restrictions will apply at any location or building where health care activities are performed under this contract.

In accordance with Army Regulation 600-63, paragraph 7-3, 14 April 2015; Operations Order 15-48 (Army Medical Command (MEDCOM) Tobacco Free Living - USAMEDCOM), 8 May 2015; and any Operations Order, regulation or other instruction implementing, defining or otherwise addressing the Tobacco Free Medical Campus (TFMC) on any military installation or DoD-controlled location, Contractor personnel are prohibited from using any tobacco product on or within any TFMC while performing under this contract. TFMCs are established at each installation or DoD-controlled location and include: (1) any property or non-residential building that is operated, maintained or assigned to support medical activities, including but not limited to, hospitals, medical laboratories, outpatient clinics (including medical, dental, and veterinary facilities), or aid stations operating for the primary purpose of delivering medical care and services for DOD eligible beneficiaries and /or meeting the mission of the Army Medical Command; (2) all other facilities in which medical activities or administration take place, to include HQ MEDCOM and Defense Health Headquarters; (3) all internal roadways, sidewalks and parking lots; and (4) all sidewalks, parking lots and grounds external but adjacent to the building or related to the migratory corridors surrounding the medical facility. The contractor shall obtain from the COR any orders, regulations, instructions or other documents implementing, defining or otherwise addressing the TFMC for any given installation or DoD-controlled location where contractor personnel may perform under this contract and shall instruct contractor personnel on the TFMC limitations for installations or DoD-controlled locations where they may perform under this contract.

W91YTZ26QA0080001

https://piee.eb.mil

4. EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE PROGRAM Exclusion from Participation in Federal Health Care Programs (October 2015)

a. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as "person") to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at h ttp://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at h ttp://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-

H ealthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as "the Lists."

b. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the Lists and no such names appear on either of the Lists.

c. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter "new persons") providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

d. The Contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of contractor personnel working in the MTF against the Lists, as specified in OTSG/MEDCOM Policy Memo 15-037. The Government will notify the Contractor in the event any contractor personnel working in the MTF appear on either of the Lists.

e. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

f. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

g. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC (S) 1320a-

7a): There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at h ttp://oig.hhs.gov

./exclusions/files/sab-05092013.pdf

5. SEXUAL HARASSMENT/ASSAULT RESPONSE AND PREVENTION

Sexual Harassment/Assault Response and Prevention (SHARP) Program. The contractor shall comply with Sexual Harassment/Assault Response and Prevention (SHARP) Program, The SHARP reporting requirements apply only to knowledge obtained by contractor personnel while performing services under this contract.

The contractor shall require all contract personnel with knowledge of an incident of sexual harassment occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours of gaining knowledge of the incident) report the incident in writing to the Government's COR. This reporting policy also applies to sexual harassment incidents involving Government personnel that occur on the contractor's owned or leased facility under this contract. All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals, when the incidents occur on a Government facility or a Government leased facility.

The contractor shall require all contract personnel with knowledge of an incident of sexual harassment occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours) report the incident in writing to the government's COR. All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals.

6. Personally Identifiable Information, Protected Health Information, and Federal Information Requirements

(Revised 10/27/2020)

General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor's requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

1. DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, "Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule DoD Health Care Programs," March 13, in 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B - Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), "OSD Records and Information Management Program" (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at ; or via postal delivery addressed to the DHA Freedom of Information DHA.FOIA@mail.mil Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

W91YTZ26QA0080001

mailto:DHA.FOIA@mail.mil mailto:DHA.PrivacyAct@mail.mil

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA)

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSA for De-Identified Data

DSA for PHI

DSA for PII Without PHI

DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (Applies if contract requirements may include human subject research)

This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.

C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

7. Privacy Act and HIPAA Training

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the

Contractor's scope of involvement with DHA's PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer's Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee's birth month thereafter.

8. HIPAA Business Associate Provisions

8.1 Business Associate - General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the "DoD Components", located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Privacy-Contract-Language /HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS. b.i. and (3)b.ii.

9. Breach Response

[This paragraph 9 is inoperative, and all references herein to "paragraph 9" shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference.

9.1 Definitions Related to Breach response

W91YTZ26QA0080001

https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an other than authorized…