Solicitation - HT940625QE006.pdf

WOMEN-OWNED SMALL

BUSINESS (WOSB)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

REQUEST

FOR QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8(A)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30.

See Schedule

See Section G - Contract Administration Data

See Schedule

HT940625QE006 19 Aug 2025

Kimberly Bunn 757-953-5740

29 Aug 2025

08:00 AM

HT9406

DEFENSE HEALTH AGENCY

HCD SOUTHEAST, 7700 ARLINGTON BLVD, ATTN SE DIV

FALLS CHURCH, VA 22042

UNITED STATES

Kimberly Bunn, Email: kimberly.p.bunn.civ@health.mil Telephone: 757-953-5740

811210

See Schedule

Solicitation/Contract Form

Maintenance Preventive Maintenance Services of Tunnel/Rack/Ultrasonic Washer, and Sterilizers;

Product Service Code: J065 Date: 24 Jul 2025

HT940625QE006

Supplies or Services & Prices or Costs

Additional Information/Notes

Item Supplies / Services Quantity Unit Unit Price Amount

Product Service Description: Maint.

Tunnel

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Rack Washer

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Ultrasonic

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Tunnel

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Rack Washer

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Ultrasonic

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Tunnel

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Rack Washer

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Ultrasonic

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Tunnel

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Rack Washer

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Ultrasonic

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Tunnel

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Rack Washer

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Product Service Description: Maint.

Ultrasonic

Claimant Program Code: S1 Pricing Arrangement: Firm Fixed Price

1 Job

Description/Specifications/Statement of Work

Department Defense of

Defense Health Agency

Performance Work Statement

Preventive Maintenance Services of Tunnel/Rack Washers and Sterilizers

29 Sept 2025

Navy Medicine Readiness and Training Command, Portsmouth

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide maintenance of the Tunnel Washer, Rack Washer, and two Sterilizer units in Building 274, Naval Medical Center Portsmouth.

1.1.1 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform maintenance of the Tunnel Washer, Rack Washer, and two Sterilizer units as defined in this Performance Work Statement (PWS).

1.1.2 Background: This is a renewal of previous non-personal services contract (N0018322P0559). Annual maintenance is required to ensure proper function and calibration of the Tunnel Washer, Rack Washer, and two Sterilizer units in Building 274, Naval Medical Center Portsmouth.

1.1.3 Scope: Contractor to provide preventive maintenance and repair service on equipment identified below. Services include inspection, corrections, adjustment, and replacement of worn/defective parts as required for proper equipment operation. Contractor will provide one (1) annual Preventive Maintenance Service visit per year. The contractor shall perform all services as required to restore equipment to normal operating condition.

1.1.4 Period of Performance (PoP): 29 Sep 2025 - 28Sep 2026; with option of four additional years

1.2 Administrative specifications

1.2.1 Place of performance: The work shall be performed at Naval Medical Center Portsmouth, 620 John Paul Cir, Portsmouth, VA 23708-2297;

Bldg 274 (Clinical Investigation Department), Rm37/35B.

1.2.2 . Contractors are not required to provide services on Federal holidays Recognized Federal holidays:

New Year's Day Labor Day

Martin Luther King Jr.'s Birthday Columbus Day

President's Day Veteran's Day

Memorial Day Thanksgiving Day

Juneteenth Day Christmas Day

Independence Day

1.2.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday (8:00 a.m. to 4:00 p.m.) except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.3 Contractor Identification

1.3.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the Government understands that the person is contractor support personnel.

2.0 SPECIFICTASKS

2.1 Preventive Maintenance

2.1.1.Coordination of services: Contractor should contact the Clinical Investigation Department (CID) Representative listed below in order to coordinate scheduling of visits, and upon arrival.

Doug Clemons (Facility Manager)

757-953-5939 douglas.s.clemons.civ@health.mil

2.1.2. Frequency: Contractor is required to provide preventive maintenance services once per year, at a time mutually agreed upon between the Contractor and the CID Representative.

2.1.3. Services provided: Preventive maintenance services provided will include inspection, adjustments, and replacement of worn/defective parts due to normal use and conditions. Contractor's price must be inclusive of all costs including labor and travel as required to restore equipment to normal operating condition. Contractor shall maintain equipment per Original Equipment Manufacturer (OEM) guidelines including all OEM recommended preventative maintenance visits. Contractor is not responsible for procurement of replacement parts, or labor /materials for service line fittings, utility lines, or other equipment not supplied by the OEM.

2.1.4. Equipment included: The following equipment will be serviced by the Contractor.

Quantity Product Category Equipment Description

1 Lynx Tunnel Washer Model 536LX

Prop #18361169

1 Schlyer Rack Washer Model RW6290

S/N: 101142

Crest Ultrasonic Washer

Model-HAL-20WRD

SN-1706H0138

2.1.5. Warranty: Contractor to warranty all completed repairs have been completed per OEM guidelines and accepted industry standards.

2.1.6. Report: The Contractor will generate a Preventive Maintenance report after each visit, containing a summary of services provided. The CID representative will review and approve the final report. The service report shall include, but not be limited to: contract number, equipment description (model, serial number, equipment control number)contractor's log number, detailed description of the service(s) performed, replacement part(s) information (part number, value, nomenclature, unit price, manufacturer, if not OEM, and whether the part is new/used/reconditioned), the completion date and time, man-hours expended and the hourly rate normally charged for the type of service performed, model and serial numbers, and the name of the FSE performing the service. In the event that agents /sub-contractor's are used in the performance of repairs, said agent shall be identified on the service report by company name and contact information (i.e., telephone number).

2.2. Replacement Parts

2.2.1. New: Uses of new replacement parts only are authorized.

2.2.2. Refurbished: Refurbished or used replacement parts are not allowed unless certified by the OEM, new parts are not available, and they are specifically approved by the Government. If refurbished parts are the only viable solution, then the vendor is to receive permission (in writing)from the CID POC prior to use.

2.3. Software Updates

2.3.1. Software: Contractor shall provide any and all software updates as they become available throughout the period of performance but no later than 30 days following its release at no additional charge.

2.4. Technical Support

2.4.1. Contractor shall provide telephone support to include services for both general system operation questions and questions concerning system failures and/or faults. Calls received during normal business hours shall be responded to immediately but no later than the next business day after receipt of the call.

3.0 Qualifications/Considerations

3.1 Special Qualifications/Considerations: The contractor shall be qualified / authorized by the Original Equipment Manufacturer (OEM) in the repair of all equipment listed within this contract, such that OEM warranty and service are provided and maintained by the OEM. All software licensing, warranty, and service associated with the equipment/system shall be in accordance with the OEM terms and conditions. Contractor shall maintain current (within 2 years)qualifications throughout entire contract period. Qualification includes but not limited to the certification of all repair persons and repair facilities by the OEM as being trained / qualified to perform required repairs. The Government shall maintain the right to seek proof of qualification prior to award and anytime during contract period of performance.

4.0 Points of Contact

4.1 Points of Contact:

Clinical Investigation Department (CID) Representative:

Doug Clemons (Facility Manager)

757-953-5939 douglas.s.clemons.civ@health.mil

Requirements Maintenance Preventive Maintenance Services of Tunnel/Rack/Ultrasonic Washer, and Sterilizers

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Product Service Code: J065

North American Industry Classification System (NAICS): 811219

Packaging and Marking

Inspection and Acceptance

Overall Contract Inspection/Acceptance Locations

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons

Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Inspection and Acceptance Location

Both Destination Instructions: Naval Medical Center Portsmouth (NMCP) Receiving Dock Hours of Operation:

NMCP Receiving Dock is open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excluding federal holidays. Receiving personnel may be reached at 757-953-5770.

DoDAAC: HT0242 CountryCode: USA

NAV MED CNT PORTSMOUTH VA - MM

ATTN SUPPLY OFFICER BLDG 250, 54 LEWIS MINOR STREET

PORTSMOUTH, VA 23708-2297

UNITED STATES

Doug Clemons Email: douglas.s.clemons.civ@health.mil Telephone: 757-953-5939

Deliveries or Performance

DOCK HOURS

Naval Medical Center Portsmouth (NMCP)Receiving Dock Hours of Operation:

NMCP Receiving Dockis open Monday through Friday 0700 to 1600 (7:00 a.m. to 4:00 p.m.), excludingfederal holidays. Receiving personnelmay be reached at 757-953-5770.

From 29 Sep 2025 to 28 Sep 2030

Contractor Destination

Line Item Delivery Schedule Quantity Address and POC

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2025 To 28 Sep 2026

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2025 To 28 Sep 2026

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2025 To 28 Sep 2026

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2026 To 28 Sep 2027

1 Job Service Performance Site

DoDAAC: HT0242

Period of Performance From 29 Sep 2026 To 28 Sep 2027

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2027 To 28 Sep 2028

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2027 To 28 Sep 2028

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2027 To 28 Sep 2028

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2028 To 28 Sep 2029

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2028 To 28 Sep 2029

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2028 To 28 Sep 2029

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2028 To 28 Sep 2029

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2029 To 28 Sep 2030

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2029 To 28 Sep 2030

1 Job Service Performance Site DoDAAC: HT0242

Period of Performance From 29 Sep 2029 To 28 Sep 2030

FAR Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

52.247-34 F.o.b. Destination. Jan 1991

Contract Administration Data

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

252.204-7006 Billing Instructions-Cost Vouchers May 2023 252.232-7003 Electronic Submission of Payment Requests and Receiving Reports. Dec 2018

DFARS Clauses Incorporated by Full Text

252.232-7006 Wide Area WorkFlow Payment Instructions. (Jan 2023)

WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) As used in this clause- Definitions.

"Department of Defense Activity Address Code (DoDAAC)" is a six position code that uniquely identifies a unit, activity, or organization.

"Document type" means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

"Local processing office (LPO)" is the office responsible for payment certification when payment certification is done external to the entitlement system.

"Payment request" and "receiving report" are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as Electronic invoicing.

authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) To access WAWF, the Contractor shall- WAWF access.

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice WAWF training.

Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the "Web Based Training" link on the WAWF home page at https://wawf.eb.mil/

(e) Document submissions may be via web entry, Electronic Data Interchange, or File Transfer WAWF methods of document submission.

Protocol.

(f) The Contractor shall use the following information when submitting payment requests and receiving reports WAWF payment instructions.

in WAWF for this contract or task or delivery order:

(1) The Contractor shall submit payment requests using the following document type(s): Document type.

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items-

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

(Contracting Officer: Insert applicable invoice and receiving report document type(s) for fixed price line items that require shipment of a deliverable.)

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

Invoice 2 in 1 Service

(Contracting Officer: Insert either "Invoice 2in1" or the applicable invoice and receiving report document type(s) for fixed price line items for services.)

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) ) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF "combo" document type to create some combinations of invoice and receiving report in one step.]

(3) The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in Document routing.

WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC HQ0490

Issue By DoDAAC HT9406

Admin DoDAAC HT9406

Inspect By DoDAAC N/A

Ship To Code HT0242

Ship From Code N/A

Mark For Code N/A

Service Approver (DoDAAC) HT0242

Service Acceptor (DoDAAC) HT0242

Accept at Other DoDAAC N/A

LPO DoDAAC N/A

DCAA Auditor DoDAAC N/A

Other DoDAAC(s) N/A

(*Contracting Officer: Insert applicable DoDAAC information. If multiple ship to/acceptance locations apply, insert "See Schedule" or "Not applicable.")

(**Contracting Officer: If the contract provides for progress payments or performance-based payments, insert the DoDAAC for the contract administration office assigned the functions under FAR 42.302(a)(13).)

(4) The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in Payment request.

accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F. Receiving report.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

(Contracting Officer: Insert applicable information or "Not applicable.")

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

Special Contract Requirements

BUSINESSASSOCIATE AGREEMENT

Privacy,Access, Use, and Disclosure of Protected Health Information

1. . In accordance with 45 C.F.R. (S)(S) 164.502(e)(2)and 164.504(e), and DoDM 6025.18,"Implementation of the Health Introduction Insurance Portability and Accountability Act(HIPAA) Privacy Rule in DoD Health Care Programs," March 13, 2019, thisdocument serves as a Business Associate Agreement (BAA) between the signatoryParties for purposes of the HIPAA and the "HITECH Act" amendments thereof, asimplemented by the HIPAA Rules and DoD HIPAA issuances (both definedbelow). The Parties are (1) a DoDMilitary Health System (MHS) component command such as a Navy Medicine MedicalTreatment Facility (MTF) (Naval Medical center or Naval hospital), or specialmission command (research, public health, other), acting as a HIPAA coveredentity, and (2) another Federal or Government organization, civilian academicinstitution, or other civilian entity, acting as a HIPAA Business Associate(BA). The HIPAA Rules require BAAsbetween covered entities and BAs. Implementing this BAA requirement, the applicable DoD HIPAA issuances(DoDM 6025.18) provides that requirements applicable to BAs must beincorporated (or incorporated by reference) into the contract or agreementbetween the Parties.

2. Definitions:

a. . Except as provided otherwise in this BAA, thefollowing terms used in this BAA shall have the same meaning as those terms Terms inthe DoD HIPAA Rules (DoDM6025.18-): Dataaggregation, designated record set, disclosure, health care operations,individual, minimum necessary, notice of privacy practices, protected healthinformation (PHI), required by law, secretary, security incident,subcontractor, unsecured PHI, and use.

b. . means actual or possible loss of control,unauthorized disclosure of or unauthorized access to PHI or other Breach PersonallyIdentifiable Information (PII) (which may include, but is not limited to PHI),where persons other than authorized users gain access or potential access tosuch information for any purpose other than authorized purposes, where one ormore individuals will be adversely affected. The foregoing definition is based on the definition of "Breach" in DoDPrivacy Act issuances as defined herein.

c. . shall generally have the same meaning as theterm "BA" in the DoD HIPAA issuances, and in reference to this BAA, shall meanthe entity BA (another Government organization, civilian academic institution, orother civilian organization), entering into agreement with a Navy Medicine MTFor special mission command.

d. . means this BAA together with the documents orother arrangements under which the BA signatory performs services Agreement involvingaccess to PHI on behalf of the MHS component signatory to this BAA.

e. . shall generally have thesame meaning as the term "covered entity" in the DoD HIPAA issuances, and inreference to this BAA, CoveredEntity shall mean a Navy Medicine MTF or special missioncommand under the Bureau of Medicine and Surgery.

f. . means the DefenseHealth Agency (DHA) Privacy and Civil Liberties Office. The DHA Privacy Office Director is the DHAPrivacy Office HIPAAPrivacy and Security Officer for DHA, including the National Capital RegionMedical Directorate.

g. . means the DoD issuances implementing theHIPAA Rules in the DoD MHS. Theseissuances are DoDM DoD HIPAA Issuances

6025.18 Implementation of the HIPAA Privacy Rule in DoDHealth Care Programs," March 13, 2019; DoD Instruction 6025.18, Privacy ofIndividually Identifiable Health Information in DoD Health Care Programs ofDecember 2009, and DoD Instruction 8580.02, Security of IndividuallyIdentifiable Health Information in DoD Health Care Programs of August 2015.

h. . means the DoD issuances implementing thePrivacy Act, which are DoD Directive 5400.11, DoD Privacy DoD Privacy Act Issuances Program of 29 October2014, and DoD 5400.11-R, Department of Defense Privacy Program of 8 May 2007.

i. . means, collectively, the HIPAA privacy,security, breach and enforcement rules, issued by the United States (US)Department HIPAA Rules of Health and Human Services (HHS) and codified at 45 C.F.R. (S)(S) 160and 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and 45C.F.R. (S) 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules which implementedthe "HITECH Act" provisions of Publication L. 111-5. See 78 Federal Regulation 5566-5702 of 25January 2013 (with corrections at 78 Federal Regulation 32464 of 7 June 2013. Additional HIPAA rules regarding electronictransactions and code sets (45 C.F.R. (S) 162) are not addressed in this BAA andare not included in the term HIPAA Rules.

j. . means a breach thatsatisfies the HIPAA Breach Rule definition of "Breach" in 45 C.F.R. (S) 164.402. HHSBreach

k. . means one or more offices within the militaryservices (Army, Navy, or Air Force) with oversight authority over Service-Level Privacy Office Privacy Actand HIPAA privacy compliance.

3. Obligationsand Activities of BA:

a. TheBA shall not access, use, or disclose PHI other than as permitted or requiredby this Agreement, the controlling Memorandum of Understanding (MOU) ortraining affiliation agreement, or as required by law.

b. TheBA shall use appropriate safeguards and comply with the DoD HIPAA Rules withrespect to electronic PHI to prevent use or disclosure of PHI other than asprovided for by this Agreement, the controlling MOU, or law.

c. TheBA shall report to the covered entity any Breach of which it becomes aware andshall proceed with breach response steps required by paragraph 7 (BreachResponse) of this BAA. With respect toelectronic PHI, the BA shall also respond to any security incident of which itbecomes aware in accordance with any information assurance provisions of theUnderstanding. If at any point the BAbecomes aware that a security incident involves a breach, the BA shallimmediately initiate breach response as required by paragraph 7 (BreachResponse) of this BAA.

d. Inaccordance with 45 C.F.R. (S)(S) 164.502(e)(1)(ii)) and 164.308(b)(2),respectively, as applicable, the BA shall ensure that any entities that create,receive, maintain, or transmit PHI on behalf of the BA agree to the samerestrictions, conditions, and requirements that apply to the BA with respect tosuch PHI.

e. The BA shall make available PHI in adesignated record set, to the covered entity or, as directed by the coveredentity, to an Individual, as necessary to satisfy the covered entityobligations under 45 C.F.R. (S) 164.524.

f. TheBA shall make any amendment(s) to PHI in a as directed or agreed to by the covered entity pursuant to 45C.F.R. (S) designatedrecord set 164.526, or take other measures as necessary to satisfy coveredentity's obligations under 45 C.F.R. (S) 164.526.

g. TheBA shall maintain and make available the information required to provide anaccounting of disclosures to the covered entity or an individual as necessaryto satisfy the covered entity's obligations under 45 C.F.R. (S) 164.528.

h. Tothe extent the BA is to carry out one or more of the covered entity'sobligation(s) under the HIPAA privacy rule, the BA shall comply with therequirements of HIPAA privacy rule that apply to the covered entity in theperformance of such obligation(s).

i. TheBA shall make its internal practices, books, and records available to theSecretary and the covered entity for purposes of audit and in determiningcompliance with the HIPAA Rules.

4. PermittedUses and Disclosures by BA:

a. TheBA may only use or disclose PHI as necessary to perform the services set forthin the Understanding or as required by law. The BA is not permitted to de-identify PHI under DoD HIPAA issuances orthe corresponding 45 C.F.R. (S) 164.514(a) through (c), nor is it permitted touse or disclose de-identified PHI except as provided by the Understanding ordirected by the covered entity.

b. TheBA agrees to use, disclose, and request PHI only in accordance with the HIPAAprivacy rule "minimum necessary" standard and corresponding DHA policies andprocedures as stated in the DoD HIPAA issuances.

c. TheBA shall not use or disclose PHI in a manner that would violate the DoD HIPAAissuances or HIPAA privacy rules if done by the covered entity, except uses anddisclosures for the BA's own management and administration and legalresponsibilities or for data aggregation services as set forth in the followingthree paragraphs:

(1) Except as otherwise limited inthe understanding, the BA may use PHI for the proper management andadministration of the BA or to carry out the legal responsibilities of theBA. The foregoing authority to use PHIdoes not apply to disclosure of PHI, which is covered in the next paragraph.

(2) Except as otherwise limited inthe Understanding, the BA may disclose PHI for the proper management andadministration of the BA or to carry out the legal responsibilities of the BA,provided that disclosures are required by law, or the BA obtains reasonableassurances from the person to whom the PHI is disclosed that it will remainconfidential and used or further disclosed only as required by law or for thepurposes for which it was disclosed to the person, and the person notifies theBA of any instances of which it is aware in which the confidentiality of theinformation has been breached.

(3) Except as otherwise limited inthe Understanding, the BA may use PHI to provide Data Aggregation servicesrelating to the covered entity's health care operations.

5. Provisionsfor Covered Entity to Inform BA of Privacy Practices and Restrictions:

a. Thecovered entity shall provide the BA with the notice of privacy practices thatthe covered entity produces in accordance with 45 C.F.R.(S)

164.520 and thecorresponding provision of the DoD HIPAA issuances (DoDM 6025.18).

b. Thecovered entity shall notify the BA of any changes in, or revocation of, thepermission by an Individual to use or disclose his or her PHI, to the extentthat such changes affect the BA's use or disclosure of PHI.

c. Thecovered entity shall notify the BA of any restriction on the use or disclosureof PHI that the covered entity has agreed to or is required to abide by under45 C.F.R. (S) 164.522, to the extent that such changes may affect the BA's use ordisclosure of PHI.

6. . Thecovered entity shall not request the BA to use or disclose PHI in any mannerthat would not be PermissibleRequests by Covered Entity permissible under the HIPAA privacy rule or any applicableGovernment regulations (including without limitation, DoD HIPAA issuances) ifdone by the covered entity, except for providing Data Aggregation services tothe covered entity and for management and administrative activities of the BAas otherwise permitted by this BAA.

7. BreachResponse:

a. . Breach Response is designed to satisfy theDoD Privacy Act issuances and the HIPAA Breach Rule as implemented by the General DoDHIPAA issuances. In general, the BAshall report the breach to the covered entity, assess the breach incident,notify affected individuals, and take mitigating actions, as applicable. Because DoD defines "Breach" to includepossible (suspected) as well as actual (confirmed) breaches, the BA shallimplement these breach response requirements immediately upon the BA'sdiscovery of a possible breach. Thefollowing provisions set forth the BA's Privacy Act and HIPAA breach responserequirements for all breaches, including but not limited to HHS breaches(defined below). In the event of abreach of PII or PHI held by the BA, the BA shall follow the breach responserequirements set forth under paragraphs 7, 8, and 9 of this BAA, which aredesigned to satisfy both the Privacy Act and HIPAA, as applicable.

(1) If a breach involves PIIwithout PHI, then the BA shall comply with DoD Privacy Act issuance breachresponse requirements only.

(2) If a breach involves PHI (asubset of PII), then the BA shall comply with both Privacy Act and HIPAA breachresponse requirements.

(3) If a breach involves PHI, itmay or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the BA has no HIPAA breachresponse obligations. In such cases, theBA must still comply with breach response requirements under the DoD PrivacyAct issuances.

b. . If the DHA Privacy Officedetermines that a breach is an HHS Breach, then the BA shall comply with boththe HIPAA Breach HHSBreach Rule and DoD Privacy Act issuances, as directed by the DHAPrivacy Office, regardless of where the breach occurs.

c. . If the DHA Privacy Officedetermines that the breach does not constitute an HHS Breach, then the BA shallcomply with Non-HHSBreach DoD Privacy Act issuances, as directed by the applicableService-Level Privacy Office.

d. . Brian Martin, whomay be reached at Comm: 904-542-3559,DSN: 312-942-Service-Level Privacy Office Pointof Contact (POC) 3559, or via E-mail: brian.k.martin4.civ@mail.mil, orusn.ncr.bumedfchava.list.bumed-pii-rpt@mail.mil.

BRIANK. MARTIN

CODEM31 PRIVACY OFFICE

BUMEDDETACHMENT JACKSONVILLE

H2005KNIGHT LANE

POBOX 140

NAVALAIR STATION JACKSONVILLE FL 32212

8. BreachReporting Provisions:

a. TheBA shall report the breach within 1 business day of discovery to the USComputer Emergency Readiness Team (US-CERT) and within 24 hours of discovery tothe

DHA Privacy Office and the otherParties set forth below. The BA isdeemed to have discovered a breach as of the time a breach (suspected orconfirmed) is known, or by exercising reasonable diligence would have beenknown, to any person (other than the person committing it) who is an employee,officer, or other agent of the BA.

b. TheBA shall submit the US-CERT report using the online form athttps://forms.us-cert.gov/report. Beforesubmission to US-CERT, the BA shall save a copy of the on-line report. After submission, the BA shall record theUS-CERT Reporting Number. Although onlylimited information about the breach may be available as of the 1 hour deadlinefor submission, the BA shall submit the US-CERT report by the deadline. The BA shall e-mail updated information as itis obtained, following the instructions at: http://www.us-cert.gov/pgp/email.html. The BA shall provide a copy of the initial or updated US-CERT report tothe DHA Privacy Office and the applicable Service-Level Privacy Office, ifrequested by either.

BA questions about US-CERTreporting shall be directed to the DHA or Service-Level Privacy Office, not theUS-CERT office.

c. TheBA report due within 24 hours shall be submitted by completing the New BreachReporting Form DD 2959 at the Breach Response page on the DHA Privacy Officeweb site and emailing that form to, as applicable, the DHA Privacy Office, theService-Level Privacy Office, the Contracting Officer (CO) and ContractingOfficer's Representative (COR) (if the Understanding is not a contract, deletethese references to the CO and COR), and the BA's DoD POC unless the POCspecifies another addressee for breach reporting. Encryption is not required, because BreachReport Forms should not contain PII or PHI. The email address for notices tothe DHA Privacy Office is provided at the Privacy Office web site breachresponse page. If electronic mail is notavailable, telephone notification is also acceptable, but all notifications andreports delivered telephonically must be confirmed by email as soon astechnically feasible.

d. If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances. The BA shall inform the DHA Privacy Office as soon as possible if it believes that "single event" breach response is appropriate; the DHA Privacy Office will determine how the BA shall proceed and, if appropriate, consolidate separately reported breaches for purposes of BA report updates ,beneficiary notification, and mitigation.

e. When a Breach Report Form initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the BA shall submit a revised form or forms, stating the updated status and previous report date(s) and showing any revisions or additions in red text. Examples of updated information the BA shall report include, but are not limited to:

(1) Confirmation on the exact dataelements involved.

(2)Root cause of the incident.

(3)Any mitigation actions to include, sanctions, training, incident containment,follow-up, etc. The BA shall submitthese report updates promptly after the new information becomes available. Prompt reporting of updates is required toallow the DHA Privacy Office to make timely final determinations on anysubsequent notifications or reports. TheBA shall provide updates to the same Parties as required for the initial BreachReporting Form. The BA is responsiblefor reporting all information needed by the DHA Privacy Office to make timelyand accurate determinations on reports to HHS as required by the HHS BreachRule and reports to the Defense Privacy and Civil Liberties Office as requiredby DoD Privacy Act issuances.

f. Inthe event the BA is uncertain on how to apply the above requirements, the BAshall consult with the DHA privacy office or service-level privacy office whendeterminations on applying the above requirements are needed.

9. Breach- Individual Notification Provisions:

a. . If theDHA Privacy Office determines that individual notification is required, the BAshall provide Determineif Notification is Required written notification to individuals affected by the breach assoon as possible, but no later than 60 working days after the breach isdiscovered and the identities of the individuals ascertained. The 60-day period begins when the BA is ableto determine the identities (including addresses) of the individuals whoserecords were impacted.

b. . The BA'sproposed notification to be issued to the affected individuals shall besubmitted to the Parties to which DraftProposed Notification reports are submitted under paragraph 7(breach response) for their review and for approval by the DHA PrivacyOffice. Upon request, the BA shallprovide the DHA Privacy Office with the final text of the notification lettersent to the affected individuals. Ifdifferent groups of affected individuals receive different notificationletters, then the BA shall provide the text of the letter for each group. PII shall not be included with the text ofthe letter(s) provided. Copies offurther correspondence with affected individuals need not be provided unlessrequested by the Privacy Office.

TheBA's notification to the individuals, at a minimum, shall include thefollowing:

(1) . Theindividual(s) must be advised of what specific data was involved. It is insufficient to simply state that PIIhas been Identify PII Lost lost. Where names, SocialSecurity Numbers (SSNs) or truncated SSNs, and Dates of Birth are involved, itis critical to advise the individual that these data elements potentially havebeen breached.

(2) . The affectedindividual(s) must be informed of the facts and circumstances surrounding thebreach. The description should be Inform sufficiently detailed so that the individualclearly understands how the breach occurred.

(3) . The affectedindividual(s) must be informed of what protective actions the BA is taking orthe individual can take to Protective Actions mitigate against potential future harm. The notice must refer the individual to thecurrent Federal Trade Commission (FTC) web site pages on identity theft and theFTC's Identity Theft Hotline: TollFree: 1-877-ID-THEFT (438-4338), TTY:1-866-653-4261.

(4) . Theindividual(s) must also be informed of any mitigating support services (e.g., 1year of free credit monitoring, Credit Monitoring identification of fraud expense coverage foraffected individuals, provision of credit freezes, etc.) that the BA may offeraffected individuals, the process to follow to obtain those services, theperiod of time the services will be made available, and contact information(including a phone…