Solicitation MVMS v5.pdf

SECTION B - Supplies or Services and Prices/Costs

B.1 Brief Description Of Supplies

The purpose of this contract is to acquire medications, vaccines and medical supplies (MVMS) for Federal Occupational Health (FOH) locations through a nationwide, contractor managed web-based ordering portal to support the Program Support Center under the Department of Health and Human Services. This contract aims to consolidate operations, offering a more convenient, reliable and cost-effective approach to MVMS procurement. Additionally, the contract will enhance FOH’s ability to maintain comprehensive oversight of MVMS procurement activities.

B.2 Type Of Contract

The contract type awarded is a Firm- Fixed Price contract

B.3 Severable Services

The services acquired under this contract are severable services. Funds are only available for use for the contract line item (CLIN) to which they are obligated. Unused funds from one CLIN may not rollover for use in other CLINs.

B.4 Consideration and Payment

Contract Period Fixed Price CLIN 1 Base Period CLIN 2 Option Period 1 CLIN 3 Option Period 2 CLIN 4 Option Period 3 CLIN 5 Option Period 4 TOTAL Potential Value Inclusive of all

CLINS

SECTION C - Description/Specifications/Performance Work Statement

TITLE: Federal Occupational Health - Medications, Vaccines, and Medical Supplies

(MVMS)

C. Program Description and Background

C.1 Purpose

The purpose of this contract is to acquire medications, vaccines and medical supplies (MVMS) for Federal Occupational Health (FOH) locations through a nationwide, contractor managed web-based ordering portal to support the Program Support Center under the Department of Health and Human Services. This contract aims to consolidate operations, offering a more convenient, reliable and cost-effective approach to MVMS procurement. Additionally, the contract will enhance FOH’s ability to maintain comprehensive oversight of MVMS procurement activities.

C.2 Background

Federal Occupational Health (FOH) improves the health, safety, and productivity of the federal workforce. As the largest provider of occupational health services in the federal government, FOH supports more than 300 federal entities and over one million federal employees nationwide, including the District of Columbia and U.S. Territories. FOH delivers comprehensive occupational health services and consultation through Interagency Agreements (IAAs) with federal departments and agencies at the national, regional, and local levels. Services range from core occupational health and safety programs to structured clinical, wellness, behavioral health, and environmental health solutions. FOH retains sole responsibility for consulting with customer agencies, while the contractor facilitates delivery of services outlined in the Performance Works Statement (PWS).

FOH sets the standard for promoting a culture of health and safety across the federal workforce. Program effectiveness depends on the expertise and performance of contractor-managed operations, including procurement of Medications, Vaccines and Medical Supplies (MVMS). Historically, FOH has sourced MVMS from multiple vendors, including the Program Support Center’s fulfillment center. This contract will consolidate MVMS procurement into a more efficient, reliable, and cost-effective model; reduce reliance on government purchase cards and unstable supply chains; and strengthen FOH oversight of procurement activities.

Scope

The contractor shall provide all necessary personnel, materials, services, facilities (except as otherwise specified), for performing all tasks required or incidental to the completion of work outlined in each task below. Additionally, the contractor shall be available for regularly scheduled status meetings, at a frequency to be agreed upon between the contractor and the COR, at a minimum. Additional meetings may be required as needed.

The Contractor shall provide Just-in-Time (JIT) delivery with no minimum order requirements and shall provide medications in unit-dose/RTA packaging as specified in the “Product List.” Further, the contractor shall provide all MVMS listed in Attachment-J.1, “Product List” in compliance with the Buy American Act (BAA) and/or the Trade Agreement Act (TAA) as applicable. In the event that the FOH product list needs to be modified due to changes in program requirements or to be in compliance with BAA and/or TAA requirements, the contractor shall propose substitutions per section C.11 and C.12 below.

Additionally, the contractor should maintain and provide administrative and user access to a secure, web-based ordering portal. This portal should support order placement by one (1) designated user per location for up to two hundred fifty (250) FOH locations, including but not limited to FOH Occupational Health Clinics, offices, and support facilities. The contractor shall administer a program capable of supporting any FOH location throughout the United States, the District of Columbia, and U.S. Territories. All products provided shall comply with all federal, state and municipal laws and regulations governing shipping, handling, tracking, and cold chain requirements. Shipping services shall be available at both Continental United States (CONUS) and Outside the Continental United States (OCONUS) locations, with options for varying shipping speeds (e.g., ground, overnight) based on government requirements. When shipping to FOH Occupational Health Clinics, the contractor shall coordinate delivery with each location to account for operating hours, cold chain requirements, security inspection delays, loading dock availability, and staff availability for signature. Each shipment must include a detailed packing list specifying the recipient location or employee, product descriptions, all items shipped, and the quantities for each location.

The contractor shall designate a qualified Program Manager, upon contract award, to oversee all contractor operations and provide comprehensive support to the government.

If there is a need to change the Program Manager, the contractor should notify the COR and CO and obtain approval prior to making the change. The program manager shall collaborate with the Contracting Officer Representative (COR) and FOH administrators to manage FOH accounts, approval workflows, formulary updates and requests for supplies and medications. Responsibilities include notifying FOH of backorders, medication recalls, inventory issues, and discontinued products, as well as proposing suitable alternatives for any unavailable items. The program manager shall facilitate returns, track orders and provide status updates for ordered and back-ordered items upon request by the COR. The Program Manager shall ensure compliance with cold chain requirements and maintain the integrity of all medications, vaccines and medical supplies and provide resolution for any supply chain and/or quality issues. While the program manager may identify a designee to assist in these duties, each designee must receive prior approval from the COR.

C.3 Place of Performance

Contracted services shall be provided at FOH locations throughout the CONUS and OCONUS locations, including, The District of Columbia, and U.S. Territories.

C.4 Overview of Services

The contractor shall provide a web-based ordering portal that is structured to have a master account accessible to the COR and up to 25 regional/nationwide administrative accounts/licenses available to COR-approved FOH staff that will function as administrative leads providing oversight on ordering. The master account shall contain sub-accounts for each location (up to 250). All users shall access the FOH ordering portal via unique username and password, with official system correspondence and validation sent to provided individual government email addresses. The contractor shall establish new accounts within ten (10) business days of contract award and subsequent requests. The contractor shall communicate any system disruptions to all FOH users within three (3) hours of an event and ensure continuation of operations in no more than twenty-four (24) hours.

Each sub-account user shall be granted access to a designated product formulary, preventing off-formulary ordering, as outlined in Attachment-J.1, “Product List,” and shall follow a customizable approval chain involving multiple users, which may be modified throughout the duration of the contract. Each sub-account shall maintain a default shipping address to facilitate expedited ordering, and the contractor shall be responsible for verifying the location address prior to product shipment.

Actions taken by members of the approval chain (e.g., Approved, Approved with Changes) shall be documented within each order and reflected in auto-generated email correspondence. Each user in the approval chain shall have the ability to add, remove, or substitute items (with varying authority), as well as approve or cancel an entire order. The original requester and approvers will be notified via auto-generated email correspondence to their corresponding government email address regarding the completion, update, or cancellation of an order. The COR and designated administrative leads are authorized to place formulary orders for any FOH location without additional approval requirements.

The contractor shall maintain a customer service phone line accessible to FOH users Monday through Friday during normal business hours regardless of location (CONUS or OCONUS); in the Eastern, Central, Mountain, and Pacific Time Zones. Normal business hours are generally defined as 9:00 am to 5:00 pm. The COR will make the contractor aware of any possibilities where contact may be outside of these generally defined hours.

C.4.1 Clinical Packaging and Dosing Standards

To ensure patient safety and adherence to strict FOH clinical protocols, the Contractor must provide medications and vaccines in 'Ready-to-Administer' (RTA) formats.

The following are Mandatory Minimum Product Requirements:

• Unit-of-Use Packaging: Where commercially available from a manufacturer, products must be provided in unit-dose packaging (e.g., individual blister packs or single-unit vials).

• Prefilled Syringes: Vaccines may be supplied in prefilled syringes if/when requested to minimize preparation errors and clinical waste. When it is not possible to provide prefilled syringes, the Contractor may provide written evidence that a manufacturer only produces the item in multi-dose vials.

• Protocol Compliance: The Contractor shall not substitute a requested unit-dose item with a bulk-package equivalent without express written approval from the COR.

C.5 Pricing

For pre-award pricing purposes, the contractor shall provide pricing for each match based on brand or generic name, manufacturer, form (e.g., capsule, injectable), strength, unit, or supply category. Pricing shall be presented on a “per unit” basis to allow flexibility if the number of units per package, box, or similar container fluctuates during the period of performance. Attachment-J.1, “Product Lists” shall include the required brand or generic name, manufacturer, form, strength, unit and supply category details, along with the preferred quantity of units per package, box, or similar container.

The contractor shall maintain firmly fixed unit prices inclusive of shipping and contractor fees. The contractor shall provide a breakdown of all price components upon request. If the manufacturer’s Wholesale Acquisition Cost (WAC) changes by more than +/- five percent (+/- 5%), notification must be made by the contractor to the COR with a minimum of thirty (30) days’ notice via email at which time either party may request a price adjustment. Adjustments must be supported by manufacturer documentation and approved by the COR. The contractor must provide “Unit of Use” or “Unit Dose” packaging as defined in Attachment-J.1 to reduce clinic-level waste. For any non-formulary items not originally listed in Attachment-J.1, the price shall be calculated as WAC plus shipping and applicable contractor fee.

FOH reserves the right to request Audit Rights if contractor’s pricing is dependent upon market flexibility.

C.6 Order Status & History

The contractor shall ensure that each order processed through the web-based portal is assigned a unique order number. The portal must provide the COR and authorized administrative users with real-time access to the status and history of all active and completed orders, including site details, requestor and approver information with dates, shipping method and tracking, ordered items, back-order status with fulfillment dates, cancellations, fulfilled items, requested and delivery dates, Lot Number/s, Expiration Dates, and any additional data mutually agreed upon. The web-based ordering portal must prevent “off-formulary” ordering unless an administrative lead overrides it. The web-based portal must display the Lot Number and Expiration Date in the order history immediately upon shipment. The COR and FOH administrative users shall have the ability to export this information in Microsoft Excel and PDF formats for internal review and reporting.

Examples of reports that shall be available on a monthly basis include, but are not limited to:

• Summary of all orders processed and delivered

• Stock levels, expirations, back orders

• Product issues, delays, shipment tracking

C.7 Vaccine Storage, Handling, Delivery and Receipt

The contractor shall adhere to current Centers for Disease Control and Prevention (CDC) standard operating procedures for vaccine storage, shipping and handling and remain compliant with all established best practices. This includes maintaining a temperature-controlled supply chain (“Cold Chain”) for all vaccine-related equipment and processes.

The cold chain shall begin at the manufacturing plant’s cold storage unit, extending through transportation and delivery, concluding with receipt at the final destination. The contractor is responsible for maintaining the cold chain until delivery hand-off to the FOH-designated site. Any break in the cold chain identified by FOH representatives upon delivery shall result in order rejection and refund of the cost of the medications, vaccines and medical supplies; the contractor shall replace the product/s within twenty-four (24) hours at their own cost. Each shipment must include a detailed packing list specifying the recipient location or employee, product descriptions, all items shipped, and the quantities for each location.

Medications, vaccines and medical supplies must be delivered without damage, spoilage, recalls, and contamination. If medications, vaccines and medical supplies are received damaged, spoiled, recalled or contaminated, a disincentive will be assessed in the amount of the full order plus 5%.

Any deliveries not received by the anticipated date and/or time that result in a service being cancelled or rescheduled will be assessed as a disincentive in the cost of the cancelled/rescheduled service plus 5%.

C.7.1 Mandated Logistical Model:

The Contractor shall utilize a Just-in-Time (JIT) distribution model. Due to extreme space limitations at Federal Occupational Health (FOH) clinical sites, the Government does not maintain warehouse or bulk storage capabilities. Consequently, the Contractor must support a 'Stockless' ordering environment, delivering supplies in small-parcel formats directly to the point of use.

The following are Mandatory Minimum Logistical Requirements:

• No Minimum Orders: The Contractor shall process and deliver orders regardless of size. There shall be zero (0) Minimum Order Quantities (MOQs) and no minimum dollar value requirements per shipment.

• Direct-to-Clinic Delivery: Deliveries must be made directly to the clinic specified on the order, bypassing centralized loading docks where applicable.

C.8 Product Recalls, Withdrawals, and Shortages

Recalls refer to the removal or correction of a marketed product that the U.S. Food and Drug Administration (FDA) determine to be in violation of applicable laws and subject to potential legal action, such as seizure. Recalls may occur voluntarily at a firm's initiative, at the request of the FDA, or under an FDA order under statutory authority.

Market Withdrawals refer to the removal or correction of a distributed product that involves either a minor violation not subject to FDA legal action or no violation.

Manufacturers of certain drug products must notify the FDA at least six (6) months prior to permanently discounting production or interrupting manufacturing in a manner likely to cause a significant disruption in the drug’s supply within the United States. If six (6) months’ notice is not feasible, manufacturers are required to provide notification as soon as practicable. As such, the contractor shall notify the COR via email to include the manufacturer’s written information about any product recalls, withdrawals, or shortages within two (2) business days of receiving notice from the manufacturer. Depending on the circumstances, the contractor and government may need to immediately identify the affected products, initiate disposal and refund process, and/or modify the current contract to reflect changes and viable alternatives.

Government-Furnished Property is not applicable to this requirement.

C.9 Formulary Adherence

The contractor shall provide an exact match for all MVMS listed in Attachment-J.1, “Product Lists.” Any change to the manufacturer, medication, form, strength, or unit shall require prior approval from the COR before any formulary substitution and may necessitate a contract modification. If an exact match cannot be provided, the contractor and COR will work together to find an acceptable alternative while ensuring alternatives comply with all federal, state and municipal laws and regulations. Once an acceptable alternative has been identified, approval is required from the COR before contractor can proceed with providing the selected alternative, no unilateral adjustments can occur. FOH reserves the right to request high-resolution photos or “at-cost” product/s if needed to make the determination of an acceptable alternative. If the contractor cannot provide an acceptable alternative and FOH must procure from an alternate source, the contractor will be assessed a disincentive in the amount of the difference in price from the alternate source plus 20% as well as the cost of any associated shipping.

*Note: The contractor is not responsible for unforeseeable events such as natural disasters, war or pandemics that make provisions difficult or impossible.

FOH expects that all medications, vaccines, and supplies be shipped and delivered in undamaged condition and with expiration dates no less than six (6) months from receipt, COR approval is required if an item has an expiration date of less than six (6) months. All MVMS must have a 98% Line-Item Fill Rate per month; if an item is on the formulary, it is required to be in stock for order placement. If a 98% Line-Item fill rate is exceeded each month on a quarterly basis, an incentive of 1% of expenses per quarter may be awarded.

The contractor shall determine appropriate shipping methods based on the types of products being shipped, ensuring compliance with the specified requirements of the contract. For example, hazardous materials, including hand sanitizers, must be shipped via ground transportation.

C.10 Influenza Vaccine

Each year, FOH front-loads Occupational Health Clinics with influenza vaccine as soon as it becomes available on the market. Pre-orders are placed for a specified quantity of multidose vials and prefilled syringe doses. After the initial pre-order, additional influenza vaccine orders are fulfilled throughout the influenza season on an as needed basis. The contractor shall notify the COR within two (2) business days of learning of any delays in the availability or delivery of influenza vaccine. Once the order has been confirmed with the contractor, failure to deliver the influenza vaccine by the requested date, resulting in cancellation or rescheduling of services, a disincentive in the amount of the cost of the cancelled or /rescheduled service plus 5% will be assessed. Any substitutions will require FOH/COR approval prior to pre-orders being placed or within 5 business days of it becoming known to the contractor that the required vaccine will not be available.

To assist the contractor with annual ordering expectations, FOH shall provide historical estimates of annual ship quantities upon award.

C.11 Formulary Modifications and Quality Control

The government shall retain the capability to order small quantities of MVMS products at cost so they can be evaluated to verify that the quality meets or exceeds government standards in the event that a formulary item needs to be replaced or added. Such “test” items shall be received within ten (10) business days from request. The government must approve any product proposed as substitute for a pre-approved “exact or equivalent” item listed in Attachment-J.1 ‘Product Lists.’ In the case of substitution, the contractor shall only propose products that meet or exceed the specifications of the original product. Any product substitutions proposed as a service (e.g., refillable oxygen) shall be pre-approved and be cost comparable.

All other performance under this contract will be monitored in accordance with the QASP.

The Government reserves the right to inspect and reject any products that do not meet quality or regulatory requirements. Items received damaged, spoiled, recalled or contaminated shall be replaced (shipped) at no additional cost to the Government within two (2) business days.

C.12 Contracting Officer’s Representative (COR) Authority

Performance of work under this contract must be subject to the technical direction of the Contracting Officer’s Representative identified above, or a representative designated in writing. The term "technical direction" includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily. Technical direction must be within the scope of the specification(s)/work statement. Technical direction may be oral or in writing. The Contracting Officer’s Representative shall confirm oral directions in writing within five (5) business days, with a copy to the Contracting Officer. The Contractor shall proceed promptly with performance resulting from the technical direction issued by the Contracting Officer’s Representative.

If, in the opinion of the contractor, any direction of the Contracting Officer’s Representative, or their designee, falls outside the scope of the contract, the contractor shall immediately notify the Contracting Officer no later than the beginning of the next business day.

The Contracting Officer's Representative, or their designee, does not have authority to issue technical direction that:

1. Constitutes a change of assignment or additional work outside the specification(s)/performance work statement.

2. Constitutes a change as defined in the clause entitled "Changes”.

3. In any manner causes an increase or decrease in the contract price, or the time required for contract performance.

4. Changes any of the terms, conditions, or specification(s)/work statement of the contract.

5. Interferes with the contractor's right to perform under the terms and conditions of the contract; or

6. Directs, supervises or otherwise controls the actions of the contractor's employees.

C.13.1 Invoicing Instructions

The Contractor shall provide the COR with a monthly draft invoice for services provided the previous month no later than the fifteenth (15th) day of the month. The COR or their designee will review the invoice and provide any recommended changes/revisions within ten (10) business days. Contractor shall provide a final and accurate invoice to the COR once all changes/revisions have been completed. All draft invoices must be verified for accuracy prior to submission to the COR, if draft invoices are routinely submitted with inaccuracies, a disincentive may be assessed.

An invoice period shall be for one (1) complete month, unless otherwise specified.

Invoice period shall begin on the first (1st) of the month and shall end on the last day of the month. The only exception to this may be for start and completion of the contract or if the Contracting Officer or COR state otherwise.

All supporting documentation to support the invoice shall be delivered to the COR at the same time as the draft invoice is submitted. Additional reporting requirements not listed may be required to verify draft invoice accuracy; the COR and the contractor will work together to determine what those may be if needed.

NOTE – The Contractor shall use Cost Accounting Numbers (CANs) in its invoicing to FOH. CANs will be provided to the Contractor after contract award.

Unless otherwise specified in an individual order the Contractor will submit invoices for payment as follows.

Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP)

• All Invoice submissions for goods and or services delivered to facilitate payments must be made electronically through the U.S. Department of Treasury’s Invoice Processing Platform System (IPP).

• Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 included in commercial items contracts. The IPP website address is: https://www.ipp.gov.

• The Agency will enroll all new Contractors into IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within three (3) to five (5) business days of the contract award for new contracts or date of modification for existing contracts.

• Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov.

Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

• The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within twenty-four (24) hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within thirty (30) days.

• If your company is already registered to use IPP, you will not be required to re-register.

• If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

Additional Office of Mission Acquisition Services (OMAS) requirements:

i. The contractor shall submit invoices under this contract once per month. For indefinite delivery vehicles, separate invoices must be submitted for each order.

ii. invoices must break-out price/cost by contract line-item number (CLIN) as specified in the pricing section of the contract.

iii. Invoices that include time and materials must include supporting documentation to substantiate material costs incurred.

iv. Invoices that include cost reimbursement CLINs must be submitted in a format having expenditures for that month, as well as contract cumulative amounts.

Invoices submitted to IPP are limited to 10MB. Backup support should be sent to the contracting officer, contract specialist, and COR in the event it causes the file size to https://www.ipp.gov/ mailto:ipp.noreply@mail.eroc.twai.gov mailto:IPPCustomerSupport@fiscal.treasury.gov exceed the limit.

Offerors may request a waiver from using the Department of Treasury Invoice Processing Platform (IPP) for payment requests, which may be approved by the Contracting Officer for a specific situation, as follows:

- As specified in OMB Memorandum M-15-19, electronic invoicing is not appropriate for the Federal procurement: of relocation services, utilities, or for vendors using PII for identification

- Offeror is in the process of transitioning to electronic submission of payment requests but needs time to complete such transition. Offeror must indicate timeline for transition.

- Contractor demonstrates that electronic submission is unduly burdensome.

Contractor must provide full explanation to include substantiating documents when necessary.

IPP waiver requests and supporting documentation shall be included in the proposal.

The following deliverables shall be provided based on the delivery timeframes given in the table below:

Ref

Paragraph Deliverable Submission Due Date

C.3 Program Manager Provide COR with name and contact information of the Program Manager

Upon contract award

C.3 Regularly Scheduled Meetings

Meet with FOH/COR to provide status, troubleshoot issues, and answer questions

As agreed, upon with the COR

C.5 Web-Based Portal Provide COR with a list of active accounts Upon contract award

C.5 Web-Based Portal Establish new accounts

Within ten (10) business days of contract award and subsequent requests

C.5 Web-Based Portal Communication of system disruptions

Within three (3) hours of an event and ensure continuation of operations in no more than twenty-four (24) hours

Paragraph Deliverable Submission Due Date

C.5 Customer Service Phone Line

Provide customer service phone line for FOH users Upon contract award

C.5 Ensure only formulary products can be ordered

Ordering Portal will have the ability to restrict users to FOH-approved 'Formulary' items

Within 10 days of contract award

C.6 Pricing

Changes/Adjustment s

Wholesale Acquisition Cost (WAC) changes by more than

+/- 5%

Notification must be made to the COR with a minimum of thirty (30) days notice

C.7 Order History Status Reports

Provide reports on order status such as, but not limited to,

• Summary of all orders processed and delivered

• Stock levels, expirations, back orders

• Product issues, delays, shipment tracking

Monthly

C.9 Product Recalls, Withdrawals, and

Shortages

In the event of a recall, withdrawal or shortage

Notification must be sent to COR via email within two (2) business days of receiving notice from manufacturer

C.11 Influenza Vaccine Notification

Notification to COR regarding any delays or availability issues

Within two (2) business days of learning of any delays in the availability or delivery of influenza vaccine.

C.12 Quality Control

Provide small quantities of MVMS products at cost so they can be evaluated to verify that quality meets or exceeds government standards.

To be received within ten (10) business days from request

C.13.2 Quality Assurance Surveillance Plan (QASP)

Paragraph

Service Level Agreement

Requirement Measurement

C.5 Overview of Services Provide customer service line for FOH sites and administrators

Respond to inquiries from staff regarding issues within 24 hours; ≥ 95% compliance required

C.5.1 Unit-Dose Packaging 100% of items delivered must match the packaging format in the Formulary.

Rejection of shipment at Contractor’s expense; credit issued within 24 hours.

C.7 Orders The web-based ordering portal must prevent “off-formulary” ordering

Web-Based portal will not allow off-formulary ordering

C.8 Storage, Shipping & Handling

Adhere to current CDC SOPs for vaccine storage, shipping and handling, especially ensuring cold chain consistency through delivery

Identified by FOH representatives. If rejected, a refund of the cost of medications, vaccines and medical supplies will occur within twenty-four (24) hours at vendors own cost.

C.8 Storage, Shipping & Handling

Receipt of deliveries did not occur

Failure to deliver by anticipated due date and/or time that results in a service being cancelled or rescheduled, a disincentive will be assessed in the amount of the cost of the cancelled/rescheduled service plus 5%

C.8 Ensure quality of all medications, vaccines and medical supplies.

Medications, vaccines and medical supplies are delivered without

Monitor product quality issues through clinic reporting. If received damaged, spoiled, Ref Paragraph Deliverable Submission Due Date

C.13.1 Invoicing Provide COR with a monthly draft invoice and all supporting documentation

No later than the fifteenth (15th) day of the month and after any recommended changes/revisions occur

Paragraph

Service Level Agreement

Requirement Measurement damage, spoilage, recalls or contamination.

recalled or contaminated a disincentive will be assessed in the amount of the full order plus 5%. Notify the COR via email to include the manufacturer’s written information about any product recalls, withdrawals, or shortages within two (2) business days of receiving notice from the manufacturer.

C.8.1 No Minimum Orders 100% compliance; no rejected orders due to size/value.

$500 per rejected order + cost of procurement from alternate source.

C.10 Formulary Adherence Provide exact matches for all MVMS unless an acceptable alternative is identified

Contractor and COR to work together to find an acceptable alternative. Only provide acceptable alternative upon COR approval. If an acceptable alternative cannot be provided and FOH must procure from an alternate source, a disincentive will be assessed in the amount of the difference in price plus any associated expedited shipping costs.

C.10 MVMS Expiration Dates

Medications, Vaccines and Medical Supplies purchased

Medications, Vaccines and Medical Supplies must be delivered with expiration dates no less than six (6) months from receipt. COR approval is required if an item has an expiration date of less than six

(6) months.

C.10 Fill Rate All MVMS must have a 98% Line-item fill rate

Monthly reports generated via the Web-Based portal. 98% Line-Item fill rate exceeded each month on a quarterly basis, an incentive may be assessed.

C.10 Availability of Items All items must be in stock in accordance with established formulary list

If the contractor cannot provide an acceptable alternative and FOH must procure from an alternate source, the contractor

Paragraph

Service Level Agreement

Requirement Measurement will be assessed a disincentive in the amount of the difference in price from the alternate source plus 20% as well as any associated shipping costs.

C.11 Influenza Vaccine Notification

Notification to COR regarding any delays or availability issues within two (2) business days of learning of any delays in the availability or delivery of influenza vaccine

Failure to deliver by anticipated due date and/or time that results in a service being cancelled or rescheduled, a disincentive will be assessed in the amount of the cost of the cancelled/rescheduled service plus 5%

C.13.1 Invoicing Provide draft invoices with no discrepancies

If draft invoices are routinely submitted with inaccuracies, a disincentive will be assessed in the amount of $500.00 per business day until the invoice has been accepted as complete and accurate by the COR.

Customer Satisfaction Contractor complies with SOW specifications.

Contractor adheres to guidance provided by

COR.

COR feedback

Fewer than 2 written complaints from COR during the period of performance.

Overall Contract Management, Including Timeliness Contractor maintains high level of quality assurance. Contractor informs COR timely of issues or problems.

Contractor meets time frames agreed upon.

COR and Contracting Officer monitoring and review of activities and deliverables.

COR makes no more than 2 valid written complaints during the period of performance. No more than a two-week delay in agreed upon schedule.

Overall Contract Management, Including Timeliness Contractor maintains

COR and Contracting Officer monitoring and review of activities and

COR makes no more than 2 valid written complaints during the period of performance. No more than a two-week delay in agreed upon schedule.

Paragraph

Service Level Agreement

Requirement Measurement high level of quality assurance. Contractor informs COR timely of issues or problems.

Contractor meets time frames agreed upon.

deliverables.

Written Products Contractor provides high-quality written materials.

COR and other federal staff reviews of draft and final products.

Minimal rewriting or editing required; product utilized (e.g., disseminated) as planned.

C.13.3 Information Security and/or Physical Access Security Requirements

Important Note to Contractor: In the event of a discrepancy between the following language and included HHSAR clauses, the HHSAR clauses take precedence.

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/FOH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/FOH and information systems that store, process, and/or transmit HHS information in accordance with Federal Information Processing Standard Publication 199 (FIPS 199) and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, FOH SOP, or other representatives, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: X Low Moderate High Integrity: X Low Moderate High Availability: X Low Moderate High Overall Impact Level: X Low Moderate High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/FOH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/FOH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/FOH security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/FOH privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. Privacy Threshold Analysis (PTAs) analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, https://hhsgov.sharepoint.com/sites/HHSAP https://hhsgov.sharepoint.com/sites/HHSAP https://hhsgov.sharepoint.com/sites/HHSAP maintains, or disposes of PII. Privacy Impact Assessment (PIAs) are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract.

The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within FOH to insert contract-specific timeline after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed.

Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for

Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability.

The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificates from the NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and FOH policies. Unauthorized disclosure of information will be subject to the HHS/FOH sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (1Pv6) available at https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25.

The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents FOH specify which documents/forms will be provided to contractor to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information

PHI, proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and FOH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificates from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR FOH-provided delivery date.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability…