A.09.03_Solicitation_Final.pdf

SEE ADDENDUM

(No Collect Calls)

W81K00-15-T-0283 26-Aug-2015

b. TELEPHONE NUMBER

210-539-8656

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 25 Sep 2015

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W81K009. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

ARLISA T. HARLEY

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

0010651536

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

W40M USA MEDCOM HCAA

SOUTHERN REG CONTR OFC

3551 ROGER BROOK DR BLDG 3600

FORT SAM HOUSTON TX 78234-6200

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W81NWY 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

W2DN BROOKE ARMY MED CTR

W2DN BROOKE ARMY MED CTR

WAREHOUSE RECEIVING DOCK BLDG 3600

3551 ROGER BROOKE DRIVE

JBSA FT SAM HOUSTON TX 78234-4504

TEL: 210-221-7928 FAX:

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

NAICS:

325413

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF49

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W81K00-15-T-0283

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 120 Case

TRIMA ACCEL RBC/PLATELET/PLASMA SET

FFP

: Subject to the Availability of FY16 funds EA = CASE Trima Accel Red Blood

Cell / Platelet / Plasma Set (with ISBT labels) - 6 sets per case. Catalog # 80440.

Delivery: 10 cases on / before the 15th of each month Part Number: 80440

FOB: Destination

PURCHASE REQUEST NUMBER: 0010651536

NET AMT

0002 60 Case

ACD SOLUTION A

FFP

: Subject to the Availability of FY16 funds EA = CASE ACD-A (anticoagulant citrate dextrose) Solution A -- 12 bags per case - Item must be maintained at manufacturer's required temperature through entire shipping/delivery Process.

Catalog # 40800. Delivery Schedule: 5 cases on or before the 15th of each month

Part Number: 40800

PURCHASE REQUEST NUMBER: 0010651536

1001 120 Case

OPTION TRIMA ACCEL RBC/PLATELET/PLASMA SET

FFP

:Trima Accel Red Blood Cell / Platelet / Plasma Set (with ISBT labels) - 6 sets per case. Catalog # 80440. Delivery: 10 cases on / before the 15th of each month Part

Number: 80440

1002 60 Case

OPTION ACD SOLUTION A

FFP

: ACD-A (anticoagulant citrate dextrose) Solution A -- 12 bags per case - Item must be maintained at manufacturer's required temperature through entire shipping/delivery Process. Catalog # 40800. Delivery Schedule: 5 cases on or before the 15th of each month Part Number: 40800

2001 120 Case

OPTION TRIMA ACCEL RBC/PLATELET/PLASMA SET

FFP

:Trima Accel Red Blood Cell / Platelet / Plasma Set (with ISBT labels) - 6 sets per case. Catalog # 80440. Delivery: 10 cases on / before the 15th of each month Part

Number: 80440

2002 60 Case

OPTION ACD SOLUTION A

FFP

:ACD-A (anticoagulant citrate dextrose) Solution A -- 12 bags per case - Item must be maintained at manufacturer's required temperature through entire shipping/delivery Process. Catalog # 40800. Delivery Schedule: 5 cases on or before the 15th of each month Part Number: 40800

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government

0002 Destination Government Destination Government

1001 Destination Government Destination Government

1002 Destination Government Destination Government

2001 Destination Government Destination Government

2002 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC

0001 POP 01-OCT-2015 TO

30-SEP-2016

N/A W2DN BROOKE ARMY MED CTR

W2DN BROOKE ARMY MED CTR

WAREHOUSE RECEIVING DOCK BLDG

3551 ROGER BROOKE DRIVE

JBSA FT SAM HOUSTON TX 78234-4504

210-221-7928

W81NWY

0002 POP 01-OCT-2015 TO

30-SEP-2016

N/A (SAME AS PREVIOUS LOCATION)

1001 POP 01-OCT-2016 TO

30-SEP-2017

N/A (SAME AS PREVIOUS LOCATION)

1002 POP 01-OCT-2016 TO

30-SEP-2017

N/A (SAME AS PREVIOUS LOCATION)

2001 POP 01-OCT-2017 TO

30-SEP-2018

N/A (SAME AS PREVIOUS LOCATION)

2002 POP 01-OCT-2017 TO

30-SEP-2018

N/A (SAME AS PREVIOUS LOCATION)

SALIENT CHARACTERISTICS

Trima Accel Enhanced Platelet, Plasma, Red Blood Cell (RBC) Set (with ISBT labels) – TerumoBCT Product #80440

1. Must be able to be used on red blood cells, platelets and plasma.

2. Must have ISBT (International Society of Blood Transfusion) standard blood labeling.

3. The set shall include a pre-attached sampling system with the needle and bottle adapter for transfer of sample to the culture media.

4. Reservoir must be at least 10mL with 0.5mL increments for accurate delivery of sample.

5. Must have a mechanism that enables a fail-safe inoculation, such as a self-aligning bottle adapter.

6. Must have at least one protection layer for user safety.

ACD-A (Anticoagulant Citrate Dextrose) Solution A– TerumoBCT Product #40800

1. Anticoagulant citrate dextrose sodium solution for use in the collection of red blood cells, platelets, plasma, and mononuclear cells, as well as therapeutic apheresis procedures, on automated apheresis equipment.

2. Each 100mL contains Dextrose Monohydrate USP: 2.45g, Sodium Citrate Dihydrate USP: 2.2G, Citric

Acid Anhydrous (USP) .73g, in Water for Injection USP.

3. Sterile, non – pyrogenic for use only with automated apheresis devices. Solution must come in single – use bags, 750mL total volume.

4. Solution / bags must be compatible with the Trima (registered) automated blood collection system and

COBE (registered) Spectra (trademark) apheresis system.

CLAUSES INCORPORATED BY REFERENCE

52.212-4 Contract Terms and Conditions--Commercial Items MAY 2015

CLAUSES INCORPORATED BY FULL TEXT

ADDENDUM TO 52.212-4

(w) The non-FAR Part 12 discretionary FAR, DFARS, AFARS, and LOCAL clauses included herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 herein for locations where full text can be found.

(End of Provision)

52.203-3 Gratuities APR 1984

52.203-6 Alt I Restrictions On Subcontractor Sales To The Government

(Sep 2006) -- Alternate I

OCT 1995

52.203-12 Limitation On Payments To Influence Certain Federal

Transactions

OCT 2010

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber

Content Paper

MAY 2011

52.204-10 Reporting Executive Compensation and First-Tier

Subcontract Awards

JUL 2013

52.209-6 Protecting the Government's Interest When Subcontracting

With Contractors Debarred, Suspended, or Proposed for

Debarment

AUG 2013

52.219-8 Utilization of Small Business Concerns OCT 2014

52.219-16 Liquidated Damages-Subcontracting Plan JAN 1999

52.222-3 Convict Labor JUN 2003

52.222-19 Child Labor -- Cooperation with Authorities and Remedies JAN 2014

52.222-21 Prohibition Of Segregated Facilities APR 2015

52.222-26 Equal Opportunity APR 2015

52.222-35 Equal Opportunity for Veterans JUL 2014

52.222-36 Equal Opportunity for Workers with Disabilities JUL 2014

52.222-37 Employment Reports on Veterans JUL 2014

52.222-43 Fair Labor Standards Act And Service Contract Labor

Standards - Price Adjustment (Multiple Year And Option

Contracts)

MAY 2014

52.222-50 Combating Trafficking in Persons MAR 2015

52.222-54 Employment Eligibility Verification AUG 2013

52.223-3 Hazardous Material Identification And Material Safety Data JAN 1997

52.223-18 Encouraging Contractor Policies To Ban Text Messaging

While Driving

AUG 2011

52.225-13 Restrictions on Certain Foreign Purchases JUN 2008

52.228-5 Insurance - Work On A Government Installation JAN 1997

52.232-18 Availability Of Funds APR 1984

52.232-33 Payment by Electronic Funds Transfer--System for Award

Management

JUL 2013

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013

52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

DEC 2013

52.233-3 Protest After Award AUG 1996

52.233-4 Applicable Law for Breach of Contract Claim OCT 2004

52.242-13 Bankruptcy JUL 1995

52.242-15 Stop-Work Order AUG 1989

252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013

252.204-7003 Control Of Government Personnel Work Product APR 1992

252.209-7004 Subcontracting With Firms That Are Owned or Controlled By

The Government of a Country that is a State Sponsor of

Terrorism

DEC 2014

252.219-7004 Small Business Subcontracting Plan (Test Program) OCT 2014

252.225-7001 Buy American And Balance Of Payments Program-- Basic

(Nov 2014)

NOV 2014

252.225-7002 Qualifying Country Sources As Subcontractors DEC 2012

252.225-7012 Preference For Certain Domestic Commodities FEB 2013

252.225-7021 Trade Agreements--Basic (Nov 2014) NOV 2014

252.225-7036 Buy American--Free Trade Agreement--Balance of Payments

Program--Basic (Nov 2014)

NOV 2014

252.225-7048 Export-Controlled Items JUN 2013

252.226-7001 Utilization of Indian Organizations and Indian-Owned

Economic Enterprises, and Native Hawaiian Small Business

Concerns

SEP 2004

252.232-7010 Levies on Contract Payments DEC 2006

252.243-7001 Pricing Of Contract Modifications DEC 1991

252.243-7002 Requests for Equitable Adjustment DEC 2012

252.247-7023 Transportation of Supplies by Sea APR 2014

52.209-10 Prohibition on Contracting With Inverted Domestic Corporations. (DEC 2014)

(a) Definitions. As used in this clause--

Inverted domestic corporation means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of

6 U.S.C. 395(c).

Subsidiary means an entity in which more than 50 percent of the entity is owned--

(1) Directly by a parent corporation; or

(2) Through another subsidiary of a parent corporation.

(b) If the contractor reorganizes as an inverted domestic corporation or becomes a subsidiary of an inverted domestic corporation at any time during the period of performance of this contract, the Government may be prohibited from paying for Contractor activities performed after the date when it becomes an inverted domestic corporation or subsidiary. The Government may seek any available remedies in the event the Contractor fails to perform in accordance with the terms and conditions of the contract as a result of Government action under this clause.

(c) Exceptions to this prohibition are located at 9.108-2.

(End of clause)

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days before contract expires; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 36 months.

52.219-28 POST-AWARD SMALL BUSINESS PROGRAM REREPRESENTATION (JULY 2013)

Long-term contract means a contract of more than five years in duration, including options. However, the term does not include contracts that exceed five years in duration because the period of performance has been extended for a cumulative period not to exceed six months under the clause at 52.217-8, Option to Extend Services, or other appropriate authority.

Small business concern means a concern, including its affiliates, that is independently owned and operated, not dominant in the field of operation in which it is bidding on Government contracts, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (c) of this clause. Such a concern is ``not dominant in its field of operation'' when it does not exercise a controlling or major influence on a national basis in a kind of business activity in which a number of business concerns are primarily engaged. In determining whether dominance exists, consideration shall be given to all appropriate factors, including volume of business, number of employees, financial resources, competitive status or position, ownership or control of materials, processes, patents, license agreements, facilities, sales territory, and nature of business activity.

(b) If the Contractor represented that it was a small business concern prior to award of this contract, the Contractor shall rerepresent its size status according to paragraph (e) of this clause or, if applicable, paragraph (g) of this clause, upon the occurrence of any of the following:

(1) Within 30 days after execution of a novation agreement or within 30 days after modification of the contract to include this clause, if the novation agreement was executed prior to inclusion of this clause in the contract.

(2) Within 30 days after a merger or acquisition that does not require a novation or within 30 days after modification of the contract to include this clause, if the merger or acquisition occurred prior to inclusion of this clause in the contract.

(3) For long-term contracts--

(i) Within 60 to 120 days prior to the end of the fifth year of the contract; and

(ii) Within 60 to 120 days prior to the date specified in the contract for exercising any option thereafter.

(c) The Contractor shall rerepresent its size status in accordance with the size standard in effect at the time of this rerepresentation that corresponds to the North American Industry Classification System (NAICS) code assigned to this contract. The small business size standard corresponding to this NAICS code can be found at http://www.sba.gov/content/table-small-business-size-standards.

(d) The small business size standard for a Contractor providing a product which it does not manufacture itself, for a contract other than a construction or service contract, is 500 employees.

(e) Except as provided in paragraph (g) of this clause, the Contractor shall make the representation required by paragraph (b) of this clause by validating or updating all its representations in the Representations and Certifications section of the System for Award Management (SAM) and its other data in SAM, as necessary, to ensure that they reflect the Contractor's current status. The

Contractor shall notify the contracting office in writing within the timeframes specified in paragraph (b) of this clause that the data have been validated or updated, and provide the date of the validation or update.

(f) If the Contractor represented that it was other than a small business concern prior to award of this contract, the

Contractor may, but is not required to, take the actions required by paragraphs (e) or (g) of this clause.

(g) If the Contractor does not have representations and certifications in SAM, or does not have a representation in

SAM for the NAICS code applicable to this contract, the Contractor is required to complete the following rerepresentation and submit it to the contracting office, along with the contract number and the date on which the rerepresentation was completed:

The Contractor represents that it ( ) is, ( ) is not a small business concern under NAICS Code 325413- assigned to contract number .

(Contractor to sign and date and insert authorized signer's name and title).

52.222-40 NOTIFICATION OF EMPLOYEE RIGHTS UNDER THE NATIONAL LABOR RELATIONS ACT

(DEC 2010)

(a) During the term of this contract, the Contractor shall post an employee notice, of such size and in such form, and containing such content as prescribed by the Secretary of Labor, in conspicuous places in and about its plants and offices where employees covered by the National Labor Relations Act engage in activities relating to the performance of the contract, including all places where notices to employees are customarily posted both physically and electronically, in the languages employees speak, in accordance with

29 CFR 471.2(d) and (f).

(1) Physical posting of the employee notice shall be in conspicuous places in and about the Contractor's plants and offices so that the notice is prominent and readily seen by employees who are covered by the National Labor

Relations Act and engage in activities related to the performance of the contract.

(2) If the Contractor customarily posts notices to employees electronically, then the Contractor shall also post the required notice electronically by displaying prominently, on any Web site that is maintained by the Contractor and is customarily used for notices to employees about terms and conditions of employment, a link to the Department of

Labor's Web site that contains the full text of the poster. The link to the Department's Web site, as referenced in

(b)(3) of this section, must read, ``Important Notice about Employee Rights to Organize and Bargain Collectively with Their Employers.''

(b) This required employee notice, printed by the Department of Labor, may be--

(1) Obtained from the Division of Interpretations and Standards, Office of Labor-Management Standards, U.S.

Department of Labor, 200 Constitution Avenue, NW., Room N-5609, Washington, DC 20210, (202) 693-0123, or from any field office of the Office of Labor-Management Standards or Office of Federal Contract Compliance

Programs;

(2) Provided by the Federal contracting agency if requested;

(3) Downloaded from the Office of Labor-Management Standards Web site at http://www.dol.gov/olms/regs/compliance/EO13496.htm; or

(4) Reproduced and used as exact duplicate copies of the Department of Labor's official poster.

(c) The required text of the employee notice referred to in this clause is located at Appendix A, Subpart A, 29 CFR

Part 471.

(d) The Contractor shall comply with all provisions of the employee notice and related rules, regulations, and orders of the Secretary of Labor.

(e) In the event that the Contractor does not comply with the requirements set forth in paragraphs (a) through (d) of this clause, this contract may be terminated or suspended in whole or in part, and the Contractor may be suspended or debarred in accordance with 29 CFR 471.14 and subpart 9.4. Such other sanctions or remedies may be imposed as are provided by 29 CFR part 471, which implements Executive Order 13496 or as otherwise provided by law.

(f) Subcontracts. (1) The Contractor shall include the substance of this clause, including this paragraph (f), in every subcontract that exceeds $10,000 and will be performed wholly or partially in the United States, unless exempted by the rules, regulations, or orders of the Secretary of Labor issued pursuant to section 3 of Executive Order 13496 of

January 30, 2009, so that such provisions will be binding upon each subcontractor.

(2) The Contractor shall not procure supplies or services in a way designed to avoid the applicability of Executive

Order 13496 or this clause.

(3) The Contractor shall take such action with respect to any such subcontract as may be directed by the Secretary of

Labor as a means of enforcing such provisions, including the imposition of sanctions for noncompliance.

(4) However, if the Contractor becomes involved in litigation with a subcontractor, or is threatened with such involvement, as a result of such direction, the Contractor may request the United States, through the Secretary of

Labor, to enter into such litigation to protect the interests of the United States.

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

http://www.arnet.gov/far http://farsite.hill.af.mil http://www.dtic.mil/dfas

52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (APR 1984)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

252.204-7012 SAFEGUARDING OF UNCLASSIFIED CONTROLLED TECHNICAL INFORMATION (NOV

2013)

Adequate security means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

Attribution information means information that identifies the Contractor, whether directly or indirectly, by the grouping of information that can be traced back to the Contractor (e.g., program description or facility locations).

Compromise means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

Contractor information system means an information system belonging to, or operated by or for, the Contractor.

http://farsite.hill.af.mil/

Controlled technical information means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

Controlled technical information is to be marked with one of the distribution statements B-through-F, in accordance with DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

Cyber incident means actions taken through the use of computer networks that result in an actual or potentially adverse effect on an information system and/or the information residing therein.

Exfiltration means any unauthorized release of data from within an information system. This includes copying the data through covert network channels or the copying of data to unauthorized media.

Media means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which information is recorded, stored, or printed within an information system.

Technical information means technical data or computer software, as those terms are defined in the clause at

DFARS 252.227-7013, Rights in Technical Data--Non Commercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

(b) Safeguarding requirements and procedures for unclassified controlled technical information. The Contractor shall provide adequate security to safeguard unclassified controlled technical information from compromise. To provide adequate security, the Contractor shall—

(1) Implement information systems security in its project, enterprise, or company-wide unclassified information technology system(s) that may have unclassified controlled technical information resident on or transiting through them. The information systems security program shall implement, at a minimum—

(i) The specified National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 security controls identified in the following table; or

(ii) If a NIST control is not implemented, the Contractor shall submit to the Contracting Officer a written explanation of how—

(A) The required security control identified in the following table is not applicable; or

(B) An alternative control or protective measure is used to achieve equivalent protection.

(2) Apply other information systems security requirements when the Contractor reasonably determines that information systems security measures, in addition to those identified in paragraph (b)(1) of this clause, may be required to provide adequate security in a dynamic environment based on an assessed risk or vulnerability.

Table 1--Minimum Security Controls for Safeguarding

Minimum required security controls for unclassified controlled technical information requiring safeguarding in accordance with paragraph (d) of this clause. (A description of the security controls is in the NIST SP 800-53, ``Security and Privacy Controls for Federal Information Systems and Organizations''

(http://csrc.nist.gov/publications/PubsSPs.html).)

Access Control

AC-2

Audit &

Accountability

Identification and

Media Protection

MP-4

System & Comm

Protection http://csrc.nist.gov/publications/PubsSPs.html)

AC-3(4)

AC-4

AC-6

AC-7

AC-11(1)

AC-17(2)

AC-18(1)

AC-19

AC-20(1)

AC-20(2)

AC-22

AU-2

AU-3

AU-6(1)

AU-7

AU-8

AU-9

Authentication

IA-2

IA-4

IA-5(1)

MP-6

SC-2

SC-4

SC-7

SC-8(1)

SC-13

SC-15

SC-28

Physical and

Environmental

Protection

PE-2

PE-3

PE-5

Incident

Response

IR-2

IR-4

IR-5

IR-6

Configuration

Management

CM-2

CM-6

CM-7

CM-8

Program Management

PM-10

System &

Information

Integrity

SI-2

SI-3

SI-4

Maintenance

MA-4(6)

MA-5

MA-6

Risk Assessment

RA-5

Awareness &

Training

AT-2

Contingency

Planning

CP-9

Legend:

AC: Access Control

AT: Awareness and Training MP:

AU: Auditing and Accountability

CM: Configuration Management

CP: Contingency Planning

IA: Identification and Authentication

IR: Incident Response

MA: Maintenance

MP: Media Protection

PE: Physical & Environmental Protection

PM: Program Management

RA: Risk Assessment

SC: System & Communications Protection

SI: System & Information Integrity

(c) Other requirements. This clause does not relieve the Contractor of the requirements specified by applicable statutes or other Federal and DoD safeguarding requirements for Controlled Unclassified

Information as established by Executive Order 13556, as well as regulations and guidance established pursuant thereto.

(d) Cyber incident and compromise reporting.

(1) Reporting requirement. The Contractor shall report as much of the following information as can be obtained to the Department of Defense via (http://dibnet.dod.mil/) within 72 hours of discovery of any cyber incident, as described in paragraph (d)(2) of this clause, that affects unclassified controlled technical information resident on or transiting through the Contractor's unclassified information systems:

(i) Data Universal Numbering System (DUNS).

(ii) Contract numbers affected unless all contracts by the company are affected.

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location.

http://dibnet.dod.mil/

(iv) Point of contact if different than the POC recorded in the System for Award Management (address, position, telephone, email).

(v) Contracting Officer point of contact (address, position, telephone, email).

(vi) Contract clearance level.

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network.

(viii) DoD programs, platforms or systems involved.

(ix) Location(s) of compromise.

(x) Date incident discovered.

(xi) Type of compromise (e.g., unauthorized access, inadvertent release, other).

(xii) Description of technical information compromised.

(xiii) Any additional information relevant to the information compromise.

(2) Reportable cyber incidents. Reportable cyber incidents include the following:

(i) A cyber incident involving possible exfiltration, manipulation, or other loss or compromise of any unclassified controlled technical information resident on or transiting through Contractor's, or its subcontractors', unclassified information systems.

(ii) Any other activities not included in paragraph (d)(2)(i) of this clause that allow unauthorized access to the

Contractor's unclassified information system on which unclassified controlled technical information is resident on or transiting.

(3) Other reporting requirements. This reporting in no way abrogates the Contractor's responsibility for additional safeguarding and cyber incident reporting requirements pertaining to its unclassified information systems under other clauses that may apply to its contract, or as a result of other U.S. Government legislative and regulatory requirements that may apply (e.g., as cited in paragraph (c) of this clause).

(4) Contractor actions to support DoD damage assessment. In response to the reported cyber incident, the Contractor shall—

(i) Conduct further review of its unclassified network for evidence of compromise resulting from a cyber incident to include, but is not limited to, identifying compromised computers, servers, specific data and users accounts. This includes analyzing information systems that were part of the compromise, as well as other information systems on the network that were accessed as a result of the compromise;

(ii) Review the data accessed during the cyber incident to identify specific unclassified controlled technical information associated with DoD programs, systems or contracts, including military programs, systems and technology; and

(iii) Preserve and protect images of known affected information systems and all relevant monitoring/packet capture data for at least 90 days from the cyber incident to allow DoD to request information or decline interest.

(5) DoD damage assessment activities. If DoD elects to conduct a damage assessment, the Contracting Officer will request that the Contractor point of contact identified in the incident report at (d)(1) of this clause provide all of the damage assessment information gathered in accordance with paragraph (d)(4) of this clause. The Contractor shall comply with damage assessment information requests. The requirement to share files and images exists unless there are legal restrictions that limit a company's ability to share digital media. The Contractor shall inform the

Contracting Officer of the source, nature, and prescription of such limitations and the authority responsible.

(e) Protection of reported information. Except to the extent that such information is lawfully publicly available without restrictions, the Government will protect information reported or otherwise provided to DoD under this clause in accordance with applicable statutes, regulations, and policies. The Contractor shall identify and mark attribution information reported or otherwise provided to the DoD. The Government may use information, including attribution information and disclose it only to authorized persons for purposes and activities consistent with this clause.

(f) Nothing in this clause limits the Government's ability to conduct law enforcement or counterintelligence activities, or other lawful activities in the interest of homeland security and national security. The results of the activities described in this clause may be used to support an investigation and prosecution of any person or entity, including those attempting to infiltrate or compromise information on a contractor information system in violation of any statute.

(g) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (g), in all subcontracts, including subcontracts for commercial items.

252.244-7000 SUBCONTRACTS FOR COMMERCIAL ITEMS (JUN 2013)

(a) The Contractor is not required to flow down the terms of any Defense Federal Acquisition Regulation

Supplement (DFARS) clause in subcontracts for commercial items at any tier under this contract, unless so specified in the particular clause.

(b) While not required, the Contractor may flow down to subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligation.

(c) The Contractor shall include the terms of this clause, including this paragraph (c), in subcontracts awarded under this contract, including subcontracts for the acquisition of commercial items.

252.247-7024 Notification of Transportation of Supplies by Sea (MAR 2000)

(a) The Contractor has indicated by the response to the solicitation provision, Representation of Extent of

Transportation by Sea, that it did not anticipate transporting by sea any supplies. If, however, after the award of this contract, the Contractor learns that supplies, as defined in the Transportation of Supplies by Sea clause of this contract, will be transported by sea, the Contractor --

(1) Shall notify the Contracting Officer of that fact; and

(2) Hereby agrees to comply with all the terms and conditions of the Transportation of Supplies by Sea clause of this contract.

(b) The Contractor shall include this clause; including this paragraph (b), revised as necessary to reflect the relationship of the contracting parties--

(1) In all subcontracts under this contract, if this contract is a construction contract; or

(2) If this contract is not a construction contract, in all subcontracts under this contract that are for--

(i) Noncommercial items; or

(ii) Commercial items that--

(A) The Contractor is reselling or distributing to the Government without adding value (generally, the Contractor does not add value to items that it subcontracts for f.o.b. destination shipment);

(B) Are shipped in direct support of U.S. military contingency operations, exercises, or forces deployed in humanitarian or peacekeeping operations; or

(C) Are commissary or exchange cargoes transported outside of the Defense Transportation System in accordance with 10 U.S.C. 2643.

Invoicing, Receipt, Acceptance and Property Transfer (iRAPT) – formerly known as WAWF iRAPT is the authorized method to electronically process vendor request for payment. This application allows DOD vendors to submit and track Invoices and Receipt/Acceptance documents electronically. Contractor shall (i) register to use iRAPT at https://wawf.eb.mil and (ii) ensure an electronic business point of contract (POC) is designated in the System for Award Management at https://www.sam.gov within ten (10) calendar days after award of this contract/order.

iRAPT Instructions:

Questions concerning payments should be directed to the Defense Finance and Accounting Service (DFAS) location listed in Block 18a of your purchase order/contract. Please have your purchase order/contract number ready when calling about payments.

You can easily access payment and receipt information using the DFAS web site at http://www.dfas.mil/money/vendor . Your purchase order/contract number or invoice number will be required to inquire status of your payment.

The following codes and information will be required to assure successful flow of iRAPT documents.

Foreign Vendors will submit banking information in the Comments Tab of the iRAPT invoice.

TYPE OF DOCUMENT [X the appropriate block]

___ Invoice (Contractor Only)

_ x_ Invoice and Receiving Report (COMBO)

___ Invoice as 2-in-1 (Services Only)

___ Receiving Report (Government Only) https://wawf.eb.mil/ https://www.sam.gov/ http://www.dfas.mil/money/vendor https://wawf.eb.mil/SUM%20RoboHelp%20Web%20Help/Detailed_Document_Information/Scribble550.htm https://wawf.eb.mil/SUM%20RoboHelp%20Web%20Help/Detailed_Document_Information/Scribble560.htm https://wawf.eb.mil/SUM%20RoboHelp%20Web%20Help/Detailed_Document_Information/Scribble570.htm https://wawf.eb.mil/SUM%20RoboHelp%20Web%20Help/Detailed_Document_Information/Scribble620.htm

CAGE CODE: ______________

ISSUE BY DODAAC: W81K00

ADMIN BY DODAAC: W81K00

INSPECT BY DODAAC: W81NTE

ACCEPT BY DODAAC: W81NTE

SHIP TO DODAAC: W81NTE

PAYMENT OFFICE FISCAL STATION CODE: 021001

EMAIL POINTS OF CONTACT LISTING: (Use Group e-mail accounts if applicable)

INSPECTOR ____________________________________________

ACCEPTOR ____________________________________________

RECEIVING OFFICE POC: ___________________________________________

CONTRACT ADMINISTRATOR/ SPECIALIST: arlisa.t.harley.civ@mail.mil

DSN: 389-8656

Comm: 210-539-8656

CONTRACTING OFFICER: See Block 31b on SF1449 for email address.

ADDITIONAL CONTACT:

Any modification requests must be in writing and submitted to:ADMIN DODAAC.

HCAA Local Clause 5001 - Non-Defense Health Agency (Non-DHA) Health Insurance Portability and Accountability Act (HIPAA) Business Associate Agreement (BAA) (7 July 2014)

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health

Information Privacy Regulation,” January 24, 2003, this document serves as a BAA between the signatory parties for purposes of the HIPAA and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and

DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health

Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health

Information, and Use.

—Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other

PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act

Issuances as defined herein.

—Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA

Issuances, and in reference to this BAA, shall mean [insert name of Business Associate signatory to this BAA].

—Agreement means this BAA together with the documents and/or other arrangements under which the Business

Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this

BAA.

—Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [insert name of MHS component signatory to this BAA].

—DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the

HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate

(NCRMD).

—DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health

System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

—DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11

(2007) and DoD 5400.11-R (2007).

—HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

—HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the

U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E

(Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the

2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-

5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

—Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by the Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business

Associate shall also respond to any security incident of which it becomes aware in accordance with any Information

Assurance provisions of the Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively), as applicable, the Business

Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the

Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45

CFR 164.524.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45

CFR 164.528.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the

HIPAA Privacy Rule, the Business Associate shall comply with the requirements of HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in the

Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule

“minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA

Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in the Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in the Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business

Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business

Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in the Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall provide the Business Associate with the notice of privacy practices that the Covered

Entity produces in accordance with 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an

Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the

Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the

Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act

Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

If the DHA Privacy Office determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the DHA Privacy Office, regardless of whether the breach occurs at DHA or at one of the Service components.