W81K0226QA016 - Solit - FINAL - 02.09.26.pdf

WOMEN-OWNED SMALL

BUSINESS (WOSB)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

REQUEST

FOR QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8(A)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30.

calls)

Solicitation/Contract Form Continuation

Hospital Aseptic Management System (HAMS) Services for the 51st Medical Instrument Name:

Group at Osan Air Base, South Korea

W81K0226QA016

Continuation of Supplies or Services and Prices/Costs

Additional Information/Notes

Item Supplies/Service Quantity Unit Unit Price

Amount

0001 Product Service Description:

Hospital Aseptic Management System (HAMS) Services Base Period PoP: 01 April 2026 through 30 September 2026 The contractor shall provide non-personal HAMS services for the 51st Medical Group at Osan Air Base, South Korea in accordance with the Performance Work Statement (PWS).

Pricing Arrangement: Firm Fixed Price

6 Months

Option Line Item

Product Service Description:

Hospital Aseptic Management System (HAMS) Services Option I PoP: 01 October 2026 through 30 September 2027 The contractor shall provide non-personal HAMS services for the 51st Medical Group at Osan Air Base, South Korea in accordance with the Performance Work Statement (PWS).

Pricing Arrangement: Firm Fixed Price

12 Months

Option Line Item

Product Service Description:

Hospital Aseptic Management System (HAMS) Services Option II PoP: 01 October 2027 through 30 September 2028 The contractor shall provide non-personal HAMS services for the 51st Medical Group at Osan Air Base, South Korea in accordance with the Performance Work Statement (PWS).

12 Months

Pricing Arrangement: Firm Fixed Price

Option Line Item

Product Service Description:

Hospital Aseptic Management System (HAMS) Services Option III PoP: 01 October 2028 through 30 September 2029 The contractor shall provide non-personal HAMS services for the 51st Medical Group at Osan Air Base, South Korea in accordance with the Performance Work Statement (PWS).

Pricing Arrangement: Firm Fixed Price

12 Months

Option Line Item

Product Service Description:

Hospital Aseptic Management System (HAMS) Services Option IV PoP: 01 October 2029 through 30 September 2030 The contractor shall provide non-personal HAMS services for the 51st Medical Group at Osan Air Base, South Korea in accordance with the Performance Work Statement (PWS).

Pricing Arrangement: Firm Fixed Price

12 Months

Continuation of Description

Requirements Hospital Aseptic Management System (HAMS) Services for the 51st Medical Group at Osan Air Base, South Korea

Product Service Code : Q901 North American Industry Classification System (NAICS) : 561720

Option Line Item 1001 Product Service Code : Q901 North American Industry Classification System (NAICS) : 561720

Option Line Item 2001 Product Service Code : Q901 North American Industry Classification System (NAICS) : 561720

Option Line Item 3001 Product Service Code : Q901 North American Industry Classification System (NAICS) : 561720

Option Line Item 4001 Product Service Code : Q901 North American Industry Classification System (NAICS) : 561720

Continuation of Packaging and Marking

Continuation of Inspection and Acceptance

Overall Contract Inspection/Acceptance Locations

0001 Inspection and Acceptance Location

Both Destination Instructions: See Performance Word Statement (PWS) for Acceptance/Inspection criteria.

DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG

PYONG TAEK 17759

KOREA, REPUBLIC OF

Option Line Item

Inspection and Acceptance Location

Both Destination Instructions: See Performance Word Statement (PWS) for Acceptance/Inspection criteria.

DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG

PYONG TAEK 17759

KOREA, REPUBLIC OF

Option Line Item

Inspection and Acceptance Location

Both Destination Instructions: See Performance Word Statement (PWS) for Acceptance/Inspection criteria.

DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG

PYONG TAEK 17759

KOREA, REPUBLIC OF

Option Line Item

Inspection and Acceptance Location

Both Destination Instructions: See Performance Word Statement (PWS) for Acceptance/Inspection criteria.

DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG

PYONG TAEK 17759

KOREA, REPUBLIC OF

Option Line Item

Inspection and Acceptance Location

Both Destination Instructions: See Performance Word Statement (PWS) for Acceptance/Inspection criteria.

DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG

PYONG TAEK 17759

KOREA, REPUBLIC OF

Continuation of Deliveries or Performance

0001 6 MonthsQuantity

Address and POC Place of Performance DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG PYONG TAEK

17759 KOREA, REPUBLIC OF

Period of Performance From 01 Apr 2026 To 30 Sep 2026

Option Line Item

12 MonthsQuantity

Address and POC Place of Performance DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG PYONG TAEK

17759 KOREA, REPUBLIC OF

Period of Performance From 01 Oct 2026 To 30 Sep 2027

Option Line

12 MonthsQuantity

Item

Address and POC Place of Performance DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG PYONG TAEK

17759 KOREA, REPUBLIC OF

Period of Performance From 01 Oct 2027 To 30 Sep 2028

Option Line Item

12 MonthsQuantity

Address and POC Place of Performance DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG PYONG TAEK

17759 KOREA, REPUBLIC OF

Period of Performance From 01 Oct 2028 To 30 Sep 2029

Option Line Item

12 MonthsQuantity

Address and POC Place of Performance DoDAAC: HT1087 CountryCode: KOR

51ST MDSS SGSM - MM

CP 011 82 505 784 2536, OSAN AB BLDG 777 SINJANG DONG PYONG TAEK

17759 KOREA, REPUBLIC OF

Period of Performance From 01 Oct 2029 To 30 Sep 2030

Continuation of Accounting and Appropriation Data

Contract Clauses

FAR Clauses Incorporated by Reference

Number Title Effective Date

Alternate Deviation

Variation Effective Date

52.203-3 Gratuities. 1984-04

52.203-6 Restrictions on Subcontractor Sales to the Government.

2020-06

52.203-6 Restrictions on Subcontractor Sales to the Government. (Alternate I)

2020-06 Alternate I

2021-11

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements.

2017-01

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards.

2026-02

52.204-13 System for Award Management- Maintenance.

2026-02

52.209-6 Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded.

2026-02

52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters.

2026-02

52.212-4 Terms and Conditions-Commercial Products and Commercial Services.

2026-02

52.222-50 Combating Trafficking in Persons. 2026-02

52.224-3 Privacy Training. 2017-01

52.224-3 Privacy Training. (Alternate I) 2017-01 Alternate I

2017-01

52.226-8 Encouraging Contractor Policies to Ban Text Messaging While Driving.

2024-05

52.229-12 Tax on Certain Foreign Procurements. 2021-02

52.232-33 Payment by Electronic Funds Transfer- System for Award Management.

2018-10

52.232-40 Providing Accelerated Payments to Small Business Subcontractors.

2023-03

52.233-3 Protest after Award. 2026-02

52.233-4 Applicable Law for Breach of Contract Claim.

2026-02

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate Deviation

Variation Effective Date

252.203-7000 Requirements Relating to Compensation of Former DoD Officials.

2011-09

252.203-7002 Requirement to Inform Employees of Whistleblower Rights.

2022-12

252.204-7004 Antiterrorism Awareness Training for Contractors.

2023-01

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. (DEVIATION 2024-O0013

REVISION 1)

2024-05 Deviation 2024- O0013

2024-05

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

2023-01

252.205-7000 Provision of Information to Cooperative Agreement Holders.

2024-10

252.225-7012 Preference for Certain Domestic Commodities.

2022-04

252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime.

2023-01

252.225-7060 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region.

2023-06

252.226-7001 Utilization of Indian Organizations, Indian-Owned Economic Enterprises, and Native Hawaiian Small Business Concerns.

2023-01

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports.

2018-12

252.232-7010 Levies on Contract Payments. 2006-12

252.243-7002 Requests for Equitable Adjustment. 2022-12

252.247-7023 Transportation of Supplies by Sea. 2024-10

FAR Clauses Incorporated by Full Text

Date

Alternate Deviation

Variation Effective Date

52.222-50 Combating Trafficking in Persons. (Alternate I)

2026-02 Alternate I 2026-02

Alternate I (Feb 2026). As prescribed in 22.1703-2(a)(2), substitute the following paragraph in place of paragraph (c)(1)(i) of the basic clause:

(c)(1)(i)(A) The United States Government's policy prohibiting trafficking in persons described in paragraph (b) of this clause; and

(B) The following directive(s) or notice(s) applicable to employees performing work at the contract place(s) of performance as indicated below:

Document Title Document may be obtained from: Applies to performance in/at:

USFK Reg 190-2 Policy (21 Feb 2012) http://www.usfk.mil/Resources /Off-Limits/ Republic of Korea Off Limits Maps http://www.usfk.mil/Portals/105/Documents/OffLimits /Off-Limits%20List%20and%20Maps%201%20October%202015.pdf Republic of Korea [Contracting Officer must insert title of directive/notice; indicate the document is attached or provide source (such as website link) for obtaining document; and, indicate the contract performance location outside the United States to which the document applies.]

DFARS Clauses Incorporated by Full Text

Date

Alternate Deviation

Variation Effective Date

252.225-7043 Antiterrorism/Force Protection for Defense Contractors Outside the United States.

2015-06

ANTITERRORISM/FORCE PROTECTION POLICY FOR DEFENSE CONTRACTORS

OUTSIDE THE UNITED STATES (JUN 2015)

(a) Definition. " United States ," as used in this clause, means, the 50 States, the District of Columbia , and outlying areas.

(b) Except as provided in paragraph (c) of this clause, the Contractor and its subcontractors, if performing or traveling outside the United States under this contract, shall-

(1) Affiliate with the Overseas Security Advisory Council, if the Contractor or subcontractor is a U.S. entity;

(2) Ensure that Contractor and subcontractor personnel who are U.S. nationals and are in-country on a non-transitory basis, register with the U.S. Embassy, and that Contractor and subcontractor personnel who are third country nationals comply with any security related requirements of the Embassy of their nationality;

(3) Provide, to Contractor and subcontractor personnel, antiterrorism/force protection awareness information commensurate with that which the Department of Defense (DoD) provides to its military and civilian personnel and their families, to the extent such information can be made available prior to travel outside the United States; and

(4) Obtain and comply with the most current antiterrorism/force protection guidance for Contractor and subcontractor personnel.

(c) The requirements of this clause do not apply to any subcontractor that is-

(1) A foreign government;

(2) A representative of a foreign government; or

(3) A foreign corporation wholly owned by a foreign government.

(d) Information and guidance pertaining to DoD antiterrorism/force protection can be obtained from ____(Contracting Officer to insert applicable information cited in PGI 225.372- 1 (DFARS/PGI view)).

(End of clause)

252.232-7006 Wide Area WorkFlow Payment Instructions.

2023-01

WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) As used in this clause- Definitions.

"Department of Defense Activity Address Code (DoDAAC)" is a six position code that uniquely identifies a unit, activity, or organization.

"Document type" means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

"Local processing office (LPO)" is the office responsible for payment certification when payment certification is done external to the entitlement system.

"Payment request" and "receiving report" are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) The WAWF system provides the method to electronically Electronic invoicing.

process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) To access WAWF, the Contractor shall- WAWF access.

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) The Contractor should follow the training instructions of the WAWF WAWF training.

Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the "Web Based Training" link on the WAWF home page at https://wawf.eb.mil/

(e) Document submissions may be via web WAWF methods of document submission.

entry, Electronic Data Interchange, or File Transfer Protocol.

(f) The Contractor shall use the following information WAWF payment instructions.

when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) The Contractor shall submit payment requests using the Document type.

following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items-

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

N/A

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

Invoice as 2-in-1

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) ) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

(3) The Contractor shall use the information in the Routing Data Document routing.

Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC

HQ0490

Issue By DoDAAC W81K02

Admin DoDAAC W81K02

Inspect By DoDAAC

HT1087

Ship To Code N/A

Ship From Code N/A

Mark For Code N/A

Service Approver (DoDAAC)

HT1087

Service Acceptor (DoDAAC)

HT1087

Accept at Other DoDAAC N/A

LPO DoDAAC N/A

DCAA Auditor DoDAAC N/A

Other DoDAAC(s) N/A

(4) The Contractor shall ensure a payment request includes Payment request.

documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) The Contractor shall ensure a receiving report meets the Receiving report.

requirements of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

Inspector/Acceptor: Mr. Chi Pak, chi.pak.ln@health.mil and/or Individual with approved COR appointment and/or Individual with WAC apporved certification, when applicable.

Contract Specialist: Scott Saito, scott.k.saito.civ@health.mil

Contracting Officer: See Block 31b on SF1449

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

Addendum to 52.212-4, Contract Terms and Conditions - Commercial Products and Commercial Services

(w) UNILATERAL MODIFICATIONS

In addition to 52.212-4(c), the Government may make unilateral modifications considered administrative in nature. These include, but are not limited to, changes in the accounting and appropriation data, payment and issuing office addresses, and other corrections that have no effect on the terms and conditions of the contract.

(x) The non-FAR Part 12 discretionary FAR and DFARS clauses included herein are incorporated into this contract either by reference or in full text.

If incorporated by reference, see clause 52.252-2 herein for locations where full text can be found.

*** END OF NARRATIVE 1 ***

Contract Terms and Conditions Required To Implement Statutes or Executive Orders — Commercial Products and Commercial Services

Addendum to Contract Clauses

FAR Clauses Incorporated by Reference

Number Title Effective Date

Alternate Deviation

Variation Effective Date

52.203-12 Limitation on Payments to Influence Certain Federal Transactions.

2020-06

52.204-9 Personal Identity Verification of Contractor Personnel.

2011-01

52.204-19 Incorporation by Reference of Representations and Certifications.

2014-12

52.209-10 Prohibition on Contracting With Inverted Domestic Corporations.

2026-02

52.223-5 Pollution Prevention and Right-to- Know Information.

2024-05

52.223-23 Sustainable Products and Services.

(DEVIATION 2025-O0004)

2026-02 Deviation 2025- O0004

2025-03

52.232-18 Availability of Funds. 1984-04

52.232-39 Unenforceability of Unauthorized Obligations.

2013-06

52.240-91 Security Prohibitions and Exclusions. 2026-02

52.244-6 Subcontracts for Commercial Products and Commercial Services.

2026-02

DFARS Clauses Incorporated by Reference

Date

Alternate Deviation

Variation Effective Date

252.201-7000 Contracting Officer's Representative. 1991-12

252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.

2023-01

252.222-7002 Compliance with Local Labor Laws (Overseas).

1997-06

252.225-7005 Identification of Expenditures in the United States .

2005-06

252.225-7041 Correspondence in English. 1997-06

252.232-7008 Assignment of Claims (Overseas). 1997-06

252.233-7001 Choice of Law (Overseas). 1997-06

252.237-7010 Prohibition on Interrogation of Detainees by Contractor Personnel.

2023-01

FAR Clauses Incorporated by Full Text

Date

Alternate Deviation

Variation Effective Date

52.217-8 Option to Extend Services. 1999-11

Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within .30 calendar days before the contract expires

(End of clause)

52.217-9 Option to Extend the Term of the Contract.

2000-03

Option to Extend the Term of the Contract (Mar 2000)

The Government may extend the term of this contract by written notice to the Contractor (a) within ; provided that the Government gives the 30 days before the contract expires Contractor a preliminary written notice of its intent to extend at least days before the 60 contract expires. The preliminary notice does not commit the Government to an extension.

If the Government exercises this option, the extended contract shall be considered to (b) include this option clause.

The total duration of this contract, including the exercise of any options under this clause, (c) shall not exceed .60 months, or up to 66 months if FAR 52.217-8 is exercised

(End of clause)

52.252-2 Clauses Incorporated by Reference.

1998-02

Clauses Incorporated By Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

https://www.acq.osd.mil/dpap/dars/dfarspgi/current/ https://www.acquisition.gov/browse/index/far

(End of clause)

52.252-6 Authorized Deviations in Clauses.

2020-11

Authorized Deviations in Clauses (Nov 2020)

The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR (a) Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

The use in this solicitation or contract of any (48 CFR ) (b) DoD FAR Supplement Chapter 2 clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

W81K0226QA016

https://www.acq.osd.mil/dpap/dars/dfarspgi/current/

(End of clause)

List of Contract Documents, Exhibits, or Attachments

ADDITIONAL INSTRUCTIONS AND INFORMATION

A. EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE PROGRAMS

(OCTOBER 2015)

1. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as "person") to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at http://oig.hhs.gov/fraud /exclusions.asp, and the TRICARE Sanctioned Provider list at http://www.health.mil/Military- Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-Healthcare/Program- Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as "the Lists."

2. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the Lists and no such names appear on either of the Lists.

3. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter "new persons") providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

4. The Contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of contractor personnel working in the MTF against the Lists, as specified in OTSG/MEDCOM Policy Memo 15-037. The Government will notify the Contractor in the event any contractor personnel working in the MTF appear on either of the Lists.

5. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

6. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

7. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC (S) 1320a-7a):

a. There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

b. Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person.

8. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at http://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

B. PERSONALLY IDENTIFIABLE INFORMATION, PROTECTED HEALTH INFORMATION,

AND FEDERAL INFORMATION REQUIREMENTS (REVISED 10/27/2020)

1. General Requirements Overview - Personally Identifiable Information (PII), Protected

Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor's requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter.

DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C

(Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, "Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care

Programs," March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B - Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), "OSD Records and Information Management Program" (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA)

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. Data Sharing Agreement (DSA)

6.1. (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data))

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSA for De-Identified Data

DSA for PHI

DSA for PII Without PHI

DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2. (Applies if contract requirements may include human subject research)

This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness

(OUSD(P&R)).

7. Privacy Act and HIPAA Training

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor's scope of involvement with DHA's PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer's Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee's birth month thereafter.

8. HIPAA Business Associate Provisions

8.1. Business Associate - General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the "DoD

Components", located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the- MHS. b.i. and (3)b.ii

9. Breach Response

[This paragraph 9 is inoperative, and all references herein to "paragraph 9" shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference]

9.1. Definitions Related to Breach response

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

9.1.3 A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII /PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

How the event was discovered;

Did the information stay within the covered entity's control;

Was the information actually accessed/viewed; and

Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4. A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII /PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

9.1.5. A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;

The unauthorized person who used the PHI or to whom the disclosure was made;

Whether the PHI was actually acquired or viewed; and

The extent to which the risk to the PHI has been mitigated.

9.1.6. A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII /PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI.

However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

9.2. General

9.2.1 The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

9.2.2 Because DoD defines "breach" to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor's discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor's responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

9.2.4 In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency Readiness Team (US-CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below.

The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirements.

9.2.5 Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery. The time of that report to the contractor shall trigger the contractor's DHA Privacy Office reporting deadline (24 hours) under paragraph 9.3.2. If a cybersecurity incident is involved, the contractor's deadline for US-CERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall report directly to US-CERT and the DHA Privacy Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

9.2.6 Contractors shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome. Investigations identifying unauthorized disclosures must be logged for HIPAA and Privacy Act disclosure accounting purposes, whether or not individual notification is required under the HIPAA Breach Rule.

9.2.7 Contractors, when acting as HIPAA-covered entities, and not as business associates, are not subject to the breach response requirements herein. However, such contractors are subject to both the HIPAA Breach Rule (applicable to them in their capacity as covered entities) and DoD cybersecurity requirements (applicable to them in their capacity as DoD contractors).

9.3. Reporting Provisions

9.3.1 Immediately upon discovery of a possible or confirmed breach or cybersecurity incident, the contractor shall initiate an investigation. If the incident involves electronic PII/PHI, and if the investigation finds a confirmed breach or cybersecurity incident, the contractor shall report it, within 1 hour of confirmation, to the US-CERT Incident Reporting System at https://forms.us-cert.gov/report/, as required by the Department of Homeland Security (DHS).

Note: DHS no longer requires US-CERT reporting of non-cyber breaches or unconfirmed electronic breaches. However, DHS permits US-CERT reporting of unconfirmed cyber-related incidents on a voluntary basis. Thus, if a contractor is uncertain whether a possible cyber-related incident should be treated as confirmed and thus reportable, the contractor may voluntarily report the incident.

Before submission to US-CERT, the contractor shall save a copy of the on-line report. After submitting the report, the contractor shall record the US-CERT incident reporting number, which shall be included in the initial report to the DHA Privacy Office as described in paragraph 9.3.2.

Note: Regardless of whether or not an incident is confirmed as a breach, the contractor must also investigate whether or not the incident impacts data integrity or availability of PII/PHI. If such impact is confirmed, then the incident is reportable to US-CERT as a cybersecurity incident.