TITLE Medicare MEC Notices

BASIS OF

ITEM NO. DESCRIPTION AWARD UNIT RATE COST UNIT RATE COST UNIT RATE COST UNIT RATE COST UNIT RATE COST

I. FILE PROCESSING:

(a) Initial Notices

(1) English...per 100 records 972 $2.00 $1,944.00 $5.00 $4,860.00 $3.32 $3,227.04 $3.00 $2,916.00 $0.971 $943.81

(2) Spanish...per 100 records 84 $6.00 $504.00 $5.00 $420.00 $3.32 $278.88 $3.00 $252.00 $0.971 $81.56

(b) Correction Notices

(1) English...per 100 records 24 $25.00 $600.00 $5.00 $120.00 $3.32 $79.68 $3.00 $72.00 $0.971 $23.30

(2) Spanish...per 100 records 3 $100.00 $300.00 $5.00 $15.00 $3.32 $9.96 $3.00 $9.00 $0.971 $2.91

(c) Replacement Notices

(1) English...per 100 records 402 $25.00 $10,050.00 $5.00 $2,010.00 $3.32 $1,334.64 $3.00 $1,206.00 $0.971 $390.34

(2) Spanish...per 100 records 43 $200.00 $8,600.00 $5.00 $215.00 $3.32 $142.76 $3.00 $129.00 $0.971 $41.75

(d) Secure Destruct Reports (when total mailing exceeds 499 mail pieces)

(1) English...per 100 mailed records 1,398 $2.50 $3,495.00 $50.00 $69,900.00 $0.67 $936.66 $5.00 $6,990.00 $1.03 $1,439.94

(2) Spanish...per 100 mailed records 84 $3.00 $252.00 $50.00 $4,200.00 $0.67 $56.28 $5.00 $420.00 $1.03 $86.52

II. PRTG/IMAGING, TRM TO SIZE, ASSEMBLY, FOLD, INSERT:

(a) Printing/Imaging Variable Data Pages...per 100 printed pages 3,056 $5.00 $15,280.00 $3.00 $9,168.00 $4.25 $12,988.00 $38.00 $116,128.00 $0.7473 $2,283.75

(b) Printing/Imaging Static Data Pages...per 100 printed pages 6,112 $5.00 $30,560.00 $6.00 $36,672.00 $4.25 $25,976.00 $14.00 $85,568.00 $0.7473 $4,567.50

(c) Printing/Imaging Mailing Envelopes...per 100 envelopes 1,528 $4.00 $6,112.00 $0.06 $91.68 $2.10 $3,208.80 $20.00 $30,560.00 $0.977 $1,492.86

(d) Collate leaves, fold, insert into envelope...per 100 leaves 4,584 $4.00 $18,336.00 $4.00 $18,336.00 $3.75 $17,190.00 $12.00 $55,008.00 $0.6757 $3,097.41

III. STOCK/PAPER:

 (a) White Uncoated Text (50 lbs.) or White Plain Copier, Xerographic (20 lbs.)... per 100 env 4,584 $1.35 $6,188.40 $3.67 $16,823.28 $0.91 $4,171.44 $1.00 $4,584.00 $2.813 $12,894.79

(b) White Writing/Wove Mailing Envelope (20 or 24 lbs.)...per 100 envelopes 1,528 $4.00 $6,112.00 $4.26 $6,509.28 $2.10 $3,208.80 $3.00 $4,584.00 $2.535 $3,873.48

Contractor Total $108,333.40 $169,340.24 $72,808.94 $308,426.00 - - - - - -

Prompt Payment Discount 0.00% $0.00 0.00% $0.00 0.25% $182.02 0.00% $0.00 - - - - - -

Discounted Totals $108,333.40 $169,340.24 20 Days $72,626.92 $308,426.00 - - - - - -

Created By: Linda Price 11/01/2022

Reviewed By: Yana Rudenko 11/01/2022

AWARDED

United Mail, LLC

Louisville, KY

NPC

PROGRAM 2571-S

Term of Contract Testing period: Date of Award through November 30, 2022

Claysburg, PA

HM Health Solutions

Jacksonville, FL

Term of Contract Production Period: December 1, 2022 through November 30, 2023

Greenville, SC

Amsive St. Louis Presort

St. Lous, MO
Program 2571-S Page 1 of 42

Specifications by LLP

Reviewed by RLW

U.S. Government Publishing Office

Northeast Region

General Terms, Conditions, and Specifications

For the Procurement of

Medicare QHC Notices

as requisitioned from the U.S. Government Publishing Office (GPO) by the

Department of Health and Human Services (HHS) Centers for Medicare and Medicaid Services (CMS)

Single Award

TERM OF CONTRACT

The term of this contract includes an initial testing period beginning Date of Award through November 30, 2022.

The production period begins December 1, 2022 through November 30, 2023 and 4 option year periods (December 1, 

2023 through November 30, 2024; December 1, 2024 through November 30, 2025; December 1, 2025 through November

30, 2026, and December 1 2026 through November 30, 2027). Special attention is directed to the following provision and 

clauses in Section 1 of this contract: “Option to Extend Term of Contract”, and “Economic Price Adjustment.”

BID OPENING:

Bids shall be publicly opened at 11:00 a.m., prevailing Columbus, Ohio time, on November 1, 2022.

BID SUBMISSION:

Bidders MUST submit email bids to bidsnortheast@gpo.gov for this solicitation. No other method of bid submission will 

be accepted at this time.

The company name, program number, and bid opening date must be specified in the subject line of the emailed bid 

submission. Bids received after 11:00 a.m. prevailing Eastern Time on the bid opening date specified above will not be 

considered for award.

NOTICE TO BIDDERS:

Significant revisions have been made. Schedule of Prices changed from per 1,000 to per 100. Bidders are cautioned to 

familiarize themselves with all provisions of this contract before bidding.

Special attention is directed to the bid submission provisions under “Additional Emailed Bid Submission Provisions” on 

page 9.

Formerly Program 4571-S. Abstract of current contract prices for Program 4571-S available at https://www.gpo.gov/howto-work-with-us/vendors/contract-pricing.

For information of a technical nature contact Linda Price at lprice@gpo.gov or (614) 488-4616, ext. 7 (No collect calls).
Medicare QHC Notices Page 2 of 42

2571-S (11/23)

SECTION 1. – GENERAL TERMS AND CONDITIONS

GPO CONTRACT TERMS

Any contract which results from this Invitation for Bid will be subject to the applicable provisions, clauses, and 

supplemental specifications of GPO Contract Terms (GPO Pub. 310.2, effective December 1, 1987 (Rev. 1-18)) and GPO 

Contract Terms, Quality Assurance Through Attributes Program for Printing and Binding (GPO Pub. 310.1, effective May 

1979 (Rev. 09-19)).

GPO Contract Terms (GPO Publication 310.2) is available at the following web address: 

https://www.gpo.gov/docs/default-source/forms-and-standards-files-for-vendors/contract-terms-01-18.pdf

GPO QATAP (GPO Publication 310.1) is available at the following web address: https://www.gpo.gov/docs/defaultsource/forms-and-standards-files-for-vendors/qatap-rev-09-19.pdf

Additional GPO Publications can be found at the following web address: https://www.gpo.gov/how-to-work-withus/vendors/forms-and-standards.

REGULATIONS GOVERNING PROCUREMENT

The U.S. Government Publishing Office (GPO) is an office in the legislative branch of the United States Government. 

Accordingly, the Federal Acquisition Regulation is inapplicable to this, and all GPO procurements. However, the text of 

certain provisions of the Federal Acquisition Regulation as contained in the Code of Federal Regulations (CFR), are 

referenced in this solicitation. The offeror should note that only those provisions of the Federal Acquisition Regulation 

which are specifically incorporated by reference into this solicitation are applicable.

SUBCONTRACTING

The predominant production functions are downloading files, manipulating data from TIBCO files, computerized variable 

imaging, preparation for mailing, and delivery to USPS. These items CANNOT be subcontracted. All other items, 

including printing of static data are not considered part of the predominant production functions. Bidder who must 

subcontract any of the predominant production functions may be declared non-responsible.

SECURITY

The contractor awarded this contract will be in custody of Government owned material considered Personally Identifiable 

Information (PII). See “Section 5. – CMS Security Specifications” for security requirements of this contract. The 

Government may conduct on-site unannounced, randomized Security inspections at any time.

CMS Acceptable Risk Safeguards for TIBCO transmissions: Low Security Impact Level.

QUALITY ASSURANCE LEVELS AND STANDARDS

The following levels and standards shall apply to these specifications:

PRODUCT QUALITY LEVELS:

(a) Printing (Page Related) Attributes -- Level III.

(b) Finishing (Item Related) Attributes -- Level III.

Inspection Levels (from ANSI/ASQC Z 1.4):

(a) Non-destructive Tests - General Inspection Level I.

(b) Destructive Tests - Special Inspection Level S-2.

Specified Standards: The specified standards for the attributes requiring them shall be:

Attribute Specified Standard

P-7. Type Quality and Uniformity Approved Proofs
Medicare QHC Notices Page 3 of 42

2571-S (11/23)

CONTRACTOR’S QUALITY ASSURANCE SYSTEM

The contractor must provide and maintain an effective quality assurance system that includes, at a minimum the following 

elements:

1. Perform a random quality inspection of records in the TIBCO files. Samples should be tested for construction, 

type, and placement of data in each field.

2. Ensure that the computerized imaging is clear and legible and that the appropriate Notices are mailed to each 

address contained in the TIBCO files.

3. Maintenance and calibration records on all applicable production and inspection equipment.

4. Controls that assure all steps in the process generate a product that conforms to all requirements of this contract.

5. Performance utilizing a calibration system that stops production whenever an extra piece is inserted or a piece is 

left out.

If errors are found or discrepancies exist between the TIBCO data files and reports, e.g. print order, record layout, etc., the 

contractor must cease further production and contact Mark Rydberg at (410) 786-3038. If errors exist in the file and the 

contractor failed to identify them during his/her quality assurance inspection, no reimbursement for the cost of reprinting 

will be allowed.

Quality Systems

The contractor shall initiate, prior to start-up and maintain throughout the life of this contract, Quality Systems to assure 

conformance to all requirements of this contract. The Quality Systems plan should address what actions will be initiated 

when defects are detected.

The Quality Systems shall assure the quality of components from subsidiary plants. This element includes assuring that 

components from different sources will be compatible BEFORE the start of production.

The Quality Systems shall include procedures for assuring that all variable data are accurately and completely printed and 

that all addressed items are mailed. The procedures shall explicitly describe the methods to be used to assure that no 

records are missed or duplicated when an interruption of variable printing occurs (e.g. due to equipment malfunction).

Records of tests, inspections, and critical processes shall be timed stamped and maintained on file. The records must be 

available to GPO and or HHS/CMS employees until the expiration of the warranty period of this contract.

Verification of Production and Mailing

Contractor will be responsible for validating the integrity of every notice produced in all phases of printing, inserting and

mailing and to ensure all notices received from CMS were correctly entered into the United States postal system.

Notice integrity shall be defined as: Each notice shall include all pages (and only those pages) intended for the designated 

recipient as contained in the print files received from CMS.

The contractor is responsible for providing the automated print notice integrity control systems and processes required to 

prevent the commingling of pages intended for different recipients into a completed package. The contractor’s printing 

process must have automated systems that include notice coding and scanning technology capable of:

• Validating the count of pages in a notice set.

• Validating the sequence of pages in a notice set.

• Validating the sequence of notice sets in a production batch.

• Interrupting production if variances are detected.

Mailing integrity shall be defined as all Items received from CMS for each Print Order were imaged, printed, inserted and 

entered correctly into the United States postal system.

The contractor is responsible for providing the automated inserted notice tracking/reporting systems and processes 

required to validate that 100% of all records received from CMS were printed, inserted and mailed correctly.
Medicare QHC Notices Page 4 of 42

2571-S (11/23)

The contractor’s inserting equipment must have automated systems that include notice coding and scanning technology 

capable of:

• Reconciling page and notice counts from CMS provided print files to Print Order control totals provided by CMS; 

reporting variances.

• Uniquely identifying each notice within a Print Order using a sequence number range assigned by the contractor.

• Unique identifier to be scanned after insertion to ensure all notices are present and accounted for.

• Tracking and reporting all notices produced and mailed within a Print Order at the notice level.

• Identifying and reporting all missing notices that were lost or spoiled during production within a Print Order.

• Generating a new production file for all missing notices.

• Reconciling the total of all notices produced and mailed within a Print Order to the control totals provided by 

CMS; reporting all variances.

• Reconciling the total of all notices mailed to mailing totals contained on Postal Entry Forms within a Print Order; 

reporting all variances.

• Generate a final automated summary report which provides information that all mail pieces have been scanned, 

after insertion, verifying that all pieces for each Print Order are accounted for. The summary report will contain 

the sequence number range for a particular Print Order, show all sequence numbers were scanned and accounted 

for after notice is inserted, and event information on any spoiled or missing pieces verifying that they were 

scanned and accounted for. A copy of the summary report(s) must be submitted with the matching GPO Form 

712(s).

Contractor must generate an automated audit report when necessary showing the tracking of all Items throughout all 

phases of production for each mail piece. This audit report will contain all information outlined above for each phase of 

printing, inserting and mailing. All notice tracking/reporting data must be retained in electronic form for 120 days after 

mailing, and must be made available to CMS for auditing of contractor performance upon request.

Unique Identification Number

Unique identifying numbers will be used to track each individual notice, thereby providing 100% accountability. This 

enables the contractor to track each notice through completion of the project. If required by the Government, the 

contractor will be required to create a test sample totaling 50 notices. This test must have a unique number and must be 

produced on each of the notices. The contractor will generate a list of the unique identifying numbers for each sample. 

As samples are pulled, their unique number will be marked off the list. This enables the contractor to track which samples 

have been produced and pulled and what records have been produced.

In addition, if required, the contractor will produce a printed sample of each notice used for the Unique Identification 

Number sample plan. Those samples, along with the unique numbers, are to be processed and mailed directly to 

HHS/CMS; 7500 Security Blvd., SL 12-18; Baltimore, MD 21244-1850; Attn: Mark Rydberg.

A recovery system will be required to ensure that all defective or missing/mutilated pieces detected are identified, 

reprinted and replaced. The recovery system must use unique sequential numbers assigned to each piece to aid in the 

recovery and replacement of any defective or missing/mutilated pieces, and must be capable of tracking and/or locating 

any individual piece of mail from the time it leaves the press, up to and including when it is off-loaded at the USPS 

facility.

The Government will not as a routine matter request that the contractor produce individual pieces in transit within the 

plant, however, the contractor must demonstrate that they have an audit trail established that has the ability to comply with 

this type request when and if the need arises.

The contractor’s Quality Assurance System and the Verification of Production and Mailing plans must account for the 

number of pieces mailed. The contractor shall monitor all aspects of the job including material handling and mail flow, to 

assure that the production and delivery of these notices meet specifications and Government requirements.
Medicare QHC Notices Page 5 of 42

2571-S (11/23)

WARRANTY

The provisions of Article 15, “Warranty” of Contract Clauses in GPO Contract Terms is amended for the solicitation to 

the effect that the warranty period is EXTENDED from 120 days to one calendar year from the date the check is tendered 

as final payment. All other provisions remain the same.

REDUNDANT FACILITY

As part of the pre-award survey, the contractor shall provide a redundant facility plan which is to include having two or 

more contractor owned/controlled facilities that have the capability to perform all predominate production requirements of 

the contract. This plan is to allow for back-up facilities if for any reason(s) (act of God, labor disagreements, etc.) a 

production facility is unable to meet all the requirements of the contract. The back-up facilities, equipment, and personnel 

must be established and operational prior to award. Failure to have a back-up facility may result in a non-responsible 

determination.

OPTION TO EXTEND TERM OF CONTRACT

The Government has the option to extend the term of this contract for a period of 12 months by written notice to the 

contractor not later than 30 days before the contract expires. If the Government exercises this option, the extended 

contract shall be considered to include this clause, except, the total duration of the contract may not exceed 5 years 

(November 30, 2027) as a result of, and including, any extension(s) added under this clause. Further extension may be 

negotiated under the “Extension of Term of Contract” clause. See also “Economic Price Adjustment” clause for 

authorized pricing adjustment(s).

EXTENSION OF TERM OF CONTRACT

At the request of the Government, the term of any contract resulting from this solicitation may be extended for such 

period of time as may be mutually agreeable to the GPO and the contractor.

ECONOMIC PRICE ADJUSTMENT

The pricing under this contract shall be adjusted in accordance with this clause, provided that in no event will any pricing 

adjustment be made that would exceed the maximum permissible under any law in effect at the time of the adjustment.

There will be no adjustment for orders placed during the first period specified below. Pricing will thereafter be eligible 

for adjustment during the second and any succeeding performance period(s). For each performance period after the first, 

a percentage figure will be calculated as described below and that figure will be the economic price adjustment for that 

entire next period.

Pricing adjustments under this clause are not applicable to reimbursable postage or to transportation costs, or to paper. 

Paper prices are subject to adjustment by the “Paper Price Adjustment” clause in this contract.

For the purpose of this clause, performance under this contract will be divided into successive periods. The first period 

will extend from December 1, 2022 through November 30, 2023, and the second and any succeeding period(s) will 

extend for 12 months from the end of the last preceding period, except that the length of the final period may vary. The 

first day of the second and any succeeding period(s) will be the effective date of the economic price adjustment for that 

period.

Pricing adjustments in accordance with this clause will be based on changes in the seasonally adjusted “Consumer Price 

Index For All Urban Consumers – Commodities Less Food” (Index) published monthly in the CPI Detailed Report by the 

U.S. Department of Labor, Bureau of Labor Statistics.

The economic price adjustment will be the percentage difference between Index averages as specified in this paragraph. 

An index called the variable index will be calculated by averaging the monthly Indexes from the 12-month interval ending 

three (3) months prior to the beginning of the period being considered for adjustment. This average is then compared to 

the average of the monthly Indexes for the 12-month interval ending August 31, 2022, called the base index. The 

percentage change (plus or minus) of the variable index from the base index will be the economic price adjustment for the 

period being considered for adjustment.
Medicare QHC Notices Page 6 of 42

2571-S (11/23)

The Government will notify the contractor by contract modification specifying the percentage increase or decrease to be 

applied to invoices for orders placed during the period indicated. The contractor shall apply the percentage increase or 

decrease against the total price of the invoice less reimbursable postage or transportation costs and separately adjusted 

paper prices. Payment discounts shall be applied after the invoice price is adjusted.

If the Government exercises an option, the extended contract shall be considered to include this economic price 

adjustment clause.

PAPER PRICE ADJUSTMENT

Paper prices charged under this contract will be adjusted in accordance with “Table 9 – Producer Price Indexes and 

Percent Changes for Commodity Groupings and Individual Items” in Producer Price Indexes report, published by the 

Bureau of Labor Statistics (BLS), as follows:

1. BLS code 0913 for “All Paper” will apply to all paper required under this contract.

2. The applicable index figures for the month of December 1, 2022 will establish the base index.

3. There shall be no price adjustment for the first three months of the contract.

4. Price adjustments may be monthly thereafter, but only if the index varies by an amount (plus or minus) exceeding 

5% by comparing the base index to the index for that month which is two months prior to the month being 

considered for adjustment.

5. Beginning with order placement in the fourth month, index variances will be calculated in accordance with the 

following formula:

 x 100 = %

base index

x base index ____

where X = the index for that month which is two months prior to the month being considered for adjustment.

6. The contract adjustment amount, if any, will be the percentage calculated in 5 above less 5%.

7. Adjustments under this clause will be applied to the contractor’s bid price(s) for all line items under “Item II. 

STOCK/PAPER” in the Schedule of Prices and will be effective on the first day of any month for which prices 

are to be adjusted.

The Contracting Officer will give written notice to the contractor of any adjustments to be applied to invoices for orders 

placed during months affected by this clause.

In no event, however, will any price adjustment be made which would exceed the maximum permissible under any law in 

effect at the time of the adjustment. The adjustment, if any, shall not be based upon the actual change in cost to the 

contractor, but shall be computed as provided above.

The contractor warrants that the paper prices set forth in this contract do not include any allowance for any contingency to 

cover anticipated increased costs of paper to the extent such increases are covered by this price adjustment clause.

PREAWARD SURVEY

In order to determine the responsibility of the prime contractor or any subcontractor, the Government reserves the right to 

conduct an on-site preaward survey at the contractor’s/subcontractor’s facility or to require other evidence of technical, 

production, managerial, financial, and similar abilities to perform, prior to the award of a contract.

As part of the financial determination, the contractor in line for award may be required to provide one or more of the 

following financial documents:

1. Most recent profit and loss statement

2. Most recent balance sheet

3. Statement of cash flows

4. Current official bank statement

5. Current lines of credit (with amounts available)
Medicare QHC Notices Page 7 of 42

2571-S (11/23)

6. Letter of commitment from paper supplier(s)

7. Letter of commitment from any subcontractor

The documents will be reviewed to validate that adequate financial resources are available to perform the contract 

requirements. Documents submitted will be kept confidential and used only for the determination of responsibility by the 

Government. Failure to provide the requested information in the time specified by the Government may result in the 

Contracting Officer not having adequate information to reach an affirmative determination of responsibility.

The Preaward Survey will include a review of all subcontractors involved, along with their specific functions; and the 

contractor’s/subcontractor’s, personnel, data handling, production, security and other requirements outlined in “Section 5

CMS Security Specifications”.

Attending the preaward survey will be representatives from the GPO and/or CMS. The Government reserves the right to 

conduct postaward surveys of the same nature as needed.

POSTAWARD CONFERENCE

The postaward conference between contractor and agency is required, unless waived by the Government. The postaward 

conference shall be conducted via telephone, video conference, or at contractor’s facility(ies). The purpose of the 

conference will be to discuss and review all aspects of the contractor’s production plan and to establish coordination of all

internal and external operations required to complete the contract and for CMS to determine the appropriate level of 

security investigation.

POST AWARD TEST

The contractor awarded the contract shall be required to demonstrate their ability to retrieve TIBCO files and print the 

items required in these specifications at the requisite quality level by completing a Post Award Test which includes a 

Variable Data Test and a Live Notice Test as described hereafter. The Government reserves the right to waive all or part 

of the Postaward Test if there is other evidence that, in the opinion of the Contracting Officer, indicates that the contractor 

being considered for award has the capability to successfully produce the items required.

VARIABLE DATA TEST

Unless waived by the Government, 2 work days after receipt of data files, the contractor may be required to submit postaward test samples. The contractor will be required to submit 50 randomly selected samples in .PDF format of the notices 

to be ordered under this contract.

Contractor must also submit the corresponding source data files (also known as a “data dump”). Test samples must show 

the correct variable data information taken from the furnished test files in accordance with the Data Layout Sheet.

In addition, the contractor will be required to provide data programming as required to accomplish the Variable 

Computerized Imaging as defined under “Printing/Imaging” in “Section 2 – Specifications”. E-mail the test samples to

mark.rydberg@cms.hhs.gov.

LIVE NOTICE TEST

Within 3 workdays after receiving Variable Data Test approval, the contractor must submit the samples for evaluation to: 

HHS/CMS; 7500 Security Blvd., SL 12-18; Baltimore, MD 21244-1850; Attn: Mark Rydberg.

The contractor will be required to submit 50 copies of each complete notice as required by the Government. Each notice 

must be a completed, ready-to-mail package and include the letter, language pages, and IRS Form 1095-B (if applicable), 

and mailing envelope and must be produced in accordance with the specifications.

The furnished records will simulate the items the contractor may be expected to print and mail. Each notice must be 

constructed as specified and must be of the size, kind, and quality that the contractor will furnish.
Medicare QHC Notices Page 8 of 42

2571-S (11/23)

VARIABLE DATA TEST AND LIVE NOTICE TEST

The Variable Data Test and Live Notice Test produced during the Postaward Test will be checked for adherence to all 

specifications. The Government will approve, conditionally approve, or disapprove these test proofs and samples within 2

workdays of the receipt thereof.

Approval or conditional approval shall not relieve the contractor from complying with the specifications and all other 

terms and conditions of the contract. A conditional approval shall state any further action required by the contractor. A 

notice of disapproval shall sate the reasons therefore.

If these copies are disapproved by the Government due to printer’s errors, the Government may require the contractor to 

submit additional copies for inspection and testing, in the time and under the terms and conditions specified in the notice 

of disapproval. Such additional copies shall be furnished, and necessary changes made, at no additional cost to the 

Government.

In the event these additional copies are disapproved by the Government due to printer’s errors, the contractor may be 

deemed to have failed to make delivery within the meaning of the default clause in which event this contract shall be 

subject to termination for default.

If the ability to achieve the specified quality is not satisfactorily demonstrated, the contractor may be subject to 

Termination for Default for contractor’s failure to perform. The postaward test will be performed at no cost to the 

Government. All samples must be manufactured at the same facilities and on the same equipment used for producing 

contract production quantities.

ASSIGNMENT OF JACKETS, PURCHASE AND PRINT ORDERS

A GPO jacket number will be assigned and a purchase order issued to the contractor to cover work performed. The 

purchase order will be supplemented by an individual “Print Order” for each job placed with the contractor. The print 

order, when issued, will indicate the quantity to be produced and any other information pertinent to the particular order.

ORDERING

Items to be furnished under the contract shall be ordered by the issuance of print orders by the Government. Production 

orders may be issued under the contract from December 1, 2022 through November 30, 2023 plus for such additional 

period(s) as the contract is extended. All print orders issued hereunder are subject to the terms and conditions of the 

contract. The contract shall control in the event of conflict with any print order. A print order shall be “issued” upon 

notification by the Government for purposes of the contract when it is electronically transmitted or otherwise physically 

furnished to the contractor in conformance with the schedule.

REQUIREMENTS

This is a requirements contract for the items and for the period specified herein. Shipment and/or delivery of items or 

performance of work shall be made only as authorized by orders issued in accordance with the clause entitled “Ordering”. 

The quantities of items specified herein are estimates only, and are not purchased hereby. Except as may be otherwise 

provided in this contract, if the Government’s requirements for the items set forth herein do not result in orders in the 

amounts or quantities described as “estimated”, it shall not constitute the basis for an equitable price adjustment under this 

contract.

Except as otherwise provided in this contract, the Government shall order from the contractor all the items set forth which 

are required to be purchased by the Government activities identified on page 1.

The Government shall not be required to purchase from the contractor, requirements in excess of the limit on total orders 

under this contract, if any.

Orders issued during the effective period of this contract and not completed within that time shall be completed by the 

contractor within the time specified in the order, and the rights and obligations of the contractor and the Government 

respecting those orders shall be governed by the terms of this contract to the same extent as if completed during the 

effective period of this contract.
Medicare QHC Notices Page 9 of 42

2571-S (11/23)

If shipment/delivery of any quantity of an item covered by the contract is required by reason of urgency prior to the 

earliest date that shipment/delivery may be specified under this contract, and if the contractor will not accept an order 

providing for the accelerated shipment/delivery, the Government may procure this requirement from another source.

The Government may issue orders which provide for shipment/delivery to or performance at multiple destinations.

Subject to any limitations elsewhere in this contract, the contractor shall furnish to the Government all items set forth 

herein which are called for by print orders issued in accordance with the “Ordering” clause of this contract.

ADDITIONAL EMAILED BID SUBMISSION PROVISIONS

The Government will not be responsible for any failure attributable to the transmission or receipt of the emailed bid

including, but not limited to, the following –

1. Illegibility of bid.

2. Emails over 75 MB may not be received by GPO due to size limitations for receiving emails.

3. The bidder’s email provider may have different size limitations for sending email; however, bidders are advised 

not to exceed GPO’s stated limit.

4. When the email bid is received by GPO, it will remain unopened until the specified bid opening time. Government 

personnel will not validate receipt of the emailed bid prior to bid opening. GPO will use the prevailing Columbus, 

Ohio time and the exact time that the email is received by GPO’s email server as the official time stamp for bid

receipt at the specified location.

PAYMENT

Submitting all invoices for payment via the GPO fax gateway (if no samples are required) utilizing the GPO barcode 

coversheet program application is the most efficient method of invoicing. Instruction for using this method can be found 

at https://winapps.access.gpo.gov/fms/vouchers/barcode/instructions.html.

Invoices may also be mailed to: U.S. Government Publishing Office, Office of Financial Management, Attn: 

Comptroller, Stop: FMCE, Washington, DC 20401.

For more information about the billing process refer to the General Information of the Office of Finance web page located 

at https://www.gpo.gov/finance/index.htm.

At time of invoicing, the contractor shall submit a copy of the print order, contractor’s invoice, and all mailing and/or 

delivery receipts via e-mail to infonortheast@gpo.gov.

In addition to the payment voucher submitted to GPO for billing, the contractor is required to e-mail to Mark Rydberg at 

mark.rydberg@cms.hhs.gov a copy of the GPO voucher and mailing statements for each print order within five workdays 

after mailing has been completed by the contractor.
Medicare QHC Notices Page 10 of 42

2571-S (11/23)

SECTION 2. – SPECIFICATIONS

SCOPE

These specifications cover the production of Medicare QHC Notices (letter, IRS Form 1095-B, and mailing envelopes)

requiring such operations as programming of variable data, printing/imaging in English and Spanish, envelope 

construction and printing, collating, folding, inserting, and mailing.

TITLE

Medicare QHC Notices

ITEMS

Medicare QHC (Qualifying Health Coverage) Notices consist of three notice types. Additional notices may be added 

throughout the term of the contract as mutually agreed between the contractor and the Government.

• Initial Notices: Includes letter, IRS Form 1095-B, and mailing envelope.

• Correction Notices: Includes letter, IRS Form 1095-B, and mailing envelope.

• Replacement Notices: Includes letter, IRS Form 1095-B, and mailing envelope

NUMBER OF ORDERS

Anticipate 27 to 28 orders per year.

INITIAL AND CORRECTION NOTICES

Anticipate 3 to 4 orders per year. It is anticipated that the Initial Notices and Correction Notices will be issued on the 

same print order.

REPLACEMENT NOTICES

Anticipate 24 orders per year. It is anticipated that the Replacement Notices will be ordered twice a month. One order 

will be for the previous tax year and the other order will be for tax years preceding the previous tax year.

QUANTITY

Production quantities (English and Spanish) will be indicated on the individual print orders.

INITIAL NOTICES

Anticipate 1 English data file per order, 30,000 to 80,000 English records per data file. Anticipate 1 Spanish data file per

order, 2,000 to 8,000 Spanish records per data file.

CORRECTION NOTICES

Anticipate 1 English data file per order, 750 to 2,500 English records per data file. Anticipate 1 Spanish data file per 

order, 25 to 150 Spanish records per data file.

REPLACEMENT NOTICES – PREVIOUS TAX YEAR

Anticipate 1 English data file per order, 200 to 15,000 records per data file. Anticipate 1 Spanish data file per order, 1 to 

1,000 records per data file.

REPLACEMENT NOTICES – TAX YEARS PRECEDING THE PREVIOUS TAX YEAR

Anticipate 1 to 7 English data files per order, 1 to 2,000 records per data file. Anticipate 1 to 7 Spanish data file per order, 

1 to 100 records per data file.

PAGES

Up to 6 pages (3 leaves) per notice as described below and one mailing envelope:
Medicare QHC Notices Page 11 of 42

2571-S (11/23)

• Letters: anticipate 4 pages (2 leaves) printed face and back, includes letter content and CMS Language pages.

• IRS Form 1095-B: Two pages (one leaf) printed face and back.

• Mailing Envelope: One envelope printed on face and back (on flap) after construction.

NOTE: While the above is anticipated, additional pages may be added to the different letters. The page count will not 

exceed 6 pages unless mutually agreed by contractor and the Government.

TRIM SIZES

• Letters: 8-1/2 x 11”

• IRS Form 1095-B: 8-1/2 x 11” or 11 x 8-1/2”

• Mailing Envelopes (#10 size): 4-1/8 x 9-1/2”

GOVERNMENT TO FURNISH

Files created on Apple OS or Windows platform. Variable data files will be furnished via electronic file transmission 

(EFT) and viewable using a Chrome browser. Contractor will need GIS-compatible Secure File Transfer Protocol Client 

(sFTP). Static templates of letter, envelope, and IRS Tax Form 1095-B will be furnished via e-mail or sFTP.

If discrepancies are found on the Government-furnished material(s), the contractor must contact Mark Rydberg, CMS, at 

(410) 786-3038, before starting production.

Variable data files furnished with each Print Order in Microsoft Excel 2019 or higher, or in delimited file format, .CSV, 

.TXT, or similar. Delimiter to be determined after award. Multiple data files furnished with each Print Order. Each data 

file will contain a specific data set. Each data set will be for a specific notice type, a specific tax year, and will be in 

English or in Spanish.

Letter and envelope templates furnished in MS Word 2019 or higher after award. Templates may change but contractor 

will be notified 30 days prior to any change. The letter templates will be provided in two files. The letter content will be 

in one file and the CMS language pages will be in another file. Contractor’s option to merge two files into one file or 

print from two separate files.

Multiple IRS Tax Form 1095-B templates furnished in .PDF after award and with each new tax year. Each tax year will 

have a unique template.

Contractor’s option to preprint static data of letters, envelopes, and IRS Tax Form 1095-B templates but is cautioned that 

reimbursement will only be made for actual quantities ordered.

Complete record specifications and data mapping crosswalk for each letter and tax form furnished after award in 

Microsoft Word 2019 or higher or Adobe .PDF file.

Contractor will be required to support all current and future upgrades for software.

FONTS

All printer and screen fonts will be furnished. The contractor is cautioned that furnished fonts are the property of the 

Government and/or its originator. All furnished fonts are to be eliminated from the contractor’s archive immediately after 

completion of the contract.

Special Software Consideration: Office graphics (e.g., files from Presentation, Word Processing, or other non-publishing 

applications) are furnished for this procurement. Additional system work may be required to produce output as per 

specifications. If supplied by the Government, a black and white visual will be used as the standard for page integrity. 

Contractor must ensure that the job outputs exactly as the furnished visual.

The contractor will not receive additional compensation, or time for common errors associated with the output of Office 

Graphics files. Common errors include, but are not limited to: 1) Color issues and Shifts (RGB color data, no spot 

colors, loss of Black plate), 2) Page Integrity (text reflow), 3) Missing prepress features (e.g., bleeds, trim marks), or 4) 

Loss of text characters from graphic elements.
Medicare QHC Notices Page 12 of 42

2571-S (11/23)

Upon completion of the order, the contractor must furnish final production native application files (digital deliverables) 

with the furnished material. The digital deliverables must be an exact representation of the final printed product and shall

be returned on the same type of storage media as was originally furnished.

ELECTRONIC PREPRESS

Immediately upon receipt and prior to image processing, the contractor shall perform a basic check (preflight) of the 

furnished media and publishing files to assure correct output of the required reproduction image. Any errors, media 

damage, or data corruption that might interfere with proper file image processing must be reported to GPO Contracting 

Office prior to further performance.

It is recommended that the contractor output files on the same platform; no additional time or compensation will be given 

for errors commonly associated with file output from a different platform.

The contractor shall create or alter any necessary trapping, set proper screen angles and screen frequency, and define file 

output selection for the imaging device being utilized. Furnished files must be imaged as necessary to meet the assigned 

quality level.

ADDITIONAL FURNISHED MATERIAL

The following additional items that will be furnished to the contractor at the time of award or with the first print order.

• PS Form 3615 (Mailing Permit Application and Customer Profile)

• GPO Form 712 (Certificate of Conformance).

• GPO Form 952 (Desktop Publishing – Disk Information).

• GPO Form 2511 (Print Order).

• GPO Form 905 (R. 3/90) (Delivery/Shipping Status Report).

Identification markings such as register marks, ring folios, rubber stamped jacket numbers, commercial identification 

marks of any kind, etc., except GPO imprint, form number, and revision date, carried on copy or film, must not appear on 

finished product.

CONTRACTOR TO FURNISH

All materials and operations, other than those listed under “Government to Furnish”, necessary to produce the products in 

accordance with these specifications. Contractor is required to verify that the CMS furnished files and quantity(s) are in 

the TIBCO mailbox within two hours of the print order and file(s) have been made available for downloading.

REPRODUCIBLES

The contractor must make all reproducibles required. The contractor is responsible for determining what type 

reproducibles will be used but must maintain the quality level specified in the contract. No separate charges will be 

allowed for the various types of reproducibles that may be used.

Further, the contractor is responsible for outputting all images contained on furnished material, regardless of the 

production process, at the highest effective resolution possible. The contractor is responsible for determining the 

appropriate output resolution to achieve optimal results for such design elements as blends, gradients, halftones, type and 

other images. This determination should be made using factors such as stock, 

imaging device (or press) being used, and other factors unique to the contractor’s production environment.

VARIABLE DATA VERIFICATION AND TEXT LAYOUT PROOFS

Contractor must submit 50 proofs (combined English and Spanish) of each notice component. The individual print order 

will indicate the number of proofs required for each notice package. Contractor to submit one “Press Quality” .PDF 

“soft” proof (for content and variable data placement only) of each Letter, IRS Form 1095-B, and mailing envelope.
Medicare QHC Notices Page 13 of 42

2571-S (11/23)

Proofs to be created using the same Raster Image Processor (RIP) that will be used to produce the final printed product. 

Proofs will be evaluated for text flow and image position for variable and static data. Contractor must also submit the 

corresponding source data files (also known as a “data dump”) in a Microsoft Excel format in the same sequence as the 

submitted letter proofs.

Proofs of complete notice to be e-mailed in encrypted, password protected, PK zipped .PDF files to Mark Rydberg at

mark.rydberg@cms.hhs.gov. Include Jacket # and Requisition #, Program # and Print Order # with title in the subject line 

of the e-mail. Contractor required to confirm receipt of e-mail via telephone notification at (410) 786-3038 within 1 hour

of transmission.

The contractor will be responsible for performing all necessary proofreading to ensure that the proofs submitted are in 

conformity with the furnished copy and record specifications. If CMS finds errors during the proofing process, the 

contractor must make all corrections and submit additional proofs along with the corresponding source data files. This 

process will be repeated until the contractor submit samples that CMS considers to be error-free.

If any contractor’s errors are serious enough in the opinion of the GPO to require revised proofs, the revised proofs are to 

be provided at no expense to the Government. No extra time can be allowed for this reproofing; such operations must be 

accomplished within the original production schedule allotted in the specifications.

The Government will approve or disapprove the samples within the number of workdays as defined under “Schedule”. 

Notification will be given by e-mail. Approval or disapproval will not relieve the contractor of complying with the 

specifications and all other terms and conditions of the contract. Additional e-mail samples may be required if image

samples are disapproved.

The contractor must not print/image prior to receipt of an “OK to Print”.

STOCK/PAPER

The specifications of all paper furnished must be in accordance with those listed herein or listed for the corresponding JCP 

Code numbers in the “Government Paper Specification Standards No. 13” dated September 2019.

Color of paper furnished shall be of a uniform shade and a close match by visual inspection of the JCP and/or attached 

color sample(s). The Contracting Officer reserves the right to reject shipments of any order printed on paper the color of 

which, in his opinion, materially differs from that of the color sample(s).

To assure the mailing qualifies for all automation discounts, meets USPS mail quality standards, and to prevent delays in 

processing, the color of the letter paper and ink used to address the mail piece MUST meet all USPS mail 

acceptance/automation requirements for Reflectance and Print contrast.

LETTERS AND IRS FORM 1095-B

Contractor’s option:

White Uncoated Text, basis size 25 x 38”, 50 lbs. per 500 sheets, equal to JCP Code A60

White Plain Copier, Xerographic, basis size 17 x 22”, 20 lbs. per 500 sheets, equal to JCP Code O65.

MAILING ENVELOPES

White Writing Envelopes, basis size 17 x 22”, 20-24 lbs. (contractor’s option) per 500 sheets, equal to JCP Code V20.

PRINTING/IMAGING

At contractor’s option, the product may be produced via conventional offset or digital printing provided that Quality Level 

3 standards are maintained. Final output must be a minimum of 133-line screen and at a minimum resolution of 1200 x 

1200 dpi x 1 bit or 600 x 600 dpi x 4-bit depth technology.

STATIC DATA IMAGING

At contractor’s option, static data may be imaged digitally or printed using the traditional offset method.
Medicare QHC Notices Page 14 of 42

2571-S (11/23)

VARIABLE COMPUTERIZED IMAGING

Contractor will be required to provide variable imaging of letter in black ink in accordance with record specifications 

provided with the individual print order which identify the field name, format, start/end position, and remarks locations. 

The content for most letters will contain address fields. The content for IRS Form 1095-B will contain a significant 

number of variable data fields, including address fields.

Address Formatting Requirements: The address fields on the letter and IRS Form 1095-B will be four to seven lines. 

Address elements, components, ink characteristics, type placement, format, and fonts, including IMb (Intelligent Mail 

Barcode) and all required postal markings, must be consistent with current U.S. Postal Service (USPS) Address Quality 

Standards, and in accordance with appropriate USPS rules and regulations, including USPS Domestic Mail Manual 

(DMM), in effect at the time of mailing. The type font must be one of the USPS accepted and verified MLOCR readable 

type.

LETTERS

Page 1 of all letters will print/image variable data for mailing address (see “Address Formatting Requirements” below), 

salutation (if provided), date (contractor to use date of printing/imaging), and “HICN” number.

Balance of page 1 and pages 2 through 4 (includes CMS Language pages), will print/image static data.

IRS FORM 1095-B

Page 1 prints/images extensive variable data and prints with static data.

Page 2 prints/images static data (form instructions).

PRINTING ENVELOPES

Print static data face and back (on flap) after construction in black ink. Face prints return address in upper left corner, 

First-Class Mail postage and fees paid permit imprint in upper right corner and one line of type. Outside flap of envelope 

prints four typelines and one rule in black ink. Overall size of image on flap is 1-3/4 x 1” and is to be centered on flap. 

Follow furnished copy.

Return address placement, format, and fonts must be consistent with current U.S. Postal Service (USPS) Address Quality 

Standards, and in accordance with appropriate USPS rules and regulations including USPS Domestic Mail Manual 

(DMM) in effect at the time of mailing. Position of all elements per furnished copy.

Use standard obliteration feature on interior (after construction) of envelope. The contractor may use jumbled character 

design, or at the contractor’s option, use their own design (no proprietary design or company logos permitted). Print in 

blue or black ink. Contractor must guarantee that the product will ensure complete opacity and prevent show through of 

any material contained therein and cannot bleed onto enclosed material.

ENVELOPE CONSTRUCTION

Envelope to be open side with diagonal or side seams (contractor’s option). A fully gummed flap is required. Face of 

envelope to have a die-cut window, approximate size is 1-3/8 x 4-1/4” and approximate location is 3/4” from left edge of 

envelope and 3/4” from bottom edge of envelope to allow imaged address on letter to show through window when it is 

folded and inserted. Contractor to determine exact size and position of window.

Window must be sized to accurately display up to seven lines of address, IMb barcode and applicable USPS markings,

and meet all applicable USPS machineable mail/addressing standards. Cover window with a clear glassine or poly 

material securely glued on all sides to the interior of the envelope.

MARGINS

No bleeds. Adequate gripper margins follow trim marks on electronic files.
Medicare QHC Notices Page 15 of 42

2571-S (11/23)

TRIMMING/FOLDING/ASSEMBLY

Trim 4 sides. Each piece of each notice is to be gathered in sequence (Letter and IRS Form 1095-B), face up on all pages 

and fold from 8-1/2 x 11” to 8-1/2 x 7-1/4” and then to 8-1/2 x 3-9/16”, with two accordion or wraparound folds, with the 

mailing address on letter facing out for visibility of the address through the window in the envelope.

It is the contractor’s responsibility to assure that only the computer-generated address and IMb and other applicable USPS 

barcodes/markings on the letter will be visible through the window in the envelope and that only one complete notice is 

inserted into each envelope.

MAIL PREPARATION

All envelopes will have a printed CMS Mail Postage and Fees Paid permit. The contractor is cautioned to use the permit 

imprint only for mailing material produced under this contract. Domestic mailing addresses only.

Using the CMS address information as provided, the contractor is required to obtain the maximum USPS postage 

discounts possible in accordance with the USPS First Class mail automated mail discount structure in effect at the time of 

mailing. In compliance with USPS Mail Preparation & Sortation Regulations, all mail must be appropriately marked and 

supported with the documentation necessary to ensure USPS acceptance.

Mailing Envelopes must be prepared and sealed in a manner that will ensure acceptance, security, and safe delivery by the 

U.S. Postal Service. Gather each piece and insert into mailing envelope, and seal.

The contractor must provide all mailing materials, as well as all labeling and marking, as necessary to fulfill mailing and 

distribution requirements. Noncompliance with the packing and labeling instructions will be cause for the Government to 

take corrective action in accordance with GPO Contract Terms Pub. 310.2.

Contractor must be able to read/print/image up to seven lines of address information and ensure all addresses can display 

the address format acceptable for USPS automation processing through the window.

Addresses for this mailing come from a Government maintained file. For this mailing, CMS will provide certificates 

indicating that within 95 days the addresses have been matched against both the USPS required Coding Accuracy Support 

System (CASS) and National Change of Address (NCOA) software. In the event the CASS and NCOA certification has 

expired, the contractor may be required to provide the certification prior to mailing.

All addresses must be verified as mailable pieces before printing/imaging is started. All unmailable addresses and the 

count of these addresses must be reported back to GPO and CMS before printing/imaging is started.

Contractor sponsored address data enhancements to secure postal discount MUST NOT negatively affect deliverability 

and/or omit/change any required address field as provided by CMS address files. It is the contractor’s responsibility to 

keep up to date on all USPS requirements.

All copies mailed must conform to the appropriate regulations in the U.S. Postal Service manuals for domestic presorted 

First-Class mail as applicable, and must be prepared for the most cost-effective mailing rate/class obtainable presorting for 

maximum postal automation discounts, including full-service IMb. The placement and application of the IMb barcodes 

must not compromise any applicable USPS addressing/imprinting requirements.

In addition, USPS has instituted a verification procedure called a “tap” test used to screen all mailings with barcode 

inserts for proper barcode spacing within the envelope window. USPS will randomly select samples from a mailing and 

tap the pieces on their left, right, and bottom edges to test whether the barcode maintains a minimum spacing of 1/8 inch 

between the barcode and the left and right edges of the window, at least 1/25 inch between the barcode and the bottom 

edge of the mail piece. Mail pieces are not to be tapped upside down (i.e. on their top edge).

INTELLIGENT MAIL BARCODE (IMB)

The successful bidder must understand and be able to implement all mail preparation requirements enacted by the Postal 

Service related to using Intelligent Mail. The requirements include, but are not limited to preparing Intelligent Mail 

barcodes meeting USPS quality acceptance standards.
Medicare QHC Notices Page 16 of 42

2571-S (11/23)

Experience with assigning unique numbers for each mail piece, preparing electronic manifests, making electronic 

appointments, producing revised tray/pallet label formats and other similarly detailed IMb requirements as mandated by 

the Postal Service is essential.

The IMb must appear in the address block of the letter and show through the window area of the mailing envelope. 

Printing or imaging of the IMb on the envelope is NOT permissible.

Secure Destruct (SD) is required for all mailings that exceed 499 mail pieces. SD requires Full Service IMb – ACS SD 

Option 2 – Service Type ID 335. CMS to provide the Mailer Identifier (MID) Code to contractor for use in the IMb.

The metrics for SD to be encoded in the IMb is as follows: 

• Mailier Identifier (MID) Code

• SingleSource ACS

• Service Type Identifiers (STIDs) 335

o Forward Mail pieces

o Undeliverable Mail pieces

o Note: Change-of-Address (COA’s) life cycle is for 12 months. During months 13-18 the mail pieces will 

be destroyed and an Address Correction Service (ACS) notice is generated and coded as Forwarding 

Order Expired (FOE) on the record. A notice will contain the reason for non-delivery as a UAA Code.

U.S. Postal Service - Electronic Product Fulfillment (EPF): The U.S. Postal Service uploads daily the SD metrics of mailpieces. Contractor to downloaded these metrics on a daily basis from the password protected EPF site. There are two 

files per day, one is the delimited SD file and the other contains a fixed length file of the SD plus ACS metrics. The 

contractor retains these downloaded files for each Print Order and store in a secure location.

First metrics report to be downloaded daily and puts into the weekly reports will be linked to the Print Order as follows:

• Short Date field of the EPF download results for each day.

• UAA Code for each Beneficiary Name for each mail piece that was SD. 

• How many pieces delivered.

• How many pieces were forward, ACS counts and ACS forwarding counts.

Second metrics report provides beneficiary level data of ACS/SD records that contain PII.

The contractor must provide all mailing materials, as well as all labeling and marking, as necessary to fulfill mailing and 

distribution requirements. Noncompliance with the packing and labeling instructions will be cause for the government to 

take corrective action in accordance with GPO Pub. 310.2.

Contractor may be responsible for any postage fees related to undeliverable notices caused by print quality control issues.

Any address/mail management related questions/issues should be directed to Erika Grant, at (410) 786-1067, or e-mail 

erika.grant@cms.hhs.gov or Cynthia Williams, at (410) 786-6071, or e-mail cynthia.williams@cms.hhs.gov at CMS 

respectively.

VERIFICATION OF PRODUCTION AND MAILING

Contractor will be responsible for validating the integrity of every notice produced in all phases of printing, inserting and 

mailing and to ensuring all notices received from CMS were correctly entered into the United States postal system. 

Contractor must furnish a state-by-state count of all notices mailed, identifying state and numbers of copies mailed to that 

state. Include information with copies to Mark Rydberg, mark.rydberg@cms.hhs.gov.
Medicare QHC Notices Page 17 of 42

2571-S (11/23)

DISTRIBUTION

Mail f.o.b. contractor’s city using contractor printed “First Class Postage and Fees Paid Permit” imprint to Domestic 

addresses. The contractor will be required to provide mailing under the provided CMS “G-28” permit imprint via presorted “First Class Mail, U.S. Postage & Fees Paid”.

The contractor is cautioned that “Postage and Fees Paid” indicia may be used only for the purpose of mailing material 

produced under the contract. All copies mailed must conform to the appropriate regulations in the U.S. Postal Service 

manuals for “Domestic Mail” as applicable.

CERTIFICATE OF CONFORMANCE AND USPS FORMS

When using Permit Imprint Mail the contractor must complete GPO Form 712 Certificate of Conformance (Rev. 1-85) 

and the appropriate mailing statement or statements required by USPS for full-service IMb. GPO Form 712 is available at 

www.gpo.gov.

MAILING STATEMENTS

Contractor must complete and supply all copies of all USPS forms (including appropriate USPS Form 3602) and GPO 

712’s to GPO and CMS within 1 workday of USPS certification. Copies of all mailing statements shall be e-mailed to

GPO, infonortheast@gpo.gov; Mark Rydberg, mark.rydberg@cms.hhs.gov; Erika Grant, erika.grant@cms.hhs.gov; and 

Cynthia Williams, cynthia.williams@cms.hhs.gov. The Program, Print Order Number, and “Mailing Statements” must 

appear in the e-mail “Subject” line. Copies must be submitted with contractor’s invoice to GPO for payment.

SCHEDULE

Adherence to this schedule must be maintained. Contractor must not start production of any job prior to receipt of the 

individual print order (GPO Form 2511) and furnished material.

The schedule begins when GPO Form 2511 (Print Order) and furnished files have been successfully downloaded from the 

TIBCO site and confirmation is provided to CMS.

Contractor will be notified via e-mail when electronic files are available in TIBCO mailbox. E-mail notification will 

include the number of copies and pages printed/imaged in English and in Spanish that are to be generated for each notice 

letter on each print order. In the event that multiple print orders are placed, CMS reserves the right to indicate which print 

order will be mailed first.

Contractor will have 60 minutes to download and confirm receipt of files and verify the quantity to be produced. 

Confirmation to be sent to mark.rydberg@cms.hhs.gov and infonortheast@gpo.gov. Contractor will have one workday to 

submit proofs to CMS. Proofs will be held for up to three workdays. Complete production and mailing of all Correction 

and Replacement Notices must be completed 5 workdays after proof approval.

The contactor shall e-mail a production report for print order. The production report is to be created in Excel 2019 or 

higher and shall include the total quantity printed, inserted, and mailed for each print order. The production report is to be 

e-mailed to mark.rydberg@cms.hhs.gov and to infonortheast@gpo.gov. If reports are not received the day after mailing is 

completed, the contractor may be subject to adverse action on the contract.

The ship/deliver date indicated on the print order is the date that all notices must be mailed.

RECEIPT FOR DELIVERY

Contractor must furnish their own receipts for delivery. These receipts must include the GPO jacket, program, and print 

order numbers, total quantity delivered, number of cartons, and quantity per carton, date delivery made, and signature of 

the Government agent accepting delivery.

Unscheduled material such as shipping documents, receipts or instructions, delivery lists, labels, etc., will be furnished 

with the order or shortly thereafter. In the event such information is not received in due time, the contractor will not be 

relieved of any responsibility in meeting the shipping schedule because of failure to request such information.
Medicare QHC Notices Page 18 of 42

2571-S (11/23)

SECTION 3. – DETERMINATION OF AWARD

The Government will determine the lowest bid by applying the prices offered in the “Schedule of Prices” to the following 

units of production which are the estimated requirements to produce 1 year’s orders under this contract. These units do 

not constitute, nor are they to be construed as, a guarantee of the volume of work which may be ordered for a like period 

of time.

The following item designations correspond to those listed in the “Schedule of Prices”.

I. (1) (2)

(a) 972 84

(b) 24 3

(c) 402 43

(d) 1,398 84

II. (a) 3,056

(b) 6,112

(c) 1,528

(d) 4,584

III. (a) 4,584

(b) 1,528
Medicare QHC Notices Page 19 of 42

2571-S (11/23)

SECTION 4. – SCHEDULE OF PRICES

Bids offered are f.o.b. contractor’s city by permit imprint.

Prices must be submitted for the entire term of the contract and bids qualified for a lesser period will not be considered.

Prices must include the cost of all required materials and operations for each item listed in accordance with these 

specifications.

Bidder must make an entry in each of the spaces provided. Bids submitted with any obliteration, revision, or alteration of 

the order and manner of submitting bids, may be declared nonresponsive.

An entry of NC (No Charge) shall be entered if bidder intends to furnish individual items at no charge to the Government.

Bids submitted with NB (No Bid), NA (Not Applicable), or blank spaces for an item may be declared nonresponsive.

The Contracting Officer reserves the right to reject any offer that contains prices for individual items of production 

(whether or not such items are included in the Determination of Award) that are inconsistent or unrealistic in regard to 

other prices in the same offer or to GPO prices for the same operation if such action would be in the best interest of the 

Government.

All vouchers submitted to the GPO shall be based on the most economical method of production.

Fractional parts of 100 will be prorated at the 100 rate.

I. FILE PROCESSING: The prices offered must be all-inclusive in accordance with these specifications and shall 

include the cost of all required materials and operations for downloading and preparing print files.

English Spanish

(1) (2)

(a) Initial Notices............................................................. per 100 records.................... $__________ $__________

(b) Correction Notices..................................................... per 100 records.................... $__________ $__________

(c) Replacement Notices ................................................. per 100 records.................... $__________ $__________

(d) Secure Destruct Reports (when total mailing

exceeds 499 mail pieces) ........................................... per 100 mailed records........ $__________ $__________

II. PRINTING/IMAGING, TRIMMING TO SIZE, ASSEMBLY, FOLDING, AND INSERTING: The prices 

offered must be all-inclusive in accordance with these specifications and shall include the cost of all required materials 

and operations for complete production except for Items III. Stock/Paper

(a) Printing/Imaging variable data pages......................... per 100 printed pages.................$ _____________

(b) Printing/Imaging static data pages............................. per 100 printed pages.................$ _____________

(c) Printing/Imaging mailing envelopes.......................... per 100 envelopes.......................$ _____________

(d) Collating, folding, and inserting into envelope.......... per 100 leaves.............................$ _____________

__________

(Initials)

RETURN THIS PAGE TO US GPO, NORTHEAST REGION
Medicare QHC Notices Page 20 of 42

2571-S (11/23)

SCHEDULE OF PRICES

III. STOCK/PAPER: Payment for all stock/paper supplied by the contractor under the terms of these specifications, as 

ordered on the individual print orders, will be based on the net number of leaves furnished for the product(s). The cost of 

any paper required for make-ready or running spoilage must be included in the prices offered.

(a) White Uncoated Text (50 lbs.) or White Plain Copier,

Xerographic (20 lbs.) .............................................................. per 100 envelopes..........$ _____________

(b) White Writing/Wove Mailing Envelope (20 or 24 lbs.) ......... per 100 envelopes..........$ _____________

LOCATION OF POST OFFICE: All mailing will be made from the Post Office located at:

Street Address __________________________________________________________________________________

City __________________________________________________________ , State _______ Zip Code _________

__________

(Initials)

RETURN THIS PAGE TO US GPO, NORTHEAST REGION
Medicare QHC Notices Page 21 of 42

2571-S (11/23)

SCHEDULE OF PRICES

SHIPMENT(S): Shipments will be made from: City _________________________, State ____________

The city(ies) indicated above will be used for evaluation of transportation charges when shipment f.o.b. contractor’s city 

is specified. If no shipping point is indicated above, it will be deemed that the bidder has selected the city and state shown 

below in the address block, and the bid will be evaluated and the contract awarded on that basis. If shipment is not made 

from evaluation point, the contractor will be responsible for any additional shipping costs incurred.

DISCOUNTS: Discounts are offered for payment as follows: __________ Percent, __________ calendar days. See 

Article 12 “Discounts” of Solicitations Provisions in GPO Contract Terms (Publication 310.2).

AMENDMENT(S): Bidder hereby acknowledges amendment(s) number(ed) _______________________

BID ACCEPTANCE PERIOD: In compliance with the above, the undersigned agree, if this bid is accepted within 

__________ calendar days (60 calendar days unless a different period is inserted by the bidder) from the date for receipt 

of bids, to furnish the specified items at the price set opposite each item, delivered at the designated point(s), in exact 

accordance with specifications.

NOTE: Failure to provide a 60-day bid acceptance period may result in expiration of the bid prior to award.

BIDDER’S NAME AND SIGNATURE: Unless specific written exception is taken, the bidder, by signing and 

submitting a bid, agrees with and accepts responsibility for all certifications and representations as required by the 

solicitation and GPO Contract Terms – Publication 310.2. When responding by fax or mail, fill out and return one copy of 

all pages in “SECTION 4. – SCHEDULE OF PRICES,” including initialing/signing where indicated.

Failure to sign the signature block below may result in the bid being declared non-responsive.

Bidder 

(Contractor Name) (GPO Contractor’s Code)

(Street Address)

(City – State – Zip Code)

By 

(Printed Name, Signature, and Title of Person Authorized to Sign this Bid) (Date)

(Person to be Contacted) (Telephone Number) (Email)

THIS SECTION FOR GPO USE ONLY

Contracting Officer: ___________ Date __________ Certifier: ___________ Date ___________

(Initials) (Initials)

RETURN THIS PAGE TO US GPO, NORTHEAST REGION
Medicare QHC Notices Page 22 of 42

2571-S (11/23)

SECTION 5. – CMS SECURITY SPECIFICATIONS

THE REQUIREMENTS UNDER THIS SECTION WILL BE ADMINISTERED BY A CMS SECURITY 

REPRESENTATIVE (NAME AND CONTACT INFORMATION WILL BE PROVIDED AT TIME OF 

AWARD).

CMS INFORMATION SECURITY (APR 2013)

FAR 52.227-14 Rights in Data – General (May 2014).

As prescribed in 27.409(b)(1), insert the following clause with any appropriate alternates:

(a) Definitions. As used in this clause--

“Computer database” or “database” means a collection of recorded information in a form capable of, and for the purpose 

of, being stored in, processed, and operated on by a computer. The term does not include computer software.

“Computer software”—

(1) Means

(i) Computer programs that comprise a series of instructions, rules, routines, or statements, 

regardless of the media in which recorded, that allow or cause a computer to perform a 

specific operation or series of operations; and

(ii) Recorded information comprising source code listings, design details, algorithms, processes, 

flow charts, formulas, and related material that would enable the computer program to be 

produced, created, or compiled.

(2) Does not include computer databases or computer software documentation.

“Computer software documentation” means owner’s manuals, user’s manuals, installation instructions, 

operating instructions, and other similar items, regardless of storage medium, that explain the capabilities of 

the computer software or provide instructions for using the software.

“Data” means recorded information, regardless of form or the media on which it may be recorded. The term 

includes technical data and computer software. The term does not include information incidental to contract 

administration, such as financial, administrative, cost or pricing, or management information.

“Form, fit, and function data” means data relating to items, components, or processes that are sufficient to 

enable physical and functional interchangeability, and data identifying source, size, configuration, mating, and 

attachment characteristics, functional characteristics, and performance requirements. For computer software it 

means data identifying source, functional characteristics, and performance requirements but specifically 

excludes the source code, algorithms, processes, formulas, and flow charts of the software.

“Limited rights” means the rights of the Government in limited rights data as set forth in the Limited Rights 

Notice of subparagraph (g)(2) if included in this clause.

“Limited rights data” means data, other than computer software, that embody trade secrets or are commercial 

or financial and confidential or privileged, to the extent that such data pertain to items, components, or 

processes developed at private expense, including minor modifications.

“Restricted computer software” means computer software developed at private expense and that is a trade 

secret; is commercial or financial and is confidential or privileged; or is copyrighted computer software, 

including minor modifications of the computer software.
Medicare QHC Notices Page 23 of 42

2571-S (11/23)

“Restricted rights,” as used in this clause, means the rights of the Government in restricted computer software, 

as set forth in a Restricted Rights Notice of paragraph (g) if included in this clause, or as otherwise may be 

provided in a collateral agreement incorporated in and made part of this contract, including minor 

modifications of such computer software.

“Technical data” means recorded information (regardless of the form or method of the recording) of a 

scientific or technical nature (including computer databases and computer software documentation). This term 

does not include computer software or financial, administrative, cost or pricing, or management data or other 

information incidental to contract administration. The term includes recorded information of a scientific or 

technical nature that is included in computer databases (See 41 U.S.C. 116).

“Unlimited rights” means the right of the Government to use, disclose, reproduce, prepare derivative works, 

distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, 

and to have or permit others to do so.

(b) Allocation of rights.

(1) Except as provided in paragraph (c) of this clause, the Government shall have unlimited rights in—

(i) Data first produced in the performance of this contract;

(ii) Form, fit, and function data delivered under this contract;

(iii) Data delivered under this contract (except for restricted computer software) that constitute manuals or 

instructional and training material for installation, operation, or routine maintenance and repair of 

items, components, or processes delivered or furnished for use under this contract; and

(iv) All other data delivered under this contract unless provided otherwise for limited rights data or 

restricted computer software in accordance with paragraph (g) of this clause.

(2) The Contractor shall have the right to—

(i) Assert copyright in data first produced in the performance of this contract to the extent provided in 

paragraph (c)(1) of this clause;

(ii) Use, release to others, reproduce, distribute, or publish any data first produced or specifically used by 

the Contractor in the performance of this contract, unless provided otherwise in paragraph (d) of this 

clause;

(iii) Substantiate use of, add or correct limited rights, restricted rights, or copyright notices and to take 

other appropriate action, in accordance with paragraphs (e) and (f) of this clause; and

(iv) Protect from unauthorized disclosure and use those data that are limited rights data or restricted 

computer software to the extent provided in paragraph (g) of this clause.

(c) Copyright—

(1) Data first produced in the performance of this contract.

(i) Unless provided otherwise in paragraph (d) of this clause, the Contractor may establish, without prior 

approval of the Contracting Officer, claim to copyright in scientific and technical articles based on or 

containing data first produced in the performance of this contract and published in academic, 

technical or professional journals, symposia proceedings or similar works. The prior, express written 

permission of the Contracting Officer is required to assert copyright in all other data first produced 

in the performance of this contract.
Medicare QHC Notices Page 24 of 42

2571-S (11/23)

(ii) When authorized to assert copyright to the data, the Contractor shall affix the applicable copyright 

notices of 17 U.S.C. 401 or 402, and acknowledgment of Government sponsorship (including 

contract number).

(iii) For data other than computer software, the Contractor grants to the Government, and others acting on 

its behalf, a paid-up, nonexclusive, irrevocable worldwide license in such copyrighted data to 

reproduce, prepare derivative works, distribute copies to the public, and perform publicly and 

display publicly, by or on behalf of the Government. For computer software, the Contractor grants to 

the Government and others acting on its behalf, a paid-up nonexclusive, irrevocable worldwide 

license in such copyrighted computer software to reproduce, prepare derivative works, and perform 

publicly and display publicly (but not to distribute copies to the public) by or on behalf of the 

Government.

(2) Data not first produced in the performance of this contract. The Contractor shall not, without prior written 

permission of the Contracting Officer, incorporate in data delivered under this contract any data not first 

produced in the performance of this contract unless the Contractor—

(i) Identifies the data; and

(ii) Grants to the Government, or acquires on its behalf, a license of the same scope as set forth in 

subparagraph (c)(1) of this clause or; if such data are restricted computer software, the Government 

shall acquire a copyright license as set forth in subparagraph (g)(4) of this clause (if included in this 

contract) or as otherwise provided in a collateral agreement incorporated in or made part of this 

contract.

(3) Removal of copyright notices. The Government will not remove any authorized copyright notices placed on

data pursuant to this paragraph (c), and will include such notices on all reproductions of the data.

(d) Release, publication and use of data. The Contractor shall have the right to use, release to others, reproduce, distribute, 

or publish any data first produced or specifically used by the Contractor in the performance of this contract, except—

(1) As prohibited by Federal law or regulation (e.g., export control or national security laws or regulations);

(2) As expressly set forth in this contract; or

(3) If the Contractor receives or is given access to data necessary for the performance of this contract which 

contain restrictive markings, the Contractor shall treat the data in accordance with such markings unless 

otherwise specifically authorized otherwise in writing by the Contracting Officer.

(e) Unauthorized marking of data.

(1) Notwithstanding any other provisions of this contract concerning inspection or acceptance, if any data 

delivered under this contract are marked with the notices specified in paragraph (g)(3) or (g)(4) of this clause 

and use of the notices is not authorized by this clause, or if such data bears any other restrictive or limiting 

markings not authorized by this contract, the Contracting Officer may at any time either return the data to the 

Contractor, or cancel or ignore the markings. However, pursuant to 41 U.S.C. 4703, the following procedures 

shall apply prior to canceling or ignoring the markings.

(i) The Contracting Officer will make written inquiry to the Contractor affording the Contractor 60 days 

from receipt of the inquiry to provide written justification to substantiate the propriety of the 

markings;
Medicare QHC Notices Page 25 of 42

2571-S (11/23)

(ii) If the Contractor fails to respond or fails to provide written justification to substantiate the propriety of 

the markings within the 60-day period (or a longer time approved in writing by the Contracting 

Officer for good cause shown), the Government shall have the right to cancel or ignore the markings 

at any time after said period and the data will no longer be made subject to any disclosure 

prohibitions.

(iii) If the Contractor provides written justification to substantiate the propriety of the markings within the 

period set in subdivision (e)(1)(i) of this clause, the Contracting Officer will consider such written 

justification and determine whether or not the markings are to be canceled or ignored. If the 

Contracting Officer determines that the markings are authorized, the Contractor will be so notified in 

writing. If the Contracting Officer determines, with concurrence of the head of the contracting 

activity, that the markings are not authorized, the Contracting Officer will furnish the Contractor a 

written determination, which determination shall become the final agency decision regarding the 

appropriateness of the markings unless the Contractor files suit in a court of competent jurisdiction 

within 90 days of receipt of the Contracting Officer’s decision. The Government shall continue to 

abide by the markings under this paragraph (e)(1)(iii) until final resolution of the matter either by the 

Contracting Officer’s determination becoming final (in which instance the Government will 

thereafter have the right to cancel or ignore the markings at any time and the data will no longer be 

made subject to any disclosure prohibitions), or by final disposition of the matter by court decision if 

suit is filed.

(2) The time limits in the procedures set forth in subparagraph (e)(1) of this clause may be modified in accordance 

with agency regulations implementing the Freedom of Information Act (5 U.S.C. 552) if necessary to respond to a 

request thereunder.

(3) Except to the extent the Government’s action occurs as the result of final disposition of the matter by a court 

of competent jurisdiction, the Contractor is not precluded by paragraph (e) of this clause from brining a claim, in 

accordance with the Disputes clause of this contract, that may arise as a result of the Government removing or 

ignoring authorized markings on data delivered under this contract.

(f) Omitted or incorrect markings.

(1) Data delivered to the Government without any restrictive markings shall be deemed to have been furnished 

with unlimited rights. The Government is not liable for the disclosure, use, or reproduction of such data.

(2) If the unmarked data has not been disclosed without restriction outside the Government, the Contractor may 

request, within 6 months (or a longer time approved by the Contracting Officer in writing for good cause shown) 

after delivery of such data, permission to have authorized notices placed on qualifying data at the Contractor’s 

expense, and the Contracting Officer may agree to do so if the Contractor—

(i) Identifies the data to which the omitted notice is to be applied;

(ii) Demonstrates that the omission of the notice was inadvertent;

(iii) Establishes that the use of the proposed notice is authorized; and

(iv) Acknowledges that the Government has no liability for the disclosure, use, or reproduction of any 

data made prior to the addition of the notice or resulting from the omission of the notice.

(3) If data has been marked with an incorrect notice, the Contracting Officer may—

(i) Permit correction of the notice at the Contractor’s expense if the Contractor identifies the data and 

demonstrates that the correct notice is authorized, or

(ii) Correct any incorrect notices.
Medicare QHC Notices Page 26 of 42

2571-S (11/23)

(g) Protection of limited rights data and restricted computer software.

(1) The Contractor may withhold from delivery qualifying limited rights data or restricted computer software that 

are not data identified in paragraphs (b)(1)(i), (ii), and (iii) of this clause. As a condition to this withholding, the 

Contractor shall—

(i) Identify the data being withheld; and

(ii) Furnish form, fit, and function data instead.

(2) Limited rights data that are formatted as a computer database for delivery to the Government shall be treated 

as limited rights data and not restricted computer software.

(3) [Reserved]

(h) Subcontracting. The Contractor shall obtain from its subcontractors all data and rights therein necessary to fulfill the 

Contractor’s obligations to the Government under this contract. If a subcontractor refuses to accept terms affording the 

Government such rights, the Contractor shall promptly notify the Contracting Officer of the refusal and shall not proceed 

with the subcontract award without authorization in writing from the Contracting Officer.

(i) Relationship to patents or other rights. Nothing contained in this clause shall imply a license to the Government under 

any patent or be construed as affecting the scope of any license or other right otherwise granted to the Government.

(end of clause)

All CMS information shall be protected from unauthorized access, use, disclosure, duplication, modification, diversion, or 

destruction, whether accidental or intentional, in order to maintain the security, confidentiality, integrity, and availability 

of such information. Therefore, if this contract requires the contractor to provide services (both commercial and noncommercial) for Federal Information/Data, to include any of the following requirements:

• Process any Information/Data; or

• Store any Information/Data (includes “Cloud” computing services); or

• Facilitate the transport of Information/Data; or

• Host/maintain Information/Data (including software and/or infrastructure developer/maintainers); or

• Have access to, or use of, Personally Identifiable Information (PII), including instances of remote access to, or 

physical removal of, such information beyond agency premises or control,

The contractor shall become and remain compliant with the requirements set forth at the CMS Information Security 

website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-ClauseProvision.html. The requirements cover all CMS contracts and associated deliverables, which are required on a “per 

contractor” basis.

The contractor shall ensure that the following Federal information security standards are met for all of its CMS contracts:

• Federal Information Security Management Act (FISMA) – FISMA information can be found at 

http://csrc.nist.gov/groups/SMA/fisma/index.html. FISMA requires each Federal agency to develop, 

document, and implement an agency-wide program to provide information security for the information and 

information systems that support the operations and assets of the agency, including those provided or 

managed by another agency, contractor, or other source; and,

• Federal Risk and Authorization Management Program (FedRAMP) – FedRAMP information can be 

found at http://www.gsa.gov/portal/category/102371. The FedRAMP is a government-wide program that 

provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud 

products and services.
Medicare QHC Notices Page 27 of 42

2571-S (11/23)

The Contractor shall include in all awarded subcontracts the FISMA/FedRAMP compliance requirements set forth at the 

CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-ClauseProvision.html.
Medicare QHC Notices Page 28 of 42

2571-S (11/23)

HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, shall be 

administered in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA,” 42 U.S.C. § 

1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the 

corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor’s duties and 

obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered 

elsewhere in the Contract.

The following definitions apply to this Contract Clause:

“Business Associate” shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it uses 

individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS’ HIPAA-covered functions.

“Covered Entity” shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

“Secretary” shall mean the Secretary of the Department of Health & Human Services or the Secretary’s designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on 

behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and 

Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA 

requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or 

on behalf of, Covered Entity other than as permitted or required by this Contract or as required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against 

any individual for:

A. Filing a complaint under 45 CFR § 160.306;

B. Testifying, assisting or participating in an investigation, compliance review, proceeding or 

hearing under 45 CFR Part 160; or

C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief 

that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not 

involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its security 

policies and procedures, including workforce security measures, to ensure proper security awareness 

and training (including security incident response and reporting), and security incident procedures, in 

accordance with this Contract, including this HIPAA Business Associate Clause and the Contract’s 

clause entitled “CMS Information Security.”

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI created, 

received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as 

provided for by this Contract. In doing so, it shall implement policies and procedures to address the 

following and, where applicable, ensure that such policies and procedures are also in conformance with 

this Contract’s clause entitled “CMS Information Security:”
Medicare QHC Notices Page 29 of 42

2571-S (11/23)

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual’s access rights to PHI (including 

the implementation of workforce security measures to ensure continued appropriate rolebased access to PHI), and technical policies and procedures to ensure compliance with 

grants of access (including unique user identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities in which 

they are housed.

C. Implement policies, procedures and physical security measures that will limit access to PHI 

through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or outside of 

the Business Associate’s facility as well as the disposal and reuse of media containing PHI.

E. Implement appropriate administrative, physical and technical safeguards that reasonably and 

appropriately protect the confidentiality, integrity and availability (including the use of contingency 

plans) of any electronic protected health information (“EPHI”) it creates, receives, maintains or 

transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, 

maintenance or transmission of such EPHI. In the establishment of such safeguards, Business 

Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, 

and its hardware and software security capabilities.

iii. Assess, and implement, where appropriate, any addressable implementation specifications associated with 

applicable PHI security standards.

iv. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or 

disclosure of PHI by Business Associate in violation of the requirements of this Contract.

v. Comply with the following Incident Reporting:

A. Report to Covered Entity any security incident/breach involving unsecured PHI, of which it becomes 

aware, including those of its agents and subcontractors. The Business Associate shall report any 

violation of the terms of this contract involving PHI and any security incidents/breaches involving 

unsecured PHI to CMS within one (1) hour of discovery in accordance with the CMS Risk 

Management Handbook (RMH), specifically “RMH Vol II Procedure 7-2 Incident Handling 

Procedure” and “RMH Vol III Standard 7-1 Incident Handling.” These procedures can be found at 

http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-InformationTechnology/InformationSecurity/Information-Security-Library.html In addition, the Business 

Associate will also notify the CMS Contracting Officer and the Contracting Officer’s Representative 

(COR) by email within one (1) hour of identifying such violation or incident.

B. Upon Covered Entity's knowledge of any material security incident/breach by Business Associate, 

Covered Entity will provide an opportunity for Business Associate to cure the breach or end the 

violation consistent with the termination clause of this Contract. See also paragraph D. Term of 

Clause below.

vi. Ensure that any agent or subcontractor agrees through a written contract, or other legally enforceable 

arrangement, to the same restrictions and conditions that apply through this HIPAA Contract Clause, 

when creating, receiving, maintaining or transmitting PHI from, or on behalf of, Covered Entity.

vii. Upon Covered Entity’s request:
Medicare QHC Notices Page 30 of 42

2571-S (11/23)

A. Provide the Covered Entity or its designee with access to the PHI created, received, maintained 

or transmitted by Business Associate from or on behalf of the Covered Entity in the course of 

contract performance in order to ensure Covered Entity’s ability to meet the requirements under 

45 CFR § 164.524.

B. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR §

164.526.

viii. Make its facilities and any books, records, accounts, and any sources of PHI, including any policies and 

procedures, that are pertinent to ascertaining its own compliance with this contract or the Covered 

Entity’s compliance with the applicable HIPAA requirements, available to Covered Entity, or, in the 

context of an investigation or compliance review, to the Secretary for purposes of the Secretary 

determining Covered Entity's compliance with the various rules implementing the HIPAA.

ix. Document disclosures of PHI and information related to such disclosures as would be required for 

Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in 

accordance with 45 CFR § 164.528.

x. Provide to Covered Entity, or an individual identified by the Covered Entity, information collected 

under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting 

of disclosures of PHI in accordance with 45 CFR § 164.528.

xi. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to 

accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent that such 

limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent that such 

changes may affect Business Associate’s use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 

164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

d. Term of Clause

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of the 

PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered Entity, or 

created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered 

Entity in accordance with “CMS Information Security” procedures. Business Associate shall not retain any 

PHI.

2. Security Incident/Breach:

Upon Covered Entity’s knowledge of a material breach by Business Associate, Covered Entity shall take 

action consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts – Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of Contracts, if the Business 

Associate does not cure the security incident/breach within the time specified by Covered Entity 

and/or cure is not possible; or,

B. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

ii. Other Agreements –Covered Entity shall either:

A. Provide an opportunity for Business Associate to cure the breach or end the violation consistent with 

the termination terms of this Contract. Covered Entity may terminate this Contract for default if the 

Business Associate does not cure the breach or end the violation within the time specified by Covered 

Entity; or,
Medicare QHC Notices Page 31 of 42

2571-S (11/23)

B. Consistent with the terms of this Contract, terminate this Contract for default if Business Associate 

has breached a material term of this Contract and cure is not possible; or,

C. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

3. Returning or Destroying PHI:

Business Associate, as defined above, which includes subcontractors or agents of the Contractor, shall:

i.Upon expiration or termination of this Contract, for any reason, return or destroy all PHI received from 

Covered Entity or another Business Associate of the Covered Entity, as well as any PHI created, received, 

maintained or transmitted from or on behalf of Covered Entity, or another Business Associate of the 

Covered Entity, in accordance with this contract, including the “CMS Information Security” clause.

ii. In the event that Business Associate determines that returning or destroying the PHI is infeasible, provide 

to Covered Entity notification of the conditions that make return or destruction infeasible. Upon such 

notice that return or destruction of PHI is infeasible, Business Associate shall extend the protections of 

this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make 

the return or destruction infeasible, for so long as Business Associate maintains such PHI.

e. Miscellaneous

1. A reference in this Contract to a section in the Rules issued under HIPAA means the section as in effect or as 

amended.

2. The respective rights and obligations of Business Associate under paragraph D.3.b of the section entitled 

“Term of Clause” shall survive the termination of this Contract.

Any ambiguity in this Contract clause shall be resolved to permit Covered Entity to comply with the Rules 

implemented under HIPAA.
Medicare QHC Notices Page 32 of 42

2571-S (11/23)

CMS SPECIFIC PROVISIONS FOR HIGH VISIBILITY/HIGH PUBLIC INTEREST CONTRACTS (OCT 2013)

OPEN GOVERNMENT PROACTIVE PREDISCLOSURE NOTIFICATION (OCT 2013)

In order to reduce the administrative burden of responding to Freedom of Information Act (FOIA) requests for high 

visibility/high public interest contracts throughout contract administration, the Contractor shall submit its review of the 

awarded contract (and contract modifications, if requested) for FOIA disclosure exemptions within thirty (30) calendar 

days of contract award. The review will substantiate “...Trade secrets and commercial or financial information obtained 

from a person and privileged or confidential...” information, in accordance with 5 U.S.C. §552 FOIA, Exemption (b)(4), 

which could reasonably be expected to cause substantial competitive harm.

Submissions: The Contractor shall submit one (1) Compact Disc (CD) or Digital Video Disc (DVD) with all 5 U.S.C. 

§552 FOIA, Exemption (b)(4), “...Trade Secrets, Commercial or Financial Information Which is Privileged or 

Confidential...,” otherwise known as public release/non-Confidential Business Information (non-CBI), with the 

information identified as follows: 

a. CBI Highlighted Copy of Contract: One copy of the contract with all CBI highlighted for CMS FOIA review.

b. Contractor Proposed Redacted Public Release Copy of Contract: An additional copy of the contract will be 

provided for public release with all the identified information redacted. Redactions shall be made using “black” 

boxes, which cannot be removed or uncovered by a reader.

c. Pre-Disclosure Concerns - Comments/Rationale for Non-Disclosure of Trade Secrets, Commercial or 

Financial Information Which is Privileged or Confidential: The Contractor shall provide, in a separate file, 

rationale for why disclosure of “...Trade Secrets, Commercial or Financial Information Which is Privileged or 

Confidential...” would cause the Contractor organization substantial competitive harm if disclosed to other 

entities. Rationale shall be provided for each individual recommended redaction. Generalized conclusions of 

competitive harm are not a sufficient basis for the CMS FOIA office to invoke the exemption and thereby protect 

the Contractor’s interest.

All CD/DVDs shall be mailed to the CMS FOIA Officer (address below) within thirty (30) calendar days of contract 

award and within thirty (30) calendar days of a CMS request, i.e. existing or modified contracts. All CD/DVD files shall 

be submitted as Portable Document Format (.pdf) files. 

CD/DVD and File Naming Conventions: The Contractor shall name the CD/DVD with the Contract Number and utilize 

the following CD/DVD file naming conventions:

HHSM-500-2013-xxxxxx – Highlighted

HHSM-500-2013-xxxxxx – Redacted

HHSM-500-2013-xxxxxx – Pre-Disclosure Concerns

CD/DVD shall be mailed to the CMS FOIA Officer at:

Centers for Medicare & Medicaid Services

Freedom of Information Act Office

ATTN: CMS FOIA Officer

Mailstop: N2-20-16

7500 Security Boulevard

Baltimore, MD 21244-1850

Copy: Correspondence Only (No CD/DVD):

Contracting Officer

Contracting Officer’s Representative (COR)

It should be noted that the CMS FOIA Office makes the final determination as to what information is released to the 

public, after considering any feedback from OAGM and/or the Contractor.
Medicare QHC Notices Page 33 of 42

2571-S (11/23)

CMS SECURITY CLAUSE

FAR 52.204-9 Personal Identity Verification of Contractor Personnel.

As prescribed in 4.1303, insert the following clause:

PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (JAN 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that 

implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance 

M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor 

employees in connection with performance under this contract. The Contractor shall return such identification to the 

issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these 

requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the 

subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine 

access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such

identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise 

approved in writing by the Contracting Officer.

(End of clause)

FAR 52.222-54 Employment Eligibility Verification.

As prescribed in 22.1803, Insert the following clause:

EMPLOYMENT ELIGIBILITY VERIFICATION (OCT 2015)

(a) Definitions. As used in this clause—

“Commercially available off-the-shelf (COTS) item”—

(1) Means any item of supply that is—

(i) A commercial item (as defined in paragraph (1) of the definition at 2.101);

(ii) Sold in substantial quantities in the commercial marketplace; and

(iii) Offered to the Government, without modification, in the same form in which it is sold in the commercial 

marketplace; and
Medicare QHC Notices Page 34 of 42

2571-S (11/23)

(2) Does not include bulk cargo, as defined in 46 U.S.C. 40102(4), such as agricultural products and petroleum 

products. Per 46 CFR 525.1 (c)(2), “bulk cargo” means cargo that is loaded and carried in bulk onboard ship without mark 

or count, in a loose unpackaged form, having homogenous characteristics. Bulk cargo loaded into intermodal equipment, 

except LASH or Seabee barges, is subject to mark and count and, therefore, ceases to be bulk cargo.

“Employee assigned to the contract” means an employee who was hired after November 6, 1986 (after November 27, 

2009 in the Commonwealth of the Northern Mariana Islands), who is directly performing work, in the United States, 

under a contract that is required to include the clause prescribed at 22.1803. An employee is not considered to be directly 

performing work under a contract if the employee—

(1) Normally performs support work, such as indirect or overhead functions; and

(2) Does not perform any substantial duties applicable to the contract.

“Subcontract” means any contract, as defined in 2.101, entered into by a subcontractor to furnish supplies or services 

for performance of a prime contract or a subcontract. It includes but is not limited to purchase orders, and changes and 

modifications to purchase orders.

“Subcontractor” means any supplier, distributor, vendor, or firm that furnishes supplies or services to or for a prime 

Contractor or another subcontractor.

“United States”, as defined in 8 U.S.C. 1101(a)(38), means the 50 States, the District of Columbia, Puerto Rico, Guam, 

the Commonwealth of the Northern Mariana Islands, and the U.S. Virgin Islands.

(b) Enrollment and verification requirements.

(1) If the Contractor is not enrolled as a Federal Contractor in E-Verify at time of contract award, the Contractor 

shall—

(i) Enroll. Enroll as a Federal Contractor in the E-Verify program within 30 calendar days of contract award;

(ii) Verify all new employees. Within 90 calendar days of enrollment in the E-Verify program, begin to use EVerify to initiate verification of employment eligibility of all new hires of the Contractor, who are working in the United 

States, whether or not assigned to the contract, within 3 business days after the date of hire (but see paragraph (b)(3) of 

this section); and

(iii) Verify employees assigned to the contract. For each employee assigned to the contract, initiate verification 

within 90 calendar days after date of enrollment or within 30 calendar days of the employee’s assignment to the contract, 

whichever date is later (but see paragraph (b)(4) of this section).

(2) If the Contractor is enrolled as a Federal Contractor in E-Verify at time of contract award, the Contractor shall 

use E-Verify to initiate verification of employment eligibility of—

(i) All new employees. 

(A) Enrolled 90 calendar days or more. The Contractor shall initiate verification of all new hires of the 

Contractor, who are working in the United States, whether or not assigned to the contract, within 3 business days after the 

date of hire (but see paragraph (b)(3) of this section); or 
Medicare QHC Notices Page 35 of 42

2571-S (11/23)

(B) Enrolled less than 90 calendar days. Within 90 calendar days after enrollment as a Federal Contractor in EVerify, the Contractor shall initiate verification of all new hires of the Contractor, who are working in the United States, 

whether or not assigned to the contract, within 3 business days after the date of hire (but see paragraph (b)(3) of this 

section); or 

(ii) Employees assigned to the contract. For each employee assigned to the contract, the Contractor shall initiate 

verification within 90 calendar days after date of contract award or within 30 days after assignment to the contract, 

whichever date is later (but see paragraph (b)(4) of this section). 

(3) If the Contractor is an institution of higher education (as defined at 20 U.S.C. 1001(a)); a State or local 

government or the government of a Federally recognized Indian tribe; or a surety performing under a takeover agreement 

entered into with a Federal agency pursuant to a performance bond, the Contractor may choose to verify only employees 

assigned to the contract, whether existing employees or new hires. The Contractor shall follow the applicable verification 

requirements at (b)(1) or (b)(2) respectively, except that any requirement for verification of new employees applies only 

to new employees assigned to the contract. 

(4) Option to verify employment eligibility of all employees. The Contractor may elect to verify all existing 

employees hired after November 6, 1986 (after November 27, 2009, in the Commonwealth of the Northern Mariana 

Islands), rather than just those employees assigned to the contract. The Contractor shall initiate verification for each 

existing employee working in the United States who was hired after November 6, 1986 (after November 27, 2009, in the 

Commonwealth of the Northern Mariana Islands), within 180 calendar days of—

(i) Enrollment in the E-Verify program; or

(ii) Notification to E-Verify Operations of the Contractor’s decision to exercise this option, using the contact 

information provided in the E-Verify program Memorandum of Understanding (MOU).

(5) The Contractor shall comply, for the period of performance of this contract, with the requirements of the EVerify program MOU. 

(i) The Department of Homeland Security (DHS) or the Social Security Administration (SSA) may terminate the 

Contractor’s MOU and deny access to the E-Verify system in accordance with the terms of the MOU. In such case, the 

Contractor will be referred to a suspension or debarment official. 

(ii) During the period between termination of the MOU and a decision by the suspension or debarment official 

whether to suspend or debar, the Contractor is excused from its obligations under paragraph (b) of this clause. If the 

suspension or debarment official determines not to suspend or debar the Contractor, then the Contractor must reenroll in 

E-Verify.

(c) Web site. Information on registration for and use of the E-Verify program can be obtained via the Internet at the 

Department of Homeland Security Web site: http://www.dhs.gov/E-Verify. 

(d) Individuals previously verified. The Contractor is not required by this clause to perform additional employment 

verification using E-Verify for any employee—

(1) Whose employment eligibility was previously verified by the Contractor through the E-Verify program;
Medicare QHC Notices Page 36 of 42

2571-S (11/23)

(2) Who has been granted and holds an active U.S. Government security clearance for access to confidential, secret, 

or top secret information in accordance with the National Industrial Security Program Operating Manual; or

(3) Who has undergone a completed background investigation and been issued credentials pursuant to Homeland 

Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and 

Contractors. 

(e) Subcontracts. The Contractor shall include the requirements of this clause, including this paragraph (e) 

(appropriately modified for identification of the parties), in each subcontract that—

(1) Is for—

(i) Commercial or noncommercial services (except for commercial services that are part of the purchase of a 

COTS item (or an item that would be a COTS item, but for minor modifications), performed by the COTS provider, and 

are normally provided for that COTS item); or 

(ii) Construction;

(2) Has a value of more than $3,500; and

(3) Includes work performed in the United States.

(End of clause)
Medicare QHC Notices Page 37 of 42

2571-S (11/23)

CMS SECURITY CLAUSE (APR 2016)

a. Applicability

In accordance with OMB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive 12 

(HSPD-12): Policy for a Common Identification Standard for Federal Employees and Contractors, dated August 27, 

2004, and Federal Information Processing Standard (FIPS) PUB Number 201-2, Personal Identity Verification (PIV) 

of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple applications by 

efficiently verifying the claimed identity of individuals seeking physical access to Federally controlled government 

facilities and/or logical access to federally controlled information systems. Contractors that require routine physical 

access to a CMS facility and/or routine access to a CMS federally controlled information system will be required to 

obtain a CMS issued PIV, PIV-I or Locally Based Physical Access card. FIPS PUB 201-2 specifies the architecture 

and technical requirements for a common identification standard for Federal employees and Contractors.

When a PIV or PIV-I card is provided, it shall be used in conjunction with a compliant card reader and middleware 

for logical system access. The Contractor shall (1) Include FIPS 201-2 compliant, HSPD-12 card readers with the 

purchase of servers, desktops, and laptops; and (2) comply with FAR 52.204-9, Personal Identity Verification of 

Contractor Personnel.

b. Definitions

“Agency Access” means access to CMS facilities, sensitive information, information systems or other CMS resources.

“Applicant” is a Contractor employee for whom the Contractor submits an application for a CMS identification card.

“Contractor Employee” means prime Contractor and subcontractor employees who require agency access to perform 

work under a CMS contract.

“Official station”— As defined by Federal Travel Regulations, An area defined by the agency that includes the 

location where the employee regularly performs his or her duties or an invitational traveler’s home or regular place of 

business. The area may be a mileage radius around a particular point, a geographic boundary, or any other definite 

domain, provided no part of the area is more than 50 miles from where the employee regularly performs his or her 

duties or from an invitational traveler’s home or regular place of business. If the employee’s work involves recurring 

travel or varies on a recurring basis, the location where the work activities of the employee’s position of record are 

based is considered the regular place of work.

“Federal Identification Card” (or “ID card”) means a federal government issued or accepted identification card such 

as a Personal Identity Verification (PIV) card, Personal Identity Verification-Interoperable (PIV-I) card, or a LocalBased Physical Access Card issued by CMS, or a Local-Based Physical Access Card issued by another Federal 

agency and approved by CMS. “Issuing Office” means the CMS entity that issues identification cards to Contractor 

employees.

“Locally Based Physical Access Card” means an access Card that is graphically personalized for visual identification, 

that does not contain an embedded computer chip, and is only used for physical access.

“Local Security Servicing Organization” means the CMS entity that provides security services to the CMS 

organization sponsoring the contract, Division of Physical Security and Strategic Information (DPSSI).

“Logical Access” means the ability for the Contractor to interact with CMS information systems, databases, digital 

infrastructure, or data via access control procedures such as identification, authentication, and authorization.

“Personal Identity Verification (PIV) card,” as defined in FIPS PUB 201-2, is a physical artifact (e.g., identity card, 

“smart” card) issued to an individual that contains a PIV Card Application which stores identity credentials (e.g., 

photograph, cryptographic keys, digitized fingerprint representation) so that the claimed identity of the cardholder can 

be verified against the stored credentials by another person (human readable and verifiable) or an automated process 

(computer readable and verifiable).
Medicare QHC Notices Page 38 of 42

2571-S (11/23)

“Personal Identity Verification-Interoperable (PIV-I) card” similar to a PIV card, is a physical artifact (e.g., identity 

card, “smart” card) issued to an individual that contains a PIV Card Application which stores identity credentials 

(e.g., photograph, cryptographic keys, digitized fingerprint representation) so that the claimed identity of the 

cardholder can be verified against the stored credentials by another person (human readable and verifiable) or an 

automated process (computer readable and verifiable). PIV-I cards are issued by a non-federal government entity to 

non-federal government staff. PIV-I cards are issued in a manner that allows federal relying parties to trust the cards. 

The PIV-I cards uses the same standards of vetting and issuance developed by the U.S. government for its employees

c. Screening of Contractor Employees

i. Contractor Screening of Applicants

1.Contractor Responsibility: The Contractor shall pre-screen individuals designated for employment 

under any CMS contract by verifying minimum suitability requirements to ensure that only qualified 

candidates are considered for contract employment. At the discretion of the government, the 

government reserves the right to request and/or review Contractor employee vetting processes. The 

federal minimum suitability requirements can be found below in section (c)(2)—Suitability 

Requirements, and are also contained in 5 CFR 731.202. The Contractor shall exercise due diligence 

in pre-screening all employees prior to submission to CMS for agency access.

2.Alien Status: The Contractor shall monitor an alien’s (foreign nationals) continued authorization for 

employment in the United States. If requested by the Agency, the Contractor shall provide 

documentation to the Contracting Officer (CO) or the Contracting Officer’s Representative (COR) 

that validates that the Employment Eligibility Verification (e-Verify) requirement has been met for 

each Contractor or sub-Contractor employee working on the contract in accordance with Federal 

Acquisition Regulation (FAR) 52.222-54 – Employment Eligibility Verification.

3.Residency Requirement: All CMS Contractor applicants shall have lived in the United States at least 

three (3) out of the last five (5) years prior to submitting an application for a Federal ID Card. CMS 

will process background investigations for foreign nationals in accordance with Office of Personnel 

Management (OPM) guidance. Contractor employees who worked for the U.S. Government as an 

employee overseas in a Federal or military capacity; and/or been a dependent of a U.S. Federal or 

military employee serving overseas, must be able to provide state-side reference coverage. State-side 

coverage information is required to make a suitability or security determination. Examples of stateside coverage information include: the state-side address of the company headquarters where the 

applicant’s personnel file is located, the state-side address of the Professor in charge of the applicant’s 

“Study Abroad” program, the religious organization, charity, educational, or other non-profit 

organization records for the applicant’s overseas missions, and/or the state-side addresses of anyone 

who worked or studied with the applicant while overseas.

4.Selective Service Registration: All males born after December 31, 1959, must meet the Federal 

Selective Service System requirements as established on www.sss.gov.

ii. Identification Card Application Process

ID Card Sponsor: The CMS Contracting Officer’s Representative (COR) will be the CMS ID card Sponsor and 

point of contact for the Contractor’s application for a CMS ID card. The COR will review and approve/deny the 

HHS ID Badge Request before the form is submitted to the CMS, Office of Support Services and Operations, 

(OSSO), Division of Personnel Security Services (DPS), for processing. If approved, an applicant may be issued 

either a Personal Identity Verification (PIV) or PIV- I card that meets the standards of HSPD-12 or a Local-Based 

Physical Access Card.
Medicare QHC Notices Page 39 of 42

2571-S (11/23)

Contractor Application Required Submissions: All applicants shall submit an HHS ID Badge Request form 

for issuance of a Federal ID Card. Unless otherwise directed by the ID Card Sponsor or DPS, applicants are

required to electronically submit the request form via CMS’ Enterprise User Administration (EUA) Electronic 

Front-end Interface (EFI) system, which is located at https://eua.cms.gov/efi. To assist users with the application 

process, a user’s guide is located at:https://www.cms.gov/About-CMS/Contracting-WithCMS/ContractingGeneralInformation/Contracting-Policy-and-Resources.html.

The EUA users guide link should be used to obtain the most current instructional guidance.

PIV Training: Contractors who need PIV or PIV-I card shall complete HHS PIV Applicant Training, which is 

found at https://www.cms.gov/About-CMS/Contracting-With-CMS/ContractingGeneralInformation/ContractingPolicy-and-Resources.html. A copy of the completion certificate shall be included with the EFI application.

CMS Applicant Evaluations: CMS will evaluate an applicant’s required access level. Once the review is 

complete and accepted for further processing, the applicant will be contacted by DPS to submit the below 

information, as applicable.

1. e-QIP: Contractor employees will be required to submit information into e-QIP, a web-based automated 

system that is designed to facilitate the processing of standard investigative forms used when conducting 

background investigations for Federal security, suitability, fitness and credentialing purposes.

2. Fingerprints: Instructions for obtaining fingerprints will be provided by CMS, OSSO, DPS.

3. OF 306: Contractor employees may be required to complete the Optional Form (OF) 306, Declaration 

for Federal Employment which can be found at https://www.opm.gov/forms/pdf_fill/of0306.PDF.

4. Access to Restricted Area(s): The CMS COR will initiate all Federal ID card holders’ physical access 

requests via Physical Access Control System (PACS) Central at https://pam.cms.local.

Suitability Requirements: CMS may decline to grant agency access to a Contractor employee including, but not 

limited to, any of the criteria cited below:

1. Misconduct or negligence in employment;

2. Criminal or dishonest conduct;

3. Material, intentional false statement, or deception or fraud in examination or appointment;

4. Refusal to furnish testimony as required by § 5.4 of 5 CFR 731.202;

5. Alcohol abuse, without evidence of substantial rehabilitation, of a nature and duration that suggests that 

the applicant or appointee would be prevented from performing the duties of the position in question, or 

would constitute a direct threat to the property or safety of the applicant or appointee or others;

6. Illegal use of narcotics, drugs, or other controlled substances without evidence of substantial 

rehabilitation;

7. Knowing and willful engagement in acts or activities designed to overthrow the U.S. Government by 

force; and

8. Any statutory or regulatory bar which prevents the lawful employment of the person involved in the 

position in question.

Badge Issuance: Upon approval of the badging application process and prior to starting work on the contract, 

applicants whose official station is located within 50 miles from CMS’ central office or one of its regional offices 

will be contacted to appear in person, at least two times (estimated at one hour for each visit), and shall provide 

two (2) original forms of identity source documents in order to generate the badge/ID. The identity source 

documents shall come from the list of acceptable documents included in FIPS 201-2, located at 

http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf. At least one (1) document shall be a valid State or 

Federal government-issued picture ID. PIV-I mobile enrollment stations will be made available for applicants 

that have an official station more than 50 miles from CMS or any of its regional offices, and the employee will 

not need to travel to a CMS Office. The Contractor will be contacted by CMS for further instructions on the 

badging process in this scenario.
Medicare QHC Notices Page 40 of 42

2571-S (11/23)

d. CMS Position Designation Assessment

CMS will assign a risk and sensitivity level designation analysis to the overall contract and/or to Contractor 

employee positions by category, group or individual. The risk and sensitivity level designations will be the basis 

for determining the level and type of personnel security investigations required for Contractor employees. At a 

minimum, the FBI National Criminal History Check (fingerprint check) must be favorably adjudicated. 

Additionally, the OPM e-QIP and other required forms must be accepted by DPS before a CMS identification 

card will be issued.

e. Post Badging Training Requirements:

Contractor employees that receive an HHS ID Badge are expected to complete the following online trainings each 

year, according to the timeframes indicated below, and annually thereafter. The below list is not all inclusive and the 

COR may indicate training that must be taken in addition to the below:

i. Security and Insider Threat Awareness and Training (30 days after receiving badge): This course 

outlines the role of Contractors with regard to protecting information and ensuring the secure operation of 

CMS federally controlled information systems. Estimated time to complete is one hour.

ii. Computer Based Training (CBT) (within 3 days of approved EUA account): This training offers 

several modules to familiarize contractor employees with features of CMS’ webinar service. Estimated 

time to complete is one hour.

f. Background Investigation and Adjudication

Upon contract award and receipt of an HHS ID Badge Request, CMS will initiate the Agency Access procedures, 

to include a background investigation.

CMS may accept favorable background investigation adjudications from other Federal agencies when there has 

been no break in service. A favorable adjudication does not preclude CMS from initiating a new investigation 

when deemed necessary. Each CMS sponsored Contractor shall use the OPM e-QIP system to complete any 

required investigative forms.

The Contractor remains fully responsible for ensuring contract performance pending completion of background 

investigations of Contractor personnel. Employees that do not require access to CMS federally controlled 

information systems, facilities, or sensitive information in order to perform their duties may begin work on a 

contract immediately and need not submit an HHS ID Badge Request.

i. Failure to cooperate with OPM or Agency representatives during the background investigation process is 

considered grounds for removal from the contract.

ii. DPS may provide written notification to the Contractor employee, with a copy to the COR, of all 

suitability/non-suitability decisions. A CMS adjudicative decision (based on criminal history results or 

completed investigation results) is final, and is not subject to appeal.

iii. Contractor personnel for whom DPS determines to be ineligible for ID issuance will be required to cease 

working on the contract immediately.

iv. The Contractor shall immediately submit an adverse information report, in writing to the CO with a copy 

to the COR, of any adverse information regarding any of its employees that may impact their ability to 

perform under this contract. Reports should be based on reliable and substantiated information, not on 

rumor or innuendo. The report shall include, at a minimum, the Contractor employee’s name and 

associated contract number along with the adverse information. The COR will forward the adverse 

information report to the DPS for review and/or action.
Medicare QHC Notices Page 41 of 42

2571-S (11/23)

v. At the Agency’s discretion, Contractor personnel may be provided an opportunity to explain or refute 

unfavorable information before an adjudicative decision is rendered on whether or not to withdraw the 

Federal ID from the individual in question. Under the provision of the Privacy Act of 1974, Contractor 

personnel may request a copy of their own investigation by submitting a written request to the OPM 

Federal Investigative Services (FIS) Freedom of Information (FOI) office. The following OPM-FOI link 

is being provided to afford one the instructions for obtaining a copy of one’s file: 

https://www.opm.gov/investigations/freedom-of-information-and-privacy-act-requests/.

g. Background Investigation Cost

The government will bear the cost of background investigations that are performed at the direction of CMS’ 

personnel security representatives by the Federal government’s approved and designated background investigation 

service provider, the OPM.

At the Agency’s discretion, if an investigated Contractor employee leaves the employment of the Contractor, or 

otherwise is no longer associated with the contract within one (1) year from the date the background investigation 

was completed, the Contractor may be required to reimburse CMS for the full cost of the investigation. Depending 

upon the type of background investigation conducted and the cost incurred by CMS, the Contractor cost will be 

determined based upon the current OPM fiscal year billing rates, which can be found at 

http://www.opm.gov/investigations/background-investigations/federal-investigations-notices. The amount to be paid 

by the Contractor shall be due and payable when the CO submits a written letter notifying the Contractor as to the 

cost of the investigation. The Contractor shall pay the amount due within thirty (30) days of the date of the CO’s 

letter by check, made payable to the “United States Treasury.” The Contractor shall provide a copy of the CO’s 

letter as an attachment to the check and submit both to the Office of Financial Management at the following address:

Centers for Medicare & Medicaid Services

PO Box 7520

Baltimore, Maryland 21207

h. Identification Card Custody and Control

The Contractor is responsible for the custody and control of all forms of Federal identification issued by CMS to 

Contractor employees. The Contractor shall immediately notify the COR when a Contractor employee no longer 

requires agency access due to transfer, completion of a project, retirement, removal from work on the contract, or 

termination of employment. Return all CMS Federal ID cards to:

The Centers for Medicare and Medicaid Services

Attn: DPS, Mailstop: SL-17-06

7500 Security Boulevard

Baltimore, Maryland 21244

The Contractor shall also ensure that Contractor employees comply with CMS requirements concerning the 

renewal, loss, theft, or damage of an ID card.

Failure to comply with the requirements for custody and control of CMS issued ID cards may result in a delay in 

withholding final payment or contract termination, based on the potential for serious harm caused by 

inappropriate access to CMS facilities, sensitive information, information systems or other CMS resources.

i. Renewal: A Contractor employee’s CMS issued ID card is valid for a maximum of five (5) years and 9 

months or until the contract expiration date (including option periods), whichever occurs first. The 

renewal process should begin six weeks before the ID card expiration date by contacting the COR. If an 

ID card is not renewed before it expires, the Contractor employee will be required to sign-in daily for 

facility access and may have limited access to information systems and other resources. Contractor ID 

card certificate(s) require yearly updates from the issuance date. The yearly updates should be coordinated 

between the contractor and the COR.
Medicare QHC Notices Page 42 of 42

2571-S (11/23)

ii. Lost/Stolen: Immediately upon detection that an ID card is lost or stolen, the Contractor or Contractor 

employee shall report a lost or stolen ID card to the COR and the local security servicing organization at 

SECURITY@cms.hhs.gov. The Contractor shall also submit an Incident Report within 48 hours, to the 

COR, DPS at Badging@cms.hhs.gov, and the local security servicing organization. The Incident Report 

shall describe the circumstances of the loss or theft. If the loss or theft is reported by the Contractor to the 

local police, a copy of the police report shall be provided to the COR. The Contractor employee shall sign 

in daily for facility access and may have limited access to information systems and other resources until 

the replacement card is issued.

iii. Replacement: An ID card will be replaced if it is damaged, contains incorrect data, or is lost or stolen for 

more than three (3) days, provided there is a continuing need for agency access to perform work under the 

contract.

In the event that the PIV card or certificate(s) are not renewed in a timely fashion, or the ID card requires 

replacement due to being lost, stolen, or damaged, the contractor employee will go through the “Badge Issuance” 

process again as described in above in section (c)(2). In any of these events, contact your COR to coordinate the 

appropriate next steps.

i. Surrender ID Cards/Access Cards, Government Equipment

CMS reserves the right to suspend or withdraw ID card access at any time for any reason. Access will be restored 

upon the resolution of the issue(s).

Upon notification that routine access to CMS facilities, sensitive information, federally controlled information 

systems or other CMS resources is no longer required, the Contractor shall surrender the CMS issued ID card, 

access card, keys, computer equipment, and other government property to the CMS COR or directly to CMS at the 

address referenced above in section (f). DPS Contractor personnel who do not return their government issued 

property within 48 hours of the last day of authorized access to CMS, may be permanently barred from CMS 

systems and facilities and may be subject to fines and penalties, as authorized by applicable Federal or State laws.