PROGRAM No. 1583-S October 1, 2022 thru September 30, 2023 plus 4 option periods, total duration may not exceed 5 years

TITLE: Medicare Enrollment Packages and Medicare Cards Agency: HHS/CMS

ITEM DESCRIPTION BASIS

OF

AWARD UNIT

12 months PRICE COST

I. PRINTING AND BINDING

A. CARDS per order:

(a) Replacements

(1) Makeready and/or Setup Charge 52 73.15 3,803.80 $ 

(2) Running per 1,000 Copies 4,232 7.64 32,332.48 $ 

(b) MBI Reassignment

(1) Makeready and/or Setup Charge 52 73.15 3,803.80 $ 

(2) Running per 1,000 Copies 44 24.21 1,065.24 $ 

(c) Accretes

(1) Makeready and/or Setup Charge 52 73.15 3,803.80 $ 

(2) Running per 1,000 Copies 2,179 7.64 16,647.56 $ 

(d) Domestic IEP

(1) Makeready and/or Setup Charge 12 73.15 877.80 $ 

(2) Running per 1,000 Copies 1,717 33.04 56,729.68 $ 

(e) Puerto Rican IEP, Foreign IEP and PBID (Bulk Order)

(1) Makeready and/or Setup Charge 25 73.15 1,828.75 $ 

(2) Running per 1,000 Copies 50 24.16 1,208.00 $ 

(f) Deemed

(1) Makeready and/or Setup Charge 1 73.15 73.15 $ 

(2) Running per 1,000 Copies 30 24.42 732.60 $ 

(g) PBID (Monthly order)

(1) Makeready and/or Setup Charge 9 73.15 658.35 $ 

(2) Running per Copy 225 0.03 6.75 $ 

B. FORMS and LETTERS, 7-1/2 x 11" and 8-1/2 x 11" per 

order, Standard Print except PBID monthly orders:

(a) Variable Image and Static Image Printing on the same 

page ..... Per imaged/printed page:

(1) Makeready and/or Setup Charge 40 1.00 40.00 $ 

(2) Running per 1,000 Copies 3,217 6.92 22,261.64 $ 

(b) Static Image Printing Only ..... per printed page:

(1) Makeready and/or Setup Charge 613 1.00 613.00 $ 

(2) Running per 1,000 Copies 28,885 8.64 249,566.40 $ 

C. FORMS and LETTERS, 7-1/2 x 11" and 8-1/2 x 11" per 

order, Large Print and PBID monthly orders:

(a) Variable Image and Static Image Printing on the same 

page ..... Per imaged/printed page:

(1) Makeready and/or Setup Charge 4 1.00 4.00 $ 

(2) Running per Copy 46 1.53 70.38 $ 

(b) Static Image Printing Only ..... per printed page:

(1) Makeready and/or Setup Charge 949 1.00 949.00 $ 

(2) Running per Copy 25,915 0.14 3,628.10 $ 

D. PAMPHLETS, SELF-COVER, Standard Print:

(a) Accretes, 3-1/2 x 7-1/2"

(1) Makeready and/or Setup Charge 832 4.49 3,735.68 $ 

(2) Running per 1,000 Copies 34,864 7.45 259,736.80 $ 

(b) Puerto Rican IEP and Puerto Rican GEP, 

3-1/2 x 8"... price per page

(1) Makeready and/or Setup Charge 208 4.49 933.92 $ 

(2) Running per 1,000 Copies 528 9.85 5,200.80 $ 

(c) Foreign IEP, 3-1/2 x 8"... price per page

(1) Makeready and/or Setup Charge 144 3.86 555.84 $ 

(2) Running per 1,000 Copies 252 12.76 3,215.52 $ 

(d) Domestic GEP, 3-1/2 x 8"... price per page

(1) Makeready and/or Setup Charge 20 49.05 981.00 $ 

(2) Running per 1,000 Copies 14,080 6.44 90,675.20 $ 

(e) Domestic IEP, 8-3/8 x 5-3/8"... price per page

(1) Makeready and/or Setup Charge 432 9.71 4,194.72 $ 

(2) Running per 1,000 Copies 61,812 3.98 246,011.76 $ 

E. PAMPHLETS, SELF-COVER, per language edition 

(English and Spanish), Large Print:

(a) Domestic GEP, 8-1/2 x 11"... price per page

(1) Makeready and/or Setup Charge 24 1.00 24.00 $ 

(2) Running per Copy 528 0.03 15.84 $ 

(b) Puerto Rican GEP, 8-1/2 x 11"... price per page

(1) Makeready and/or Setup Charge 20 1.00 20.00 $ 

(2) Running per Copy 20 0.03 0.60 $ 

F. ENVELOPES:

(a)

Weekly Pubs, PBID and Deemed Mailer Envelopes, 

4 x 8-1/8" ,

Running per 1,000 envelopes 8,243 11.45 94,382.35 $ 

(b) IEP and GEP Mailer Envelopes:

(1) Domestic IEP, 6 x 9-1/2" ,

Running per 1,000 envelopes 1,717 15.00 25,755.00 $ 

(2) Puerto Rican IEP, 4-1/8 x 9-1/2", (No. 10) , , ( ),

Running per 1,000 envelopes 27 10.50 283.50 $ 

(3) Foreign IEP, 4-1/8 x 9-1/2", (No.10),

Running per 1,000 envelopes 21 10.50 220.50 $ 

(4) Domestic GEP, 4-1/8 x 9-1/2" (No.10),

Running per 1,000 envelopes 704 14.35 10,102.40 $ 

(5) Puerto Rican GEP, 4-1/8 x 9-1/2" (No. 10),

Running per 1,000 envelopes 6 14.35 86.10 $ 

(c) GEP Large Print Mailer Envelope, 9 x 12"

Running per envelope 23 0.63 14.49 $ 

(d) Business Reply or Return Mail Envelopes:

(1) Domestic IEP, 5-3/4 x 8-3/4"

Running per 1,000 envelopes 1,717 15.88 27,265.96 $ 

(2) Foreign IEP, 3-7/8 x 8-7/8" , (No. 9)

Running per 1,000 envelopes 21 20.59 432.39 $ 

(3) Domestic GEP, 3-7/8 x 8-7/8" (No.9)

Running per 1,000 envelopes 704 8.18 5,758.72 $ 

II. STOCK/PAPER

A. Cards:

(a) 7-1/2 x 3-11/16" ................... per 1,000 leaves 6,528 20.48 133,693.44 $ 

(b) 5-1/2 x 8-1/2" ...................... per 1,000 leaves 1,717 34.66 59,511.22 $ 

B. Forms and Letters:

(a) 8-1/2 x 11" ......................... per 1,000 leaves 12,503 7.94 99,273.82 $ 

(b) 7-1/2 x 11" ......................... per 1,000 leaves 3,937 7.94 31,259.78 $ 

C. Pamphlets:

(a) 31/2 x 8" and 3-1/2 x 7-1/2" ... per 1,000 leaves 24,862 3.48 86,519.76 $ 

(b) 8-3/8 x 5-3/8" ...................... per 1,000 leaves 30,906 4.28 132,277.68 $ 

(c) 8-1/2 x 11" .......................... per leaf 274 0.01 2.74 $ 

D. Envelopes:

(a) 3-7/8 x 8-7/8" (No.9) ............ per 1,000 envelopes 725 8.53 6,184.25 $ 

(b) 4 x 8-1/8" ........................... per 1,000 envelopes 8,243 11.45 94,382.35 $ 

(c) 4-1/8 x 9-1/2" (No.10) .......... per 1,000 envelopes 758 14.10 10,687.80 $ 

(d) 5-3/4 x 8-3/4" ...................... per 1,000 envelopes 1,717 15.88 27,265.96 $ 

(e) 6 x 9-1/2" ........................... per 1,000 envelopes 1,717 15.00 25,755.00 $ 

(f) 9 x 12" ............................... per envelope 23 0.63 14.49 $ 

III. MAILING PREPARATION AND ASSEMBLY:

A. MAILING PREPERATION:

(a) Data Record File Processing ... per Print Order 166 200.00 33,200.00 $ 

(b) Secure Destruct IMb ....... Per 1,000 addresses 9,612 1.26 12,111.12 $ 

B. ASSEMBLY

(a) Replacements and MBI Reassignments, Standard Print

per 1,000 mailers 4,269 37.50 160,087.50 $ 

(b) Replacements and MBI Reassignments, Large Print

per mailer 1,411 2.25 3,174.75 $ 

(c) Accretes ........................ per 1,000 mailers 2,179 37.50 81,712.50 $ 

(d) Domestic IEP .................... per 1,000 mailers 1,717 90.00 154,530.00 $ 

(e) Puerto Rican IEP ............... per 1,000 mailers 27 90.00 2,430.00 $ 

(f) Foreign IEP ....................... per 1,000 mailers 21 90.00 1,890.00 $ 

(g) IEP Reminder Letter and Misc. Letters ... per 1,000 mailers 1,761 22.50 39,622.50 $ 

(h) Domestic GEP, Standard Print ............. per 1,000 mailers 704 28.13 19,803.52 $ 

(i) Puerto Rican GEP, Standard Print ........ per 1,000 mailers 6 56.25 337.50 $ 

(j) Domestic and Puerto Rican GEP, Large Print

per mailer 23 2.25 51.75 $ 

(k) PBID, bulk order ................. per 1,000 mailers 2 2250.00 4,500.00 $ 

(l) PBID, monthly orders .......... per mailer 243 2.25 546.75 $ 

(m) Deemed Cards .......... Per 1,000 mailers 30 28.13 843.90 $ 

(n) Insert Medicare Card Set into furnished

Alternative Package pouch ... per package 349 4.50 1,570.50 $ 

(o) Secondary Crawford mailer envelope inserted into

one package to be shipped small common carrier

per container 8 7.50 60.00 $ 

CONTRACTOR TOTAL: 2,403,607.95 $ 

PROMPT PAYMENT DISCOUNT: 0.25% 6,009.02 $ 

DISCOUNTED TOTAL: 20 DAYS 2,397,598.93 $ 

Abstracted by: Russell Woodmancy 8/10/2022

Reviewed by: Teresa Shoffstall 8/22/2022 Contract Awarded to: NPC, Inc.

NPC, Inc.

Claysburg, PA

AWARDED

Page 1 of 1
Program 1583-S Page 1 of 65

Specifications by RLW

Reviewed by llp/mjs

U.S. GOVERNMENT PUBLISHING OFFICE

Columbus, Ohio

GENERAL TERMS, CONDITIONS, AND SPECIFICATIONS

For the Procurement of

Medicare Enrollment Packages and Cards

as requisitioned from the U.S. Government Publishing Office (GPO) by the

Department of Health & Human Services, Center for Medicare & Medicaid Service

Single Award

TERM OF CONTRACT: This contract contains an Initial Testing Period and a Production Term of Contract.

INITIAL TESTING PERIOD: The Initial Testing Period begins Date of Award and ending September 30, 

2022. The Initial Testing Period allows for both Security Clearance Provisions “SECTION 5. – CMS 

SECURITY SPECIFICATIONS” and Post-Award Test.

PRODUCTION TERM OF CONTRACT: The term of this contract is for the period beginning October 1, 

2022. through September 30, 2023, plus up to 4 optional extension period(s) that may be added in accordance 

with the “Option to Extend the Term of the Contract” clause in Section 1 of this contract.

BID OPENING: Bids shall be opened at 11:00 a.m., prevailing Columbus, Ohio time August 8, 2022.

BID SUBMISSION: Bidders MUST submit email bids to bidscolumbus@gpo.gov for this solicitation. No 

other method of bid submission will be accepted at this time. The company name, program number, and bid 

opening date must be specified in the subject line of the emailed bid submission. Bids received after 11:00 a.m. 

prevailing Columbus, Ohio time on the bid opening date specified above will not be considered for award.

BIDDERS PLEASE NOTE: Formerly Program 5589-S. Significant revisions have been made. Bidders are 

cautioned to familiarize themselves with all provisions of this contract before bidding.

On page 14, see “ADDITIONAL EMAILED BID SUBMISSION PROVISIONS”.

PROGRAM NUMBER FOR THIS SOLICITATION HAS BEEN CHANGED FROM 5589-S TO 1583-S.

The previous abstract for Program 5589-S available on GPO Web Site at 

http://www.gpo.gov/gpo/abstracts/abstract.action?region=Columbus

LEGAL DISCLAIMER: Product names are the trademarks of the respective companies and do not indicate 

endorsement by the U.S. Government.

For information of a technical nature call Russell Woodmancy at (614) 488-4616, ext. 8 (No collect calls).
Medicare Enrollment Packages and Cards Page 2 of 65

1583-S (09/23)

SECTION 1. – GENERAL TERMS AND CONDITIONS

GPO CONTRACT TERMS: Any contract which results from this Invitation for Bid will be subject to the 

applicable provisions, clauses, and supplemental specifications of GPO Contract Terms (GPO Publication 310.2, 

effective December 1, 1987 (Rev. 01-18)) and GPO Contract Terms, Quality Assurance Through Attributes 

Program for Printing and Binding (GPO Publication 310.1, effective May 1979 (revised 9-19)).

• GPO Contract Terms (GPO Publication 310.2) – https://www.gpo.gov/docs/default-source/forms-andstandards-files-for-vendors/contractterms2018.pdf

• GPO QATAP (GPO Publication 310.1) – https://www.gpo.gov/docs/default-source/forms-andstandards-files-for-vendors/qatap-rev-09-19.pdf.

• More GPO Publications can be found at: https://www.gpo.gov/how-to-work-with-us/vendors/formsand-standards

REGULATIONS GOVERNING PROCUREMENT: The U.S. Government Publishing Office (GPO) is an 

office in the legislative branch of the United States Government. Accordingly, the Federal Acquisition 

Regulation is inapplicable to this, and all GPO procurements. However, the text of certain provisions of the 

Federal Acquisition Regulation as contained in the Code of Federal Regulations (CFR), are referenced in this 

solicitation. The offeror should note that only those provisions of the Federal Acquisition Regulation which are 

specifically incorporated by reference into this solicitation, are applicable.

INITIAL TESTING PERIOD: The contractor awarded the contract shall be required to demonstrate their 

ability to retrieve TIBCO electronic files and print (static and variable images) for all the items required in these 

specifications at the requisite quality level by completing a Post-Award Test. The government reserves the right 

to waive the Post-Award Test for some or all the items if there is evidence that, in the opinion of the Contracting 

Officer, indicates that the contractor being considered for award has the capability to successfully produce the 

item(s) required.

Access to TIBCO mailbox: Immediately after award, the contractor must submit two (one primary user, and 

one back-up user) completed “APPLICATION FOR ACCESS TO CMS COMPUTER SYSTEMS” Form CMS20037, complete Section 2, User Information on page 1, and the Applicant’s Information on page 3 of this Form 

at the following internet link:

http://www.cms.hhs.gov/InformationSecurity/Downloads/EUAaccessform.pdf

Please note that the Applicant’s Social Security Number must be provided in order to receive a USER ID and 

gain access to CMS’ computer systems. Corporate Tax Identification Numbers are not accepted in lieu of 

individual SSN’s. The contractor must reapply for access every 12 months during the term of the contract

unless the government communicates otherwise.

Return completed Form CMS-20037 in PDF attachment via email to clinton.howard@cms.hhs.gov

TIBCO defined: Each Print Order will have a separate TIBCO digital file and stored in a secure TIBCO 

Mailbox. TIBCO digital files contain record data for each individual, see “TIBCO Record Files” beginning on 

page 17. Each record contains fields for the contractor to generate variable imaging content, filter and/or sort. 

The record fields contain but not limited to the following: names, mailing addresses, and Medicare Beneficiary 

Identifier (MBI) numbers. 

Medicare Mail Piece Publications -- Packages, Sets, Items and Components defined: Medicare Publication 

orders are made up of different items that are produced and assembled to make up a mail piece. An item is 

defined as any of the following: card, form, letter, pamphlet, return envelope/Business Reply Mail (BRM), and 

mailing envelope. Components are defined as an element, ingredient, or constituent part used in machines for 

operation/inspection or is a part of an item produced (paper and glue for envelopes and etc.). 

CONTRACTOR: Throughout this document, the term “contractor” refers to the printing company that is 

awarded the contract. The term “subcontractor” refers to any other company that is performing work on this

contract as hired by the contractor.
Medicare Enrollment Packages and Cards Page 3 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

The contractor may utilize multiple plants within their own company structure to complete the requirements of 

this job. The predominant production functions are as follows: 

• downloading TIBCO files from TIBCO Mailbox, 

• manipulating data from TIBCO files, 

• variable imaging from TIBCO files, 

• Safeguarding the PII digitally with cybersecurity and with secure physical plant operations and 

procedures.

• preparation for mailing, includes all variable data items (PII) (folding, inserting, sorting, etc.)

• and delivery to USPS mailing facility. 

SUBCONTRACTING: The above stated predominant production functions CANNOT be subcontracted. The 

contractor may use a subcontractor for all other items, including printing of static image from static data which 

is not considered part of the predominant production functions, an example would be envelopes. Bidder who 

must subcontract any of the predominant production functions may be declared non-responsible.

The contractor MUST ensure that subcontractors have a copy of these specifications and meet all requirements 

stated within this document. In addition, it is the contractor’s responsibility to communicate with, and manage 

the work performed by subcontractors.

QUALITY ASSURANCE LEVELS AND STANDARDS: The following levels and standards shall apply to 

these specifications:

Product Quality Levels:

(a) Printing (Page Related) Attributes -- Level III.

(b) Finishing (Item Related) Attributes -- Level III.

Inspection Levels (from ANSI/ASQC Z 1.4):

(a) Non-destructive Tests - General Inspection Level I.

(b) Destructive Tests - Special Inspection Level S-2.

Specified Standards: The specified standards for the attributes requiring them shall be:

 Attribute Specified Standard 

P-7. Type Quality and Uniformity O.K. Press Sheets/Prior-to-Production Samples/Proofs

P-8. Halftone Match (Single and Double Impression) O.K Press Sheets/Prior-to-Production 

Samples/Proofs

P-9. Solid and Screen Tint Color Match O.K. Press Sheets/Prior-to-Production 

Samples/Pantone Matching System

Special Instructions: In the event that inspection of press sheets is waived by the government, the listed 

alternate standards (in order of precedence) shall become the Specified Standards.

Quick Response (QR) Code: QR Code to meet ISO (ISO/IEC18004) standard.

WARRANTY: The provisions of Article 15, “Warranty” in GPO Contract Terms is amended for the 

solicitation to the effect that the warranty period is EXTENDED from 120 days to one calendar year from the 

date the check is tendered as final payment. All other provisions remain the same.

OPTION TO EXTEND THE TERM OF CONTRACT: The government has the option to extend the term of 

this contract for a period of 12 months by written notice to the contractor not later than 30 days before the 

contract expires. If the government exercises this option, the extended contract shall be considered to include 

this clause, except, the total duration of the contract may not exceed five (5) years (September 30, 2027) as a 

result of, and including, any extension(s) added under this clause. Further extension may be negotiated under 

the “Extension of Term of Contract” clause. See also “Economic Price Adjustment” for authorized pricing 

adjustment(s).
Medicare Enrollment Packages and Cards Page 4 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

Prior to exercising the option, contractor may be required to submit any updates or revisions to the Production 

Plan that was submitted prior to award and include any changes such as but not limited to the following: 

personnel, production equipment, security, cybersecurity, financials and etc.

EXTENSION OF TERM OF CONTRACT: At the request of the government, the term of any contract 

resulting from this solicitation may be extended for such period of time as may be mutually agreeable to the 

GPO and the contractor.

ECONOMIC PRICE ADJUSTMENT: The pricing under this contract shall be adjusted in accordance with 

this clause, provided that in no event will any pricing adjustment be made that would exceed the maximum 

permissible under any law in effect at the time of the adjustment.

There will be no adjustment for orders placed during the first period specified below. Pricing will thereafter be 

eligible for adjustment during the second and any succeeding performance period(s). For each performance 

period after the first, a percentage figure will be calculated as described below and that figure will be the 

economic price adjustment for that entire next period.

Pricing adjustments under this clause are not applicable to reimbursable postage or transportation costs, or to 

paper, if paper prices are subject to adjustment by separate clause elsewhere in this contract.

For the purpose of this clause, performance under this contract will be divided into successive periods. The first 

period will extend from on October 1, 2022 through September 30, 2023, and the second and any succeeding 

period(s) will extend for 12 months from the end of the last preceding period, except that the length of the final 

period may vary. The first day of the second and any succeeding period(s) will be the effective date of the 

economic price adjustment for that period.

Pricing adjustments in accordance with this clause will be based on changes in the seasonally adjusted 

“Consumer Price Index For All Urban Consumers – Commodities Less Food” (Index) published monthly in the 

CPI Detailed Report by the U.S. Department of Labor, Bureau of Labor Statistics.

The economic price adjustment will be the percentage difference between Index averages as specified in this 

paragraph. An index called the variable index will be calculated by averaging the monthly Indexes from the 12-

month interval ending three (3) months prior to the beginning of the period being considered for adjustment. 

This average is then compared to the average of the monthly Indexes for the 12-month interval ending June 30, 

2022, called the base index. The percentage change (plus or minus) of the variable index from the base index 

will be the economic price adjustment for the period being considered for adjustment.

The government will notify the contractor by contract modification specifying the percentage increase or 

decrease to be applied to invoices for orders placed during the period indicated. The contractor shall apply the 

percentage increase or decrease against the total price of the invoice less reimbursable postage or transportation 

costs and separately adjusted paper prices. Payment discounts shall be applied after the invoice price is 

adjusted.

If the government exercises an option, the extended contract shall be considered to include this economic price 

adjustment clause.

PAPER PRICE ADJUSTMENT. Paper prices charged under this contract will be adjusted in accordance with 

“Table 9 - Producer Price Indexes and Percent Changes for Commodity Groupings and Individual Items” in 

Producer Price Indexes report, published by the Bureau of Labor Statistics (BLS), as follows:

1. BLS code 0913 for all paper will apply to all paper required under this contract.

2. The applicable index figures for the month of July, 2022 will establish the base index.

3. There shall be no price adjustment for the first three months of the contract.

4. Price adjustments may be monthly thereafter, but only if the index varies by an amount (plus or minus) 

exceeding 5% by comparing the base index to the index for that month which is two months prior to the 

month being considered for adjustment.

5. Beginning with order placement in the fourth month, index variances will be calculated in accordance 

with the following formula:

X − base index

base index × 100 = ____%
Medicare Enrollment Packages and Cards Page 5 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

where X = the index for that month which is two months prior to the month being considered for 

adjustment.

6. The contract adjustment amount, if any, will be the percentage calculated in 5 above less 5%.

7. Adjustments under this clause will be applied to the contractor's bid price(s) for line Items under 

“II. STOCK/PAPER” in Section 4 - SCHEDULE OF PRICES and will be effective on the first day of 

any month for which prices are to be adjusted.

The Contracting Officer will give written notice to the contractor of any adjustments to be applied to invoices 

for orders placed during months affected by this clause.

In no event, however, will any price adjustment be made which would exceed the maximum permissible under 

any law in effect at the time of the adjustment. The adjustment, if any, shall not be based upon the actual 

change in cost to the contractor, but shall be computed as provided above.

The contractor warrants that the paper prices set forth in this contract do not include any allowance for any 

contingency to cover anticipated increased costs of paper to the extent such increases are covered by this price 

adjustment clause.

ASSIGNMENT OF JACKETS, PURCHASE AND PRINT ORDERS: A GPO jacket number will be 

assigned and a Purchase Order issued to the contractor to cover work performed. The Purchase Order will be 

supplemented by an individual “Print Order” for each job placed with the contractor. The Print Order, when 

issued, will indicate the quantity to be produced and any other information pertinent to the particular order.

PREAWARD SURVEY: In order to determine the responsibility of the prime contractor or any subcontractor, 

the government reserves the right to conduct an on-site preaward survey at the contractor’s/subcontractor’s 

facility or to require other evidence of technical, production, managerial, financial, and similar abilities to 

perform, prior to the award of a contract. 

Attending the preaward survey will be representatives from the Government Publishing Office (GPO) and/or the 

Centers for Medicare and Medicaid Services (CMS). 

Financials: As part of the financial determination, the contractor in line for award may be required to provide 

one or more of the following financial documents:

1. Most recent profit and loss statement

2. Most recent balance sheet(s)

3. Statement of cash flows

4. Current official bank statement

5. Current lines of credit (with amounts available)

6. Letter of commitment from paper supplier(s)

7. Letter of commitment from any subcontractor

The Preaward Survey will include a review of any subcontractors involved, along with their specific functions; 

and the contractor’s/subcontractor’s, personnel, data handling, production, cyber security and other requirements 

outlined in “SECTION 5. - CMS SECURITY SPECIFICATIONS” starting on page 45.

ORDERING: Items to be furnished under the contract shall be ordered by the issuance of Print Orders by the 

government. Orders may be issued under the contract from October 1, 2022 through September 30, 2023, 

plus for such additional period(s) as the contract is extended. All Print Orders issued hereunder are subject to 

the terms and conditions of the contract. The contract shall control in the event of conflict with any Print Order. 

A Print Order shall be "issued" upon notification by the Government for purposes of the contract when it is 

electronically transmitted or otherwise physically furnished to the contractor in conformance with the schedule.

REQUIREMENTS: This is a requirements contract for the items and for the period specified herein. 

Shipment/delivery of items or performance of work shall be made only as authorized by orders issued in 

accordance with the clause entitled “Ordering”. The quantities of items specified herein are estimates only, and 

are not purchased hereby. Except as may be otherwise provided in this contract, if the government’s 

requirements for the items set forth herein do not result in orders in the amounts or quantities described as 

“estimated”, it shall not constitute the basis for an equitable price adjustment under this contract.
Medicare Enrollment Packages and Cards Page 6 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

Except as otherwise provided in this contract, the government shall order from the contractor all the items set 

forth which are required to be purchased by the government activity identified on page 1.

The government shall not be required to purchase from the contractor, requirements in excess of the limit on 

total orders under this contract.

Orders issued during the effective period of this contract and not completed within that time shall be completed 

by the contractor within the time specified in the order, and the rights and obligations of the contractor and the 

government respecting those orders shall be governed by the terms of this contract to the same extent as if 

completed during the effective period of this contract.

If shipment/delivery of any quantity of an item covered by the contract is required by reason of urgency prior to 

the earliest date that shipment/delivery may be specified under this contract, and if the contractor will not accept 

an order providing for the accelerated shipment/delivery, the government may procure this requirement from 

another source.

The government may issue orders which provide for shipment/delivery to or performance at multiple 

destinations. Subject to any limitations elsewhere in this contract, the contractor shall furnish to the government

all items set forth herein which are called for by Print Orders issued in accordance with the “Ordering” clause of 

this contract.

SUBMISSION OF PRODUCTION PLAN: After the bid opening, the Production Plan to be submitted 

within 3 workdays of government’s request. Production Plan the contains the following: Primary and 

Redundant Facility, Security Plan, Cyber Security, Production Capabilities, and Quality Assurance Plan for 

evaluation.

The proposed plan is subject to government approval. It is anticipated that approved “Production Plan” will 

become a living document and subject to review prior to the government exercising the “Option to Extend the 

Term of Contract”.

PRIMARY AND REDUNDANT FACILITY PLAN: The contractor must have two or more 

owned/controlled facilities that have the capability to perform all the predominant production requirements of 

the contract. The plan shall provide for continuous production, as well as back-up facilities, if for any reason(s) 

(act of God, labor disagreements, power grid and backup power, machine maintenance downtime, etc.) a 

production facility is impacted such that it is unable to meet all the requirements of the contract.

The back-up facilities, equipment, and personnel must be established and operational prior to award.

Failure to have a back-up facility may result in a non-responsible determination.

Production Facilities and Personnel Plan: The following information for all contractor and subcontractor 

production facilities that will be used for this project shall be provided:

▪ Company Name

▪ Plant Name

▪ Street Address

▪ Name of Contact Person

▪ Number of offset presses, digital imaging printers, binding and inserting lines that will be used to produce

item(s) for this contract

▪ Contact Person’s Telephone Numbers (Office and Cellular)

▪ Contact Person’s e-mail Address

▪ Plant and Project Manager’s Name (for each shift)

▪ Plant and Project Manager’s Telephone Numbers (Office and Cellular)

▪ Plant and Project Manager’s e-mail Address
Medicare Enrollment Packages and Cards Page 7 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

SECURITY PLAN: The following list to be included in the Data Security Plan but not limited to these. 

Additional information may be required after review of Production Plan. 

1. Plant and Office Physical Security System

2. Security 

a. Section 5. – CMS Security Specifications

3. Cyber Security 

a. Cybersecurity measures to mitigate risks

i. Hardware Network

ii. Software

1. Ransomware and Malware prevention, and if identify, then enabling isolation 

and neutralization.

2. Data Encryption

3. Secure Access

4. Assessment for Security Capabilities

iii. Social Engineering

iv. Response to possible or conform security compromise.

b. Cybersecurity review of systems and training

SECURITY: The contractor awarded this contract will be in custody of government owned material considered

Personally Identifiable Information (PII). See “SECTION 5. – CMS SECURITY SPECIFICATIONS” 

beginning on page 45, for security requirements of this contract. The government may conduct on-site 

unannounced, randomized Security inspections at any time.

Cyber Security: Contractor to implement cybersecurity protocols. Request for Information about Evaluating 

and Improving Cybersecurity Resources: The Cybersecurity Framework and Cybersecurity Supply Chain Risk 

Management | NIST

PRODUCTION CAPABILITIES: Plan to explain how the primary and redundant facilities along with any 

subcontractors are to meet contract requirements. At a minimum to include the following:

• Data Processing of TIBCO records and Mail Preparation

• Production Equipment used for this contract and capabilities at prime location and redundant location.

• Contractor to show they have the production capability to be able to meet Medicare Publications

schedule at both the primary and redundant locations:

o Material Handling and Inventory Control Plan

o Equipment Maintenance

o Personnel, responsibility, authority, and function

• Contagion disease contingency plan.

QUALITY ASSURANCE PLAN: By submission of the bid, the contractor agrees to maintain a quality

system in addition to GPO Quality Assurance Levels and Standards. The contractor shall initiate, prior to 

start-up and maintain throughout the life of this contract a Quality Assurance Plan. 

The plan to meet all requirements of this contract during each operational phase of production. Plan should 

be in written and digital form for contractor’s employees, CMS and GPO. 

For each location, the names of all quality assurance personnel and a description of the inspections that will 

be performed as well as the records that will be maintained to document these activities. 

1) Automated Control System and Data Processing: Contractor to have an automated system that includes

barcoding and scanning technology capable of the following:

(a) Unique Identification Number to be scanned during insertion to ensure all variable image (data) and 

corresponding items are present and accounted for.

a. Sequential Numbering Plan: This plan must include sufficient detail to fulfill the contract 

requirements that there are no duplicate, damaged, or missing pieces. Each piece should have a 

unique number. An explanation of the contractor’s sequential numbering system is required to 

understand the required audit trail for each and every piece. Unique sequential identifying 

number on each mail piece to track each individual variable image item in the specifications, 
Medicare Enrollment Packages and Cards Page 8 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

thereby providing 100% accountability. This enables the contractor to track each variable 

image item through the production process in the plant and when the mail piece is entered into 

the U.S. Postal System (USPS).

b. QR Code: Unique Identification Number to be incorporated with the QR Code on the back of 

Medicare Cards.

(b) Entrance Scanning: A camera system must electronically track and scan each item piece(s) as the 

inserting equipment pulls them into the machine to ensure each mail piece was produced correctly for 

the Medicare Publication and for the individual beneficiary record. If there is any variance on an item

piece or mail piece, that item piece(s) or mail piece prior to and immediately following must be diverted 

and sent back for reprint. All instances of variance must be logged in the report. 

(c) Touch and Toss: All spoilage, diverted, mutilated, or mail pieces that are acted upon directly by 

human touch prior to sealing, must be immediately recorded, discarded, properly destroyed, and 

automatically regenerated in a new print file for reprint. Exception - Intentionally diverted pieces due to 

a requirement for a Medicare Publication, which item(s) cannot be automatically inserted and requires 

manual insertion such as Alternative Format Packages, can be sealed, rescanned and placed back into 

production. These must be programmed diverts and sent to a separate bin for processing to ensure they 

are not mixed with other problem diverts and logged into the Audit system as such.

(d) Exit Scanning: A camera system is mounted just after the inserting equipment. This camera system 

reads the Unique Identification Number through the window of each mail piece and is capable of 

identifying and reporting all missing items that were lost or spoiled during production for each 

individual file by mailer number and file date. This system ensures that no missing mail pieces have 

been inadvertently inserted into another mail piece. The equipment checks each mail piece after 

insertion and verifies that all items are accounted for, and divert any suspect product. During exit 

scanning, if a Unique Identification Number is missing, the mail pieces prior to and immediately after 

must be diverted. The equipment must divert all products that exhibit missing or out of order sequence 

numbers and any other processing errors. All diverted pieces are to be automatically recorded and 

regenerated in a new print file for reprint.

(e) Reconciliation: All mail pieces and the amount of correct finished product must be electronically 

accounted for after insertion through the use of the audit system that is independent of the inserting 

equipment as well as independent of the operator. The sequence numbers, for each file, must be 

reconciled; considering any spoilage, duplicate, and/or diverted product. If the reconciliation yields 

divergent results, corrective action must be taken to locate the mail pieces that are causing any 

difference between the input and outputs of the inserting process. Therefore, all finished mail for that 

sequence run must be held in an accessible area until this reconciliation is complete.

a. Contractor must have a closed loop process* or similar to determine that the data from the 

original print file is in the correct envelope with the correct number of pages and inserts. 

* Closed Loop Processing - define: A feedback control loop of mail pieces including error detection and 

reprinting. 

The shift supervisor(s) will verify that all standards are met. 

These standards are: 

1. The proper cards, forms, letters and pamphlets were printed as required for the production batch 

for each Medicare Publication. 

2. Quality check verifies that the contents of the Medicare mail piece publication has the correct

name and physical address printed in the proper location with the required font size,

character/number bold, indentations, margins, and correct variable and non-variable text only the

mailing address is showing through the window of the mail-out envelope and the content item(s) 

are complete and verified against the pre-approved sample(s).

Mail Piece approved: material will be cleared and ticketed to proceed to the next operation.
Medicare Enrollment Packages and Cards Page 9 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

Mail Piece defective: Destruction of the defective item(s) will be ordered, for PII item(s) (an example 

would be Medicare Cards) will be securely kept and destroyed upon CMS/GPO approval. For record, a

sample of the defect and explanation of the cause of the defect will be submitted to the appropriate 

supervisor(s).

• The supervisor will be required to acknowledge why the defect occurred measures taken to rectify the 

problem action taken to ensure the problem does not reoccur issue will be escalated to management if 

necessary

• An electronic report (“Poor Quality Report”) will be submitted to the appropriate manager for review. 

Review will serve to verify that all necessary steps were taken to correct the problem. Upon request, the 

government may request the “Poor Quality Report” for any given Print Order.

• The defective pieces are documented on a “Defective Reprint” sheet. The unique identifier number(s) is 

written down. This sheet is forwarded to the Digital Print printer operator. The printer operator prints 

the reprint and documents the time and date on the reprint sheet. Both the reprint sheet and the reprint 

are forwarded back to the inserter operator. The inserter operator places the reprint into the inserter and 

inserts it. The reprint sheet is documented with the time and date and then filed.

(f) Reconfigured Print File: All missing and/or non-conforming mail pieces in response to error detection

generates a computer digital file to initiate reprints called “reconfigured print file”. This process will 

repeat itself until all mail pieces from the original print run have been inserted and accounted for.

(g) Summary (Audit) Report: Computer automatic generated summary report will contain detailed 

information for each mail piece. For more information, see “Summary (Audit) Report” on page 34.

2) Quality Assurance Inspection

Records of quality pulls, inspections and critical processes shall be time stamped and maintained on file (paper 

and/or digital). Scuff and rub testing should be part of the inspection process of variable image printing. These 

records must be available to HHS/CMS and/or GPO employees until the expiration of the Warranty period of 

this contract.

If errors are found or discrepancies exist between any of the government furnished TIBCO files, Print Order, 

record layout, art work etc., the contractor must cease further production and contact Clinton Howard at (410) 

786-1962 or clinton.howard@cms.hhs.gov and the GPO Contracting Officer/Administrator. If contractor failed 

to identify the errors or discrepancies during the quality assurance inspection, no reimbursement for the cost of 

reprinting or postage will be allowed.

The Quality Assurance Inspection to include but not limited to the following:

(a) Addresses items from any subcontractor, how the contractor’s employees will decide whether the items 

meet or do not meet the quality requirements of this contract.

(b) Proofs and Preproduction samples.

(c) Work with CMS and/or GPO on Press Sheet Inspections.

(d) Contractor to state what actions will be initiated when various defects are detected. This should include 

stoppage of work, items that contain individual’s variable information (PII), removal, destruction, and 

replacement of items. 

(e) Contractor to keep an Excel spreadsheet record of all defects with date of occurrence, Print Order 

number, with corresponding name and Unique Identification Number, but not PII, and how the issue 

was resolved.

(f) Inspection to ensure against the commingling of mail pieces, see Mail Piece Integrity and Mailing 

Integrity.

(g) One pull for every 10,000 individuals (10,000 individual’s equals one batch) per Medicare publication

that contains Medicare Cards. Contractor has the option to reduce the number of individuals in a batch 

size to increase number of pulls when needed. 
Medicare Enrollment Packages and Cards Page 10 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

3) Verification of Production and Mailing: Verification of Production to include the following: Recovery 

System, Quality Pulls, Monitor Pieces and Mailing.

Recovery System

A recovery system will be required to ensure that all defective or missing/mutilated items detected are 

identified, reprinted and replaced. The recovery system must use unique sequential numbers assigned to each 

item to aid in the recovery and replacement of any defective or missing/mutilated items, and must be capable of 

tracking and/or locating any individual piece of mail from the time it leaves the press, up to and including when 

it is off-loaded at the USPS facility.

Quality Pulls

Quality pulls of Medicare Cards are part of Quality Assurance Inspection. The contractor will be required to 

create a test sample based on the quantity submitted. This test must have a Unique Identification Number and 

must be produced on variable imaged items.

The contractor will generate a list of the Unique Identification Numbers for each sample. As samples are pulled, 

their Unique Identification Number will be marked off the list. This enables the contractor to track which 

samples have been produced and pulled and what records have been produced.

The unique number for each mail piece must not include the CMS furnished Medicare Beneficiary Identifier

(MBI) Number and it must not be formatted like a Medicare Beneficiary Identifier Number.

Contractor to keep daily electronic soft PDFs of the quality pulls (face and back). Upon government request, 

contractor to email soft PDF image of quality pulls to Clinton Howard clinton.howard@cms.hhs.gov. Hard 

copies stored at the contractor’s secure location meeting PII requirements. Contractor to store hard copy quality 

pulls for 180 days and soft PDFs for 360 days, unless otherwise notified.

Contractor’s Secure Destruction of Quality Pulls: Contractor must not perform secure destruct of Quality 

Pulls without authorization from the government. The Government CMS and/or GPO may be onsite to oversee 

secure destruction of Quality Pulls. Contractor to email PDF certificate of secure destruction of hard copy 

Quality Pulls to Clinton Howard clinton.howard@cms.hhs.gov and Russ Woodmancy rwoodmancy@gpo.gov. 

The certificate should include the quantity and the beginning and ending dates of when the hard copy Quality 

Pulls occurred. An email to Clinton Howard and Russ Woodmancy to be sent when soft PDFs of the quality 

pulls is complete. Note, government may request PDF’s of Quality Pulls to be uploaded to sFTP for 

government to download prior to contractor deleting PDFs from their computer systems.

Monitor Pieces

The contractor shall monitor all aspects of the job including material handling and mail flow, to ensure that the 

production and delivery of these Medicare Publication (mail pieces) meet specifications and government

requirements.

The government will not as a routine matter request that the contractor produce (locate) individual items using 

the Unique Identification Number in transit within the plant, however, the contractor must demonstrate that they 

have an audit trail established that has the ability to comply with this type request when and if the need arises. 

The contractor’s Quality Assurance System and the Verification of Production and Mailing plans must account 

for the number of pieces mailed per Print Order.

Verification of Mailing

The contractor will be responsible for validating the integrity of every mailed piece (packages, card sets, and 

letters) produced in all phases of data processing, printing, inserting and mailing and to ensuring all Medicare 

Mail Piece Publications received from CMS were correctly entered into the USPS and generating reports. See 

“Reporting” beginning on page 34 for a list and description of reports. In addition, per Print Order, e-mail PDFs 

of mailing statement(s) and GPO Form 712 with TIBCO counts to Clinton Howard at 

clinton.howard@cms.hhs.gov and Russell Woodmancy at rwoodmancy@gpo.gov
Medicare Enrollment Packages and Cards Page 11 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

Medicare Publication Mail Pieces: Each Print Order TIBCO records that have been data scrub, see “Mail 

Preparation” beginning on page 30. Contractor to ensure that the automated control system and data processing 

as part of the “Quality Assurance Plan” will prevent the commingling of different Medicare recipients in a 

single mail piece (only one Medicare beneficiary information per mail piece). The contractor’s printing process 

must have automated systems that include barcoding and scanning technology capable of the following:

(a) Validating the count of pages/items in a mail piece set.

(b) Validating the sequence of pages/items in a mail piece set.

(c) Validating the sequence of mail piece sets in a production batch.

(d) Interrupting production if variances are detected.

4) Technical Support 

The contractor must have a highly trained technical support staff available around the clock (24 hours/7days a 

week) to solve any mechanical and electrical malfunctions, plus staff and adequate telephone service to receive 

without interruption the transmission of any electronic media required between 7:00 a.m. Monday through noon

Saturday, Eastern Time Zone.

Contractor must also have, on site, a spare parts inventory and on-call technicians to avoid any delay in 

producing orders under this contract plus a Program Manager assigned to the project with designated backup so 

that a single point of contact will be available to answer any questions which may arise.

POST-AWARD TELEPHONE CONFERENCE: Telephone conference between contractor and the 

Government (CMS and GPO) is required, unless waived by the government. The purpose of the conference will 

be to discuss and review all aspects of the contractor’s production plan and to establish coordination of all 

internal and external operations required to complete the contract and for agency to determine the appropriate 

level of security investigation.

POST-AWARD TEST: Immediately after award, the proofing process for the items will begin, see “Proofs” 

beginning on page 18. 

The Post-Award Test requirements shall be produced at no additional charge to the government. The PostAward Test will consist of the following:

1) Variable Data Test,

2) Proof Test, 

3) Live Data Sample Test, and 

4) Prior-to-Production Sample Test. 

1) Variable Data Test: Unless waived by the government, 2 work days after receipt of data files (data files sent 

via e-mail or to contractor’s sFTP site), the contractor to submit Post-Award Test samples. Post-Award Test 

samples consist of a minimum 50 random samples showing the total range of variable data possibilities in PDF 

format of each of the items that contain variable data on this contract. 

Contractor must also submit the corresponding source data files (also known as a “data dump”). Test samples 

must show the correct variable data information taken from the furnished test files in accordance with the Data 

Layout Sheet. For more information, see “Variable Image (Data) Layout Proofs” on page 19.

In addition, the contractor will be required to provide data programming as required to accomplish the Variable

Imaging as defined under “PRINTING/IMAGING” in “SECTION 2 – SPECIFICATIONS”. e-mail the PDF test 

samples to Clinton Howard clinton.howard@cms.hhs.gov

2) Static Image Proof Test: Within 5 workdays after receipt of the Government Furnished Property (GFP) 

via e-mail or to contractor’s sFTP site, contractor shall submit PDF “Soft” proofs to the government. Proofs 

shall be produced and submitted in accordance with the requirements listed hereafter under “Static Image (Data) 

Proofs”. E-mail the PDF “Soft” Proofs to Clinton Howard clinton.howard@cms.hhs.gov and Russ Woodmancy

rwoodmancy@gpo.gov. For more information, see “Static Image (Data) Proofs” on page 19.

3) Live Variable Data Sample Test: Immediately after approval of the Variable Data Test, and prior to 

production of the Prior-to-Production Sample Test, the contractor shall be required to perform a Live Variable 

Data Sample Test using 50 live data records placed by CMS in the TIBCO mailbox and downloaded by the 
Medicare Enrollment Packages and Cards Page 12 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

contractor’s representatives who have been granted access to the TIBCO mailbox. The data sample will also 

include address library data.

Within 5 workdays after receipt of Variable Data Test approval, the contractor will be required to submit 50 

Live Data Samples of all variable data of each Medicare Publication, including Unique Identification Number. 

Contractor must perform a production run per specifications as if these were live orders; however, contractor 

must pack completed items and assemble, see Assembly beginning on page 28, per each Medicare Publication in 

a shipping container, and deliver via overnight courier (i.e.: FedEx Next Day) to: HHS/CMS, 7500 Security 

Boulevard, SL-11-17, Attn: Clinton Howard, Baltimore, MD 21244-1850.

The 50 Live Data Samples shall consist of 25 sequential records and 25 randomly selected records from the 

remaining TIBCO files. Each sample shall consist of all items of each Medicare Publication assembled in 

accordance with the contract specifications.

Data samples must be printed and constructed using the method of production that which will be used in 

producing the finished product per contract specifications. All items must be of the size, paper*, and ink. 

Contractor may request an exception for printed sample envelopes.

*NOTE: In lieu of “White 25% Index, basis weight: 110 lbs. per 500 sheets, 25-1/2 x 30-1/2”, equal to JCP 

Code K20. EXCEPTION: Brightness level must be a minimum of 90”, Live Data Samples may be printed on 

White Writing, basis weight: 20 lbs. per 500 sheets, 17 x 22”, equal to JCP Code D10 or similar. Items MUST 

be trimmed to size.

4) Prior-to-Production Samples: These samples contain both variable image and static image printing. 

Within 5 workdays after receipt of the Live Data Sample Test approval, contractor shall submit 15 sets (A set 

equals one each of all the Medicare Publications, listed on page 15) of Prior-to-Production Sample Test to the 

government (5 sets of each Medicare Publication to 3 locations), deliver via overnight courier (i.e.: FedEx Next 

Day). The three addresses to be provided at the Post-Award Telephone Conference. 

Samples will be inspected and must comply with the specifications as to kind and quality of materials, and 

quality of reproduction.

The package must be marked “PRE-PRODUCTION SAMPLES DO NOT DELAY”; and must include the GPO 

jacket number, program, dept. requisition number, and title.

Manufacture of the final product prior to approval of the prior-to-production samples is at the contractor’s risk. 

Samples will not be returned to the contractor. All samples shall be manufactured at the facilities in which the 

contract production quantities are to be manufactured.

Results – Post-Award Test: The Variable Data Test, Proof Test, Live Data Sample Test and Prior-toProduction Sample Test produced during the Post-Award Test will be checked for adherence to all 

specifications. The government will approve, conditionally approve, or disapprove these test proofs and 

samples within 3 workdays of the receipt thereof.

Approval or conditional approval shall not relieve the contractor from complying with the specifications and all 

other terms and conditions of the contract. A conditional approval shall state any further action required by the 

contractor. A notice of disapproval shall state the reasons therefore.

If a test proof(s) is disapproved by the government due to printer’s errors, the government may require the 

contractor to submit additional test proofs for inspection and testing, in the time and under the terms and 

conditions specified in the notice of disapproval. Such additional test proofs shall be furnished, and necessary 

changes made, at no additional cost to the government.

In the event these additional test proof(s) are disapproved by the government due to printer’s errors, the 

contractor may be subject to termination for default.
Medicare Enrollment Packages and Cards Page 13 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

POST-AWARD SURVEY: The government reserves the right to conduct post-award survey(s) anytime 

during the term of the contract as the need arises.

PERSONALLY IDENTIFIABLE INFORMATION (PII) SECURITY: The contractor awarded this 

contract will be in custody of government owned material considered Personally Identifiable Information (PII). 

https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2007/m07-16.pdf

OMB Memorandum M-10-23 states the following in the Appendix: Personally, Identifiable Information 

(PII). The term “PII,” as defined in OMB Memorandum M-07-16 refers to information that can be used to 

distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying 

information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single 

category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an 

individual can be identified. In performing this assessment, it is important for an agency to recognize that nonPII can become PII whenever additional information is made publicly available — in any medium and from any 

source — that, when combined with other available information, could be used to identify an individual. 

PRIVACY ACT NOTIFICATION: This procurement action requires the contractor to do one or more of the 

following: design, develop, or operate a system of records on individuals to accomplish an agency function in 

accordance with the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and 

applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties as stated in 

5 U.S.C. 552a (i)(1) CRIMINAL PENALTIES. It is incumbent upon the contractor to inform its officers and 

employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a, 

specifically, 5 U.S.C. 552a (i)(1) CRIMINAL PENALTIES and m(1) GOVERNMENT CONTRACTORS.

PRIVACY ACT

(a) The contractor agrees:

(1) to comply with the Privacy Act of l974 and the rules and regulations issued pursuant to the Act in the 

design, development, or operation of any system of records on individuals in order to accomplish an agency 

function when the contract specifically identifies (i) the system or systems of records and (ii) the work to be 

performed by the contractor in terms of any one or combination of the following: (A) design, (B) 

development, or (C) operation;

(2) to include the solicitation notification contained in this contract in every solicitation and resulting 

subcontract and in every subcontract awarded without a solicitation when the statement of work in the 

proposed subcontract requires the design, development, or operation of a system of records on individuals to 

accomplish an agency function; and

(3) to include this clause, including this paragraph (3), in all subcontracts awarded pursuant to this contract 

which require the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved where the 

violation concerns the design, development, or operation of a system of records on individuals to accomplish an 

agency function, and criminal penalties may be imposed upon the officers or employees of the agency where the 

violation concerns the operation of a system of records on individuals to accomplish an agency function. For 

purposes of the Act when the contract is for the operation of a system of records on individuals to accomplish an 

agency function, the contractor and any employee of the contractor is considered to be an employee of the 

agency.
Medicare Enrollment Packages and Cards Page 14 of 65

1583-S (09/23) Section 1. – General Terms and Conditions

(c) The terms used in this clause have the following meanings:

(1) “Operation of a system of records” means performance of any of the activities associated with 

maintaining the system of records including the collection, use, and dissemination of records.

(2) “Record” means any item, collection or grouping of information about an individual that is maintained 

by an agency, including, but not limited to, his education, financial transactions, medical history, and 

criminal or employment history and that contains his name, or the identifying number, symbol, or other 

identifying particular assigned to the individual, such as a finger or voice print or a photograph.

(3) “System of records” on individuals means a group of any records under the control of any agency from 

which information is retrieved by the name of the individual or by some identifying number, symbol, or 

other identifying particular assigned to the individual.

ADDITIONAL EMAILED BID SUBMISSION PROVISIONS:

The government will not be responsible for any failure attributable to the transmission or receipt of the 

emailed bid including, but not limited to, the following –

1. Illegibility of bid.

2. e-mails over 75 MB may not be received by GPO due to size limitations for receiving emails.

3. The bidder’s email provider may have different size limitations for sending email; however, 

bidders are advised not to exceed GPO’s stated limit.

4. When the email bid is received by GPO, it will remain unopened until the specified bid opening 

time. government personnel will not validate receipt of the emailed bid prior to bid opening. GPO 

will use the prevailing Columbus, Ohio time and the exact time that the email is received by 

GPO’s email server as the official time stamp for bid receipt at the specified location

PAYMENT: Submitting invoices for payment via the GPO fax gateway (if no samples are required) utilizing 

the GPO barcode coversheet program application is the most efficient method of invoicing. Instruction for 

using this method can be found at the following web address: 

http://winapps.access.gpo.gov/fms/vouchers/barcode/instructions.html.

Vendors are expected to submit invoices within 30 days of job shipping/delivery. Invoices may also be mailed 

to: U.S. Government Publishing Office, Office of Financial Management, Attn: Comptroller, Stop: FMCE, 

Washington, DC 20401.

For more information about the billing process refer to the General Information of the Office of Finance web 

page located at https://www.gpo.gov/how-to-work-with-us/vendors/how-to-get-paid.

At time of invoicing, the contractor must submit a copy of the Print Order, contractor’s mailing receipts (GPO 

Form 712 and Postal Forms) and/or delivery receipts via e-mail to clinton.howard@cms.hhs.gov,

infocolumbus@gpo.gov, and rwoodmancy@gpo.gov (identify Program 1583-S and Print Order number(s) in the 

Subject line). All mailing receipts must also be e-mailed to tina.dickens@cms.hhs.gov.

NOTE: Contractor’s billing invoice must be itemized in accordance with the line items in the “SECTION 4. -

SCHEDULE OF PRICES.”
Medicare Enrollment Packages and Cards Page 15 of 65

1583-S (09/23)

SECTION 2 – SPECIFICATIONS

SCOPE: These specifications cover the production of cards, forms, letters, pamphlets and envelopes.

Requiring such operations as downloading files, data mailing preparation of record files, variable imaging, 

printing static single and multi-colors, folding, binding, gathering, inserting into envelopes, labeling, sorting, 

mailing, and distribution.

TITLE: Medicare Enrollment Packages and Cards.

Specifications apply equally to all Medicare Mail Piece Publications unless otherwise noted. See Assembly 

beginning on page 28 for item breakdown per Publication.

Medicare Mail Piece 

Publications

Frequency 

of Orders

Approximate Total Quantities per Order

Standard Print 

– Domestic 

Mail

Standard Print 

– Foreign Mail

Large Print 

(English & 

Spanish) 

Domestic and 

Foreign Mail

Alternative 

Format 

Packages and 

Secondary 

Crawford 

Packages

Replacement*

One per 

Week

40,000 to 

120,000 0 to 2,100 0 to 170 0 to 28

MBI Reassignment*

One per 

Week 500 to 1,200 0 to 100 0 to 4 0 to 6

Accretes One per 

Week

22,000 to 

55,000 0 to 1,800 N/A N/A

Domestic Initial 

Enrollment Package 

(Domestic IEP)

One per 

Month

120,000 to 

160,000 N/A N/A N/A

Puerto Rican Initial 

Enrollment Package 

(Puerto Rican IEP)

One per 

Month

1,200 to 

4,400 N/A N/A N/A

Foreign Initial 

Enrollment Package

(Foreign IEP)

One per 

Month N/A 900 to 2,200 N/A N/A

IEP Reminder Letter One per 

Month

125,000 to 

155,000 20 to 40 N/A N/A

Deemed Cards One per Year 20,000 to 

35,000 0 to 4 N/A N/A

Domestic General 

Enrollment Package 

(Domestic GEP)

One per Year 650,000 to 

800,000 N/A 0 to 30 N/A

Puerto Rican General 

Enrollment Package 

(Puerto Rican GEP)

One per Year 5,000 to 

12,000 N/A 0 to 10 N/A

Miscellaneous Letters Random 100 to 

100,000 Minimum 0 to 20 N/A

Note: Domestic and Foreign print and assembly the same for each of the Medicare Publications and contractor 

to separate during mail preparation.

Note: The Large Print editions will require Domestic and Foreign mailing but majority will mail Domestically.
Medicare Enrollment Packages and Cards Page 16 of 65

1583-S (09/23) Section 2. -- Specifications

Secondary Crawford packages included on Replacement and possibly MBI Reassignment orders are infrequent 

and anticipated to average about 8 orders per year with very few cards per order.

Medicare Mail Piece 

Publications

Frequency of 

Orders

Approximate Total Quantities per Order

Standard Print –

Domestic Mail

Standard Print –

Foreign Mail

PBID Medicare Cards and 

Letter (Initial Bulk Mailing)

One-time order 

being placed in 

November or 

December of 2022

1,800 to 2,500 0 to 100

PBID Medicare Cards and 

Letter

One per Month

(starting January 

2023)

20 to 50 0 to 5

PBID Letters may print a Large Print edition.

GOVERNMENT TO FURNISH: 

Storage Media: TIBCO mailbox. Contractor internet browser to be GIS-compatible Secure File Transfer 

Protocol Client (sFTP). Government has the option to send files to the contractors sFTP site instead of the files 

being available at the TIBCO Mailbox.

After award, additional information regarding the CMS Electronic File Transmission (EFT) Infrastructure can 

be provided.

Static and Variable Data:

Static Data: PDF files, fonts, color visuals, and samples of items to be furnished after award via e-mail or 

to the contractor’s sFTP site.

Variable Data: Data Files will be furnished via EFT. A TIBCO Mailbox will be setup by CMS to provide 

contractor access to TIBCO files. 

Platform: Microsoft’s Windows operating system or Apple Macintosh Operating System.

Fonts: All printer and screen fonts will be furnished. The contractor is cautioned that furnished fonts are the 

property of the government and/or its originator. All furnished fonts are to be eliminated from the contractor’s 

archive immediately after completion of the contract.

Publishing Software: Files will be furnished in current Adobe and Microsoft software for the following 

programs: Adobe Illustrator, Adobe Photoshop, Adobe InDesign, Adobe Acrobat, Microsoft Word, and 

Microsoft Excel.

Contractor will be required to support all current and future upgrades for Adobe and Microsoft software listed in 

“Publishing Software” above.

Office graphics (e.g., files from Presentation, Word Processing, or other non-publishing applications) are 

furnished for this procurement. Additional system work may be required to produce output as per 

specifications. If supplied by the government, a black and white visual will be used as the standard for page 

integrity. Contractor must ensure that the job outputs exactly as the furnished visual.

The contractor will not receive additional compensation, or time for common errors associated with the output 

of Office Graphics files. Common errors include, but are not limited to: 

• Color issues and Shifts (RGB color data, no spot colors, loss of Black plate)

• Page Integrity (text reflow)

• Missing prepress features (e.g., bleeds, trim marks)

• Loss of text characters from graphic elements.
Medicare Enrollment Packages and Cards Page 17 of 65

1583-S (09/23) Section 2. -- Specifications

TIBCO Record Files: TIBCO record files contain variable data information for the different Medicare 

Publications.

Complete record specifications will be furnished at the beginning of the contract and will be updated when 

changes are made in the record specifications which identify the field name, format, start/end position, and 

remark locations. The image content will contain a significant number of variable data fields, including address 

fields. Contractor must be able to read/print up to six lines of address information and ensure all address 

carriers, envelope and windows can display address format acceptable for USPS automation processing.

Domestic and Foreign IEP: Domestic IEP orders may sometimes contain a Foreign address and when this 

occurs the contractor to pull out the address from the Domestic IEP records and add to the Foreign IEP records. 

When this occurs, number of record address that are removed should be indicated on the verification email after 

TIBCO records have been received.

SECTION 504 - Large Print, Alternative Format Packages and Secondary Crawford Packages: 

Contractor to create a separate record group file(s) for each of the following: Large Print for English and 

Spanish; Alternative Format Packages; and for Secondary Crawford packages.

The TIBCO record contains a field called Medicare Summary Notice (MSN). The MSN field when checked 

(indicated) states whether or not the individual qualifies for the benefits of Section 504 requirements. For these 

beneficiary individuals, items as required for the Medicare Publication, print in large print (English and Spanish 

editions). The envelopes and card items will be standard print. 

Alternative Format Packages and Secondary Crawford Packages: Replacement, MBI Reassignment and 

PBID orders will require Alternative Format material packages and Secondary Crawford package. Type of 

Alternative Format material will be indicated by MSN Media Preference Code. The code indicates type and 

language of alternative format. 

Alternative Format Packages:

Contractor will be furnished Alternative Format, Section 504 materials in Tyvek packages (envelopes), 

approximately 9 x 12”, a clear (see through) pouch approximately 6 x 9-1/2” affixed on the outside, with a 

release liner. The furnished Tyvek packages are packed in boxes measuring approximately 12 x 12 x 18”. The 

Tyvek packages will be sealed and labeled with two alpha characters on the flap as shown below in parenthesis

to indicate the contents. Contractor to store packages in a secured area. Additional Alternative Format 

Packages will be furnished as supplies run low in inventory. At completion of contract, contractor will be given 

guidance on what to do with remaining Section 504 materials. Below is a list of the Alternative Format 

materials:

• English Audio (EA)

• English Braille (EB)

• English Data (ED)

• Spanish Audio (SA)

• Spanish Braille (SB)

Secondary Crawford Packages: These beneficiaries receiving the Secondary Crawford package will be 

identified with a “X” in position 430 of the TIBCO record. 

ELECTRONIC PREPRESS: Immediately upon receipt of digital files and prior to image processing, the 

contractor shall perform a basic check (preflight) of the furnished media, TIBCO files, and publishing files to 

ensure correct output of the required reproduction image. Any errors, media damage, or data corruption that 

might interfere with proper file image processing must be reported to Clinton Howard 

clinton.howard@cms.hhs.gov and Russell Woodmancy rwoodmancy@gpo.gov prior to further performance. A 

list of government contact people regarding the TIBCO record files will be provided after award.

The contractor shall create or alter any necessary trapping, set proper screen angles and screen frequency, and 

define file output selection for the imaging device being utilized. Furnished files must be imaged as necessary 

to meet the assigned quality level.
Medicare Enrollment Packages and Cards Page 18 of 65

1583-S (09/23) Section 2. -- Specifications

Digital Deliverables: If the contractor is required to make revisions, the contractor shall, prior to making 

revisions, copy the files and make all changes to the copy. No revisions are to be made to the furnished files.

The contractor must furnish final press PDF. At the end of the contract, the current static image PDF

deliverables for each of the Medicare Publications shall be e-mailed to Clinton Howard 

clinton.howard@cms.hhs.gov and Russell Woodmancy rwoodmancy@gpo.gov

Print Orders (GPO Form 2511).

Delivery/Shipping Status Report

Identification markings such as register marks, ring folios, rubber stamped jacket numbers, commercial 

identification marks of any kind, etc., except GPO imprint, form number, and revision date, carried on copy or 

film, must not appear on finished product.

GPO Imprint to only appear on Medicare Publication pamphlets.

CONTRACTOR TO FURNISH: All materials and operations, other than those listed under “Government to 

Furnish,” necessary to produce the product(s) in accordance with these specifications.

Contractor will be required to verify that the CMS furnished files and quantity(s) are available in the TIBCO 

mailbox within two hours of receipt of the Print Order.

REPRODUCIBLES: The contractor must make all reproducibles required. The contractor is responsible for 

determining what type reproducibles will be used but must maintain the quality level specified in the contract. 

No separate charges will be allowed for the various types of reproducibles that may be used.

Further, the contractor is responsible for outputting all images contained on furnished material, regardless of the 

production process, at the highest effective resolution possible. The contractor is responsible for determining 

the appropriate output resolution to achieve optimal results for such design elements as blends, gradients, 

halftones, type and other images. This determination should be made using factors such as stock, imaging 

device (or press) being used, and other factors unique to the contractor’s production environment.

PROOFS - The following applies to both “Variable” and “Static” proofs as stated above unless otherwise 

noted: See “Post-Award Test” beginning on page 11. 

Anticipate copy changes to occur once a year. Government notification of change(s) will usually be sometime 

from October through January. These changes are expected to be in production beginning on orders issued in 

January/February. But copy changes can happen anytime throughout the year depending on the Medicare 

Publication item. 

When copy changes do occur, government notification will normally be requested via e-mail with attached 

publishing software files. Contractor to submit “Soft” PDF proofs within 5 workdays (unless more time) after 

the receipt of e-mail and Government Furnished Property. Contractor shall submit static proofs and then 

variable data test proofs when applicable. Normally the “Live Variable Data Sample Test” is only required at 

beginning of the contract but maybe required if government deems necessary at a later date and time.

The government will approve or disapprove the PDF proofs within two workdays by e-mail. Approval or 

disapproval will not relieve the contractor of complying with the specifications and all other terms and 

conditions of the contract. Additional e-mail PDF proof samples may be required if image samples are 

disapproved.

If any contractor’s errors are serious enough in the opinion of the GPO to require revised proofs, the revised 

proofs are to be provided at no expense to the government. 

Contractor’s responsibility after submission of proofs to monitor for a confirmation e-mail from the government 

in acknowledging receipt of proof(s). If a confirmation e-mail receipt from the government has not been 

received within one-hour. The contractor is required to follow-up via telephone notification to Clinton Howard 

at (410) 786-1962 to inform him that proof(s) were e-mailed or uploaded to contractor’s sFTP site.
Medicare Enrollment Packages and Cards Page 19 of 65

1583-S (09/23) Section 2. -- Specifications

VARIABLE IMAGE (DATA) LAYOUT PROOFS: Proofs will be required after award, “1) Variable Data

Test” and “3) Live Variable Data Sample Test” of 50 samples each as described beginning on page 11. For the 

“1) Variable Data Test”, contractor to submit one “Press Quality” .PDF “Soft” proof (for content only) of each 

item that requires variable imaging (card, form and letter). The variable image of all pages on forms and letters; 

and face and back of cards. Contractor’s option to submit the complete forms and letter (all pages) that contain 

both variable and static image.

Proofs to be created using the same Raster Image Processor (RIP) that will be used to produce the final printed 

product. Proofs will be evaluated for text flow and image position for variable and static data. Contractor must 

also submit the corresponding source data files (also known as a “data dump”) in a Microsoft Excel format.

The contractor will be responsible for performing all necessary proofreading to ensure that the proofs submitted 

are in conformity with the furnished copy and record specifications. If CMS finds errors during the proofing 

process, the contractor must make all corrections and submit additional proofs along with the corresponding 

source data files. This process will be repeated until the contractor submit samples that CMS considers to be 

error-free.

“1) Variable Data Test” proofs to be either uploaded to contractor’s sFTP site with e-mail notification or an email with encryption password protected, PK zipped .PDF files to Clinton Howard at

clinton.howard@cms.hhs.gov and Russell Woodmancy at rwoodmancy@gpo.gov The subject line of the email to include GPO Program Number 1583-S, Medicare Publication name and item(s) with correspondence.

STATIC IMAGE (DATA) PROOFS: Proofs will be required after award, “2) Static Image Proof Test” as 

indicated on page 11, and when copy changes occur. 

For all Medicare Publication items, contractor to submit one “Press Quality” PDF “soft” proof (for static data 

content only) using the same Raster Image Processor (RIP) that will be used to produce the final printed 

product. PDF proof will be evaluated for text flow, image position, and color breaks. Proof will not be used for 

color match. A placeholder image for where variable image will be located when applicable.

Send proofs to Clinton Howard at clinton.howard@cms.hhs.gov and Russell Woodmancy at 

rwoodmancy@gpo.gov in the subject line of the e-mail to include GPO Program Number 1583-S, Medicare 

Publication name and item(s) with all correspondence.

PRIOR-TO-PRODUCTION SAMPLES: These samples contain both variable image and static image 

printing, see “4) Prior-to-Production Samples” beginning on page 12.

The contractor must not print prior to receipt of an “OK to Print” or “OK to Print with Corrections”.

Ink Draw Downs: Upon request, contractor to submit ink draw downs on actual production stock of Pantone 

color(s) used to produce the product. 

PRESS SHEET/IMAGING INSPECTION: Upon government request, final makeready press sheets/imaging 

may be inspected and approved at the contractor’s plant for the purpose of establishing specified standards for 

use during the actual press run/imaging. Upon approval of the sheets/imaging, the contractor is charged with 

maintaining those standards throughout the press run/imaging process (within QATAP tolerances when 

applicable) and with discarding all makeready sheets that preceded approval. See GPO Publication 315.3 

(Guidelines for Contractors Holding Press Sheet Inspections) dated January 2015 (available on GPO web site at: 

https://www.gpo.gov/how-to-work-with-us/vendors/forms-and-standards under “Print Procurement”, click on 

“Guidelines for Contractors Holding Press Sheet Inspections” link to download a PDF of the document.

NOTE: A press sheet/imaging inspection is for the purpose of setting specific standards that are to be 

maintained throughout the entire run. It does not constitute a prior approval of the entire run.

Press sheets for static image must contain control bars for each color of ink on the sheet. Control bars must be 

placed parallel to the presses ink rollers. The control bars must show areas consisting of 1/8 x 1/8” minimum 

solid color patches, tint patches (25, 50 and 75%), dot gain scale (such as, BRUNNER, GATF, GRETAG, or 

RIT) and gray balance patches for process color (if applicable). These areas must be repeated across the entire 

press sheet.
Medicare Enrollment Packages and Cards Page 20 of 65

1583-S (09/23) Section 2. -- Specifications

On-Site Press Sheet for Static Printing and Variable Imaging Inspections: Unless waived by the 

government, some or all the items that comprise a Medicare Publication, an on-site press and imaging 

inspections for the first printing/imaging will be conducted at the beginning of the contract or when artwork 

changes occur. The notification schedule (below) should be followed for these Inspections. The different items 

that make up a package and/or card sets, that require an inspection, the contractor shall make all efforts 

necessary to schedule the imaging and printing inspection on the same, or subsequent days.

NOTE: The government may conduct on-site randomized Security and/or Variable Imaging inspection at any 

time.

Notification: Call GPO Columbus Office at (614) 488-4616 and CMS representative Clinton Howard at 410-

786-1962 with a minimum notice of 3 work days prior to availability of the press sheets for inspection. This 

notification must provide the starting date and time of the first press form, as well as the tentative schedule for 

all subsequent press forms required for complete production. On site press inspections must be scheduled 

Monday through Friday, exclusive of Federal holidays, and scheduled to begin between the hours of 7:00 a.m. 

and 7:00 p.m. local time at the plant.

It is the contractor’s responsibility to maintain and adjust inspection schedules, as required, to ensure all 

subsequent inspections are performed on following workdays. Inspection schedules must allow government

representatives to complete approval of all press forms within the day/time requirements. Inspections must not 

be scheduled on weekends, or to “carry over to the following week” without prior approval by the GPO 

Contracting Officer.

The GPO Contracting Officer reserves the right to deny requests for press inspections/color approvals that 

conflict with these scheduling requirements. Failure to comply with these scheduling requirements may result in 

additional government per diem, overtime, and/or travel related charges which may be chargeable to the 

contractor (See GPO Contract Terms, Pub. 310.2, (Rev. 01-18), Article 14. Inspection and Tests, (e)(1) & (2)).

STOCK/PAPER: The specifications of all paper furnished must be in accordance with those listed herein or 

listed for the corresponding JCP Code numbers in the “Government Paper Specification Standards No. 13” 

dated September 2019.

Color of paper furnished shall be of a uniform shade and a close match by visual inspection of the JCP and/or 

attached color sample(s). The Contracting Officer reserves the right to reject shipments of any order printed on 

paper the color of which, in his opinion, materially differs from that of the color sample(s).

All stock/paper used in each copy must be of a uniform shade.

Cards: White 25% Index, basis weight: 110 lbs. per 500 sheets, 25-1/2 x 30-1/2”, equal to JCP Code K20. 

EXCEPTION: Brightness level must be a minimum of 91. At contractor’s option, subject to government 

approval, White Smooth Cover, basis weight: 80 lbs. per 500 sheets, 20 x 26”, equal to JCP Code L21. 

EXCEPTION: Brightness level must be a minimum 91.

Forms and Letters: White Writing, basis weight: 20 lbs. per 500 sheets, 17 x 22”, equal to JCP Code D10.

Pamphlets: White Uncoated Text, basis weight: 50 lbs. per 500 sheets, 25 x 38”, equal to JCP Code A60. 

Contractor’s option to use 60 lbs.

Domestic IEP Reply Mail Envelope: Light Brown Kraft, basis size 17 x 22”, 24 – 28 lbs. per 500 sheets, 

equal to JCP Code V10.

Balance of Envelopes: White Writing Envelope, basis weight: 24 lbs. per 500 sheets, 17 x 22”, equal to JCP 

Code V20. Contractor’s option for 28 lbs. per 500 sheets, all other specifications shall be maintained.

PRINTING/IMAGING: Contractor is cautioned about preprinting items because of possible content changes, 

see “PREPRINTING OF STATIC DATA” on page 27. 

Static Data Printing/Imaging: Static printing is in black ink only for all items, and up to 2 additional Pantone 

ink colors for Pamphlets and Card items. Static Data Printing/Imaging is the process of reproducing content 

elements so they appear exactly the same.
Medicare Enrollment Packages and Cards Page 21 of 65

1583-S (09/23) Section 2. -- Specifications

Large Print items only, at contractor’s option, the product may be produced via conventional offset or digital 

printing provided that Quality Level 3 standards are maintained.

Variable Imaging (VI) (also known as variable–information printing (VIP) or Variable–data printing

(VDP)): Contractor will be required to produce variable imaging in black ink from TIBCO files (variable data 

files). At contractor’s option, the variable imaging to be produced by either waterproof ink jet spray or highdensity laser at a minimum 600 x 600 dpi. 

Quick Response (QR) Code: The contractor is required to image a QR code to the back of each Enrollment

Card. QR Code to meet ISO (ISO/IEC18004) standard. The QR Code fields on the back to be an exact match 

of the individual’s name, MBI number and Unique Identification Number imaged on face of card. The 

approximate QR code overall size is 5/16” square, each module is made up of 4 or more dots, and must be 

readable by handheld device, minimum standard scanner type resolution 0.25mm. Tilde “~” delimiter to be 

used to separate fields.

Note: The MBI Number and Unique Identification Number provides a two-point verification system.

Cards Trim Size Perforation Locations

Replacement, MBI Reassignment, 

Accretes, Puerto Rican IEP, 

Foreign IEP, PBID and Deemed

7-1/2 x 3-11/16”, 

includes 3-3/8 x 2-1/8” 

tear-out card.

Vertical Perforation: 3-3/8” from 

right edge of card, extending 2-1/8” 

from top edge of card.

Horizontal Perforation: 2-1/8” 

from top edge of card, extending 

3-3/8” from right edge of card.”

Domestic IEP

5-1/2 x 8-1/2”, 

includes 3-3/8 x 2-1/8” 

tear-out card.

Vertical Perforation: 3-3/8” from 

right edge of card, extending 2-1/8” 

from top edge of card.

Horizontal Perforation: 2-1/8” 

from top edge of card, extending 

3-3/8” from right edge of card.

No Large Print editions of cards. The static printing for the above two groups of cards is the same for 

each group. The cards for the Replacement and MBI Reassignment publications print identical image for 

the alternative format, large print and Secondary Crawford packages when applicable with furnished 

records for those orders. The following requirements are the same for all Cards. 

Card Static Printing: Face prints type and fine line matter in black and two Pantone ink colors, close 

registration and ink trapping required. Back prints type and rule matter in one Pantone ink color. The 

Pantone color on back will be one of the Pantone colors on face.

Static card image is the same for the Replacement, MBI Reassignment, Accretes, Puerto Rican IEP, Foreign 

IEP, and PBID. The Deemed Card static image changes every year.

The Pantone ink colors may change during the term of this contract, see “PREPRINTING OF STATIC DATA” 

on page 27. Pantone ink color(s) will be established during the proofing process.

Card Variable Image: Variable image on face consists of address block plus approximately 10 to 20 typelines. 

Address blocks consist of up to 5 lines plus postal markings, including Intelligent Mail Barcode (IMb), and 

contractors Unique Identification Number, see “Variable Imaging” on page 21 for technical specifications. 

Variable imaging the back of each card consisting of Quick Response (QR) Code. See Quick Response (QR) 

Code defined on page 21. Contractor’s option to have a 2D barcode on face and/or back of card for unique ID

but must be on the carrier card and not the individual tear out card.
Medicare Enrollment Packages and Cards Page 22 of 65

1583-S (09/23) Section 2. -- Specifications

Variable Mailing Addresses: Variable data for mailing addresses (address block) and information on the face of 

the Medicare Card must be imaged in all capital letters without punctuation. Punctuation exceptions are

hyphens positioned in the Medicare Number and hyphens and/or apostrophes that may appear in the beneficiary 

name on Medicare Card. Variable data for the text to the left of face of the Medicare card must be imaged with 

capital and lowercase letters and with punctuation. Variable data must match art (format/layout) provided by 

CMS.

• Replacement, MBI Reassignment, Accretes and Deemed cards are inserted into a 4 x 8-1/8” window 

envelope. 

• Puerto Rican IEP and Foreign IEP are inserted in a 4-1/8 x 9-1/2 window envelope.

Margins: Inadequate gripper. No bleeds. The margins around the QR Code will be 4 or more modules.

Forms and Letters – Standard Print

Medicare Mail Piece 

Publications Pages Flat Size Folded Size Fold Type

Replacement and MBI 

Reassignment Letter 2 to 6 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

Accrete Letter 2 to 4 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

Domestic IEP Letter 2 to 6 8-1/2 x 11” 8-1/2 x 5-1/2” One Fold

Puerto Rican IEP Letter 2 to 6 8-1/2 x 11” 8-1/2 x 3-2/3” Letter Fold

Foreign IEP Letter 2 to 6 8-1/2 x 11” 8-1/2 x 3-2/3” Letter Fold

Foreign IEP Form 2 8-1/2 x 11” 8-1/2 x 3-2/3” Letter Fold

IEP Reminder Letter 2 to 4 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

Domestic GEP Letter 4 to 8 8-1/2 x 11” 8-1/2 x 3-2/3” Letter Fold

Domestic GEP Form 2 8-1/2 x 11” 8-1/2 x 3-2/3” Letter Fold

Puerto Rican GEP Letter 4 to 8 8-1/2 x 11” 8-1/2 x 3-2/3” Letter Fold

PBID Letter 2 to 6 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

Miscellaneous Letters 2 to 4 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

Note: Alternative Formats and Secondary Crawford packages, only cards and envelopes are required with these

mail pieces, the accompanying letter is not required unless otherwise noted on the Print Order. 
Medicare Enrollment Packages and Cards Page 23 of 65

1583-S (09/23) Section 2. -- Specifications

Forms and Letters – Large Print (English and Spanish editions)

Medicare Mail Piece 

Publications Pages Flat Size Folded Size Fold Type

English - Replacement and MBI 

Reassignment Letters 6 to 18 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

Spanish - Replacement and 

MBI Reassignment Letters 6 to 18 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

English – PBID Letter 2 to 18 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

Spanish – PBID Letter 2 to 18 7-1/2 x 11” 7-1/2 x 3-2/3” Letter Fold

English – Domestic GEP Letter 6 to 10 8-1/2 x 11” N/A No Folding

English – Domestic GEP Form 4 8-1/2 x 11” N/A No Folding

Spanish – Puerto Rican GEP 

Letter 6 to 12 8-1/2 x 11” N/A No Folding

Variable Image for Letters and Forms consists of address block and up to 2 additional typelines on page one 

only, all within 3-1/2” from top edge. Address blocks consist of up to 5 lines plus postal markings, including

Intelligent Mail Barcode (IMb). All variable image, including addresses, must be imaged in all capital letters 

without punctuation. Exceptions permitted are hyphens positioned in the Medicare Claim Number and hyphens 

and/or apostrophes that may appear in the beneficiary name on Medicare Card. See “Variable Imaging” on page 

21.

Printing requirement is the same for all Letters as follows: Page 1 prints static and variable image in black 

ink. Page 2 and up to 18 pages (1 to 9 leaves) print black ink with static image. Note the last page may or may 

not be blank.

Note: Forms and Letters for Replacement and MBI Reassignments Print Orders print identical static images for 

each of the Standard and Large Print items.

Printing requirement is the same for all Forms as follows: Face prints black ink with static and variable 

image. Variable image consists of address block and up to 2 typelines. Back may be blank or print black ink 

with static image.

Margins: Adequate gripper.

Binding of 8-1/2 x 11” GEP Large Print Forms and Letters: One stitch in upper left corner when 2 or more 

leaves.
Medicare Enrollment Packages and Cards Page 24 of 65

1583-S (09/23) Section 2. -- Specifications

Pamphlets, Self-Cover

Medicare Mail Piece Publications Pages Trim Size Number of Inks

Accretes 16 3-1/2 x 7-1/2” Black plus 2 Pantone Colors

Domestic IEP 32 to 48 8-3/8 x 5-3/8” Black plus 2 Pantone Colors

Puerto Rican IEP 16 to 28 3-1/2 x 8” Black plus 1 Pantone Color

Foreign IEP 12 to 24 3-1/2 x 8” Black plus 1 Pantone Color

Domestic GEP – Standard Print 16 to 32 3-1/2 x 8” Black plus 1 Pantone Color

Domestic GEP – Large Print 16 to 28 8-1/2 x 11” Black Only

Puerto Rican GEP – Standard Print 12 to 20 3-1/2 x 8” Black plus 1 Pantone Color

Puerto Rican GEP – Large Print 16 to 28 8-1/2 x 11” Black Only

The following is the same for all Pamphlets:

Static Printing: Prints head-to-head in ink(s) as indicated in the above table throughout. Printing consists of 

line matter, possible QR Code, solids with reverse type, halftones, gradients and screen-tints throughout. 

• Pamphlets printing in two or more colors: Self-cover 1 (title page) bleeds top, bottom and right. Selfcover 4 bleeds bottom, left, and right. Inside text pages, including self-covers 2 and 3, bleed top, left, 

and right. Print masthead to and align across the bind edge throughout (crossovers).

• Large Print pamphlets print black ink only: Prints text and rule matter only with adequate 

gripper/margins.

Binding: Saddle stitch in two locations (5-3/8” dimension for Domestic IEP pamphlet and long dimension for 

balance of pamphlets). Page counts ordered will be in increments of 4 pages.

Business Reply (BRM) and Return Mail Envelopes

Medicare Mail Piece 

Publications Envelope Size Seam Window Size** Window Location

Domestic IEP 5-3/4 x 8-3/4” Side 1-7/16 x 3-1/2” 4-3/4” from left and 7/16” 

from bottom edges of envelope

Foreign IEP 3-7/8 x 8-7/8”

(No. 9)

Diagonal No Window N/A

Domestic GEP 3-7/8 x 8-7/8”

(No. 9)

Diagonal No Window N/A
Medicare Enrollment Packages and Cards Page 25 of 65

1583-S (09/23) Section 2. -- Specifications

Medicare - Mailing Envelopes

Medicare Mail Piece 

Publications Envelope Size Seam Window Size Window Location

Replacement, MBI 

Reassignment, 

Accretes, IEP 

Reminder Letter, 

PBID and Deemed 

Cards 

4 x 8-1/8” Diagonal 1-3/8 x 3-3/4” 3/8” from left and 5/8” from 

bottom edges of envelopes

Domestic IEP 6 x 9-1/2” Side 1-1/2 x 4-1/2” 1/2” from left and 11/16” from 

bottom edges of envelope

Puerto Rican IEP 4-1/8 x 9-1/2”

(No. 10)

Diagonal 1-3/16 x 4-9/16” 7/8” from left and 1⁄2” from 

bottom edges of envelope

Foreign IEP 4-1/8 x 9-1/2”

(No. 10)

Diagonal 1-3/16 x 4-9/16” 7/8” from left and 1⁄2” from 

bottom edges of envelope

Domestic GEP -

Standard

4-1/8 x 9-1/2”

(No. 10)

Side 1-3/8 x 4-1/2” 7/8” from left and 1⁄2” from 

bottom edges of envelope

Domestic GEP –

Large Print 9 x 12” Side 5 x 2” 3-5/16” from left and 5/8” from bottom edge of envelope

Puerto Rican GEP -

Standard

4-1/8 x 9-1/2”

(No. 10)

Side 1-3/8 x 4-1/2” 7/8” from left and 1⁄2” from 

bottom edges of envelope

Puerto Rican GEP –

Large Print 9 x 12” Side 5 x 2” 3-5/16” from left and 5/8” from bottom edge of envelope

Printing and Construction for Envelopes:

• Domestic Initial Enrollment Business Reply Mail (BRM) Envelope: Open side, split gummed straight 

flap with slightly tapered and rounded corners. Exterior prints face and back in black ink, no printing on 

flap, no bleeds, no interior security tint. BRM intended for recipient use only and if used, right address 

block of Enrollment Card is to appear in the window.

• Domestic Initial Enrollment Mailing Envelope: Open side, fully gummed straight flap with slightly 

tapered and rounded corners. After construction, print face and back in black ink, no printing on flap, and 

no bleeds. Interior prints security tint. 

• Puerto Rican Initial Enrollment Mailing Envelope: Open side, fully gummed commercial style flap. 

After construction, print face and back in black ink, no printing on flap, no bleeds. Interior prints security 

tint. 

• Foreign Initial Enrollment Return Envelope: Open side, split gummed commercial style flap, nonwindow. Exterior prints face only (no printing on flap) in black ink, no bleeds, no interior security tint.

• Foreign Initial Enrollment Mailing Envelope: Open side, fully gummed commercial style flap. After 

construction, print face and back in black ink, no printing on flap, no bleeds. Interior prints security tint. 

• Domestic General Enrollment Business Reply Mail (BRM) Envelope: Open side, fully gummed straight 

flap with slightly tapered and rounded corners, non-window. Exterior prints face and back in black ink, 

printing on flap, no bleeds, no interior security tint. BRM intended for recipient use only.
Medicare Enrollment Packages and Cards Page 26 of 65

1583-S (09/23) Section 2. -- Specifications

• Domestic General Enrollment Mailing Envelopes: Open side, fully gummed commercial style flap. 

After construction, print face and back (flap only) in black ink, no bleeds. Interior prints security tint. 

• Puerto Rican General Enrollment Mailing Envelopes: Open side, fully gummed commercial style flap. 

After construction, print face and back (flap only) in black ink, no bleeds. Interior prints security tint. 

• Replacement, MBI Reassignment, Accretes, IEP Reminder Letter, PBID, Miscellaneous Letters and 

Deemed Card Mailing Envelopes: Open side, fully gummed commercial style flap. After construction, 

print face and back (flap only) in black ink, no bleeds. Interior prints security tint. 

Security Tint: Print design or tint envelope on the inside (back - before manufacture) in black or blue ink at 

contractor’s option, lining is not acceptable. Security tint extends into ungummed area of flap. Contractor may 

use his own design for security tint, however no proprietary tints or company logos are permitted. Contractor 

must guarantee that the product will ensure complete opacity and prevent show through of any material 

contained therein.

Note: Mailing envelopes require security tint and return/reply mailing envelopes do not.

Printing and Construction: Open side and fully gummed commercial style flap. After construction, print face 

and back in black ink, no printing on flap, and no bleeds. 

Envelopes with Windows: All window envelopes to have a clear polystyrene window covering. The material 

must be transparent, securely glued on all inside edges so as not to interfere with insertion of contents and be in 

accordance with all applicable USPS requirements for automated equipment. 

Envelope Publication Number for All Medicare Package Mailing Envelopes: The Publication number to be 

printed in black ink on the face (after construction) lower left corner of the envelope as shown in the table below 

for each package. Contractor’s option, the Publication number can either be static print or variable image.

Medicare Package Publications

Publication Number 

Printed on Envelope*

Accretes, Replacements, MBI Reassignments, IEP Reminder 

Letter, Miscellaneous Letters, PBID and Deemed Cards

1583-S

Domestic IEP (English Language) 1583-S-11095

Foreign IEP (English Language) 1583-S-11871

Puerto Rico IEP (Spanish Language) 1583-S-11989-S

Domestic GEP (English Language) 1583-S-11873

Puerto Rican GEP (Spanish Language) ** 1583-S-PR GEP-S

*Note: This will be printed/imaged in 10 point bold, Times New Roman font. The Publication Number consist 

of the Program number and Product number. The Product number also resides on the back of each 

corresponding pamphlet. Accretes Product number is 12020 and is not required to be printed on the envelopes.

** Note: The Puerto Rican GEP – Large Print mailings to use the Domestic GEP Large Print envelopes.
Medicare Enrollment Packages and Cards Page 27 of 65

1583-S (09/23) Section 2. -- Specifications

PREPRINTING OF STATIC IMAGES OF ITEMS: At the contractor’s option, contractor may preprint any 

static images from static data to keep extra stock on hand or print the static image when they receive the orders. 

Although the static image will generally remain the same from order to order, changes may need to be made 

from time to time. Contractor to expect static image changes in pamphlets, forms and letters at the beginning of 

each new calendar year. The standard and large print image changes will typically change at the same time. 

The government will provide the contractor with as much advance notice as possible.

Reimbursement for mid-year copy changes, it is anticipated that the contractor may keep no more than a 3-

month supply of static images of forms, letters, pamphlets; and a 5-month supply of cards and envelopes.

Contractor may apply for reimbursement of outdated preprinted items that require disposal per contract pricing. 

Contractor to communicate and coordinate months prior to the annual copy change of preprinted static image 

item quantities with Clinton Howard at clinton.howard@cms.hhs.gov and Russell Woodmancy at 

rwoodmancy@gpo.gov. Anticipation is less than a month supply prior to schedule copy change. If government 

decides not to do an onsite inspection, contractor to provide CMS and GPO a PDF of the certificate of 

destruction which must include the following: item(s) destroyed, count (number of item(s) destroyed), date 

when occurred, and person(s) that witness the destruction of government property.

No anticipation of cards and envelopes changing during the course of the contract with the exception of the 

Deemed Cards that change every year.

LABELING AND MARKING: Contractor to download the “Labeling and Marking Specifications” form 

(GPO Form 905, R. 7-15) from www.gpo.gov fill in appropriate blanks, and attach to shipping containers.

PACKING: Pack bulk shipments in shipping containers furnished by the contractor, ( i.e. Blue Label Copies 

and hard copy Variable Data Verification Samples). Containers are not to exceed 45 pounds when fully packed.

DEPARTMENTAL RANDOM COPIES (BLUE LABEL) ONLY FOR STANDARD PRINT 

PAMPHLETS: 

It is anticipated that pamphlets will be printed in bulk for multiple month’s supply of Initial Enrollment Period 

(IEP) Packages, and Accretes. Whereas General Enrollment Packages (GEP) pamphlets occur once per year. 

Contractor to let CMS and GPO know when bulk printing of pamphlets for IEP and Accretes Blue Label Copies 

thereby can be assigned a Print Order number in advance for the contractor to use on GPO Forms 917 and 2678. 

Based upon quantity of the run, the number to be divided into equal sublots in accordance with the chart below. 

A random copy must be selected from each sublot. Do not choose copies from the same general area in each 

sublot. The contractor will be required to certify that copies were selected as directed using GPO Form 917 –

Certificate of Selection of Random Copies (located on Form 917 - CERTIFICATE OF SELECTION OF 

RANDOM COPIES (gpo.gov). The random copies constitute a part of the total quantity ordered, and no 

additional charge will be allowed.

Quantity Ordered Number of Sublots

100 - 3,200 50

3,201 - 10,000 80

10,001 - 35,000 125

35,001 and over 200

These randomly selected copies must be packed separately and identified by a special label (GPO Form 2678 –

Departmental Random Copies (Blue Label)) that must be printed on blue paper and affixed to each affected 

container. This form can be downloaded from GPO Form 2678. The container and its contents shall be 

recorded separately on all shipping documents and sent in accordance with the “Distribution” clause.

A copy of the Print Order and a signed Certificate of Selection of Random Copies, GPO Form 917 must be 

included in the shipping container. 

Prior to shipping the Blue Label Copies, contractor to send PDF of GPO Form 917 and GPO Form 2678 to

Clinton Howard at clinton.howard@cms.hhs.gov and Russell Woodmancy at rwoodmancy@gpo.gov in the 

subject line of the e-mail to include GPO Program Number 1583-S, Medicare Publication title, and Blue Label 

Copies.
Medicare Enrollment Packages and Cards Page 28 of 65

1583-S (09/23) Section 2. -- Specifications

ASSEMBLY:

Assembly - Weekly Orders

Mail Piece Publication

Insert item contents 

in the following 

order:

Description

Replacement and MBI 

Reassignment Cards –

Standard Print*

1. Card Mailing address block to show through window 

of mailing envelope.

2. Letter

Two to six pages (1 to 3 leaves) collated and 

folded to approximately 7-1/2 x 3-2/3” (letter 

fold), logo facing flap side of mailing envelope.

Replacement and MBI 

Reassignment Cards –

Large Print*

1. Card Mailing address block to show through window 

of mailing envelope.

2. TagLine/Language 

Letter

Four to six pages (2 to 3 leaves) collated and 

folded to approximately 7-1/2 x 3-2/3” (letter 

fold), logo facing flap side of mailing envelope.

3. Large Print 

Letter

Two to six pages (1 to 3 leaves) collated and 

folded to approximately 7-1/2 x 3-2/3” (letter 

fold), logo facing flap side of mailing envelope.

4. Office Alternative

Format Letter

Two to six pages (1 to 3 leaves) collated and 

folded to approximately 7-1/2 x 3-2/3” (letter 

fold), logo facing flap side of mailing envelope.

Accretes

1. Card Left mailing address block to show through 

window of mailing envelope. 

2. Pamphlet Title page facing flap side of mailing envelope.

3. Letter 7-1/2 x 11” letter fold to 7-1/2 x 3-2/3””, logo 

facing flap side of mailing envelope.

Note: Alternative Formats and Secondary Crawford packages, only cards and envelopes are required with these 

mail pieces, the accompanying letter is not required unless otherwise noted on the Print Order. 

*Alternative Format Assembly: Anticipation for the alternative format packages applies to Replacement, MBI 

Reassignment and PBID orders. Type of Alternative Format material will be indicated by an MSN Media 

Preference Code. The code indicates type and language of alternative format. Insert the Medicare Card Set into 

the pouch with the individual address facing out and remove the release liner and ensure the pouch is securely 

attached to package. The Medicare Card Set consist of Card inserted and sealed into the mailing envelope per 

contract specifications. Below is a list of the Alternative Format materials:

• English Audio (EA)

• English Braille (EB)

• English Data (ED)

• Spanish Audio (SA)

• Spanish Braille (SB)

*Secondary Crawford Packages: Anticipation for the Secondary Crawford Packages applies to Replacement, 

MBI Reassignment and PBID orders. Secondary Crawford Package is to print Large Print instead of Standard 

Print for the materials that are inserted into an envelope unless otherwise noted on Print Order. The envelope is 

to be sealed after insertion of Secondary Crawford printed items. All the sealed Secondary Crawford Packages 

to be packed in a single container for shipping.
Medicare Enrollment Packages and Cards Page 29 of 65

1583-S (09/23) Section 2. -- Specifications

Assembly - Monthly Orders

Mail Piece Publication

Insert Packet item 

contents in the 

following order

Description

Domestic Initial Enrollment

Package

(Domestic IEP)

1. Card

Left mailing address block to show through window 

of mailing envelope. Note: Domestic Initial 

Enrollment Package has an Enrollment Card. The 

complete left address block of Enrollment Card must 

appear through the window. No other content 

should appear in the window area.

2. Pamphlet Title page facing flap side of mailing envelope.

3. BRM Envelope Face of envelope facing flap side of mailing 

envelope.

4. Letter Folded to 8-1/2 x 5-1/2”, logo facing flap side of 

mailing envelope.

Puerto Rican Initial 

Enrollment Package

(Puerto Rican IEP)

1. Card Left mailing address block to show through window 

of mailing envelope.

2. Letter Fold to approximately 8-1/2 x 3-2/3” (letter fold)

3. Pamphlet Title page facing flap side of mailing envelope.

Foreign Initial Enrollment

Package

(Foreign IEP)

1. Card Left mailing address block to show through window 

of mailing envelope.

2. Form Fold to approximately 8-1/2 x 3-2/3” (letter fold)

3. Letter Fold to approximately 8-1/2 x 3-2/3” (letter fold).

4. Return Envelope Face of envelope facing flap side of mailing 

envelope.

5. Pamphlet Title page facing flap side of mailing envelope.

IEP Reminder Letter 1. Letter Mailing address block to show through window of 

mailing envelope.

PBID (Monthly Orders)

1. Card Left mailing address block to show through window 

of mailing envelope.

2. Letter Collate and Fold to approximately 7-1/2 x 3-2/3” 

(letter fold)

Assembly - Random Orders

PBID 

(Initial Bulk Mailing)

1. Card Left mailing address block to show through window 

of mailing envelope.

2. Letter Collate and Fold to approximately 7-1/2 x 3-2/3” 

(letter fold)

Miscellaneous Letters 1. Letter Mailing address block to show through window of 

mailing envelope.
Medicare Enrollment Packages and Cards Page 30 of 65

1583-S (09/23) Section 2. -- Specifications

Assembly - Yearly Orders 

Mail Piece Publication

Insert Packet item 

contents in the 

following order

Description

Domestic General 

Enrollment Package

(Domestic GEP)

Standard Print

1. Enrollment Form

CMS-L40D folded to approximately 8-1/2 x 3-2/3” 

(letter fold). Mailing address to show through 

window of mailing envelope.

2. Letter Fold to approximately 8-1/2 x 3-2/3” (letter fold)

3. BRM Envelope Face of envelope facing flap side of mailing 

envelope.

4. Pamphlet Title page facing flap side of mailing envelope.

Domestic General 

Enrollment Package

(Domestic GEP)

Large Print

1. Enrollment Form

CMS-L40D inserted flat (no folding). Mailing 

address to show through window of 9 x 12” window 

mailing envelope.

2. Letter Flat (no folding)

3. BRM Envelope Face of envelope facing flap side of mailing 

envelope.

4. Pamphlet Title page facing flap side of mailing envelope.

Puerto Rican General 

Enrollment Period Package

(Puerto Rican GEP) 

Standard Print

1. Letter

Folded to approximately 8-1/2 x 3-2/3” (letter fold), 

mailing address to show through window of mailing 

envelope.

2. Pamphlet Title page facing flap side of mailing envelope.

Puerto Rican General 

Enrollment Package

(Puerto Rican GEP)

Large Print

1. Letter Flat (no folding), mailing address to show through 

window of 9 x 12” mailing envelope.

2. Pamphlet Title page facing flap side of mailing envelope.

Deemed Cards 1. Card Mailing address block to show through window of 

mailing envelope.

MAIL PREPARATION: Contractor to mail via CMS Mail Postage and Fees Paid permit G-28. The 

contractor is cautioned to use the permit imprint only for mailing material produced under this contract Program 

1583-S. 

Addresses for mailing come from a government-control maintained file. Contractor will perform data scrub of 

Enrollment Database (EDB) addresses with CASS, NCOA and check Delivery Point Validation (DPV), before 

printing/imaging has started. All unmailable addresses (including ZIP Code drops) are to be counted and set 

aside in a separate electronic file (Excel spreadsheet). See “1) Recipient Level Report” on page 34.

Contractor is authorized to make address(es) corrections identified during CASS and NCOA processing and 

report those changes in an Excel spreadsheet. NOTE to double check before correction(s) -- When a beneficiary 

individual has a “Representative Payee Name” listed, the Enrollment Database (EDB) address field contains the 

mailing address of the representative payee name, and not the address of the “Beneficiary Name”.
Medicare Enrollment Packages and Cards Page 31 of 65

1583-S (09/23) Section 2. -- Specifications

Contractor sponsored address data enhancements to secure postal discount MUST NOT negatively affect 

deliverability of CMS address files. It is the contractor’s responsibility to keep up to date on all USPS 

requirements.

NOTE: THIS IS A REMINDER; DO NOT CHANGE ADDRESS FIELDS ON MEDICARE FOREIGN 

INITIAL ENROLLMENT PACKAGE AND MEDICARE PUERTO RICAN INITIAL ENROLLMENT 

PACKAGE – Contractor is NOT to run the Foreign files through CASS, NCOA or DPV software. This applies 

to the Packages (Initial, General and Accretes) as well as any other record files that have Foreign (International) 

addresses. 

Domestic IEP records will sometimes contain a Foreign address(es), these are to be pulled out and placed in the 

Foreign IEP addresses and mailed internationally. This is to be indicated in response email after receiving data 

record files.

Address Requirements: Address placement, format, and fonts must be consistent with current U.S. Postal 

Service (USPS) Address Quality Standards, and in accordance with appropriate USPS rules and regulations 

including USPS Domestic Mail Manual (DMM) in effect at the time of mailing. The type font must be one of 

the USPS accepted and verified Multiline Optical Character Reader (MLOCR) readable type.

It is the contractor’s responsibility to ensure that only the computer-generated address and IMb and other 

applicable USPS barcodes/markings on the mail piece will be visible through the window in the envelope and 

that only one complete package/card is inserted into each envelope.

Intelligent Mail Barcode (IMb): During the term of this contract, CMS mailers will be required to meet USPS 

requirements for using IMb to access automation postal rates for presort first class mail. Full Service IMb will 

be required for Domestic Mail only.

The successful bidder must understand and be able to implement all mail preparation requirements enacted by 

the Postal Service related to using full-service IMb. The requirements include, but are not limited to, preparing 

Intelligent Mail barcodes for the mail, trays and containers meeting USPS quality acceptance standards. 

Experience with assigning unique numbers for each mail piece, preparing electronic manifests, making 

electronic appointments, producing revised tray/pallet label formats and other similarly detailed IMb 

requirements as mandated by the Postal Service is essential.

The IMb must appear in the address block of the inserted item and show through the window area of the mailing 

envelope. Printing or imaging of the IMb on the envelope is NOT permissible.

Contractor may be responsible for any postage fees related to undeliverable letters caused by print quality 

control issues.

Any address/mail management related questions/issues should be directed to the following CMS personnel:

• Tina Dickens, at (410) 786-3895, or e-mail tina.dickens@cms.hhs.gov

• Cynthia Williams, at (410) 786-6071, or e-mail cynthia.williams@cms.hhs.gov

• Erika Grant, at (410) 786-1067, or e-mail Erika.Grant@cms.hhs.gov

International Mail – If the mailing meets the qualifications for International Priority Airmail (IPA), it 

should be processed through IPA in accordance with postal rules and regulations in effect for USPS IPA at the 

time of the mailing. To maximize postage savings, the contractor shall sort to the IPA Rate Group 1 through 15.

Pieces not qualifying for the IPA Rate Group Levels of discount shall be prepared at the Worldwide Nonpresorted rate level and any remaining pieces that do not meet IPA qualifications will be sorted by individual 

country rules according to the USPS IMM in effect at the time of the mailing.

Contractor may be responsible for any postage fees related to undeliverable letters caused by print quality 

control issues.
Medicare Enrollment Packages and Cards Page 32 of 65

1583-S (09/23) Section 2. -- Specifications

Secure Destruct IMb: Secure Destruct (SD) applies to Domestic Standard Print and Puerto Rican 

records. The Secure-Destruct process does not apply to Large Print portion of orders, Alternate Format records 

(Alternative Format Packages or Secondary Crawford Packages), or any Foreign mailing records.

The Mailer Identifier (MID) is a field within the Intelligent barcode (IMb) that is used to identify mailers 

requiring SD. Require Full Service IMb – ACS SD Option 2 – Service Type ID 335. CMS to provide the MID 

code to contractor for use in the IMb.

The metrics for SD to be encoded in the IMb is as follows: 

• MID Code

• SingleSource ACS

• Service Type Identifiers (STIDs) 335

o Forward Mail pieces

o Undeliverable Mail pieces 

o Note: Change-of-Address (COA’s) life cycle is for 12 months. During months 13-18 the mail 

pieces will be destroyed and an Address Correction Service (ACS) notice is generated and 

coded as Forwarding Order Expired (FOE) on the record. A notice will contain the reason for 

non-delivery as a UAA Code.

U.S. Postal Service - Electronic Product Fulfillment (EPF): The U.S. Postal Service uploads daily the SD 

metrics of mail-pieces. Contractor to downloaded daily these metrics from the password protected EPF 

site. There are two files per day, one is the delimited SD file and the other contains a fixed length file of the SD 

plus ACS metrics. The contractor retains these downloaded files in a secure location until the mailing for the 

1583-S is 100% complete for that week of domestic mail pieces.

The contractor must provide all mailing materials, as well as all labeling and marking, as necessary to fulfill 

mailing and distribution requirements. Noncompliance with the packing and labeling instructions will be cause 

for the government to take corrective action in accordance with GPO Pub. 310.2.

All copies mailed must conform to the appropriate regulations in the U.S. Postal Service manuals for domestic 

presorted First-Class mail, (note exception to Foreign addresses) mailing as applicable, and must be prepared for 

the most cost-effective mailing rate/class obtainable, including ZIP + 4, bar-coding, and presorting for 

maximum postal automation discounts (as applicable). The placement and application of the full-service

Intelligent Mail Barcode (IMb) must not compromise any applicable USPS addressing/imprinting 

requirements.

In addition, USPS has instituted a verification procedure called a “tap” test. This test is used to screen all 

mailings with barcoded inserts for proper barcode spacing within the envelope window. USPS will randomly 

select samples from a mailing and tap the pieces on their left, right, and bottom edges to test whether the 

barcode maintains a minimum spacing of 1/8” from the left and right edges and 1/16” from the top and bottom 

edges of the window. When an insert showing through the window is moved to any of its limits inside the 

envelope, the entire barcode must remain within the barcode clear zone, a clear space must be maintained that is 

at least 1/8” between the barcode and the left and right edges of the window and at least 1/25” between the 

barcode and the top edge of the window. Mail pieces are not to be tapped upside down (i.e., on their top edge).

All mailed copies must be sorted using the ZIP + 4 code. Exception – Puerto Rican Package Addresses must 

only display +4 codes from CMS provided address file.

VERIFICATION OF MAILING: Part of Quality Assurance Plan, “Verification of Mailing”, beginning on 

page 10. 

DISTRIBUTION: 

Mailed Copies: Mail f.o.b. contractor’s city for mailed copies using the provided government “G-Permit” 

imprint via presorted “First Class Mail, U.S. Postage and Fees Paid”. This includes the alternative format 

packages when so ordered on Replacement and MBI Reassignment orders. 

Large Print Mailing for both language editions (English and Spanish) will mail domestically and internationally.
Medicare Enrollment Packages and Cards Page 33 of 65

1583-S (09/23) Section 2. -- Specifications

The contractor is cautioned that “Postage and Fees Paid” indicia may be used only for the purpose of mailing 

material produced under the contract. All copies mailed must conform to the appropriate regulations in the U.S. 

Postal Service manuals for “Domestic Mail” or “International Mail” as applicable.

Using the mailing address information, the contractor is required to obtain the maximum USPS postage 

discounts possible in accordance with the USPS First Class mail automated mail discount structure in effect at 

the time of mailing. In compliance with USPS Mail Preparation & Sortation Regulations, all mail must be 

appropriately marked and supported with the documentation necessary to ensure USPS acceptance.

Mailing Envelopes must be prepared and sealed in a manner that will ensure acceptance, security and safe 

delivery by the U.S. Postal Service. 

Certificate of Conformance: When using Permit Imprint Mail the contractor must complete GPO Form 712 -

Certificate of Conformance (Rev. 10-15), and the appropriate mailing statement or statements supplied by 

USPS. A fillable PDF of GPO Form 712 Certificate of Conformance can be found at gpo712ff.pdf . Contractor 

to include their job number on the GPO Form 712.

Mailing Statements: Contractor must complete and supply all copies of applicable and appropriate version, 

USPS Forms and GPO 712’s to CMS within 2 work days of USPS mail certification. PDF of these postal and 

GPO forms to be emailed to clinton.howard@cms.hhs.gov and rwoodmancy@gpo.gov. 

Contractor may be responsible for any postage fees related to undeliverable letters caused by print quality 

control issues.

NOTE: THE CONTRACTOR WILL BE RESPONSIBLE FOR PAYMENT OF ANY ADDITIONAL 

POSTAGE RESULTING FROM A LOSS OF DISCOUNT AND/OR UNDELIVERABLE CAUSED BY 

FAILURE TO CONFORM TO USPS REQUIREMENTS.

The ship/deliver date indicated on the Print Order is the date products must be mailed/shipped.

Secondary Crawford Packages: Ship f.o.b. contractor’s city all of the Secondary Crawford packages/sets via 

small common carrier for 3 workday delivery unless otherwise stated on the Print Order. The ship date is the 

date indicated on the Print Order. Contractor will be reimbursed by submitting the properly filled out shipping 

receipt for payment. 

Contractor to include the tracking number and shipping receipt PDF to be emailed along with Postal receipts for 

each Crawford Secondary order.

Crawford’s receiving hours are 8:30 AM to 5:00 PM eastern time zone for deliveries.

If sending USPS please ship to:

Crawford Technologies USA Inc.

PO Box 5198

Potsdam, NY 13676-5198

If sending FedEx -or- UPS please ship to:

Crawford Technologies USA Inc.

22 Depot Street

Suite #20

Potsdam, NY 13676

SHIP F.O.B. DESTINATION:

All expenses incidental to picking up and returning materials, proofs, etc. must be borne by the contractor.

GPO Copies -- Domestic and Puerto Rican Initial Enrollment Pamphlets (Welcome to Medicare), and Accretes 

Pamphlets. Standard Print editions only. This will only be required when indicated on the Print Order (when

artwork changes occur).

• 1 copy to: BAC (C&I) 1523-01, U.S. Government Publishing Office, Federal Depository Library 

Program, Mail Stop: FDLP, 44 H St., NW, Loading Dock, Washington, DC 20401, Item No. 0512-A-03

• 10 copies to: BAC (By-Law) 1525-01, Library of Congress, U.S. Serials and Government Documents 

Section, U.S. Anglo Division, 101 Independence Avenue, SE, Stop 4276, Washington, DC 20540-

4276. Marked: Depository File Copies
Medicare Enrollment Packages and Cards Page 34 of 65

1583-S (09/23) Section 2. -- Specifications

Blue Label Copies and Variable Data Verification Samples to: HHS/CMS, 7500 Security Blvd., Room SL11-17, Baltimore, MD 21207 Attn: Clint Howard.

RECEIPT FOR DELIVERY: Contractor must furnish their own receipts for delivery. These receipts must 

include the GPO Jacket, Program, and Print Order numbers; total quantity delivered, number of cartons, and 

quantity per carton; and date delivery made and signature of the government agent accepting delivery. The 

original copy of this receipt must accompany the contractor’s voucher for payment.

Unscheduled material such as shipping documents, receipts or instructions, delivery lists, labels, etc., will be 

furnished with the order or shortly thereafter. In the event such information is not received in due time, the 

contractor will not be relieved of any responsibility in meeting the shipping schedule because of failure to 

request such information.

DELIVERY/SHIPPING STATUS INFORMATION: Contractors are to report information regarding each 

order for compliance reporting purposes and include date of delivery (or shipment if applicable) for proofs and 

delivery schedules in accordance with the contract requirements by contacting GPO Columbus Regional Office 

via email to trackcolumbus@gpo.gov. 

RETURN OF GOVERNMENT FURNISHED PROPERTY: The contractor must return all material 

furnished by the government along with any reproducibles made by the contractor, together with one copy of the 

Certificate of Conformance (GPO Form 712), to the address provided at the post-award telephone conference

unless otherwise communicated.

These materials must be packaged and properly labeled. The contractor must be able to produce a separate 

signed receipt for these materials at any time during the contract.

All expenses incidental to pick up/return of materials/proofs, and furnishing sample copies must be borne by the 

contractor.

REPORTING: The following reports must be upload to the contractor’s sFTP site on a weekly basis. 

Contractor to provide secure password to only allow select government administrators to be able to download 

the report. Contractor to email designated government officials when report is upload. Naming convention and 

possible incorporation of two-part verification system to be part of the discussed after award.

1) Recipient Level Report (Record Address Updates and Unmailable Addresses): Record addresses that 

were updated after going through Postal data scrub and unmailable addresses (including ZIP Code drops) are to 

be counted and set aside in a separate recipient level report (Excel spreadsheet). The Recipient Level Report 

will consist of items listed below:

• Beneficiary Name

• Beneficiary Address

• Print Order

• Postal data scrub result

• Reason for non-delivery

Contractor is authorized to make address(es) corrections identified during CASS and NCOA processing and 

report those changes in an Excel spreadsheet. 

• Records that were corrected by CASS and mailed; only the corrected record should be reported.

• Records that were updated by NCOA and mailed; only the updated record should be reported.

• Record undeliverable counts (CASS drops and unbailable) with the applicable reason code.

Recipient Level Report layout will be finalized after Post Award Conference. 

2) Summary (Audit) Report: As part of the Quality Assurance Plan, contractor generates a final automated 

summary (audit) report which provides information that all mail pieces have been scanned after insertion and 

verifying that all pieces inserted into the mailing envelope for each Print Order are accounted for. The summary 

report will contain the sequence number range for a particular Print Order, show all sequence numbers were 

scanned and accounted for after all mail pieces are inserted, and event information on any spoiled or missing 

pieces verifying that they were scanned and accounted for. 
Medicare Enrollment Packages and Cards Page 35 of 65

1583-S (09/23) Section 2. -- Specifications

The report to also summarize a state-by-state count of all letters mailed, identifying state and numbers of copies 

mailed to that state. Contractor to work with the CMS and GPO after award with layout and functionality of 

summary (audit) report.

3) Verification Report: Column heads consist of the following: MBI Number, Beneficiary Name, Unique ID, 

Card Type, Print Order Number, Record File Processing Date. Verification report must be upload to the 

contractor’s sFTP site.

4) Alternative Format Packages: Contractor and government will both be keeping separate Excel spreadsheet 

reports showing the number of furnished alternative format packages used per order; and remaining packages in 

inventory. This report does not contain any PII. Periodically, the contractor’s inventory of the different 

packages will be compared with GPO spreadsheet report via e-mail.

5) Secure Destruct IMb: After mailing is complete on a weekly basis, contractor to generate two Excel 

spreadsheet reports (one is the delimited SD file and the other contains a fixed length file of the SD plus ACS

metrics) from these EPF files and emailed to Clint Howard at CMS Clinton.Howard@cms.hhs.gov . Contractor 

must be retained these Excel spreadsheet reports for 12 months after mailing date, and must be made available 

to CMS and/or GPO for auditing of contractor performance upon request.

First Report metrics to be downloaded daily and puts into the weekly reports will be linked to the Print Order as 

follows: 

• Short Date field of the EPF download results for each day.

• UAA Code for each Beneficiary Name for each mail piece that was SD. 

• How many pieces delivered.

• How many pieces were forward, ACS counts and ACS forwarding counts.

Second Report provides beneficiary level data of ACS/SD records that contain PII.

SECURE DESTRUCT CERTIFICATES: The contractor will at times be required to secure destruct item(s) 

without a government representative onsite. Contractor to provide CMS and GPO a PDF of the certificate of 

destruction which must include the following: item(s) destroyed, count (number of item(s) destroyed), date 

when occurred, and person(s) that witness the destruction of government property.

Note: Contractor to provide certificate of destruction of Quality Pulls. See “Contractor’s Secure Destruction of 

Quality Pulls” on page 10 for details. Contractor and government will both be keeping separate Excel 

spreadsheet reports of Quality Pull destructions of hard and soft copies.

SCHEDULE: Adherence to this schedule must be maintained beginning with the availability of the data files

in the TIBCO Mailbox, usually Friday mornings between 5:00 am through 9:00 am. If files have not been made 

available by 9:00 am the contractor to notify CMS and GPO of the situation via e-mail. Government has the 

option to send files to the contractors sFTP site instead of the data record files being available at the TIBCO 

Mailbox. A different naming convention has been established for each Medicare Publications.

If other than Friday morning, government will notify the contractor in advance (more than 24 hours) when the 

projective data file(s) time for Medicare Publications will become available.

Within 3 work hours after the availability of the data files, contractor to e-mail an “Acknowledgement of Files 

Received and Preliminary Counts” of the Medicare Publicans to CMS and GPO administrators listing the 

preliminary count of the records received. 

Within one work day after the availability of the data files, contractor to e-mail “Files Received and Counts” 

providing the following minimum information: Number of Records received, Medicare Publication Title, Print 

Order Number, Number of ZIP Code drops, number of unmailable records, number of domestic mail pieces, 

number of foreign mail pieces, breakout of Large Print, breakout of alternative format packages, breakout of 

Secondary Crawford packages.

Normally, within 2 work days after contractor e-mails “Files Received and Counts”, CMS will verify 

information and e-mail Print Order PDF to the contractor and cc GPO. Order begins upon receiving data files 

and not when the Print Order is received. The issue date on the Print Order will reflect the date the files were 

made available to the contractor. 
Medicare Enrollment Packages and Cards Page 36 of 65

1583-S (09/23) Section 2. -- Specifications

AVAILABILITY OF TIBCO FILES

Weekly

MEDICARE CARDS (Replacement and MBI Reassignment): It is anticipated that the TIBCO files will 

be available on Friday of each week, except for holidays. 

Weekly

ACCRETE PACKAGES: It is anticipated that the TIBCO files will be available on Friday of each week, 

except for holidays. 

Monthly

INITIAL ENROLLMENT PACKAGES (Domestic, Puerto Rican and Foreign): It is anticipated that the 

TIBCO files will be available during either the first or second full week of each month, except for holidays. 

Each IEP package will be separated into three separate Print Orders/TIBCO files: 

• Domestic IEP Package

• Puerto Rico IEP Package 

• Foreign IEP Package 

Monthly

IEP Reminder Letter and PBID: It is anticipated that the TIBCO files will be available during either the 

second or third full week of each month, except for holidays.

Yearly

DEEMED MEDICARE CARDS: It is anticipated that the TIBCO files will be available during the month 

of February each year.

Yearly

GENERAL ENROLLMENT PACKAGES (Domestic and Puerto Rican) – Standard Print: It is 

anticipated that the TIBCO files will be available during late December or during the month of January each 

year. General Enrollment Period (GEP) Packages are separated into two separate files:

• Domestic GEP Package

• Puerto Rico GEP Package

Yearly

GENERAL ENROLLMENT PACKAGES (Domestic and Puerto Rican) – Large Print: It is anticipated 

that the TIBCO files will be available during the month of February or March of each year. General 

Enrollment Period (GEP) Packages are separated into two separate files:

• Domestic GEP Package – Large Print

• Puerto Rico GEP Package – Large Print

Random

Miscellaneous Mailing of Cards and Letters; or Letters only: Random orders throughout the year will 

proceed with proofing and the schedule will be flexible based upon quantities being ordered. 
Medicare Enrollment Packages and Cards Page 37 of 65

1583-S (09/23) Section 2. -- Specifications

Priors and any other related materials (furnished materials) to be delivered and pick-up at this location: 

CMS, Attn: Clinton Howard, Room SL-11-17, 7500 Security Blvd., Baltimore, MD 21244-1850. Inside 

delivery is required to the room number indicated. 

Proofs: Static and Variable Image Proof process will be conducted via e-mail correspondence before issuance 

of Print Orders. See “Proofs” beginning on page 18 for detail information. 

Production: The following schedule begins the workday after notification of the availability of TIBCO files; 

the workday after notification will be the first workday of the schedule.

Weekly and Monthly Orders*: Complete production and distribution must be made within 5 workdays 

after availability of files.

Annual and Miscellaneous Orders*: Complete production and distribution must be made within 7 

workdays after availability of files.

*Any orders that has a pamphlet inserted into the mail piece copy: One additional workday will be 

allowed for every 75,000 copies that exceed 200,000 copies.
Medicare Enrollment Period Packages and Medicare Cards Page 38 of 65

1583-S (09/23)

SECTION 3. – DETERMINATION OF AWARD

The government will determine the lowest bid by applying the prices offered in the “Section 4. - Schedule of 

Prices” to the following units of production which are the estimated requirements to produce 12 month’s orders 

(first contract period) under this contract. These units do not constitute, nor are they to be construed as, a 

guarantee of the volume of work which may be ordered for a like period of time.

The following item designations correspond to those listed in the “Section 4. -- Schedule of Prices”.

(1) (2)

I. A (a) 52 4,232

(b) 52 44

(c) 52 2,179

(d) 12 1,717

(e) 25 50

(f) 1 30

(g) 9 225

B. (a) 40 3,217

(b) 613 28,885

C. (a) 4 46

(b) 949 25,915

D. (a) 832 34,864

(b) 208 528

(c) 144 252

(d) 20 14,080

(e) 432 61,812

E. (a) 24 528

(b) 20 20

F. (a) 8,243

(b) (1) 1,717

(2) 27

(3) 21

(4) 704

(5) 6

(c) 23

(d) (1) 1,717

(2) 21

(3) 704

II. A. (a) 6,528

(b) 1,717

II. B. (a) 12,503

(b) 3,937

C. (a) 24,862

(b) 30,906

(c) 274

D. (a) 725

(b) 8,243

(c) 758

(d) 1,717

(e) 1,717

(f) 23

III. A (a) 166

(b) 9,612

B. (a) 4,269

(b) 1,411

(c) 2,179

(d) 1,717

(e) 27

(f) 21

(g) 1,761

(h) 704

(i) 6

(j) 23

(k) 2

(i) 243

(m) 30

(n) 349

(o) 8
Medicare Enrollment Period Packages and Medicare Cards Page 39 of 65

1583-S (09/23)

SECTION 4. – SCHEDULE OF PRICES

Bids offered are f.o.b. contractor’s city for mailed copies (G-Permit) and ship f.o.b. destination for GPO copies 

and bulk shipments.

Prices must be submitted for the entire term of the contract and bids qualified for a lesser period will not be 

considered. Prices must include the cost of all required materials and operations for each item listed in 

accordance with these specifications.

Bidder must make an entry in each of the spaces provided. Bids submitted with any obliteration, revision, or 

alteration of the order and manner of submitting bids, may be declared nonresponsive.

An entry of NC (No Charge) shall be entered if bidder intends to furnish individual items at no charge to the 

government. Bids submitted with NB (No Bid) or blank spaces for an item may be declared nonresponsive.

The Contracting Officer reserves the right to reject any offer that contains prices for individual items of 

production (whether or not such items are included in the Determination of Award) that are inconsistent or 

unrealistic in regard to other prices in the same offer or to GPO prices for the same operation if such action 

would be in the best interest of the government.

All vouchers submitted to the GPO shall be based on the most economical method of production.

Fractional parts of 1,000 will be prorated at the per 1,000 rate.

I. PRINTING AND BINDING: Prices offered shall include the cost of all required materials and operations 

necessary for printing, binding and distribution of the product(s) listed in accordance with these specifications. 

Pamphlets will be ordered in 4-page increments. See Item II STOCK/PAPER and Item III MAILING

PREPARATION AND ASSEMBLY for additional charges.

Makeready Running Per

and/or Setup Charge 1,000 Copies

A. CARDS: (1) (2)

(a) Replacements .........................................per order........................$ ___________ $ ___________

(b) MBI Reassignment .................................per order........................$ ___________ $ ___________

(c) Accretes ..................................................per order........................$ ___________ $ ___________

(d) Domestic IEP .........................................per order........................$ ___________ $ ___________

(e) Puerto Rican IEP, Foreign IEP and

PBID (Bulk order)...................................per order........................$ ___________ $ ___________

(f) Deemed ..................................................per order........................$ ___________ $ ___________

Makeready Running Per

and/or Setup Charge Copy 

(1) (2)

(g) PBID (Monthly orders) ...........................per order........................$ ___________ $ ___________

Note: The Domestic GEP and Puerto Rican GEP packages do not contain cards.

_____________

RETURN THIS PAGE TO GPO COLUMBUS REGIONAL OFFICE (Initials)
Medicare Enrollment Period Packages and Medicare Cards Page 40 of 65

1583-S (09/23) Section 4 – Schedule of Prices

I. PRINTING AND BINDING (Continue):

B. FORMS AND LETTERS, 7-1/2 x 11” and 8-1/2 x 11” per order, Standard Print except PBID monthly

orders:

Makeready Running Per

and/or Setup Charge 1,000 Copies

(1) (2)

(a) Variable Image and Static Image Printing

on the same page:............................. per imaged/printed page ......$ ___________ $ ___________

(b) Static Image Printing Only............... per printed page ...................$ ___________ $ ___________

C. FORMS AND LETTERS, 7-1/2 x 11” and 8-1/2 x 11” per language edition (English and Spanish), Large 

Print and PBID monthly orders:

• When English and Spanish print editions print same static image on pages, contractor is allowed one 

“Makeready and/or Setup Charge” per order. 

• When English and Spanish editions print different static image pages, contractor is allowed a separate 

“Makeready and/or Setup Charge” for each edition on the order.

Makeready Running Per

and/or Setup Charge Copy

(1) (2)

(a) Variable Image and Static Image Printing

on the same page:............................. per imaged/printed page ......$ ___________ $ ___________

(b) Static Image Printing Only............... per printed page ...................$ ___________ $ ___________

Makeready Running Per

and/or Setup Charge 1,000 Copies

D. PAMPHLETS, SELF-COVER, Standard Print: (1) (2)

(a) Accretes, 3-1/2 x 7-1/2” ..........................price per page................$ ___________ $ ___________

(b) Puerto Rican IEP and

Puerto Rican GEP, 3-1/2 x 8” ................price per page................$ ___________ $ ___________

(c) Foreign IEP, 3-1/2 x 8” ..........................price per page................$ ___________ $ ___________

(d) Domestic GEP, 3-1/2 x 8”.......................price per page................$ ___________ $ ___________

(e) Domestic IEP, 8-3/8 x 5-3/8”..................price per page................$ ___________ $ ___________

E. PAMPHLETS, SELF-COVER, per language edition (English and Spanish), Large Print:

Makeready Running Per

and/or Setup Charge Copy

(1) (2)

(a) Domestic GEP, 8-1/2 x 11”.....................price per page................$ ___________ $ ___________

(b) Puerto Rican GEP, 8-1/2 x 11” ..............price per page................$ ___________ $ ___________

_____________

RETURN THIS PAGE TO GPO COLUMBUS REGIONAL OFFICE (Initials)
Medicare Enrollment Period Packages and Medicare Cards Page 41 of 65

1583-S (09/23) Section 4 – Schedule of Prices

F. ENVELOPES:

(a) Weekly Pubs, Miscellaneous, PBID and Deemed Mailer Envelopes, 4 x 8-1/8”:

Running per 1,000 envelopes............................................................................ $ ___________

(b) IEP and GEP Mailer Envelopes:

(1) Domestic IEP, 6 x 9-1/2”:

Running per 1,000 envelopes............................................................................ $ ___________

(2) Puerto Rican IEP, 4-1/8 x 9-1/2”, (No. 10):

Running per 1,000 envelopes............................................................................ $ ___________

(3) Foreign IEP, 4-1/8 x 9-1/2”, (No. 10):

Running per 1,000 envelopes............................................................................ $ ___________

(4) Domestic GEP, 4-1/8 x 9-1/2”, (No. 10):

Running per 1,000 envelopes............................................................................ $ ___________

(5) Puerto Rican GEP, 4-1/8 x 9-1/2”, (No. 10):

Running per 1,000 envelopes............................................................................ $ ___________

(c) GEP Large Print Mailer Envelopes, 9 x 12”:

Running per envelope .................................................................................................... $ ___________

(d) Business Reply or Return Mail Envelopes:

(1) Domestic IEP, 5-3/4 x 8-3/4”:

Running per 1,000 envelopes............................................................................ $ ___________

(2) Foreign IEP, 3-7/8 x 8-7/8”, (No. 9):

Running per 1,000 envelopes............................................................................ $ ___________

(3) Domestic GEP, 3-7/8 x 8-7/8”, (No. 9):

Running per 1,000 envelopes............................................................................ $ ___________

_____________

RETURN THIS PAGE TO GPO COLUMBUS REGIONAL OFFICE (Initials)
Medicare Enrollment Period Packages and Medicare Cards Page 42 of 65

1583-S (09/23) Section 4 – Schedule of Prices

II. STOCK/PAPER: Payment for all stock/paper supplied by the contractor under the terms of these 

specifications, as ordered on the individual Print Orders, will be based on item of Paper/Stock as defined in 

Section 2 “STOCK/PAPER” on page 20. The envelope size is after construction. The cost of any paper 

required for make-ready or running spoilage must be included in the prices offered. 

Note below instead of per 1,000 rate, the per leaf and per envelope rates, due to the low quantities of the Large 

Print pamphlet editions.

A. Cards:

(a) 7-1/2 x 3-11/16”

per 1,000 leaves ...................................................................................................... $ ___________

(b) 5-1/2 x 8-1/2”

per 1,000 leaves ...................................................................................................... $ ___________

B. Forms and Letters:

(a) 7-1/2 x 11”

per 1,000 leaves ...................................................................................................... $ ___________

(b) 8-1/2 x 11”

per 1,000 leaves ...................................................................................................... $ ___________

C. Pamphlets:

(a) 3-1/2 x 8” and 3-1/2 x 7-1/2”

per 1,000 leaves ...................................................................................................... $ ___________

(b) 8-3/8 x 5-3/8”

per 1,000 leaves ...................................................................................................... $ ___________

(c) 8-1/2 x 11”

per leaf .................................................................................................................... $ ___________

D. Envelopes:

(a) 3-7/8 x 8-7/8”, (No. 9)

per 1,000 envelopes................................................................................................. $ ___________

(b) 4 x 8-1/8”

per 1,000 envelopes................................................................................................. $ ___________

(c) 4-1/8 x 9-1/2”, (No. 10)

per 1,000 envelopes................................................................................................. $ ___________

(d) 5-3/4 x 8-3/4” 

per 1,000 envelopes................................................................................................. $ ___________

(e) 6 x 9-1/2”

per 1,000 envelopes................................................................................................. $ ___________

(f) 9 x 12”

per envelope............................................................................................................. $ ___________

_____________

RETURN THIS PAGE TO GPO COLUMBUS REGIONAL OFFICE (Initials)
Medicare Enrollment Period Packages and Medicare Cards Page 43 of 65

1583-S (09/23) Section 4 – Schedule of Prices

III. MAILING PREPARATION AND ASSEMBLY: Gathering and Insertion item pieces into Mailing 

Envelope and preparation for mailing.

A MAILING PREPARATION:

(a). Data Record File Processing.......................................per Print Order .................... $ ___________

Note: Replacement and MBI Reassignment Medicare Publications are issued on the same Print Order and 

balance of Publications are issued on seperate Print Orders.

(b) Secure Destruct IMb ..................................................per 1,000 addresses............. $ ___________

B ASSEMBLY:

(a) Replacements and MBI Reassignments,

Standard Print .............................................................per 1,000 mailers................. $ ___________

(b) Replacements and MBI Reassignments

Large Print .................................................................per mailer............................ $ ___________

(c) Accretes .....................................................................per 1,000 mailers................. $ ___________

(d) Domestic IEP .............................................................per 1,000 mailers................. $ ___________

(e) Puerto Rican IEP .......................................................per 1,000 mailers................. $ ___________

(f) Foreign IEP ................................................................per 1,000 mailers................. $ ___________

(g) IEP Reminder Letter and Miscellaneous Letters........per 1,000 mailers................. $ ___________

(h) Domestic GEP, Standard Print ..................................per 1,000 mailers................. $ ___________

(i) Puerto Rican GEP, Standard Print .............................per 1,000 mailers................. $ ___________

(j) Domestic and Puerto Rican GEP, Large Print ...........per mailer............................ $ ___________

(k) PBID, bulk order Standard Print.................................per 1,000 mailers................. $ ___________

(l) PBID, monthly orders Standard Print and 

Large Print for both bulk and monthly .......................per mailer............................ $ ___________

(m) Deemed Cards ............................................................per 1,000 mailers................. $ ___________

(n) Insert Medicare Card Set into furnished 

Alternative Package pouch ........................................per package ......................... $ ___________

(o) Secondary Crawford mailer envelopes inserted into one package 

to be shipped small common carrier...........................per container ....................... $ ___________

_____________

RETURN THIS PAGE TO GPO COLUMBUS REGIONAL OFFICE (Initials)
Medicare Enrollment Period Packages and Medicare Cards Page 44 of 65

1583-S (09/23) Section 4 – Schedule of Prices

SECTION 4. – SCHEDULE OF PRICES

SHIPMENT(S): Shipments will be made from: City __________________________, State _______________

The city(ies) indicated above will be used for evaluation of transportation charges when transportation charges 

are specified to be a factor in determination of award. If no shipping point is indicated above, it will be deemed 

that the bidder has selected the city and state shown below in the address block, and the bid will be evaluated 

and the contract awarded on that basis. If shipment is not made from evaluation point, the contractor will be 

responsible for any additional shipping costs incurred.

DISCOUNTS: Discounts are offered for payment as follows: ____________ Percent, ____________ calendar 

days. See Article 12 “Discounts” of Solicitations Provisions in GPO Contract Terms (Publication 310.2).

AMENDMENT(S): Bidder hereby acknowledges amendment(s) number(ed) ___________________________

BID ACCEPTANCE PERIOD: In compliance with the above, the undersigned agree, if this bid is accepted 

within _____________ calendar days (60 calendar days unless a different period is inserted by the bidder) from 

the date for receipt of bids, to furnish the specified items at the price set opposite each item, delivered at the 

designated point(s), in exact accordance with specifications.

NOTE: Failure to provide a 60-day bid acceptance period may result in expiration of the bid prior to award.

BIDDER’S NAME AND SIGNATURE: Unless specific written exception is taken, the bidder, by signing and 

submitting a bid, agrees with and accepts responsibility for all certifications and representations as required by 

the solicitation and GPO Contract Terms – Publication 310.2. When responding by email, fill out and return 

one copy of all pages in “SECTION 4. – SCHEDULE OF PRICES,” including initialing/signing where 

indicated. Valid electronic signatures will be accepted in accordance with the Uniform Electronic Transactions 

Act, §2. Electronic signatures must be verifiable of the person authorized by the company to sign bids.

Failure to sign the signature block below may result in the bid being declared non-responsive.

Bidder ___________________________________________________________________________________

(Contractor’s Name) (GPO Contractor’s Code)

__________________________________________________________________________________________

(Street Address)

__________________________________________________________________________________________

(City – State – Zip Code)

By _______________________________________________________________________________________

(Printed Name, Signature, and Title of Person Authorized to Sign this Bid) (Date)

__________________________________________________________________________________________

(Person to be Contacted) (Telephone Number) (e-mail)

THIS SECTION FOR GPO USE ONLY

Contracting Officer: ___________ Date ___________ Certifier by: __________ Date __________

(Initials) (Initials)
Medicare Enrollment Period Packages and Medicare Cards Page 45 of 65

1583-S (09/23)

SECTION 5. – CMS SECURITY SPECIFICATIONS

THE REQUIREMENTS UNDER THIS SECTION WILL BE ADMINISTERED BY A CMS SECURITY 

REPRESENTATIVE (NAME AND CONTACT INFORMATION WILL BE PROVIDED AT TIME OF 

AWARD).

CMS INFORMATION SECURITY (APR 2013)

FAR 52.227-14 Rights in Data – General (May 2014).

As prescribed in 27.409(b)(1), insert the following clause with any appropriate alternates:

(a) Definitions. As used in this clause--

“Computer database” or “database” means a collection of recorded information in a form capable of, and for 

the purpose of, being stored in, processed, and operated on by a computer. The term does not include computer 

software.

“Computer software”—

(1) Means

(i) Computer programs that comprise a series of instructions, rules, routines, or statements, 

regardless of the media in which recorded, that allow or cause a computer to perform a 

specific operation or series of operations; and

(ii) Recorded information comprising source code listings, design details, algorithms, 

processes, flow charts, formulas, and related material that would enable the computer 

program to be produced, created, or compiled.

(2) Does not include computer databases or computer software documentation.

“Computer software documentation” means owner’s manuals, user’s manuals, installation instructions, 

operating instructions, and other similar items, regardless of storage medium, that explain the 

capabilities of the computer software or provide instructions for using the software.

“Data” means recorded information, regardless of form or the media on which it may be recorded. The 

term includes technical data and computer software. The term does not include information incidental to 

contract administration, such as financial, administrative, cost or pricing, or management information.

“Form, fit, and function data” means data relating to items, components, or processes that are sufficient 

to enable physical and functional interchangeability, and data identifying source, size, configuration, 

mating, and attachment characteristics, functional characteristics, and performance requirements. For 

computer software it means data identifying source, functional characteristics, and performance 

requirements but specifically excludes the source code, algorithms, processes, formulas, and flow charts 

of the software.

“Limited rights” means the rights of the government in limited rights data as set forth in the Limited 

Rights Notice of subparagraph (g)(2) if included in this clause.

“Limited rights data” means data, other than computer software, that embody trade secrets or are 

commercial or financial and confidential or privileged, to the extent that such data pertain to items, 

components, or processes developed at private expense, including minor modifications.
Medicare Enrollment Period Packages and Medicare Cards Page 46 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

“Restricted computer software” means computer software developed at private expense and that is a 

trade secret; is commercial or financial and is confidential or privileged; or is copyrighted computer 

software, including minor modifications of the computer software.

“Restricted rights,” as used in this clause, means the rights of the government in restricted computer 

software, as set forth in a Restricted Rights Notice of paragraph (g) if included in this clause, or as 

otherwise may be provided in a collateral agreement incorporated in and made part of this contract, 

including minor modifications of such computer software.

“Technical data” means recorded information (regardless of the form or method of the recording) of a 

scientific or technical nature (including computer databases and computer software documentation). 

This term does not include computer software or financial, administrative, cost or pricing, or 

management data or other information incidental to contract administration. The term includes recorded 

information of a scientific or technical nature that is included in computer databases (See 41 U.S.C. 

116).

“Unlimited rights” means the right of the government to use, disclose, reproduce, prepare derivative 

works, distribute copies to the public, and perform publicly and display publicly, in any manner and for 

any purpose, and to have or permit others to do so.

(b) Allocation of rights.

(1) Except as provided in paragraph (c) of this clause, the government shall have unlimited rights in—

(i) Data first produced in the performance of this contract;

(ii) Form, fit, and function data delivered under this contract;

(iii) Data delivered under this contract (except for restricted computer software) that constitute 

manuals or instructional and training material for installation, operation, or routine 

maintenance and repair of items, components, or processes delivered or furnished for use 

under this contract; and

(iv) All other data delivered under this contract unless provided otherwise for limited rights 

data or restricted computer software in accordance with paragraph (g) of this clause.

(2) The Contractor shall have the right to—

(i) Assert copyright in data first produced in the performance of this contract to the extent 

provided in paragraph (c)(1) of this clause;

(ii) Use, release to others, reproduce, distribute, or publish any data first produced or 

specifically used by the Contractor in the performance of this contract, unless provided 

otherwise in paragraph (d) of this clause;

(iii) Substantiate use of, add or correct limited rights, restricted rights, or copyright notices and 

to take other appropriate action, in accordance with paragraphs (e) and (f) of this clause; 

and

(iv) Protect from unauthorized disclosure and use those data that are limited rights data or 

restricted computer software to the extent provided in paragraph (g) of this clause.
Medicare Enrollment Period Packages and Medicare Cards Page 47 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

(c) Copyright—

(1) Data first produced in the performance of this contract.

(i) Unless provided otherwise in paragraph (d) of this clause, the Contractor may establish, 

without prior approval of the Contracting Officer, claim to copyright in scientific and 

technical articles based on or containing data first produced in the performance of this 

contract and published in academic, technical or professional journals, symposia 

proceedings or similar works. The prior, express written permission of the Contracting 

Officer is required to assert copyright in all other data first produced in the performance 

of this contract.

(ii) When authorized to assert copyright to the data, the Contractor shall affix the applicable 

copyright notices of 17 U.S.C. 401 or 402, and acknowledgment of government

sponsorship (including contract number).

(iii) For data other than computer software, the Contractor grants to the government, and 

others acting on its behalf, a paid-up, nonexclusive, irrevocable worldwide license in such 

copyrighted data to reproduce, prepare derivative works, distribute copies to the public, 

and perform publicly and display publicly, by or on behalf of the government. For 

computer software, the Contractor grants to the government and others acting on its 

behalf, a paid-up nonexclusive, irrevocable worldwide license in such copyrighted 

computer software to reproduce, prepare derivative works, and perform publicly and 

display publicly (but not to distribute copies to the public) by or on behalf of the 

government.

(2) Data not first produced in the performance of this contract. The Contractor shall not, without 

prior written permission of the Contracting Officer, incorporate in data delivered under this contract 

any data not first produced in the performance of this contract unless the Contractor—

(i) Identifies the data; and

(ii) Grants to the government, or acquires on its behalf, a license of the same scope as set 

forth in subparagraph (c)(1) of this clause or; if such data are restricted computer 

software, the government shall acquire a copyright license as set forth in subparagraph 

(g)(4) of this clause (if included in this contract) or as otherwise provided in a collateral 

agreement incorporated in or made part of this contract.

(3) Removal of copyright notices. The government will not remove any authorized copyright notices 

placed on data pursuant to this paragraph (c), and will include such notices on all reproductions of 

the data.

(d) Release, publication and use of data. The Contractor shall have the right to use, release to others, reproduce, 

distribute, or publish any data first produced or specifically used by the Contractor in the performance of this 

contract, except—

(1) As prohibited by Federal law or regulation (e.g., export control or national security laws or 

regulations);

(2) As expressly set forth in this contract; or

(3) If the Contractor receives or is given access to data necessary for the performance of this 

contract which contain restrictive markings, the Contractor shall treat the data in accordance with 

such markings unless otherwise specifically authorized otherwise in writing by the Contracting 

Officer.
Medicare Enrollment Period Packages and Medicare Cards Page 48 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

(e) Unauthorized marking of data.

(1) Notwithstanding any other provisions of this contract concerning inspection or acceptance, if 

any data delivered under this contract are marked with the notices specified in paragraph (g)(3) or 

(g)(4) of this clause and use of the notices is not authorized by this clause, or if such data bears any 

other restrictive or limiting markings not authorized by this contract, the Contracting Officer may at 

any time either return the data to the Contractor, or cancel or ignore the markings. However, 

pursuant to 41 U.S.C. 4703, the following procedures shall apply prior to canceling or ignoring the 

markings.

(i) The Contracting Officer will make written inquiry to the Contractor affording the 

Contractor 60 days from receipt of the inquiry to provide written justification to 

substantiate the propriety of the markings;

(ii) If the Contractor fails to respond or fails to provide written justification to substantiate the 

propriety of the markings within the 60-day period (or a longer time approved in writing 

by the Contracting Officer for good cause shown), the government shall have the right to 

cancel or ignore the markings at any time after said period and the data will no longer be 

made subject to any disclosure prohibitions.

(iii) If the Contractor provides written justification to substantiate the propriety of the 

markings within the period set in subdivision (e)(1)(i) of this clause, the Contracting 

Officer will consider such written justification and determine whether or not the markings 

are to be canceled or ignored. If the Contracting Officer determines that the markings are 

authorized, the Contractor will be so notified in writing. If the Contracting Officer 

determines, with concurrence of the head of the contracting activity, that the markings are 

not authorized, the Contracting Officer will furnish the Contractor a written 

determination, which determination shall become the final agency decision regarding the 

appropriateness of the markings unless the Contractor files suit in a court of competent 

jurisdiction within 90 days of receipt of the Contracting Officer’s decision. The 

government shall continue to abide by the markings under this paragraph (e)(1)(iii) until 

final resolution of the matter either by the Contracting Officer’s determination becoming 

final (in which instance the government will thereafter have the right to cancel or ignore 

the markings at any time and the data will no longer be made subject to any disclosure 

prohibitions), or by final disposition of the matter by court decision if suit is filed.

(2) The time limits in the procedures set forth in subparagraph (e)(1) of this clause may be modified 

in accordance with agency regulations implementing the Freedom of Information Act (5 U.S.C. 

552) if necessary to respond to a request thereunder.

(3) Except to the extent the government’s action occurs as the result of final disposition of the 

matter by a court of competent jurisdiction, the Contractor is not precluded by paragraph (e) of this 

clause from brining a claim, in accordance with the Disputes clause of this contract, that may arise 

as a result of the government removing or ignoring authorized markings on data delivered under this 

contract.

(f) Omitted or incorrect markings.

(1) Data delivered to the government without any restrictive markings shall be deemed to have been 

furnished with unlimited rights. The government is not liable for the disclosure, use, or reproduction 

of such data.

(2) If the unmarked data has not been disclosed without restriction outside the government, the 

Contractor may request, within 6 months (or a longer time approved by the Contracting Officer in 

writing for good cause shown) after delivery of such data, permission to have authorized notices 
Medicare Enrollment Period Packages and Medicare Cards Page 49 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

placed on qualifying data at the Contractor’s expense, and the Contracting Officer may agree to do 

so if the Contractor—

(i) Identifies the data to which the omitted notice is to be applied;

(ii) Demonstrates that the omission of the notice was inadvertent;

(iii) Establishes that the use of the proposed notice is authorized; and

(iv) Acknowledges that the government has no liability for the disclosure, use, or reproduction 

of any data made prior to the addition of the notice or resulting from the omission of the 

notice.

(3) If data has been marked with an incorrect notice, the Contracting Officer may—

(i) Permit correction of the notice at the Contractor’s expense if the Contractor identifies the 

data and demonstrates that the correct notice is authorized, or

(ii) Correct any incorrect notices.

(g) Protection of limited rights data and restricted computer software.

(1) The Contractor may withhold from delivery qualifying limited rights data or restricted computer 

software that are not data identified in paragraphs (b)(1)(i), (ii), and (iii) of this clause. As a 

condition to this withholding, the Contractor shall—

(i) Identify the data being withheld; and

(ii) Furnish form, fit, and function data instead.

(2) Limited rights data that are formatted as a computer database for delivery to the government

shall be treated as limited rights data and not restricted computer software.

(3) [Reserved]

(h) Subcontracting. The Contractor shall obtain from its subcontractors all data and rights therein necessary to 

fulfill the Contractor’s obligations to the government under this contract. If a subcontractor refuses to accept 

terms affording the government such rights, the Contractor shall promptly notify the Contracting Officer of the 

refusal and shall not proceed with the subcontract award without authorization in writing from the Contracting 

Officer.

(i) Relationship to patents or other rights. Nothing contained in this clause shall imply a 

license to the government under any patent or be construed as affecting the scope of any 

license or other right otherwise granted to the government.

(end of clause)
Medicare Enrollment Period Packages and Medicare Cards Page 50 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

All CMS information shall be protected from unauthorized access, use, disclosure, duplication, modification, 

diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, 

integrity, and availability of such information. Therefore, if this contract requires the contractor to provide 

services (both commercial and non-commercial) for Federal Information/Data, to include any of the following 

requirements:

• Process any Information/Data; or

• Store any Information/Data (includes “Cloud” computing services); or

• Facilitate the transport of Information/Data; or

• Host/maintain Information/Data (including software and/or infrastructure developer/maintainers); or

• Have access to, or use of, Personally Identifiable Information (PII), including instances of remote 

access to, or physical removal of, such information beyond agency premises or control.

The contractor shall become and remain compliant with the requirements set forth at the CMS Information 

Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-ClauseProvision.html. The requirements cover all CMS contracts and associated deliverables, which are required on a 

“per contractor” basis.

The contractor shall ensure that the following Federal information security standards are met for all of its CMS 

contracts:

• Federal Information Security Management Act (FISMA) – FISMA information can be found at 

http://csrc.nist.gov/groups/SMA/fisma/index.html . FISMA requires each Federal agency to develop, 

document, and implement an agency-wide program to provide information security for the information 

and information systems that support the operations and assets of the agency, including those provided 

or managed by another agency, contractor, or other source; and,

• Federal Risk and Authorization Management Program (FedRAMP) – FedRAMP information can 

be found at http://www.gsa.gov/portal/category/102371 . The FedRAMP is a government-wide 

program that provides a standardized approach to security assessment, authorization, and continuous 

monitoring for cloud products and services.

The Contractor shall include in all awarded subcontracts the FISMA/FedRAMP compliance requirements set 

forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-andSystems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-InformationSecurity-Contract-Clause-Provision.html.

HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, 

shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 

(“HIPAA,” 42 U.S.C. § 1320d), as amended, as well as the corresponding implementing regulations and this 

HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, 

and the corresponding implementing regulations. Non-HIPAA related provisions governing the 

Contractor’s duties and obligations, such as those under the Privacy Act and any applicable data use 

agreements, are generally covered elsewhere in the Contract.
Medicare Enrollment Period Packages and Medicare Cards Page 51 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

The following definitions apply to this Contract Clause:

“Business Associate” shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it 

uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS’ HIPAAcovered functions.

“Covered Entity” shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

“Secretary” shall mean the Secretary of the Department of Health & Human Services or the Secretary’s 

designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or 

disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the 

HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA 

requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business 

Associate from, or on behalf of, Covered Entity other than as permitted or required by this 

Contract or as required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action 

against any individual for:

A. Filing a complaint under 45 CFR § 160.306;

B. Testifying, assisting or participating in an investigation, compliance review, proceeding 

or hearing under 45 CFR Part 160; or

C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good 

faith belief that the practice is unlawful, the manner of opposition is reasonable, and the 

opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its 

security policies and procedures, including workforce security measures, to ensure proper 

security awareness and training (including security incident response and reporting), and 

security incident procedures, in accordance with this Contract, including this HIPAA Business 

Associate Clause and the Contract’s clause entitled “CMS Information Security.”

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI 

created, received, maintained or transmitted by Business Associate from, or on behalf of 

Covered Entity only as provided for by this Contract. In doing so, it shall implement policies 

and procedures to address the following and, where applicable, ensure that such policies and 

procedures are also in conformance with this Contract’s clause entitled “CMS Information 

Security:”
Medicare Enrollment Period Packages and Medicare Cards Page 52 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual’s access rights to PHI 

(including the implementation of workforce security measures to ensure 

continued appropriate role-based access to PHI), and technical policies and 

procedures to ensure compliance with grants of access (including unique user 

identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities 

in which they are housed.

C. Implement policies, procedures and physical security measures that will limit access to 

PHI through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or 

outside of the Business Associate’s facility as well as the disposal and reuse of media 

containing PHI.

E. Implement appropriate administrative, physical and technical safeguards that 

reasonably and appropriately protect the confidentiality, integrity and availability (including 

the use of contingency plans) of any electronic protected health information (“EPHI”) it 

creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent 

impermissible use, disclosure, maintenance or transmission of such EPHI. In the 

establishment of such safeguards, Business Associate shall consider its size, complexity and 

capabilities, as well as its technical infrastructure, and its hardware and software security 

capabilities.

iii. Assess, and implement, where appropriate, any addressable implementation specifications 

associated with applicable PHI security standards.

iv. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a 

use or disclosure of PHI by Business Associate in violation of the requirements of this 

Contract.

v. Comply with the following Incident Reporting:

A. Report to Covered Entity any security incident/breach involving unsecured PHI, of which it 

becomes aware, including those of its agents and subcontractors. The Business Associate 

shall report any violation of the terms of this contract involving PHI and any security 

incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in 

accordance with the CMS Risk Management Handbook (RMH), specifically “RMH Vol 

II Procedure 7-2 Incident Handling Procedure” and “RMH Vol III Standard 7-1 Incident 

Handling.” These procedures can be found at http://www.cms.gov/Research-StatisticsData-and-Systems/CMS-Information-Technology/InformationSecurity/InformationSecurity-Library.html In addition, the Business Associate will also notify the CMS 

Contracting Officer and the Contracting Officer’s Representative (COR) by email within 

one (1) hour of identifying such violation or incident.

B. Upon Covered Entity's knowledge of any material security incident/breach by Business 

Associate, Covered Entity will provide an opportunity for Business Associate to cure the 

breach or end the violation consistent with the termination clause of this Contract. See also

paragraph D. Term of Clause below.
Medicare Enrollment Period Packages and Medicare Cards Page 53 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

vi. Ensure that any agent or subcontractor agrees through a written contract, or other legally 

enforceable arrangement, to the same restrictions and conditions that apply through this 

HIPAA Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or 

on behalf of, Covered Entity.

vii. Upon Covered Entity’s request:

A. Provide the Covered Entity or its designee with access to the PHI created, received, 

maintained or transmitted by Business Associate from or on behalf of the Covered Entity in 

the course of contract performance in order to ensure Covered Entity’s ability to meet the 

requirements under 45 CFR § 164.524.

B. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR §

164.526.

viii. Make its facilities and any books, records, accounts, and any sources of PHI, including any 

policies and procedures, that are pertinent to ascertaining its own compliance with this 

contract or the Covered Entity’s compliance with the applicable HIPAA requirements, 

available to Covered Entity, or, in the context of an investigation or compliance review, to the 

Secretary for purposes of the Secretary determining Covered Entity's compliance with the 

various rules implementing the HIPAA.

ix. Document disclosures of PHI and information related to such disclosures as would be 

required for Covered Entity to respond to a request by an Individual for an accounting of 

disclosures of PHI in accordance with 45 CFR § 164.528.

x. Provide to Covered Entity, or an individual identified by the Covered Entity, information 

collected under this Contract, to permit Covered Entity to respond to a request by an 

Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

xi. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum 

necessary to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent that 

such limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent that 

such changes may affect Business Associate’s use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 

§ 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

d. Term of Clause

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of 

the PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered 

Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or 

returned to Covered Entity in accordance with “CMS Information Security” procedures. Business 

Associate shall not retain any PHI.
Medicare Enrollment Period Packages and Medicare Cards Page 54 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

2. Security Incident/Breach:

Upon Covered Entity’s knowledge of a material breach by Business Associate, Covered Entity shall take action 

consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts – Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of 

Contracts, if the Business Associate does not cure the security incident/breach 

within the time specified by Covered Entity and/or cure is not possible; or,

B. If neither termination nor cure is feasible, Covered Entity shall report the 

violation to the Secretary.

ii. Other Agreements –Covered Entity shall either:

A. Provide an opportunity for Business Associate to cure the breach or end the 

violation consistent with the termination terms of this Contract. Covered Entity 

may terminate this Contract for default if the Business Associate does not cure 

the breach or end the violation within the time specified by Covered Entity; or,

B. Consistent with the terms of this Contract, terminate this Contract for default if 

Business Associate has breached a material term of this Contract and cure is not 

possible; or,

C. If neither termination nor cure is feasible, Covered Entity shall report the 

violation to the Secretary.

3. Returning or Destroying PHI:

Business Associate, as defined above, which includes subcontractors or agents of the Contractor, shall:

i. Upon expiration or termination of this Contract, for any reason, return or destroy all 

PHI received from Covered Entity or another Business Associate of the Covered Entity, 

as well as any PHI created, received, maintained or transmitted from or on behalf of 

Covered Entity, or another Business Associate of the Covered Entity, in accordance 

with this contract, including the “CMS Information Security” clause.

ii. In the event that Business Associate determines that returning or destroying the PHI is 

infeasible, provide to Covered Entity notification of the conditions that make return or 

destruction infeasible. Upon such notice that return or destruction of PHI is infeasible, 

Business Associate shall extend the protections of this Contract to such PHI and limit 

further uses and disclosures of such PHI to those purposes that make the return or 

destruction infeasible, for so long as Business Associate maintains such PHI.

e. Miscellaneous

1. A reference in this Contract to a section in the Rules issued under HIPAA means 

the section as in effect or as amended.

2. The respective rights and obligations of Business Associate under paragraph D.3.b 

of the section entitled “Term of Clause” shall survive the termination of this 

Contract.

Any ambiguity in this Contract clause shall be resolved to permit Covered Entity to comply with the Rules 

implemented under HIPAA.
Medicare Enrollment Period Packages and Medicare Cards Page 55 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

CMS SPECIFIC PROVISIONS FOR HIGH VISIBILITY/HIGH PUBLIC INTEREST CONTRACTS 

(OCT 2013)

OPEN GOVERNMENT PROACTIVE PREDISCLOSURE NOTIFICATION (OCT 2013)

In order to reduce the administrative burden of responding to Freedom of Information Act (FOIA) requests for 

high visibility/high public interest contracts throughout contract administration, the Contractor shall submit its 

review of the awarded contract (and contract modifications, if requested) for FOIA disclosure exemptions within 

thirty (30) calendar days of contract award. The review will substantiate “...Trade secrets and commercial or 

financial information obtained from a person and privileged or confidential...” information, in accordance with 

5 U.S.C. §552 FOIA, Exemption (b)(4), which could reasonably be expected to cause substantial competitive 

harm.

Submissions: The Contractor shall submit one (1) Compact Disc (CD) or Digital Video Disc (DVD) with all 5 

U.S.C. §552 FOIA, Exemption (b)(4), “...Trade Secrets, Commercial or Financial Information Which is 

Privileged or Confidential...,” otherwise known as public release/non-Confidential Business Information (nonCBI), with the information identified as follows: 

a. CBI Highlighted Copy of Contract: One copy of the contract with all CBI highlighted for CMS FOIA 

review.

b. Contractor Proposed Redacted Public Release Copy of Contract: An additional copy of the contract 

will be provided for public release with all the identified information redacted. Redactions shall be 

made using “black” boxes, which cannot be removed or uncovered by a reader.

c. Pre-Disclosure Concerns - Comments/Rationale for Non-Disclosure of Trade Secrets, Commercial 

or Financial Information Which is Privileged or Confidential: The Contractor shall provide, in a 

separate file, rationale for why disclosure of “...Trade Secrets, Commercial or Financial Information 

Which is Privileged or Confidential...” would cause the Contractor organization substantial competitive 

harm if disclosed to other entities. Rationale shall be provided for each individual recommended 

redaction. Generalized conclusions of competitive harm are not a sufficient basis for the CMS FOIA 

office to invoke the exemption and thereby protect the Contractor’s interest.

All CD/DVDs shall be mailed to the CMS FOIA Officer (address below) within thirty (30) calendar days of 

contract award and within thirty (30) calendar days of a CMS request, i.e. existing or modified contracts. All 

CD/DVD files shall be submitted as Portable Document Format (.pdf) files. 

CD/DVD and File Naming Conventions: The Contractor shall name the CD/DVD with the Contract Number 

and utilize the following CD/DVD file naming conventions:

HHSM-500-2013-xxxxxx – Highlighted

HHSM-500-2013-xxxxxx – Redacted

HHSM-500-2013-xxxxxx – Pre-Disclosure Concerns

CD/DVD shall be mailed to the CMS FOIA Officer at:

Centers for Medicare & Medicaid Services

Freedom of Information Act Office

ATTN: CMS FOIA Officer

Mailstop: N2-20-16

7500 Security Boulevard

Baltimore, MD 21244-1850
Medicare Enrollment Period Packages and Medicare Cards Page 56 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

Copy– Correspondence Only (No CD/DVD):

Contracting Officer

Contracting Officer’s Representative (COR)

It should be noted that the CMS FOIA Office makes the final determination as to what information is released to 

the public, after considering any feedback from OAGM and/or the Contractor.

CMS SECURITY CLAUSE

FAR 52.204-9 Personal Identity Verification of Contractor Personnel.

As prescribed in 4.1303, insert the following clause:

PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (JAN 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the 

contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management 

and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS 

PUB) Number 201.

(b) The Contractor shall account for all forms of government-provided identification issued to the 

Contractor employees in connection with performance under this contract. The Contractor shall return such 

identification to the issuing agency at the earliest of any of the following, unless otherwise determined by 

the government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with 

these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts 

when the subcontractor’s employees are required to have routine physical access to a Federally-controlled 

facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of 

the prime Contractor to return such identification to the issuing agency in accordance with the terms set 

forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

(End of clause)

FAR 52.222-54 Employment Eligibility Verification.

As prescribed in 22.1803, Insert the following clause:

EMPLOYMENT ELIGIBILITY VERIFICATION (OCT 2015)

(a) Definitions. As used in this clause—

“Commercially available off-the-shelf (COTS) item”—

(1) Means any item of supply that is—

(i) A commercial item (as defined in paragraph (1) of the definition at 2.101);

(ii) Sold in substantial quantities in the commercial marketplace; and

(iii) Offered to the government, without modification, in the same form in which it is sold in the 

commercial marketplace; and
Medicare Enrollment Period Packages and Medicare Cards Page 57 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

(2) Does not include bulk cargo, as defined in 46 U.S.C. 40102(4), such as agricultural products and 

petroleum products. Per 46 CFR 525.1 (c)(2), “bulk cargo” means cargo that is loaded and carried in 

bulk onboard ship without mark or count, in a loose unpackaged form, having homogenous 

characteristics. Bulk cargo loaded into intermodal equipment, except LASH or Seabee barges, is 

subject to mark and count and, therefore, ceases to be bulk cargo.

“Employee assigned to the contract” means an employee who was hired after November 6, 1986 (after 

November 27, 2009 in the Commonwealth of the Northern Mariana Islands), who is directly performing 

work, in the United States, under a contract that is required to include the clause prescribed at 22.1803. 

An employee is not considered to be directly performing work under a contract if the employee—

(i) Normally performs support work, such as indirect or overhead functions; and

(ii) Does not perform any substantial duties applicable to the contract.

“Subcontract” means any contract, as defined in 2.101, entered into by a subcontractor to furnish 

supplies or services for performance of a prime contract or a subcontract. It includes but is not 

limited to purchase orders, and changes and modifications to purchase orders.

“Subcontractor” means any supplier, distributor, vendor, or firm that furnishes supplies or services 

to or for a prime Contractor or another subcontractor.

“United States”, as defined in 8 U.S.C. 1101(a)(38), means the 50 States, the District of Columbia, 

Puerto Rico, Guam, the Commonwealth of the Northern Mariana Islands, and the U.S. Virgin 

Islands.

(b) Enrollment and verification requirements.

(1) If the Contractor is not enrolled as a Federal Contractor in E-Verify at time of contract award, the 

Contractor shall—

(i) Enroll. Enroll as a Federal Contractor in the E-Verify program within 30 calendar days of 

contract award;

(ii) Verify all new employees. Within 90 calendar days of enrollment in the E-Verify program, 

begin to use E-Verify to initiate verification of employment eligibility of all new hires of the 

Contractor, who are working in the United States, whether or not assigned to the contract, within 3 

business days after the date of hire (but see paragraph (b)(3) of this section); and

(iii) Verify employees assigned to the contract. For each employee assigned to the contract, initiate 

verification within 90 calendar days after date of enrollment or within 30 calendar days of the 

employee’s assignment to the contract, whichever date is later (but see paragraph (b)(4) of this 

section).

(2) If the Contractor is enrolled as a Federal Contractor in E-Verify at time of contract award, the 

Contractor shall use E-Verify to initiate verification of employment eligibility of—

(i) All new employees. 

(A) Enrolled 90 calendar days or more. The Contractor shall initiate verification of all new hires 

of the Contractor, who are working in the United States, whether or not assigned to the contract, 

within 3 business days after the date of hire (but see paragraph (b)(3) of this section); or 

(B) Enrolled less than 90 calendar days. Within 90 calendar days after enrollment as a Federal 

Contractor in E-Verify, the Contractor shall initiate verification of all new hires of the 

Contractor, who are working in the United States, whether or not assigned to the contract, 

within 3 business days after the date of hire (but see paragraph (b)(3) of this section); or 
Medicare Enrollment Period Packages and Medicare Cards Page 58 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

(ii) Employees assigned to the contract. For each employee assigned to the contract, the Contractor 

shall initiate verification within 90 calendar days after date of contract award or within 30 days after 

assignment to the contract, whichever date is later (but see paragraph (b)(4) of this section). 

(3) If the Contractor is an institution of higher education (as defined at 20 U.S.C. 1001(a)); a State or 

local government or the government of a Federally recognized Indian tribe; or a surety performing 

under a takeover agreement entered into with a Federal agency pursuant to a performance bond, the 

Contractor may choose to verify only employees assigned to the contract, whether existing employees 

or new hires. The Contractor shall follow the applicable verification requirements at (b)(1) or (b)(2) 

respectively, except that any requirement for verification of new employees applies only to new 

employees assigned to the contract. 

(4) Option to verify employment eligibility of all employees. The Contractor may elect to verify all 

existing employees hired after November 6, 1986 (after November 27, 2009, in the Commonwealth of 

the Northern Mariana Islands), rather than just those employees assigned to the contract. The Contractor 

shall initiate verification for each existing employee working in the United States who was hired after 

November 6, 1986 (after November 27, 2009, in the Commonwealth of the Northern Mariana Islands), 

within 180 calendar days of—

(i) Enrollment in the E-Verify program; or

(ii) Notification to E-Verify Operations of the Contractor’s decision to exercise this option, using 

the contact information provided in the E-Verify program Memorandum of Understanding (MOU).

(5) The Contractor shall comply, for the period of performance of this contract, with the requirements of 

the E-Verify program MOU. 

(i) The Department of Homeland Security (DHS) or the Social Security Administration (SSA)

may terminate the Contractor’s MOU and deny access to the E-Verify system in accordance with 

the terms of the MOU. In such case, the Contractor will be referred to a suspension or debarment 

official. 

(ii) During the period between termination of the MOU and a decision by the suspension or 

debarment official whether to suspend or debar, the Contractor is excused from its obligations under 

paragraph (b) of this clause. If the suspension or debarment official determines not to suspend or 

debar the Contractor, then the Contractor must reenroll in E-Verify.

(c) Web site. Information on registration for and use of the E-Verify program can be obtained via the 

Internet at the Department of Homeland Security Web site: http://www.dhs.gov/E-Verify. 

(d) Individuals previously verified. The Contractor is not required by this clause to perform additional 

employment verification using E-Verify for any employee—

(1) Whose employment eligibility was previously verified by the Contractor through the E-Verify 

program.

(2) Who has been granted and holds an active U.S. Government security clearance for access to 

confidential, secret, or top secret information in accordance with the National Industrial Security 

Program Operating Manual; or

(3) Who has undergone a completed background investigation and been issued credentials pursuant to 

Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard 

for Federal Employees and Contractors. 
Medicare Enrollment Period Packages and Medicare Cards Page 59 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

(e) Subcontracts. The Contractor shall include the requirements of this clause, including this paragraph (e) 

(appropriately modified for identification of the parties), in each subcontract that—

(1) Is for—

(i) Commercial or noncommercial services (except for commercial services that are part of the 

purchase of a COTS item (or an item that would be a COTS item, but for minor modifications), 

performed by the COTS provider, and are normally provided for that COTS item); or 

(ii) Construction;

(2) Has a value of more than $3,500; and

(3) Includes work performed in the United States.

(End of clause)

CMS SECURITY CLAUSE (APR 2016)

a. Applicability

In accordance with OMB Memorandum M-05-24, Implementation of Homeland Security Presidential 

Directive 12 (HSPD-12): Policy for a Common Identification Standard for Federal Employees and 

Contractors, dated August 27, 2004, and Federal Information Processing Standard (FIPS) PUB Number 

201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve 

appropriate security assurance for multiple applications by efficiently verifying the claimed identity of 

individuals seeking physical access to Federally controlled government facilities and/or logical access to 

federally controlled information systems. Contractors that require routine physical access to a CMS facility 

and/or routine access to a CMS federally controlled information system will be required to obtain a CMS 

issued PIV, PIV-I or Locally Based Physical Access card. FIPS PUB 201-2 specifies the architecture and 

technical requirements for a common identification standard for Federal employees and Contractors.

When a PIV or PIV-I card is provided, it shall be used in conjunction with a compliant card reader and 

middleware for logical system access. The Contractor shall (1) Include FIPS 201-2 compliant, HSPD-12 

card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR 52.204-9, 

Personal Identity Verification of Contractor Personnel.

b. Definitions

“Agency Access” means access to CMS facilities, sensitive information, information systems or other CMS 

resources.

“Applicant” is a Contractor employee for whom the Contractor submits an application for a CMS 

identification card.

“Contractor Employee” means prime Contractor and subcontractor employees who require agency access to 

perform work under a CMS contract.

“Official Station”— As defined by Federal Travel Regulations, An area defined by the agency that includes 

the location where the employee regularly performs his or her duties or an invitational traveler’s home or 

regular place of business. The area may be a mileage radius around a particular point, a geographic 

boundary, or any other definite domain, provided no part of the area is more than 50 miles from where the 

employee regularly performs his or her duties or from an invitational traveler’s home or regular place of 

business. If the employee’s work involves recurring travel or varies on a recurring basis, the location where 

the work activities of the employee’s position of record are based is considered the regular place of work.

“Federal Identification Card” (or “ID card”) means a federal government issued or accepted identification 

card such as a Personal Identity Verification (PIV) card, Personal Identity Verification-Interoperable (PIV-I) 

card, or a Local-Based Physical Access Card issued by CMS, or a Local-Based Physical Access Card issued 

by another Federal agency and approved by CMS. “Issuing Office” means the CMS entity that issues 

identification cards to Contractor employees.
Medicare Enrollment Period Packages and Medicare Cards Page 60 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

“Locally Based Physical Access Card” means an access Card that is graphically personalized for visual 

identification, that does not contain an embedded computer chip, and is only used for physical access.

“Local Security Servicing Organization” means the CMS entity that provides security services to the CMS 

organization sponsoring the contract, Division of Physical Security and Strategic Information (DPSSI).

“Logical Access” means the ability for the Contractor to interact with CMS information systems, databases, 

digital infrastructure, or data via access control procedures such as identification, authentication, and 

authorization.

“Personal Identity Verification (PIV) card,” as defined in FIPS PUB 201-2, is a physical artifact (e.g., 

identity card, “smart” card) issued to an individual that contains a PIV Card Application which stores 

identity credentials (e.g., photograph, cryptographic keys, digitized fingerprint representation) so that the 

claimed identity of the cardholder can be verified against the stored credentials by another person (human 

readable and verifiable) or an automated process (computer readable and verifiable).

“Personal Identity Verification-Interoperable (PIV-I) card” similar to a PIV card, is a physical artifact 

(e.g., identity card, “smart” card) issued to an individual that contains a PIV Card Application which stores 

identity credentials (e.g., photograph, cryptographic keys, digitized fingerprint representation) so that the 

claimed identity of the cardholder can be verified against the stored credentials by another person (human 

readable and verifiable) or an automated process (computer readable and verifiable). PIV-I cards are 

issued by a non-federal government entity to non-federal government staff. PIV-I cards are issued in a 

manner that allows federal relying parties to trust the cards. The PIV-I cards uses the same standards of 

vetting and issuance developed by the U.S. government for its employees

c. Screening of Contractor Employees

i. Contractor Screening of Applicants

1.Contractor Responsibility: The Contractor shall pre-screen individuals designated for 

employment under any CMS contract by verifying minimum suitability requirements to 

ensure that only qualified candidates are considered for contract employment. At the 

discretion of the government, the government reserves the right to request and/or review 

Contractor employee vetting processes. The federal minimum suitability requirements can 

be found below in section (c)(2)—Suitability Requirements, and are also contained in 5 

CFR 731.202. The Contractor shall exercise due diligence in pre-screening all employees 

prior to submission to CMS for agency access.

2.Alien Status: The Contractor shall monitor an alien’s (foreign nationals) continued 

authorization for employment in the United States. If requested by the Agency, the 

Contractor shall provide documentation to the Contracting Officer (CO) or the 

Contracting Officer’s Representative (COR) that validates that the Employment 

Eligibility Verification (e-Verify) requirement has been met for each Contractor or subContractor employee working on the contract in accordance with Federal Acquisition 

Regulation (FAR) 52.222-54 – Employment Eligibility Verification.

3.Residency Requirement: All CMS Contractor applicants shall have lived in the United 

States at least three (3) out of the last five (5) years prior to submitting an application for a 

Federal ID Card. CMS will process background investigations for foreign nationals in 

accordance with Office of Personnel Management (OPM) guidance. Contractor 

employees who worked for the U.S. Government as an employee overseas in a Federal or 

military capacity; and/or been a dependent of a U.S. Federal or military employee serving 
Medicare Enrollment Period Packages and Medicare Cards Page 61 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

overseas, must be able to provide state-side reference coverage. State-side coverage 

information is required to make a suitability or security determination. Examples of stateside coverage information include: the state-side address of the company headquarters 

where the applicant’s personnel file is located, the state-side address of the Professor in 

charge of the applicant’s “Study Abroad” program, the religious organization, charity, 

educational, or other non-profit organization records for the applicant’s overseas missions, 

and/or the state-side addresses of anyone who worked or studied with the applicant while 

overseas.

4.Selective Service Registration: All males born after December 31, 1959, must meet the 

Federal Selective Service System requirements as established on www.sss.gov.

ii. Identification Card Application Process

ID Card Sponsor: The CMS Contracting Officer’s Representative (COR) will be the CMS ID card 

Sponsor and point of contact for the Contractor’s application for a CMS ID card. The COR will review 

and approve/deny the HHS ID Badge Request before the form is submitted to the CMS, Office of 

Support Services and Operations, (OSSO), Division of Personnel Security Services (DPS), for 

processing. If approved, an applicant may be issued either a Personal Identity Verification (PIV) or 

PIV- I card that meets the standards of HSPD-12 or a Local-Based Physical Access Card.

Contractor Application Required Submissions: All applicants shall submit an HHS ID Badge 

Request form for issuance of a Federal ID Card. Unless otherwise directed by the ID Card Sponsor or 

DPS, applicants are required to electronically submit the request form via CMS’ Enterprise User 

Administration (EUA) Electronic Front-end Interface (EFI) system, which is located at 

https://eua.cms.gov/efi. To assist users with the application process, a user’s guide is located 

at:https://www.cms.gov/About-CMS/Contracting-WithCMS/ContractingGeneralInformation/Contracting-Policy-and-Resources.html.

The EUA users guide link should be used to obtain the most current instructional guidance.

PIV Training: Contractors who need PIV or PIV-I card shall complete HHS PIV Applicant Training, 

which is found at https://www.cms.gov/About-CMS/Contracting-WithCMS/ContractingGeneralInformation/Contracting-Policy-and-Resources.html. A copy of the 

completion certificate shall be included with the EFI application.

CMS Applicant Evaluations: CMS will evaluate an applicant’s required access level. Once the 

review is complete and accepted for further processing, the applicant will be contacted by DPS to 

submit the below information, as applicable.

1. e-QIP: Contractor employees will be required to submit information into e-QIP, a web-based 

automated system that is designed to facilitate the processing of standard investigative forms 

used when conducting background investigations for Federal security, suitability, fitness and 

credentialing purposes.

2. Fingerprints: Instructions for obtaining fingerprints will be provided by CMS, OSSO, DPS.

3. OF 306: Contractor employees may be required to complete the Optional Form (OF) 306, 

Declaration for Federal Employment which can be found at 

https://www.opm.gov/forms/pdf_fill/of0306.PDF.

4. Access to Restricted Area(s): The CMS COR will initiate all Federal ID card holders’ 

physical access requests via Physical Access Control System (PACS) Central at 

https://pam.cms.local.
Medicare Enrollment Period Packages and Medicare Cards Page 62 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

Suitability Requirements: CMS may decline to grant agency access to a Contractor employee 

including, but not limited to, any of the criteria cited below:

1. Misconduct or negligence in employment;

2. Criminal or dishonest conduct;

3. Material, intentional false statement, or deception or fraud in examination or appointment;

4. Refusal to furnish testimony as required by § 5.4 of 5 CFR 731.202;

5. Alcohol abuse, without evidence of substantial rehabilitation, of a nature and duration that 

suggests that the applicant or appointee would be prevented from performing the duties of the 

position in question, or would constitute a direct threat to the property or safety of the applicant 

or appointee or others;

6. Illegal use of narcotics, drugs, or other controlled substances without evidence of substantial 

rehabilitation;

7. Knowing and willful engagement in acts or activities designed to overthrow the U.S. 

Government by force; and

8. Any statutory or regulatory bar which prevents the lawful employment of the person involved in 

the position in question.

Badge Issuance: Upon approval of the badging application process and prior to starting work on the 

contract, applicants whose official station is located within 50 miles from CMS’ central office or one of 

its regional offices will be contacted to appear in person, at least two times (estimated at one hour for 

each visit), and shall provide two (2) original forms of identity source documents in order to generate 

the badge/ID. The identity source documents shall come from the list of acceptable documents included 

in FIPS 201-2, located at http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf. At least one (1) 

document shall be a valid State or Federal government-issued picture ID. PIV-I mobile enrollment 

stations will be made available for applicants that have an official station more than 50 miles from CMS 

or any of its regional offices, and the employee will not need to travel to a CMS Office. The Contractor 

will be contacted by CMS for further instructions on the badging process in this scenario.

d. CMS Position Designation Assessment

CMS will assign a risk and sensitivity level designation analysis to the overall contract and/or to 

Contractor employee positions by category, group or individual. The risk and sensitivity level 

designations will be the basis for determining the level and type of personnel security investigations 

required for Contractor employees. At a minimum, the FBI National Criminal History Check 

(fingerprint check) must be favorably adjudicated. Additionally, the OPM e-QIP and other required 

forms must be accepted by DPS before a CMS identification card will be issued.

e. Post Badging Training Requirements:

Contractor employees that receive an HHS ID Badge are expected to complete the following online 

trainings each year, according to the timeframes indicated below, and annually thereafter. The below list is 

not all inclusive and the COR may indicate training that must be taken in addition to the below:

i. Security and Insider Threat Awareness and Training (30 days after receiving badge): 

This course outlines the role of Contractors with regard to protecting information and ensuring 

the secure operation of CMS federally controlled information systems. Estimated time to 

complete is one hour.

ii. Computer Based Training (CBT) (within 3 days of approved EUA account): This training 

offers several modules to familiarize contractor employees with features of CMS’ webinar 

service. Estimated time to complete is one hour.
Medicare Enrollment Period Packages and Medicare Cards Page 63 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

f. Background Investigation and Adjudication

Upon contract award and receipt of an HHS ID Badge Request, CMS will initiate the Agency Access 

procedures, to include a background investigation.

CMS may accept favorable background investigation adjudications from other Federal agencies when 

there has been no break in service. A favorable adjudication does not preclude CMS from initiating a 

new investigation when deemed necessary. Each CMS sponsored Contractor shall use the OPM e-QIP

system to complete any required investigative forms.

The Contractor remains fully responsible for ensuring contract performance pending completion of 

background investigations of Contractor personnel. Employees that do not require access to CMS 

federally controlled information systems, facilities, or sensitive information in order to perform their 

duties may begin work on a contract immediately and need not submit an HHS ID Badge Request.

i. Failure to cooperate with OPM or Agency representatives during the background investigation 

process is considered grounds for removal from the contract.

ii. DPS may provide written notification to the Contractor employee, with a copy to the COR, of 

all suitability/non-suitability decisions. A CMS adjudicative decision (based on criminal history 

results or completed investigation results) is final, and is not subject to appeal.

iii. Contractor personnel for whom DPS determines to be ineligible for ID issuance will be required 

to cease working on the contract immediately.

iv. The Contractor shall immediately submit an adverse information report, in writing to the CO 

with a copy to the COR, of any adverse information regarding any of its employees that may 

impact their ability to perform under this contract. Reports should be based on reliable and 

substantiated information, not on rumor or innuendo. The report shall include, at a minimum, 

the Contractor employee’s name and associated contract number along with the adverse 

information. The COR will forward the adverse information report to the DPS for review 

and/or action.

v. At the Agency’s discretion, Contractor personnel may be provided an opportunity to explain or 

refute unfavorable information before an adjudicative decision is rendered on whether or not to 

withdraw the Federal ID from the individual in question. Under the provision of the Privacy 

Act of 1974, Contractor personnel may request a copy of their own investigation by submitting 

a written request to the OPM Federal Investigative Services (FIS) Freedom of Information 

(FOI) office. The following OPM-FOI link is being provided to afford one the instructions for 

obtaining a copy of one’s file: https://www.opm.gov/investigations/freedom-of-informationand-privacy-act-requests/.

g. Background Investigation Cost

The government will bear the cost of background investigations that are performed at the direction of 

CMS’ personnel security representatives by the Federal government’s approved and designated 

background investigation service provider, the OPM.

At the Agency’s discretion, if an investigated Contractor employee leaves the employment of the 

Contractor, or otherwise is no longer associated with the contract within one (1) year from the date the 

background investigation was completed, the Contractor may be required to reimburse CMS for the full 

cost of the investigation. Depending upon the type of background investigation conducted and the cost 

incurred by CMS, the Contractor cost will be determined based upon the current OPM fiscal year billing 

rates, which can be found at http://www.opm.gov/investigations/background-investigations/federal-
Medicare Enrollment Period Packages and Medicare Cards Page 64 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

investigations-notices. The amount to be paid by the Contractor shall be due and payable when the CO 

submits a written letter notifying the Contractor as to the cost of the investigation. The Contractor shall 

pay the amount due within thirty (30) days of the date of the CO’s letter by check, made payable to the 

“United States Treasury.” The Contractor shall provide a copy of the CO’s letter as an attachment to the 

check and submit both to the Office of Financial Management at the following address:

Centers for Medicare & Medicaid Services

PO Box 7520

Baltimore, Maryland 21207

h. Identification Card Custody and Control

The Contractor is responsible for the custody and control of all forms of Federal identification issued by 

CMS to Contractor employees. The Contractor shall immediately notify the COR when a Contractor 

employee no longer requires agency access due to transfer, completion of a project, retirement, removal 

from work on the contract, or termination of employment. Return all CMS Federal ID cards to:

The Centers for Medicare and Medicaid Services

Attn: DPS, Mailstop: SL-17-06

7500 Security Boulevard

Baltimore, Maryland 21244

The Contractor shall also ensure that Contractor employees comply with CMS requirements concerning 

the renewal, loss, theft, or damage of an ID card.

Failure to comply with the requirements for custody and control of CMS issued ID cards may result in a 

delay in withholding final payment or contract termination, based on the potential for serious harm 

caused by inappropriate access to CMS facilities, sensitive information, information systems or other 

CMS resources.

i. Renewal: A Contractor employee’s CMS issued ID card is valid for a maximum of five (5) 

years and 9 months or until the contract expiration date (including option periods), whichever 

occurs first. The renewal process should begin six weeks before the ID card expiration date by 

contacting the COR. If an ID card is not renewed before it expires, the Contractor employee will 

be required to sign-in daily for facility access and may have limited access to information 

systems and other resources. Contractor ID card certificate(s) require yearly updates from the 

issuance date. The yearly updates should be coordinated between the contractor and the COR.

ii. Lost/Stolen: Immediately upon detection that an ID card is lost or stolen, the Contractor or 

Contractor employee shall report a lost or stolen ID card to the COR and the local security 

servicing organization at SECURITY@cms.hhs.gov. The Contractor shall also submit an 

Incident Report within 48 hours, to the COR, DPS at Badging@cms.hhs.gov, and the local 

security servicing organization. The Incident Report shall describe the circumstances of the loss 

or theft. If the loss or theft is reported by the Contractor to the local police, a copy of the police 

report shall be provided to the COR. The Contractor employee shall sign in daily for facility 

access and may have limited access to information systems and other resources until the 

replacement card is issued.

iii. Replacement: An ID card will be replaced if it is damaged, contains incorrect data, or is lost or 

stolen for more than three (3) days, provided there is a continuing need for agency access to 

perform work under the contract.
Medicare Enrollment Period Packages and Medicare Cards Page 65 of 65

1583-S (09/23) Section 5 – CMS Security Specifications

In the event that the PIV card or certificate(s) are not renewed in a timely fashion, or the ID card 

requires replacement due to being lost, stolen, or damaged, the contractor employee will go through the 

“Badge Issuance” process again as described in above in section (c)(2). In any of these events, contact 

your COR to coordinate the appropriate next steps.

i. Surrender ID Cards/Access Cards, Government Equipment

CMS reserves the right to suspend or withdraw ID card access at any time for any reason. Access will be 

restored upon the resolution of the issue(s).

Upon notification that routine access to CMS facilities, sensitive information, federally controlled 

information systems or other CMS resources is no longer required, the Contractor shall surrender the

CMS issued ID card, access card, keys, computer equipment, and other government property to the CMS 

COR or directly to CMS at the address referenced above in section (f). DPS Contractor personnel who do 

not return their government issued property within 48 hours of the last day of authorized access to CMS, 

may be permanently barred from CMS systems and facilities and may be subject to fines and penalties, as 

authorized by applicable Federal or State laws.