TITLE

BASIS OF

ITEM DESCRIPTION AWARD UNIT RATE COST UNIT RATE COST UNIT RATE COST UNIT RATE COST UNIT RATE COST 

I. Printing/Imaging, Trim to Size, Assemble, Fold, & Insert

(a) Printing/Imaging Variable Data Pages...per 1,000 images 7,868 4.27 33,596.36 7.00 55,076.00 25.00 196,700.00 15.00 118,020.00 8.75 68,845.0

(b) Printing/Imaging Static Data Pages...per 1,000 images 7,684 4.17 32,042.28 7.00 53,788.00 20.00 153,680.00 15.00 115,260.00 8.75 67,235.0

(c) Printing/Imaging Mailing Envelopes...per 1,000 envelopes 4,184 9.95 41,630.80 6.45 26,986.80 5.00 20,920.00 2.00 8,368.00 8.75 36,610.0

(d) Collate leaves, fold, insert into envelope...per 1,000 leaves 7,868 4.80 37,766.40 ‐ ‐ ‐ ‐ ‐ ‐ ‐ ‐ ‐ ‐‐ ‐ ‐ ‐ ‐ ‐ ‐ ‐ ‐ ‐ ‐ 9.00 70,812.00 17.00 133,756.00 8.75 68,845.0

II. STOCK/PAPER:

(a) White Offset Book (50 lbs.) or White Plain Copier, Xerographic Copier, Laser

Printer (Qualified Product) (20 lbs.) or White Plain Copier, Xerographic

(Qualified Product) (20 lbs.)... per 1,000 leaves 7,868 7.10 55,862.80 6.05 47,601.40 9.00 70,812.00 8.00 62,944.00 8.00 62,944.0

(b) White Writing/Wove Mailing Envelope (20 or 24 lbs.)...per 1,000 envelopes 4,184 6.75 28,242.00 7.70 32,216.80 15.00 62,760.00 16.50 69,036.00 8.00 33,472.0

Contractor Total $229,140.64 ‐‐ ‐‐ ‐‐ ‐‐ ‐‐ ‐‐ ‐‐ $575,684.00 $507,384.00 $337,951.00 

Prompt Payment Discount 0.25% $572.85 1.00% $5,756.84 0.00% $0.00 1.00% $0.00 

Discounted Totals 20 DAYS $228,567.79 20 DAYS $569,927.16 NET $507,384.00 10 DAYS $337,951.00 

Abstracted by: Teri Doughty‐Shoffstall 9/22/2017

Verified by: Linda Price 09/26/2017

Contract Awarded to: Allison Payment Systems, LLC

AWARDED

THE DATA CENTER

Salt Lake City, UT

BARTON & COONEY

Burlington, NJ Waldorf, MD

IMS, INC.

Liverpool, NY

ALLISON PAYMENT SYS

Indianapolis, IN 

PROGRAM 4571‐S (R1)

Term of Contract Production Period: December 1, 2017 through November 30, 2018

Medicare MEC Notices

Term of Contract Testing period: Date of Award through November 30, 2017

MPM COMM 

Page 1 of 1
Program 4571-S (R1) Page 1 of 48

Specifications by LLP

Reviewed by MJS

THIS IS A RESOLICITATION WITH REVISED SPECIFICATIONS

U.S. GOVERNMENT PUBLISHING OFFICE

Columbus, Ohio

GENERAL TERMS, CONDITIONS, AND SPECIFICATIONS

For the Procurement of

Medicare MEC Notices

as requisitioned from the U.S. Government Publishing Office (GPO) by the

Department of Health and Human Services

Centers for Medicare and Medicaid Services (CMS)

Single Award

TERM OF CONTRACT: The term of this contract includes an initial testing period beginning Date of Award 

through November 30, 2017. The production period begins December 1, 2017 through November 30, 2018) and 

4 option year periods (December 1, 2018 through November 30, 2019; December 1, 2019 through November 30, 

2020; December 1, 2020 through November 30, 2021, and December 1 2021 through November 30, 2022). 

Special attention is directed to the following provision and clauses in Section 1 of this contract: “Option to 

Extend the Term of Contract”, and “Economic Price Adjustment.”

BID OPENING: Bids shall be publicly opened at 2:00 p.m., prevailing Columbus, Ohio time on

September 22, 2017.

SUBMIT SEALED BID TO: U.S. Government Publishing Office, 1335 Dublin Road Suite 112-B, Columbus, 

Ohio 43215-7034. Bid must be clearly marked on the outermost envelope/package with company name and 

address of the bidder, program number, and bid date opening. Telegraphic, facsimile, and e-mail bids 

transmitted to GPO offices WILL NOT be considered.

BIDDERS PLEASE NOTE: This contract was previously solicited under Program 2571-S. Bidders are 

cautioned to familiarize themselves with all provisions of this contract before bidding. Deleted requirement for 

Language Pages. Additional changes scattered throughout. Resolicitation revisions: “Security” on page 2, 

Annual Notice quantity under “Quantities” on page 10, and schedule for “Quarterly Correction Notices

and Monthly Replacement Notices” under “Schedule” on page 17, and “Determination of Award” on page 

19.

Abstract for Program 2571-S is available on GPO Web Site at:

http://www.gpo.gov/gpo/abstracts/abstract.action?region=Columbus

For information of a technical nature call Linda Price at (614) 488-4616, ext. 7 (No collect calls).
Medicare MEC Notices 2 of 48

4571-S (R1) (11/18)

SECTION 1. – GENERAL TERMS AND CONDITIONS

GPO CONTRACT TERMS: Any contract which results from this Invitation for Bid will be subject to the 

applicable provisions, clauses, and supplemental specifications of GPO Contract Terms (GPO Pub. 310.2, 

effective December 1, 1987 (Rev. 06/01)) and GPO Contract Terms, Quality Assurance Through Attributes 

Program for Printing and Binding (GPO Pub. 310.1, effective May 1979 (Rev. 08/02)).

 GPO Contract Terms (GPO Publication 310.2): http://www.gpo.gov/pdfs/vendors/sfas/terms.pdf

 GPO QATAP (GPO Publication 310.1): http://www.gpo.gov/pdfs/vendors/sfas/qatap.pdf

 DISPUTES: GPO Publication 310.2, GPO Contract Terms, Contract Clause 5. Disputes, is hereby 

replaced with the June 2008 clause found at www.gpo.gov/pdfs/vendors/contractdisputes.pdf.

 Other GPO Forms: http://www.gpo.gov/vendors.sfas.htm

REGULATIONS GOVERNING PROCUREMENT

The U.S. Government Publishing Office (GPO) is an office in the legislative branch of the United States 

Government. Accordingly, the Federal Acquisition Regulation is inapplicable to this, and all GPO procurements. 

However, the text of certain provisions of the Federal Acquisition Regulation as contained in the Code of Federal 

Regulations (CFR), are referenced in this solicitation. The offeror should note that only those provisions of the 

Federal Acquisition Regulation which are specifically incorporated by reference into this solicitation are 

applicable.

SUBCONTRACTING: The predominant production functions are downloading files, manipulating data from 

TIBCO files, computerized variable imaging, preparation for mailing, and delivery to USPS. These items 

CANNOT be subcontracted. All other items, including printing of static data are not considered part of the 

predominant production functions. Bidder who must subcontract any of the predominant production functions 

may be declared non-responsible.

SECURITY: The contractor awarded this contract will be in custody of Government owned material considered 

Personally Identifiable Information (PII). See “Section 5. – CMS Security Specifications” for security 

requirements of this contract. The Government may conduct on-site unannounced, randomized Security 

inspections at any time.

CMS Acceptable Risk Safeguards for TIBCO transmissions: Low Security Impact Level.

QUALITY ASSURANCE LEVELS AND STANDARDS: The following levels and standards shall apply to 

these specifications:

Product Quality Levels:

(a) Printing (Page Related) Attributes -- Level III.

(b) Finishing (Item Related) Attributes -- Level III.

Inspection Levels (from ANSI/ASQC Z 1.4):

(a) Non-destructive Tests - General Inspection Level I.

(b) Destructive Tests - Special Inspection Level S-2.

Specified Standards: The specified standards for the attributes requiring them shall be:
Medicare MEC Notices 3 of 48

4571-S (R1) (11/18)

Attribute Specified Standard

P-7. Type Quality and Uniformity Prior to Production Samples/Proofs

and/or PSI/Imaging Inspections

CONTRACTOR’S QUALITY ASSURANCE SYSTEM: The contractor must provide and maintain an 

effective quality assurance system that includes, at a minimum the following elements:

1. Perform a random quality inspection of records in the TIBCO files. Samples should be tested for 

construction, type, and placement of data in each field.

2. Ensure that the computerized imaging is clear and legible and that the appropriate notice letters are mailed 

to each address contained in the TIBCO files.

3. Maintenance and calibration records on all applicable production and inspection equipment.

4. Controls that assure all steps in the process generate a product that conforms to all requirements of this 

solicitation.

5. Performance utilizing a calibration system that stops production whenever an extra piece is inserted or a 

piece is left out.

If errors are found or discrepancies exist between the TIBCO data files and reports, e.g. print order, record layout, 

etc., the contractor must cease further production and contact Mark Rydberg at (410) 786-3038. If errors exist in 

the file and the contractor failed to identify them during his/her quality assurance inspection, no reimbursement 

for the cost of reprinting will be allowed.

QUALITY SYSTEMS: The contractor shall initiate, prior to start-up and maintain throughout the life of this 

contract, Quality Systems to assure conformance to all requirements of this contract. The Quality Systems plan 

should address what actions will be initiated when defects are detected.

The Quality Systems shall assure the quality of components from subsidiary plants. This element includes 

assuring that components from different sources will be compatible BEFORE the start of production.

The Quality Systems shall include procedures for assuring that all variable data are accurately and completely 

printed and that all addressed items are mailed. The procedures shall explicitly describe the methods to be used to 

assure that no records are missed or duplicated when an interruption of variable printing occurs (e.g. due to 

equipment malfunction).

Records of tests, inspections, and critical processes shall be timed stamped and maintained on file. The records 

must be available to GPO and or HHS/CMS employees until the expiration of the warranty period of this contract.

VERIFICATION OF PRODUCTION AND MAILING: Contractor will be responsible for validating the 

integrity of every notice produced in all phases of printing, inserting and mailing and to ensure all notices 

received from CMS were correctly entered into the United States postal system.

Notice integrity shall be defined as: Each notice shall include all pages (and only those pages) intended for the 

designated recipient as contained in the print files received from CMS.

The contractor is responsible for providing the automated print notice integrity control systems and processes 

required to prevent the commingling of pages intended for different recipients into a completed package. The 

contractor’s printing process must have automated systems that include notice coding and scanning technology 

capable of:
Medicare MEC Notices 4 of 48

4571-S (R1) (11/18)

 Validating the count of pages in a notice set.

 Validating the sequence of pages in a notice set.

 Validating the sequence of notice sets in a production batch.

 Interrupting production if variances are detected.

Mailing integrity shall be defined as all Items received from CMS for each Print Order were imaged, printed, 

inserted and entered correctly into the United States postal system.

The contractor is responsible for providing the automated inserted notice tracking/reporting systems and processes 

required to validate that 100% of all records received from CMS were printed, inserted and mailed correctly. The 

contractor’s inserting equipment must have automated systems that include notice coding and scanning 

technology capable of:

 Reconciling page and notice counts from CMS provided print files to Print Order control totals provided 

by CMS; reporting variances.

 Uniquely identifying each notice within a Print Order using a sequence number range assigned by the 

contractor.

 Unique identifier to be scanned after insertion to ensure all notices are present and accounted for.

 Tracking and reporting all notices produced and mailed within a Print Order at the notice level.

 Identifying and reporting all missing notices that were lost or spoiled during production within a Print 

Order.

 Generating a new production file for all missing notices.

 Reconciling the total of all notices produced and mailed within a Print Order to the control totals provided 

by CMS; reporting all variances.

 Reconciling the total of all notices mailed to mailing totals contained on Postal Entry Forms within a Print 

Order; reporting all variances.

 Generate a final automated summary report which provides information that all mail pieces have been 

scanned, after insertion, verifying that all pieces for each Print Order are accounted for. The summary 

report will contain the sequence number range for a particular Print Order, show all sequence numbers 

were scanned and accounted for after notice is inserted, and event information on any spoiled or missing 

pieces verifying that they were scanned and accounted for. A copy of the summary report(s) must be 

submitted with the matching GPO Form 712(s).

Contractor must generate an automated audit report when necessary showing the tracking of all Items throughout 

all phases of production for each mail piece. This audit report will contain all information outlined above for each 

phase of printing, inserting and mailing. All notice tracking/reporting data must be retained in electronic form for 

120 days after mailing, and must be made available to CMS for auditing of contractor performance upon request.

UNIQUE IDENTIFICATION NUMBER: Unique identifying numbers will be used to track each individual 

notice, thereby providing 100% accountability. This enables the contractor to track each notice through 

completion of the project. If required by the Government, the contractor will be required to create a test sample 

totaling 50 notices. This test must have a unique number and must be produced on each of the notices. The 

contractor will generate a list of the unique identifying numbers for each sample. As samples are pulled, their 

unique number will be marked off the list. This enables the contractor to track which samples have been 

produced and pulled and what records have been produced.

In addition, if required, the contractor will produce a printed sample of each notice used for the Unique

Identification Number sample plan. Those samples, along with the unique numbers, are to be processed and 

mailed directly to HHS/CMS; 7500 Security Blvd., SL 12-18; Baltimore, MD 21244-1850; Attn: Mark Rydberg.
Medicare MEC Notices 5 of 48

4571-S (R1) (11/18)

A recovery system will be required to ensure that all defective or missing/mutilated pieces detected are identified, 

reprinted and replaced. The recovery system must use unique sequential numbers assigned to each piece to aid in 

the recovery and replacement of any defective or missing/mutilated pieces, and must be capable of tracking and/or 

locating any individual piece of mail from the time it leaves the press, up to and including when it is off-loaded at 

the USPS facility.

The Government will not as a routine matter request that the contractor produce individual pieces in transit within 

the plant, however, the contractor must demonstrate that they have an audit trail established that has the ability to 

comply with this type request when and if the need arises. The contractor’s Quality Assurance System and the 

Verification of Production and Mailing plans must account for the number of pieces mailed. The contractor shall 

monitor all aspects of the job including material handling and mail flow, to assure that the production and delivery 

of these notices meet specifications and Government requirements.

REDUNDANT FACILITY: As part of the pre-award survey, the contractor shall provide a redundant facility 

plan which is to include having two or more contractor owned/controlled facilities that have the capability to 

perform all predominate production requirements of the contract. This plan is to allow for back-up facilities if for 

any reason(s) (act of God, labor disagreements, etc.) a production facility is unable to meet all the requirements 

of the contract.

The back-up facilities, equipment, and personnel must be established and operational prior to award. Failure to 

have a back-up facility may result in a non-responsible determination.

WARRANTY: The provisions of Article 15, “Warranty” of Contract Clauses in GPO Contract Terms is 

amended for the solicitation to the effect that the warranty period is EXTENDED from 120 days to one calendar 

year from the date the check is tendered as final payment. All other provisions remain the same.

OPTION TO EXTEND TERM OF CONTRACT: The Government has the option to extend the term of this 

contract for a period of 12 months by written notice to the contractor not later than 30 days before the contract 

expires. If the Government exercises this option, the extended contract shall be considered to include this clause, 

except, the total duration of the contract may not exceed 5 years (November 30, 2022) as a result of, and 

including, any extension(s) added under this clause. Further extension may be negotiated under the “Extension of 

Term of Contract” clause. See also “Economic Price Adjustment” clause for authorized pricing adjustment(s).

EXTENSION OF TERM OF CONTRACT: At the request of the Government, the term of any contract

resulting from this solicitation may be extended for such period of time as may be mutually agreeable to the GPO 

and the contractor.

ECONOMIC PRICE ADJUSTMENT: The pricing under this contract shall be adjusted in accordance with this 

clause, provided that in no event will any pricing adjustment be made that would exceed the maximum 

permissible under any law in effect at the time of the adjustment.

There will be no adjustment for orders placed during the first period specified below. Pricing will thereafter be 

eligible for adjustment during the second and any succeeding performance period(s). For each performance 

period after the first, a percentage figure will be calculated as described below and that figure will be the 

economic price adjustment for that entire next period.

Pricing adjustments under this clause are not applicable to reimbursable postage or transportation costs, or to 

paper, if paper prices are subject to adjustment by separate clause elsewhere in this contract.
Medicare MEC Notices 6 of 48

4571-S (R1) (11/18)

For the purpose of this clause, performance under this contract will be divided into successive periods. The first 

period will extend from December 1, 2017 through November 30, 2018, and the second and any succeeding 

period(s) will extend for 12 months from the end of the last preceding period, except that the length of the final 

period may vary. The first day of the second and any succeeding period(s) will be the effective date of the 

economic price adjustment for that period.

Pricing adjustments in accordance with this clause will be based on changes in the seasonally adjusted “Consumer 

Price Index For All Urban Consumers – Commodities Less Food” (Index) published monthly in the CPI Detailed 

Report by the U.S. Department of Labor, Bureau of Labor Statistics.

The economic price adjustment will be the percentage difference between Index averages as specified in this 

paragraph. An index called the variable index will be calculated by averaging the monthly Indexes from the 

12-month interval ending three (3) months prior to the beginning of the period being considered for adjustment. 

This average is then compared to the average of the monthly Indexes for the 12-month interval ending 

August 31, 2017, called the base index. The percentage change (plus or minus) of the variable index from the 

base index will be the economic price adjustment for the period being considered for adjustment.

The Government will notify the contractor by contract modification specifying the percentage increase or 

decrease to be applied to invoices for orders placed during the period indicated. The contractor shall apply the 

percentage increase or decrease against the total price of the invoice less reimbursable postage or transportation 

costs and separately adjusted paper prices. Payment discounts shall be applied after the invoice price is adjusted.

If the Government exercises an option, the extended contract shall be considered to include this economic price 

adjustment clause.

PAPER PRICE ADJUSTMENT: Paper prices charged under this contract will be adjusted in accordance with 

“Table 9 – Producer Price Indexes and Percent Changes for Commodity Groupings and Individual Items” in 

Producer Price Indexes report, published by the Bureau of Labor Statistics (BLS), as follows:

1. BLS code 0913 for “All Paper” will apply to all paper required under this contract.

2. The applicable index figures for the month of December 1, 2017 will establish the base index.

3. There shall be no price adjustment for the first three months of the contract.

4. Price adjustments may be monthly thereafter, but only if the index varies by an amount (plus or minus) 

exceeding 5% by comparing the base index to the index for that month which is two months prior to the 

month being considered for adjustment.

5. Beginning with order placement in the fourth month, index variances will be calculated in accordance 

with the following formula:

where X = the index for that month which is two months prior to the month being considered for 

adjustment.

6. The contract adjustment amount, if any, will be the percentage calculated in 5 above less 5%.

 x 100 = %

base index

x base index

____
Medicare MEC Notices 7 of 48

4571-S (R1) (11/18)

7. Adjustments under this clause will be applied to the contractor’s bid price(s) for all line items under “Item 

II. STOCK/PAPER” in the Schedule of Prices and will be effective on the first day of any month for 

which prices are to be adjusted.

The Contracting Officer will give written notice to the contractor of any adjustments to be applied to invoices for 

orders placed during months affected by this clause.

In no event, however, will any price adjustment be made which would exceed the maximum permissible under 

any law in effect at the time of the adjustment. The adjustment, if any, shall not be based upon the actual change 

in cost to the contractor, but shall be computed as provided above.

The contractor warrants that the paper prices set forth in this contract do not include any allowance for any 

contingency to cover anticipated increased costs of paper to the extent such increases are covered by this price 

adjustment clause.

PREAWARD SURVEY: In order to determine the responsibility of the prime contractor or any subcontractor, 

the Government reserves the right to conduct an on-site preaward survey at the contractor’s/subcontractor’s 

facility or to require other evidence of technical, production, managerial, financial, and similar abilities to 

perform, prior to the award of a contract.

The Preaward Survey will include a review of all subcontractors involved, along with their specific functions; and 

the contractor’s/subcontractor’s, personnel, data handling, production, security and other requirements outlined in 

“Section 5 CMS Security Specifications”.

Attending the preaward survey will be representatives from the Government Publishing Office and/or the Centers 

for Medicare and Medicaid Services. The Government reserves the right to conduct postaward surveys of the 

same nature as needed.

POSTAWARD CONFERENCE: The postaward conference between contractor and agency is required, unless 

waived by the Government. The postaward conference sill be conducted via telephone or at contractor’s 

facility(ies). The purpose of the conference will be to discuss and review all aspects of the contractor’s 

production plan and to establish coordination of all internal and external operations required to complete the 

contract and for CMS to determine the appropriate level of security investigation.

POST AWARD TEST: The contractor awarded the contract shall be required to demonstrate their ability to 

retrieve TIBCO files and print the items required in these specifications at the requisite quality level by 

completing a Post Award Test which includes a Variable Data Test and a Live Notice Test as described hereafter. 

The Government reserves the right to waive the Postaward Test if there is other evidence that, in the opinion of 

the Contracting Officer, indicates that the contractor being considered for award has the capability to successfully 

produce the items required.

Variable Data Test: Unless waived by the Government, 2 work days after receipt of data files, the contractor 

may be required to submit post-award test samples. The contractor will be required to submit 50 randomly 

selected samples in .PDF format of the notices to be ordered under this contract.

Contractor must also submit the corresponding source data files (also known as a “data dump”). Test samples 

must show the correct variable data information taken from the furnished test files in accordance with the Data 

Layout Sheet.

In addition, the contractor will be required to provide data programming as required to accomplish the Variable 

Computerized Imaging as defined under “Printing/Imaging” in “Section 2 – Specifications”. E-mail the test 

samples to mark.rydberg@cms.hhs.gov.
Medicare MEC Notices 8 of 48

4571-S (R1) (11/18)

Live Notice Test: Within 3 workdays after receiving Variable Data Test approval, the contractor must submit the 

samples for evaluation to: HHS/CMS; 7500 Security Blvd., SL 12-18; Baltimore, MD 21244-1850; Attn: Mark 

Rydberg.

The contractor will be required to submit 50 copies of each complete notice as required by the Government. Each 

notice must be a completed, ready-to-mail package and include the letter, language pages, and IRS Form 1095-B 

(if applicable), and mailing envelope and must be produced in accordance with the specifications.

The furnished records will simulate the items the contractor may be expected to print and mail. Each notice must 

be constructed as specified and must be of the size, kind, and quality that the contractor will furnish.

Variable Data Test and Live Notice Test: The Variable Data Test and Live Notice Test produced during the 

Postaward Test will be checked for adherence to all specifications. The Government will approve, conditionally 

approve, or disapprove these test proofs and samples within 2 workdays of the receipt thereof.

Approval or conditional approval shall not relieve the contractor from complying with the specifications and all 

other terms and conditions of the contract. A conditional approval shall state any further action required by the 

contractor. A notice of disapproval shall sate the reasons therefore.

If these copies are disapproved by the Government due to printer’s errors, the Government may require the 

contractor to submit additional copies for inspection and testing, in the time and under the terms and conditions 

specified in the notice of disapproval. Such additional copies shall be furnished, and necessary changes made, at 

no additional cost to the Government.

In the event these additional copies are disapproved by the Government due to printer’s errors, the contractor may 

be deemed to have failed to make delivery within the meaning of the default clause in which event this contract 

shall be subject to termination for default.

If the ability to achieve the specified quality is not satisfactorily demonstrated, the contractor may be subject to 

Termination for Default for contractor’s failure to perform. The postaward test will be performed at no cost to the 

Government. All samples must be manufactured at the same facilities and on the same equipment used for 

producing contract production quantities.

ASSIGNMENT OF JACKETS, PURCHASE AND PRINT ORDERS: A GPO jacket number will be 

assigned and a purchase order issued to the contractor to cover work performed. The purchase order will be

supplemented by an individual “Print Order” for each job placed with the contractor. The print order, when 

issued, will indicate the quantity to be produced and any other information pertinent to the particular order.

ORDERING: Items to be furnished under the contract shall be ordered by the issuance of print orders by the 

Government. Production orders may be issued under the contract from December 1, 2017 through 

November 30, 2018 plus for such additional period(s) as the contract is extended. All print orders issued 

hereunder are subject to the terms and conditions of the contract. The contract shall control in the event of 

conflict with any print order. A print order shall be “issued” upon notification by the Government for purposes of 

the contract when it is electronically transmitted or otherwise physically furnished to the contractor in 

conformance with the schedule.

REQUIREMENTS: This is a requirements contract for the items and for the period specified herein. 

Shipment/delivery of items or performance of work shall be made only as authorized by orders issued in 

accordance with the clause entitled “Ordering”. The quantities of items specified herein are estimates only, and 

are not purchased hereby. Except as may be otherwise provided in this contract, if the Government’s 

requirements for the items set forth herein do not result in orders in the amounts or quantities described as

“estimated”, it shall not constitute the basis for an equitable price adjustment under this contract.
Medicare MEC Notices 9 of 48

4571-S (R1) (11/18)

Except as otherwise provided in this contract, the Government shall order from the contractor all the items set 

forth which are required to be purchased by the Government activities identified on page 1.

The Government shall not be required to purchase from the contractor, requirements in excess of the limit on total 

orders under this contract, if any.

Orders issued during the effective period of this contract and not completed within that time shall be completed 

by the contractor within the time specified in the order, and the rights and obligations of the contractor and the 

Government respecting those orders shall be governed by the terms of this contract to the same extent as if 

completed during the effective period of this contract.

If shipment/delivery of any quantity of an item covered by the contract is required by reason of urgency prior to 

the earliest date that shipment/delivery may be specified under this contract, and if the contractor will not accept 

an order providing for the accelerated shipment/delivery, the Government may procure this requirement from 

another source.

The Government may issue orders which provide for shipment/delivery to or performance at multiple 

destinations.

Subject to any limitations elsewhere in this contract, the contractor shall furnish to the Government all items set 

forth herein which are called for by print orders issued in accordance with the “Ordering” clause of this contract.

DELIVERY/SHIPPING STATUS INFORMATION: Contractors are to report information regarding each 

order for compliance reporting purposes and include date of delivery (or shipment if applicable) for proofs and 

delivery schedules in accordance with the contract requirements by contacting Columbus Regional Office via email to trackcolumbus@gpo.gov, or by calling (614) 488-4616, ext. 6, or by faxing to (614) 488-4577. Personnel 

receiving e-mail, phone call, or fax will be unable to respond to questions of a technical nature or transfer any 

inquiries.

PAYMENT: Submitting all invoices for payment via the GPO fax gateway (if no samples are required) utilizing 

the GPO barcode coversheet program application is the most efficient method of invoicing. Instruction for using 

this method can be found at https://winapps.access.gpo.gov/fms/vouchers/barcode/instructions.html.

Invoices may also be mailed to: U.S. Government Publishing Office, Office of Financial Management, Attn: 

Comptroller, Stop: FMCE, Washington, DC 20401.

For more information about the billing process refer to the General Information of the Office of Finance web page 

located at https://www.gpo.gov/finance/index.htm.

At time of invoicing, the contractor shall submit a copy of the print order, contractor’s invoice, and all mailing 

and/or delivery receipts via e-mail to infocolumbus@gpo.gov.

In addition to the payment voucher submitted to GPO for billing, the contractor is required to e-mail to Mark 

Rydberg at mark.rydberg@cms.hhs.gov a copy of the GPO voucher and mailing statements for each print order 

within five workdays after mailing has been completed by the contractor.
Medicare MEC Notices 10 of 48

4571-S (R1) (11/18)

SECTION 2. – SPECIFICATIONS

SCOPE: These specifications cover the production of Medicare MEC Notices, including one or more of the 

following: letter, IRS Form 1095-B, and mailing envelopes which require such operations as programming of 

variable data, printing/imaging in English and Spanish, envelope construction and printing, collating, folding, 

inserting, and mailing.

TITLE: Medicare MEC Notices

ITEMS: Medicare MEC (Minimum Essential Coverage) Notices consist of four notice types.

 Annual Notices: Includes letter, IRS Form 1095-B, and mailing envelope.

 Quarterly Correction Notices: Includes letter, IRS Form 1095-B, and mailing envelope.

 Monthly Replacement Notices: Includes letter, IRS Form 1095-B, and mailing envelope.

 Ad Hoc Notices: Includes letter and mailing envelope. IRS Form 1095-B not included.

FREQUENCY OF ORDERS: Anticipate 13 orders per year. It is anticipated that the Annual Notice and the Ad 

Hoc Notice will be issued on individual print orders. The three Quarterly Correction Notices, when ordered, will 

be placed on the same print order as the Monthly Replacement Notices.

 One Annual Notice ordered in December/January.

 Three Quarterly Correction Notices ordered in April, July, and October.

 Eleven Monthly Replacement Notices ordered February through December.

 One Ad Hoc Notice ordered in April/May.

NOTE: Additional notices may be added throughout the term of the contract as mutually agreed between the 

contractor and the Government.

QUANTITIES: Production quantities (English and Spanish) will be indicated on the individual print orders.

 Annual Notices: Anticipated to be 3.5 million notices per order.

 Quarterly Correction Notices: Anticipated to be 10,000 to 150,000 per order.

 Monthly Replacement Notices: Anticipated to be 100 to 150,000 per order.

 Ad Hoc Notices: Anticipated to be 500,000 to 3 million notices per order.

PAGES: Up to 8 pages (4 leaves) per notice as described below and one mailing envelope:

 Letters: Up to eight pages (four leaves) printed face only or face and back.

o Annual Notices, anticipate 2 pages (1 leaf) printed face and back.

o Quarterly, and Monthly Notices, anticipate 2 pages (1 leaf) printed face only.

o Ad Hoc Notices, anticipate 2 to 8 pages (1 to 4 leaves) printed face only or face and back.

 IRS Form 1095-B: Two pages (one leaf) printed face and back (not included in the Ad Hoc Notices).

 Mailing Envelope: One envelope printed on face and back (on flap) after construction.

NOTE: While the above is anticipated, additional pages may be added to the different letters. The page count 

will not exceed 8 pages unless mutually agreed by contractor and the Government.

TRIM SIZES: Letters and IRS Form 1095-B: 8-1/2 x 11”

Mailing Envelopes (#10 size): 4-1/8 x 9-1/2”

GOVERNMENT TO FURNISH: Files, created on Apple OS or Windows platform, will be furnished via 

electronic file transmission (EFT). Contractor will need Internet Explorer 5.0 or above, or GIS-compatible Secure 

File Transfer Protocol Client (sFTP). If discrepancies are found on the Government-furnished material(s), the 

contractor must contact Mark Rydberg at (410) 786-3038, before starting production.
Medicare MEC Notices 11 of 48

4571-S (R1) (11/18)

Files created on Mac OS or Windows platform. Complete record specifications for each notice in Microsoft 

Word 2010 or Adobe .PDF file. Variable data files furnished in Microsoft Excel 2010, .CSV, or .TXT file. Static 

data files furnished in Microsoft Word 2010 or Adobe .PDF Contractor will be required to support all current and 

future upgrades for software.

FONTS: All printer and screen fonts will be furnished. The contractor is cautioned that furnished fonts are the 

property of the Government and/or its originator. All furnished fonts are to be eliminated from the contractor’s 

archive immediately after completion of the contract.

Special Software Consideration: Office graphics (e.g., files from Presentation, Word Processing, or other nonpublishing applications) are furnished for this procurement. Additional system work may be required to produce 

output as per specifications. If supplied by the Government, a black and white visual will be used as the standard 

for page integrity. Contractor must ensure that the job outputs exactly as the furnished visual.

The contractor will not receive additional compensation, or time for common errors associated with the output of 

Office Graphics files. Common errors include, but are not limited to: 1) Color issues and Shifts (RGB color 

data, no spot colors, loss of Black plate), 2) Page Integrity (text reflow), 3) Missing prepress features (e.g., 

bleeds, trim marks), or 4) Loss of text characters from graphic elements.

Upon completion of the order, the contractor must furnish final production native application files (digital 

deliverables) with the furnished material. The digital deliverables must be an exact representation of the final 

printed product and shall be returned on the same type of storage media as was originally furnished.

Electronic Prepress: Immediately upon receipt and prior to image processing, the contractor shall perform a 

basic check (preflight) of the furnished media and publishing files to assure correct output of the required 

reproduction image. Any errors, media damage, or data corruption that might interfere with proper file image 

processing must be reported to Columbus GPO Contracting Office prior to further performance.

It is recommended that the contractor output files on the same platform; no additional time or compensation will 

be given for errors commonly associated with file output from a different platform.

The contractor shall create or alter any necessary trapping, set proper screen angles and screen frequency, and 

define file output selection for the imaging device being utilized. Furnished files must be imaged as necessary to 

meet the assigned quality level.

Additional Furnished Material: The following additional items that will be furnished to the contractor at the 

time of award or with the first print order and with each copy change.

 A visual of letters, IRS Form 1095-B, and mailing envelope.

 PS Form 3615 (Mailing Permit Application and Customer Profile)

 GPO Form 712 (Certificate of Conformance).

 GPO Form 952 (Desktop Publishing – Disk Information).

 GPO Form 2511 (Print Order).

 GPO Form 905 (R. 3/90) (Delivery/Shipping Status Report).

 “Labeling and Marking Specifications”.

Identification markings such as register marks, ring folios, rubber stamped jacket numbers, commercial 

identification marks of any kind, etc., except GPO imprint, form number, and revision date, carried on copy or 

film, must not appear on finished product.
Medicare MEC Notices 12 of 48

4571-S (R1) (11/18)

CONTRACTOR TO FURNISH: All materials and operations, other than those listed under “Government to 

Furnish”, necessary to produce the products in accordance with these specifications. Contractor is required to 

verify that the CMS furnished files and quantity(s) are in the TIBCO mailbox within two hours of the print order 

and file(s) have been made available for downloading.

REPRODUCIBLES: The contractor must make all reproducibles required. The contractor is responsible for 

determining what type reproducibles will be used but must maintain the quality level specified in the contract. No 

separate charges will be allowed for the various types of reproducibles that may be used.

Further, the contractor is responsible for outputting all images contained on furnished material, regardless of the 

production process, at the highest effective resolution possible. The contractor is responsible for determining the 

appropriate output resolution to achieve optimal results for such design elements as blends, gradients, halftones, 

type and other images. This determination should be made using factors such as stock, 

imaging device (or press) being used, and other factors unique to the contractor’s production environment.

VARIABLE DATA VERIFICATION AND TEXT LAYOUT PROOFS: For every 50,000 notices, contractor 

must submit one English and one Spanish proof of each notice component. Contractor to submit one “Press 

Quality” .PDF “soft” proof (for content only) of each letter, IRS Form 1095-B (if ordered), and mailing envelope.

Proofs to be created using the same Raster Image Processor (RIP) that will be used to produce the final printed 

product. Proofs will be evaluated for text flow and image position for variable and static data. Contractor must 

also submit the corresponding source data files (also known as a “data dump”) in a Microsoft Excel format in the 

same sequence as the submitted letter proofs.

Proofs of complete notice to be e-mailed in encrypted, password protected, PK zipped .PDF files to Mark 

Rydberg at mark.rydberg@cms.hhs.gov. Include Jacket # and Requisition #, Program # and Print Order # with 

title in the subject line of the e-mail. Contractor required to confirm receipt of e-mail via telephone notification at 

(410) 786-3038 within 1 hour of transmission.

The contractor will be responsible for performing all necessary proofreading to ensure that the proofs submitted 

are in conformity with the furnished copy and record specifications. If CMS finds errors during the proofing 

process, the contractor must make all corrections and submit additional proofs along with the corresponding 

source data files. This process will be repeated until the contractor submit samples that CMS considers to be 

error-free.

If any contractor’s errors are serious enough in the opinion of the GPO to require revised proofs, the revised 

proofs are to be provided at no expense to the Government. No extra time can be allowed for this reproofing; 

such operations must be accomplished within the original production schedule allotted in the specifications.

The Government will approve or disapprove the samples within the number of workdays as defined under 

“Schedule”. Notification will be given by e-mail. Approval or disapproval will not relieve the contractor of 

complying with the specifications and all other terms and conditions of the contract. Additional e-mail samples 

may be required if image samples are disapproved.

The contractor must not print/image prior to receipt of an “OK to Print”.

PRESS SHEET/IMAGING INSPECTION: Unless waived by the Government, an on-site press sheet 

inspection for the first order will be conducted. The Government reserves the right to request press sheet 

inspections as the Government deems necessary. If a press sheet inspection is required after the first order, it will 

be indicated on the individual print order. References to press sheet inspections listed herein include the 

equivalent variable imaging inspection requirements.
Medicare MEC Notices 13 of 48

4571-S (R1) (11/18)

Final makeready press sheets may be inspected and approved at the contractor’s plant for the purpose of 

establishing specified standards for the actual press run. Upon approval of the sheets, contractor is charged with 

maintaining those standards throughout the press run (within QATAP tolerances when applicable) and with 

discarding all makeready sheets that preceded approval. When a press sheet inspection is required, it will be 

specified on the individual print order. See GPO Publication 315.3 (Guidelines for Contractors Holding Press 

Sheet Inspections) issued January 2015. NOTE: A press sheet inspection is for the purpose of setting specific 

standards that are to be maintained through the entire run. It does not constitute a prior approval of the entire run.

The notification schedule (below) should be followed for press sheet inspections. The contractor shall make all 

efforts necessary to schedule the imaging and printing inspection on the same, or subsequent, days for all of the 

letters.

Notification: Notify GPO Columbus Regional Office at (614) 488-4616 and Mark Rydberg at (410) 786-3038

with a minimum notice of 2 work days prior to availability of press sheets. This notification must provide the 

starting date and time of the first press form, as well as the tentative schedule for all subsequent press forms 

required for complete production.

On site press inspections must be scheduled Monday to Friday, exclusive of Federal holidays, and scheduled to 

begin between the hours of 7:00 a.m. and 7:00 p.m. local time. It is the contractor’s responsibility to maintain and 

adjust inspection schedules, as required, to ensure all subsequent inspections are performed on following 

workdays. Inspection schedules must allow Government representatives to complete approval of all press forms 

within the day/time requirements. Inspections must not be scheduled on weekends, or to “carry over to the 

following week” without prior approval by the GPO Contracting Officer.

The GPO reserves the right to deny requests for press inspections that conflict with these scheduling 

requirements. Failure to comply with these scheduling requirements may result in additional Government per 

diem, overtime, and/or travel related charges which may be chargeable to the contractor (See GPO Contract 

Terms, Pub. 310.2, (Rev. 6-01), Article 14. Inspection and Tests, (e) (1) & (2)).

STOCK/PAPER: The specifications of all paper furnished must be in accordance with those listed herein or 

listed for the corresponding JCP Code numbers in the “Government Paper Specification Standards No. 12” dated 

March 2011. Color of paper furnished shall be of a uniform shade and a close match by visual inspection of the 

JCP and/or attached color sample(s). The Contracting Officer reserves the right to reject shipments of any order 

printed on paper the color of which, in his opinion, materially differs from that of the color sample(s).

To assure the mailing qualifies for all automation discounts, meets USPS mail quality standards, and to prevent 

delays in processing, the color of the notice paper and ink used to address the mailpiece MUST meet all USPS 

mail acceptance/automation requirements for Reflectance and Print contrast.

Letters and IRS Form 1095-B: Contractor’s option: White Offset Book, basis size 25 x 38”, 50 lbs. per 500 

sheets, equal to JCP Code A60 or White Plain Copier, Xerographic Copier, Laser Printer (Qualified Product), 

basis size 17 x 22”, 20 lbs. per 500 sheets, equal to JCP Code O63 or White Plain Copier, Xerographic (Qualified 

Product), basis size 17 x 22”, 20 lbs. per 500 sheets, equal to JCP Code O65.

Mailing Envelopes: White Writing/Wove Envelopes, basis size 17 x 22”, 20-24 lbs. per 500 sheets, equal to JCP 

Code V20.

PRINTING/IMAGING: Contractor is cautioned not to preprint letters or IRS Form 1095-B because of possible 

content changes. Contractor will be required to print/image variable and static data in black ink. At contractor’s 

option, the product may be produced via conventional offset or digital printing provided that Quality Level 3 

standards are maintained. Final output must be a minimum of 150 line screen and at a minimum resolution of 

1200 x 1200 dpi x 1 bit or 600 x 600 dpi x 4 bit depth technology.
Medicare MEC Notices 14 of 48

4571-S (R1) (11/18)

Letters: Page 1 of all letters will print/image variable data for mailing address (see “Address Formatting 

Requirements” below), salutation (if provided), date (contractor to use date of printing/imaging), and “HICN” 

number. Balance of page 1 and all subsequent pages will print/image static data.

IRS Form 1095-B: Page 1 prints/images extensive variable data and prints with static data. Page 2 prints/images 

static data (form instructions).

Static Data Imaging: At contractor’s option, static data may be imaged digitally or printed using the traditional 

offset method.

Variable Computerized Imaging: Contractor will be required to provide variable imaging of notice in black ink 

in accordance with record specifications provided with the individual print order which identify the field name, 

format, start/end position, and remarks locations. The content for most letters will contain address fields. The 

content for IRS Form 1095-B will contain a significant number of variable data fields, including address fields.

Address Formatting Requirements: The address fields on the notice and IRS Form 1095-B will be four to 

seven lines. Address elements, components, ink characteristics, type placement, format, and fonts, including IMb 

(Intelligent Mail Barcode) and all required postal markings, must be consistent with current U.S. Postal Service 

(USPS) Address Quality Standards, and in accordance with appropriate USPS rules and regulations, including 

USPS Domestic Mail Manual (DMM), in effect at the time of mailing. The type font must be one of the USPS 

accepted and verified MLOCR readable type.

ENVELOPE PRINTING AND CONSTRUCTION: The following specifications will apply to all envelopes 

ordered on this contract. Contractor’s option to preprint envelopes; however, contractor is cautioned that 

reimbursement will only be made for quantities ordered on the individual print order.

Printing Envelopes: Print static data face and back (on flap) after construction in black ink. Face prints return 

address in upper left corner, First-Class Mail postage and fees paid permit imprint in upper right corner and one 

line of type. Outside flap of envelope prints four typelines and one rule in black ink. Overall size of image on 

flap is 1-3/4 x 1” and is to be centered on flap. Follow furnished copy.

Return address placement, format, and fonts must be consistent with current U.S. Postal Service (USPS) Address 

Quality Standards, and in accordance with appropriate USPS rules and regulations including USPS Domestic 

Mail Manual (DMM) in effect at the time of mailing. Position of all elements per furnished copy.

Use standard obliteration feature on interior (after construction) of envelope. The contractor may use jumbled 

character design, or at the contractor’s option, use their own design (no proprietary design or company logos 

permitted). Print in blue or black ink. Contractor must guarantee that the product will ensure complete opacity 

and prevent show through of any material contained therein and cannot bleed onto enclosed material.

Envelope Construction: Envelope to be open side with diagonal or side seams and a fully gummed flap. Face 

of envelope to have an approximately 4-1/4 x 1-3/8” die-cut window approximately positioned 3/4” from left and 

3/4” from bottom to allow imaged address on letter to show through window when it is folded and inserted. 

Contractor to determine exact size and position of window.

Window must be sized to accurately display up to seven lines of address, IMb barcode and applicable USPS 

markings, and meet all applicable USPS machineable mail/addressing standards. Cover window with a clear 

glassine or poly material securely glued on all sides to the interior of the envelope.

MARGINS: No bleeds. Adequate gripper margins follow trim marks on electronic files.
Medicare MEC Notices 15 of 48

4571-S (R1) (11/18)

TRIMMING/FOLDING/ASSEMBLY: Trim 4 sides. Each piece of each notice is to be gathered in sequence

(letter and IRS Form 1095-B (if required)), face up on all pages and fold from 8-1/2 x 11” to 8-1/2 x 7-1/4” and 

then to 8-1/2 x 3-9/16”, with two accordion or wraparound folds, with the mailing address on letter facing out for 

visibility of the address through the window in the envelope.

It is the contractor’s responsibility to assure that only the computer-generated address and IMb and other 

applicable USPS barcodes/markings on the notice will be visible through the window in the envelope and that 

only one complete notice is inserted into each envelope.

MAIL PREPARATION: All envelopes will have a printed CMS Mail Postage and Fees Paid permit. The 

contractor is cautioned to use the permit imprint only for mailing material produced under this contract. Domestic 

mailing addresses only.

Using the CMS address information as provided, the contractor is required to obtain the maximum USPS postage 

discounts possible in accordance with the USPS First Class mail automated mail discount structure in effect at the 

time of mailing. In compliance with USPS Mail Preparation & Sortation Regulations, all mail must be 

appropriately marked and supported with the documentation necessary to ensure USPS acceptance.

Mailing Envelopes must be prepared and sealed in a manner that will ensure acceptance, security, and safe

delivery by the U.S. Postal Service. Gather each piece and insert into mailing envelope, and seal.

The contractor must provide all mailing materials, as well as all labeling and marking, as necessary to fulfill 

mailing and distribution requirements. Noncompliance with the packing and labeling instructions will be cause 

for the Government to take corrective action in accordance with GPO Contract Terms Pub. 310.2.

Contractor must be able to read/print/image up to seven lines of address information and ensure all addresses can 

display the address format acceptable for USPS automation processing through the window.

Addresses for this mailing come from a Government maintained file. For this mailing, CMS will provide 

certificates indicating that within 95 days the addresses have been matched against both the USPS required 

Coding Accuracy Support System (CASS) and National Change of Address (NCOA) software. In the event the 

CASS and NCOA certification has expired, the contractor may be required to provide the certification prior to 

mailing.

All addresses must be verified as mailable pieces before printing/imaging is started. All unmailable addresses and 

the count of these addresses must be reported back to GPO and CMS before printing/imaging is started.

Contractor sponsored address data enhancements to secure postal discount MUST NOT negatively affect

deliverability and/or omit/change any required address field as provided by CMS address files. It is the

contractor’s responsibility to keep up to date on all USPS requirements.

All copies mailed must conform to the appropriate regulations in the U.S. Postal Service manuals for domestic 

presorted First-Class mail as applicable, and must be prepared for the most cost effective mailing rate/class 

obtainable presorting for maximum postal automation discounts, including full-service IMb. The placement and 

application of the IMb barcodes must not compromise any applicable USPS addressing/imprinting requirements.

In addition, USPS has instituted a verification procedure called a “tap” test used to screen all mailings with 

barcode inserts for proper barcode spacing within the envelope window. USPS will randomly select samples 

from a mailing and tap the pieces on their left, right, and bottom edges to test whether the barcode maintains a 

minimum spacing of 1/8 inch between the barcode and the left and right edges of the window, at least 1/25 inch 

between the barcode and the bottom edge of the mail piece. Mailpieces are not to be tapped upside down (i.e. on 

their top edge).
Medicare MEC Notices 16 of 48

4571-S (R1) (11/18)

Intelligent Mail Barcode (IMb): The successful bidder must understand and be able to implement all mail 

preparation requirements enacted by the Postal Service related to using Intelligent Mail. The requirements 

include, but are not limited to preparing Intelligent Mail barcodes meeting USPS quality acceptance standards.

Experience with assigning unique numbers for each mail piece, preparing electronic manifests, making electronic 

appointments, producing revised tray/pallet label formats and other similarly detailed IMb requirements as 

mandated by the Postal Service is essential.

The IMb must appear in the address block of the letter and show through the window area of the mailing 

envelope. Printing or imaging of the IMb on the envelope is NOT permissible.

Contractor may be responsible for any postage fees related to undeliverable letters caused by print quality control 

issues.

Any address/mail management related questions/issues should be directed to Tina Dickens, at (410) 786-3895, or 

e-mail tina.dickens@cms.hhs.gov or Cynthia Williams, at (410) 786-6071, or e-mail 

cynthia.williams@cms.hhs.gov at CMS respectively.

VERIFICATION OF PRODUCTION AND MAILING: Contractor will be responsible for validating the 

integrity of every notice produced in all phases of printing, inserting and mailing and to ensuring all notices 

received from CMS were correctly entered into the United States postal system. Contractor must furnish a stateby-state count of all letters mailed, identifying state and numbers of copies mailed to that state. Include 

information with copies to Mark Rydberg, mark.rydberg@cms.hhs.gov.

DISTRIBUTION: Mail f.o.b. contractor’s city using contractor printed “First Class Postage and Fees Paid 

Permit” imprint to Domestic addresses. The contractor will be required to provide mailing under the provided 

CMS “G-28” permit imprint via pre-sorted “First Class Mail, U.S. Postage & Fees Paid”.

The contractor is cautioned that “Postage and Fees Paid” indicia may be used only for the purpose of mailing 

material produced under the contract. All copies mailed must conform to the appropriate regulations in the U.S. 

Postal Service manuals for “Domestic Mail” as applicable.

Certificate of Conformance and USPS Forms: When using Permit Imprint Mail the contractor must complete 

GPO Form 712 Certificate of Conformance (Rev. 1-85) and the appropriate mailing statement or statements 

required by USPS for full-service IMb. GPO Form 712 is available at www.gpo.gov.

MAILING STATEMENTS: Contractor must complete and supply all copies of all USPS forms (including 

appropriate USPS Form 3602) and GPO 712’s to GPO and CMS within 1 workday of USPS certification.

Copies, with Program and Print Order Number and “Mailing Statements” in subject line, to be e-mailed to Teri 

Shoffstall, tshoffstall@gpo.gov; Linda Price, lprice@gpo.gov; GPO, infocolumbus@gpo.gov; Mark Rydberg, 

mark.rydberg@cms.hhs.gov; Tina Dickens, tina.dickens@cms.hhs.gov; and Cynthia Williams, 

cynthia.williams@cms.hss.gov.

Contractor’s option to mail statements, mail to: US GPO, Columbus RO, 1335 Dublin Road, Suite 112-B, 

Columbus, OH 43215 and to: HHS/CMS, ATTN: Mark Rydberg, SL 12-18, 7500 Security Blvd., Baltimore, 

MD 21244-1850. Copies must be submitted with contractor’s invoice to GPO for payment.

Prior to or in conjunction with presenting the mailing for acceptance, a MERLIN (Mail Evaluation Readability 

Lookup Instrument) mail diagnostics analysis may be completed by the Postal Service. If MERLIN is performed, 

within 24 hours of acceptance, a copy of the “MERLIN” Summary Verification Reports listing the results must be 

emailed to Tina Dickens at tina.dickens@cms.hhs.gov.
Medicare MEC Notices 17 of 48

4571-S (R1) (11/18)

SCHEDULE: Adherence to this schedule must be maintained. Contractor must not start production of any job 

prior to receipt of the individual print order (GPO Form 2511) and furnished material. No definite schedule can 

be predetermined. The schedule begins when GPO Form 2511 (Print Order) and furnished files have been 

successfully downloaded from the TIBCO site and confirmation is provided to CMS.

During the course of this contract print orders will be issued prior to the placement of files in the TIBCO mail 

box. Contractor will be notified via e-mail when electronic files are available in TIBCO mailbox. E-mail 

notification will include the number of copies and pages printed/imaged in English and in Spanish that are to be 

generated for each notice letter on each print order. In the event that multiple print orders are placed, CMS 

reserves the right to indicate which print order will be mailed first.

Contractor will have 60 minutes to download and confirm receipt of files and verify the quantity to be produced. 

Confirmation to be sent to mark.rydberg@cms.hhs.gov and infocolumbus@gpo.gov.

Annual Notice: It is anticipated that GPO Form 2511, Print Order, and furnished files will be placed in the 

TIBCO starting the last week of December. Files will be submitted in batches. Batch size to be discussed at the 

post-award conference.

Contractor will have two workdays to submit proofs of each batch to CMS. Proofs will be held for up to three

workdays. Complete production and mailing of all Annual Notices shall be completed by January 31st of stated 

year to comply with IRS tax regulations.

NOTE: Failure to mail by January 31st of stated year may result in penalties to CMS and subject to actual 

damages of contractor (see GPO Pub 310.2 Contract Clause 21, “Actual Damages”).

Quarterly Correction Notices and Monthly Replacement Notices: It is anticipated that GPO Form 2511, Print 

Order, and files will be placed in the TIBCO during the months described under “Frequency of Orders”.

Contractor will have one workday to submit proofs to CMS. Proofs will be held for up to three workdays. 

Complete production and mailing of all Quarterly Correction and Monthly Replacement Notices must be 

completed 5 workdays after proof approval.

Ad Hoc Notices: It is anticipated that GPO Form 2511, Print Order, and files will be placed in the TIBCO during 

the months described under “Frequency of Orders”.

Contractor will have two workdays to submit proofs to CMS. Proofs will be held for up to three workdays. 

Complete production and mailing of all Ad Hoc Notices must be completed ten workdays after proof approval.

Revised Proofs: When revised proofs are required by the Government due to Government errors or printer’s 

errors, the revised proofs must be submitted to the government in a timely manner as to not jeopardize the original 

mailing schedule.

Mailing and Reporting: The contractor must mail completed pieces on a flow basis as production runs are 

completed in accordance with permit requirement for mailing.

The contactor shall e-mail a production report for each notice on a daily basis. The production report is to be 

created in Excel 2010 or higher. The production report shall include the total quantity printed on the day of the 

report, the total quantity inserted on the day of the report, and the total quantity mailed on the day of the report.

The production report is a deliverable and is to be e-mailed on a daily basis to mark.rydberg@cms.hhs.gov and to 

infocolumbus@gpo.gov. If reports are not received on a daily basis, the contractor may be subject to adverse 

action on the contract.
Medicare MEC Notices 18 of 48

4571-S (R1) (11/18)

The ship/deliver date indicated on the print order is the date that all notices must be mailed.

RECEIPT FOR DELIVERY: Contractor must furnish their own receipts for delivery. These receipts must 

include the GPO jacket, program, and print order numbers, total quantity delivered, number of cartons, and 

quantity per carton, date delivery made, and signature of the Government agent accepting delivery.

Unscheduled material such as shipping documents, receipts or instructions, delivery lists, labels, etc., will be 

furnished with the order or shortly thereafter. In the event such information is not received in due time, the 

contractor will not be relieved of any responsibility in meeting the shipping schedule because of failure to request 

such information.
Medicare MEC Notices 19 of 48

4571-S (R1) (11/18)

SECTION 3. – DETERMINATION OF AWARD

The Government will determine the lowest bid by applying the prices offered in the “Schedule of Prices” to the 

following units of production which are the estimated requirements to produce 1 year’s orders under this contract. 

These units do not constitute, nor are they to be construed as, a guarantee of the volume of work which may be 

ordered for a like period of time.

The following item designations correspond to those listed in the “Schedule of Prices”.

I. (a) 7,868

(b) 7,684

(c) 4,184

(d) 7,868

II. (a) 7,868

(b) 4,184
Medicare MEC Notices 20 of 48

4571-S (R1) (11/18)

PAGE 20 IS BLANK.
Medicare MEC Notices 21 of 48

4571-S (R1) (11/18)

SECTION 4. – SCHEDULE OF PRICES

Bids offered are f.o.b. contractor’s city by permit imprint.

Prices must be submitted for the entire term of the contract and bids qualified for a lesser period will not be 

considered.

Prices must include the cost of all required materials and operations for each item listed in accordance with these 

specifications.

Bidder must make an entry in each of the spaces provided. Bids submitted with any obliteration, revision, or 

alteration of the order and manner of submitting bids, may be declared nonresponsive.

An entry of NC (No Charge) shall be entered if bidder intends to furnish individual items at no charge to the 

Government.

Bids submitted with NB (No Bid), NA (Not Applicable), or blank spaces for an item may be declared 

nonresponsive.

The Contracting Officer reserves the right to reject any offer that contains prices for individual items of 

production (whether or not such items are included in the Determination of Award) that are inconsistent or 

unrealistic in regard to other prices in the same offer or to GPO prices for the same operation if such action would 

be in the best interest of the Government.

All vouchers submitted to the GPO shall be based on the most economical method of production.

Fractional parts of 1,000 will be prorated at the 1,000 rate.

I. PRINTING/IMAGING, TRIMMING TO SIZE, ASSEMBLY, FOLDING, AND INSERTING: The 

prices offered must be all-inclusive in accordance with these specifications and shall include the cost of all 

required materials and operations for complete production except for Items II. Stock/Paper

(a) Printing/Imaging variable data pages........................................per 1,000 images......... $__________

(b) Printing/Imaging static data pages.............................................per 1,000 images......... $__________

(c) Printing/Imaging mailing envelopes..........................................per 1,000 envelopes .... $__________

(d) Collate leaves, fold as required, and insert into envelope .........per 1,000 leaves .......... $__________

II. STOCK/PAPER: Payment for all stock/paper supplied by the contractor under the terms of these 

specifications, as ordered on the individual print orders, will be based on the net number of leaves furnished for 

the product(s). The cost of any paper required for make-ready or running spoilage must be included in the prices 

offered.

(a) White Offset Book (50 lbs.) or White Plain Copier,

Xerographic Copier, Laser Printer (Qualified Product)

(20 lbs.) or White Plain Copier, Xerographic (Qualified

Product) (20 lbs.).......................................................................per 1,000 leaves .......... $__________

(b) White Writing/Wove Mailing Envelope (20 or 24 lbs.)............per 1,000 envelopes .... $__________

____________

(Initials)

RETURN THIS PAGE TO US GPO RO, COLUMBUS, OH
Medicare MEC Notices 22 of 48

4571-S (R1) (11/18)

SCHEDULE OF PRICES

BID SUBMISSION AND BIDDER’S NAME AND SIGNATURE: Fill out and return all pages in “Section 4. 

– Schedule of Prices”, initial or sign each in the space provided. See page 1 for instructions on how and where to 

submit bid.

Fill out and return GPO Form 910. The schedule of prices will prevail in instances where prices are inadvertently 

entered on GPO Form 910.

GPO Form 910 is available on GPO web site at http://www.gpo.gov/pdfs/vendors/sfas/bids910.pdf

Bidder

(Company Name)

(Address, City, and State)

By

(Signature and title of person authorized to sign this bid)

________________________________________ ____________________ ____________________

(Person to be contacted) (Telephone Number) (Fax Number)

E-Mail Address(s)

______________________________

(Contractor Code Number, if known)

LOCATION OF POST OFFICE: All mailing will be made from the Post Office located at:

Street Address

City , State , Zip Code

RETURN THIS PAGE TO US GPO RO, COLUMBUS, OH
Medicare MEC Notices 23 of 48

4571-S (R1) (11/18)

SECTION 5. – CMS SECURITY SPECIFICATIONS

THE REQUIREMENTS UNDER THIS SECTION WILL BE ADMINISTERED BY A CMS SECURITY 

REPRESENTATIVE (NAME AND CONTACT INFORMATION WILL BE PROVIDED AT TIME OF 

AWARD).

CMS INFORMATION SECURITY (APR 2013)

FAR 52.227-14 Rights in Data – General (May 2014).

As prescribed in 27.409(b)(1), insert the following clause with any appropriate alternates:

(a) Definitions. As used in this clause--

“Computer database” or “database” means a collection of recorded information in a form capable of, and for the 

purpose of, being stored in, processed, and operated on by a computer. The term does not include computer 

software.

“Computer software”—

(1) Means

(i) Computer programs that comprise a series of instructions, rules, routines, or 

statements, regardless of the media in which recorded, that allow or cause a computer 

to perform a specific operation or series of operations; and

(ii) Recorded information comprising source code listings, design details, algorithms, 

processes, flow charts, formulas, and related material that would enable the computer 

program to be produced, created, or compiled.

(2) Does not include computer databases or computer software documentation.

“Computer software documentation” means owner’s manuals, user’s manuals, installation 

instructions, operating instructions, and other similar items, regardless of storage medium, that

explain the capabilities of the computer software or provide instructions for using the software.

“Data” means recorded information, regardless of form or the media on which it may be recorded. 

The term includes technical data and computer software. The term does not include information 

incidental to contract administration, such as financial, administrative, cost or pricing, or management 

information.

“Form, fit, and function data” means data relating to items, components, or processes that are 

sufficient to enable physical and functional interchangeability, and data identifying source, size, 

configuration, mating, and attachment characteristics, functional characteristics, and performance 

requirements. For computer software it means data identifying source, functional characteristics, and 

performance requirements but specifically excludes the source code, algorithms, processes, formulas, 

and flow charts of the software.

“Limited rights” means the rights of the Government in limited rights data as set forth in the Limited 

Rights Notice of subparagraph (g)(2) if included in this clause.
Medicare MEC Notices 24 of 48

4571-S (R1) (11/18)

“Limited rights data” means data, other than computer software, that embody trade secrets or are 

commercial or financial and confidential or privileged, to the extent that such data pertain to items, 

components, or processes developed at private expense, including minor modifications.

“Restricted computer software” means computer software developed at private expense and that is a 

trade secret; is commercial or financial and is confidential or privileged; or is copyrighted computer 

software, including minor modifications of the computer software.

“Restricted rights,” as used in this clause, means the rights of the Government in restricted computer 

software, as set forth in a Restricted Rights Notice of paragraph (g) if included in this clause, or as 

otherwise may be provided in a collateral agreement incorporated in and made part of this contract, 

including minor modifications of such computer software.

“Technical data” means recorded information (regardless of the form or method of the recording) of a 

scientific or technical nature (including computer databases and computer software documentation). 

This term does not include computer software or financial, administrative, cost or pricing, or 

management data or other information incidental to contract administration. The term includes 

recorded information of a scientific or technical nature that is included in computer databases (See 41 

U.S.C. 116).

“Unlimited rights” means the right of the Government to use, disclose, reproduce, prepare derivative 

works, distribute copies to the public, and perform publicly and display publicly, in any manner and 

for any purpose, and to have or permit others to do so.

(b) Allocation of rights.

(1) Except as provided in paragraph (c) of this clause, the Government shall have unlimited rights in—

(i) Data first produced in the performance of this contract;

(ii) Form, fit, and function data delivered under this contract;

(iii) Data delivered under this contract (except for restricted computer software) that constitute 

manuals or instructional and training material for installation, operation, or routine 

maintenance and repair of items, components, or processes delivered or furnished for use 

under this contract; and

(iv) All other data delivered under this contract unless provided otherwise for limited rights data 

or restricted computer software in accordance with paragraph (g) of this clause.

(2) The Contractor shall have the right to—

(i) Assert copyright in data first produced in the performance of this contract to the extent 

provided in paragraph (c)(1) of this clause;

(ii) Use, release to others, reproduce, distribute, or publish any data first produced or specifically 

used by the Contractor in the performance of this contract, unless provided otherwise in 

paragraph (d) of this clause;
Medicare MEC Notices 25 of 48

4571-S (R1) (11/18)

(iii) Substantiate use of, add or correct limited rights, restricted rights, or copyright notices and to 

take other appropriate action, in accordance with paragraphs (e) and (f) of this clause; and

(iv) Protect from unauthorized disclosure and use those data that are limited rights data or 

restricted computer software to the extent provided in paragraph (g) of this clause.

(c) Copyright—

(1) Data first produced in the performance of this contract.

(i) Unless provided otherwise in paragraph (d) of this clause, the Contractor may establish, 

without prior approval of the Contracting Officer, claim to copyright in scientific and 

technical articles based on or containing data first produced in the performance of this 

contract and published in academic, technical or professional journals, symposia 

proceedings or similar works. The prior, express written permission of the Contracting 

Officer is required to assert copyright in all other data first produced in the performance of 

this contract.

(ii) When authorized to assert copyright to the data, the Contractor shall affix the applicable 

copyright notices of 17 U.S.C. 401 or 402, and acknowledgment of Government sponsorship 

(including contract number).

(iii) For data other than computer software, the Contractor grants to the Government, and others 

acting on its behalf, a paid-up, nonexclusive, irrevocable worldwide license in such 

copyrighted data to reproduce, prepare derivative works, distribute copies to the public, and 

perform publicly and display publicly, by or on behalf of the Government. For computer 

software, the Contractor grants to the Government and others acting on its behalf, a paid-up 

nonexclusive, irrevocable worldwide license in such copyrighted computer software to 

reproduce, prepare derivative works, and perform publicly and display publicly (but not to 

distribute copies to the public) by or on behalf of the Government.

(2) Data not first produced in the performance of this contract. The Contractor shall not, without prior 

written permission of the Contracting Officer, incorporate in data delivered under this contract any 

data not first produced in the performance of this contract unless the Contractor—

(i) Identifies the data; and

(ii) Grants to the Government, or acquires on its behalf, a license of the same scope as set forth in 

subparagraph (c)(1) of this clause or; if such data are restricted computer software, the 

Government shall acquire a copyright license as set forth in subparagraph (g)(4) of this 

clause (if included in this contract) or as otherwise provided in a collateral agreement 

incorporated in or made part of this contract.

(3) Removal of copyright notices. The Government will not remove any authorized copyright notices 

placed on data pursuant to this paragraph (c), and will include such notices on all reproductions of the 

data.
Medicare MEC Notices 26 of 48

4571-S (R1) (11/18)

(d) Release, publication and use of data. The Contractor shall have the right to use, release to others, reproduce, 

distribute, or publish any data first produced or specifically used by the Contractor in the performance of this 

contract, except—

(1) As prohibited by Federal law or regulation (e.g., export control or national security laws or 

regulations);

(2) As expressly set forth in this contract; or

(3) If the Contractor receives or is given access to data necessary for the performance of this contract 

which contain restrictive markings, the Contractor shall treat the data in accordance with such 

markings unless otherwise specifically authorized otherwise in writing by the Contracting Officer.

(e) Unauthorized marking of data.

(1) Notwithstanding any other provisions of this contract concerning inspection or acceptance, if any data 

delivered under this contract are marked with the notices specified in paragraph (g)(3) or (g)(4) of this 

clause and use of the notices is not authorized by this clause, or if such data bears any other restrictive 

or limiting markings not authorized by this contract, the Contracting Officer may at any time either 

return the data to the Contractor, or cancel or ignore the markings. However, pursuant to 41 U.S.C. 

4703, the following procedures shall apply prior to canceling or ignoring the markings.

(i) The Contracting Officer will make written inquiry to the Contractor affording the Contractor 

60 days from receipt of the inquiry to provide written justification to substantiate the 

propriety of the markings;

(ii) If the Contractor fails to respond or fails to provide written justification to substantiate the 

propriety of the markings within the 60-day period (or a longer time approved in writing by 

the Contracting Officer for good cause shown), the Government shall have the right to 

cancel or ignore the markings at any time after said period and the data will no longer be 

made subject to any disclosure prohibitions.

(iii) If the Contractor provides written justification to substantiate the propriety of the markings 

within the period set in subdivision (e)(1)(i) of this clause, the Contracting Officer will 

consider such written justification and determine whether or not the markings are to be 

canceled or ignored. If the Contracting Officer determines that the markings are authorized, 

the Contractor will be so notified in writing. If the Contracting Officer determines, with 

concurrence of the head of the contracting activity, that the markings are not authorized, the 

Contracting Officer will furnish the Contractor a written determination, which determination 

shall become the final agency decision regarding the appropriateness of the markings unless 

the Contractor files suit in a court of competent jurisdiction within 90 days of receipt of the 

Contracting Officer’s decision. The Government shall continue to abide by the markings 

under this paragraph (e)(1)(iii) until final resolution of the matter either by the Contracting 

Officer’s determination becoming final (in which instance the Government will thereafter 

have the right to cancel or ignore the markings at any time and the data will no longer be 

made subject to any disclosure prohibitions), or by final disposition of the matter by court 

decision if suit is filed.
Medicare MEC Notices 27 of 48

4571-S (R1) (11/18)

(2) The time limits in the procedures set forth in subparagraph (e)(1) of this clause may be modified in 

accordance with agency regulations implementing the Freedom of Information Act (5 U.S.C. 552) if 

necessary to respond to a request thereunder.

(3) Except to the extent the Government’s action occurs as the result of final disposition of the matter by a 

court of competent jurisdiction, the Contractor is not precluded by paragraph (e) of this clause from 

brining a claim, in accordance with the Disputes clause of this contract, that may arise as a result of the 

Government removing or ignoring authorized markings on data delivered under this contract.

(f) Omitted or incorrect markings.

(1) Data delivered to the Government without any restrictive markings shall be deemed to have been 

furnished with unlimited rights. The Government is not liable for the disclosure, use, or reproduction of 

such data.

(2) If the unmarked data has not been disclosed without restriction outside the Government, the 

Contractor may request, within 6 months (or a longer time approved by the Contracting Officer in writing 

for good cause shown) after delivery of such data, permission to have authorized notices placed on 

qualifying data at the Contractor’s expense, and the Contracting Officer may agree to do so if the 

Contractor—

(i) Identifies the data to which the omitted notice is to be applied;

(ii) Demonstrates that the omission of the notice was inadvertent;

(iii) Establishes that the use of the proposed notice is authorized; and

(iv) Acknowledges that the Government has no liability for the disclosure, use, or reproduction of 

any data made prior to the addition of the notice or resulting from the omission of the notice.

(3) If data has been marked with an incorrect notice, the Contracting Officer may—

(i) Permit correction of the notice at the Contractor’s expense if the Contractor identifies the data 

and demonstrates that the correct notice is authorized, or

(ii) Correct any incorrect notices.

(g) Protection of limited rights data and restricted computer software.

(1) The Contractor may withhold from delivery qualifying limited rights data or restricted computer 

software that are not data identified in paragraphs (b)(1)(i), (ii), and (iii) of this clause. As a condition to 

this withholding, the Contractor shall—

(i) Identify the data being withheld; and

(ii) Furnish form, fit, and function data instead.
Medicare MEC Notices 28 of 48

4571-S (R1) (11/18)

(2) Limited rights data that are formatted as a computer database for delivery to the Government shall be 

treated as limited rights data and not restricted computer software.

(3) [Reserved]

(h) Subcontracting. The Contractor shall obtain from its subcontractors all data and rights therein necessary to 

fulfill the Contractor’s obligations to the Government under this contract. If a subcontractor refuses to accept 

terms affording the Government such rights, the Contractor shall promptly notify the Contracting Officer of the 

refusal and shall not proceed with the subcontract award without authorization in writing from the Contracting 

Officer.

(i) Relationship to patents or other rights. Nothing contained in this clause shall imply a license to the 

Government under any patent or be construed as affecting the scope of any license or other right otherwise 

granted to the Government.

(end of clause)

All CMS information shall be protected from unauthorized access, use, disclosure, duplication, modification, 

diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, 

integrity, and availability of such information. Therefore, if this contract requires the contractor to provide 

services (both commercial and non-commercial) for Federal Information/Data, to include any of the following 

requirements:

 Process any Information/Data; or

 Store any Information/Data (includes “Cloud” computing services); or

 Facilitate the transport of Information/Data; or

 Host/maintain Information/Data (including software and/or infrastructure developer/maintainers); or

 Have access to, or use of, Personally Identifiable Information (PII), including instances of remote access 

to, or physical removal of, such information beyond agency premises or control,

The contractor shall become and remain compliant with the requirements set forth at the CMS Information 

Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-ClauseProvision.html. The requirements cover all CMS contracts and associated deliverables, which are required on a 

“per contractor” basis.

The contractor shall ensure that the following Federal information security standards are met for all of its CMS 

contracts:

 Federal Information Security Management Act (FISMA) – FISMA information can be found at 

http://csrc.nist.gov/groups/SMA/fisma/index.html. FISMA requires each Federal agency to develop, 

document, and implement an agency-wide program to provide information security for the 

information and information systems that support the operations and assets of the agency, including 

those provided or managed by another agency, contractor, or other source; and,
Medicare MEC Notices 29 of 48

4571-S (R1) (11/18)

 Federal Risk and Authorization Management Program (FedRAMP) – FedRAMP information 

can be found at http://www.gsa.gov/portal/category/102371. The FedRAMP is a government-wide 

program that provides a standardized approach to security assessment, authorization, and continuous 

monitoring for cloud products and services.

The Contractor shall include in all awarded subcontracts the FISMA/FedRAMP compliance requirements set 

forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-andSystems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-InformationSecurity-Contract-Clause-Provision.html.
Medicare MEC Notices 30 of 48

4571-S (R1) (11/18)

HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, shall 

be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA,”

42 U.S.C. § 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business 

Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and 

the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor’s 

duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are 

generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

“Business Associate” shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it 

uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS’ HIPAAcovered functions.

“Covered Entity” shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

“Secretary” shall mean the Secretary of the Department of Health & Human Services or the Secretary’s 

designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or 

disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the 

HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA 

requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate 

from, or on behalf of, Covered Entity other than as permitted or required by this Contract or as 

required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action 

against any individual for:

A. Filing a complaint under 45 CFR § 160.306;
Medicare MEC Notices 31 of 48

4571-S (R1) (11/18)

B. Testifying, assisting or participating in an investigation, compliance review, proceeding 

or hearing under 45 CFR Part 160; or

C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good 

faith belief that the practice is unlawful, the manner of opposition is reasonable, and the 

opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its 

security policies and procedures, including workforce security measures, to ensure proper 

security awareness and training (including security incident response and reporting), and 

security incident procedures, in accordance with this Contract, including this HIPAA Business 

Associate Clause and the Contract’s clause entitled “CMS Information Security.”

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI 

created, received, maintained or transmitted by Business Associate from, or on behalf of 

Covered Entity only as provided for by this Contract. In doing so, it shall implement policies 

and procedures to address the following and, where applicable, ensure that such policies and 

procedures are also in conformance with this Contract’s clause entitled “CMS Information 

Security:”

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual’s access rights to PHI 

(including the implementation of workforce security measures to ensure 

continued appropriate role-based access to PHI), and technical policies and 

procedures to ensure compliance with grants of access (including unique user 

identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities in 

which they are housed.

C. Implement policies, procedures and physical security measures that will limit access to 

PHI through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or 

outside of the Business Associate’s facility as well as the disposal and reuse of media 

containing PHI.
Medicare MEC Notices 32 of 48

4571-S (R1) (11/18)

E. Implement appropriate administrative, physical and technical safeguards that reasonably 

and appropriately protect the confidentiality, integrity and availability (including the use of 

contingency plans) of any electronic protected health information (“EPHI”) it creates, 

receives, maintains or transmits from, or on behalf of the Covered Entity to prevent 

impermissible use, disclosure, maintenance or transmission of such EPHI. In the 

establishment of such safeguards, Business Associate shall consider its size, complexity and 

capabilities, as well as its technical infrastructure, and its hardware and software security 

capabilities.

iii. Assess, and implement, where appropriate, any addressable implementation specifications 

associated with applicable PHI security standards.

iv. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use 

or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

v. Comply with the following Incident Reporting:

A. Report to Covered Entity any security incident/breach involving unsecured PHI, of which it 

becomes aware, including those of its agents and subcontractors. The Business Associate 

shall report any violation of the terms of this contract involving PHI and any security 

incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in 

accordance with the CMS Risk Management Handbook (RMH), specifically “RMH Vol II 

Procedure 7-2 Incident Handling Procedure” and “RMH Vol III Standard 7-1 Incident 

Handling.” These procedures can be found at http://www.cms.gov/Research-Statistics-Dataand-Systems/CMS-Information-Technology/InformationSecurity/Information-SecurityLibrary.html In addition, the Business Associate will also notify the CMS Contracting 

Officer and the Contracting Officer’s Representative (COR) by email within one (1) hour of 

identifying such violation or incident.

B. Upon Covered Entity's knowledge of any material security incident/breach by Business 

Associate, Covered Entity will provide an opportunity for Business Associate to cure the 

breach or end the violation consistent with the termination clause of this Contract. See also 

paragraph D. Term of Clause below.

vi. Ensure that any agent or subcontractor agrees through a written contract, or other legally 

enforceable arrangement, to the same restrictions and conditions that apply through this HIPAA 

Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or on behalf 

of, Covered Entity.

vii. Upon Covered Entity’s request:
Medicare MEC Notices 33 of 48

4571-S (R1) (11/18)

A. Provide the Covered Entity or its designee with access to the PHI created, received, 

maintained or transmitted by Business Associate from or on behalf of the Covered 

Entity in the course of contract performance in order to ensure Covered Entity’s ability 

to meet the requirements under 45 CFR § 164.524.

B. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR §

164.526.

viii. Make its facilities and any books, records, accounts, and any sources of PHI, including any 

policies and procedures, that are pertinent to ascertaining its own compliance with this contract 

or the Covered Entity’s compliance with the applicable HIPAA requirements, available to 

Covered Entity, or, in the context of an investigation or compliance review, to the Secretary 

for purposes of the Secretary determining Covered Entity's compliance with the various rules 

implementing the HIPAA.

ix. Document disclosures of PHI and information related to such disclosures as would be required 

for Covered Entity to respond to a request by an Individual for an accounting of disclosures of 

PHI in accordance with 45 CFR § 164.528.

x. Provide to Covered Entity, or an individual identified by the Covered Entity, information 

collected under this Contract, to permit Covered Entity to respond to a request by an Individual 

for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

xi. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary 

to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent 

that such limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent 

that such changes may affect Business Associate’s use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 

CFR § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure 

of PHI.

d. Term of Clause
Medicare MEC Notices 34 of 48

4571-S (R1) (11/18)

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of 

the PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered 

Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or 

returned to Covered Entity in accordance with “CMS Information Security” procedures. Business 

Associate shall not retain any PHI.

2. Security Incident/Breach:

Upon Covered Entity’s knowledge of a material breach by Business Associate, Covered Entity shall 

take action consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts – Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of Contracts, if the 

Business Associate does not cure the security incident/breach within the time specified by 

Covered Entity and/or cure is not possible; or,

B. If neither termination nor cure is feasible, Covered Entity shall report the violation to the 

Secretary.

ii. Other Agreements –Covered Entity shall either:

A. Provide an opportunity for Business Associate to cure the breach or end the violation 

consistent with the termination terms of this Contract. Covered Entity may terminate this 

Contract for default if the Business Associate does not cure the breach or end the violation 

within the time specified by Covered Entity; or,

B. Consistent with the terms of this Contract, terminate this Contract for default if Business 

Associate has breached a material term of this Contract and cure is not possible; or,

C. If neither termination nor cure is feasible, Covered Entity shall report the violation to the 

Secretary.

3. Returning or Destroying PHI:

Business Associate, as defined above, which includes subcontractors or agents of the Contractor, 

shall:

i.Upon expiration or termination of this Contract, for any reason, return or destroy all PHI received 

from Covered Entity or another Business Associate of the Covered Entity, as well as any PHI 

created, received, maintained or transmitted from or on behalf of Covered Entity, or another 

Business Associate of the Covered Entity, in accordance with this contract, including the “CMS

Information Security” clause.
Medicare MEC Notices 35 of 48

4571-S (R1) (11/18)

ii. In the event that Business Associate determines that returning or destroying the PHI is infeasible, 

provide to Covered Entity notification of the conditions that make return or destruction infeasible. 

Upon such notice that return or destruction of PHI is infeasible, Business Associate shall extend 

the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to 

those purposes that make the return or destruction infeasible, for so long as Business Associate 

maintains such PHI.

e. Miscellaneous

1. A reference in this Contract to a section in the Rules issued under HIPAA means the section as in 

effect or as amended.

2. The respective rights and obligations of Business Associate under paragraph D.3.b of the section 

entitled “Term of Clause” shall survive the termination of this Contract.

Any ambiguity in this Contract clause shall be resolved to permit Covered Entity to comply with the 

Rules implemented under HIPAA.
Medicare MEC Notices 36 of 48

4571-S (R1) (11/18)

CMS SPECIFIC PROVISIONS FOR HIGH VISIBILITY/HIGH PUBLIC INTEREST CONTRACTS 

(OCT 2013)

OPEN GOVERNMENT PROACTIVE PREDISCLOSURE NOTIFICATION (OCT 2013)

In order to reduce the administrative burden of responding to Freedom of Information Act (FOIA) requests for 

high visibility/high public interest contracts throughout contract administration, the Contractor shall submit its 

review of the awarded contract (and contract modifications, if requested) for FOIA disclosure exemptions within 

thirty (30) calendar days of contract award. The review will substantiate “...Trade secrets and commercial or 

financial information obtained from a person and privileged or confidential...” information, in accordance with 5 

U.S.C. §552 FOIA, Exemption (b)(4), which could reasonably be expected to cause substantial competitive 

harm.

Submissions: The Contractor shall submit one (1) Compact Disc (CD) or Digital Video Disc (DVD) with all 5 

U.S.C. §552 FOIA, Exemption (b)(4), “...Trade Secrets, Commercial or Financial Information Which is 

Privileged or Confidential...,” otherwise known as public release/non-Confidential Business Information (nonCBI), with the information identified as follows: 

a. CBI Highlighted Copy of Contract: One copy of the contract with all CBI highlighted for CMS FOIA 

review.

b. Contractor Proposed Redacted Public Release Copy of Contract: An additional copy of the contract 

will be provided for public release with all the identified information redacted. Redactions shall be made 

using “black” boxes, which cannot be removed or uncovered by a reader.

c. Pre-Disclosure Concerns - Comments/Rationale for Non-Disclosure of Trade Secrets, Commercial 

or Financial Information Which is Privileged or Confidential: The Contractor shall provide, in a 

separate file, rationale for why disclosure of “...Trade Secrets, Commercial or Financial Information 

Which is Privileged or Confidential...” would cause the Contractor organization substantial competitive 

harm if disclosed to other entities. Rationale shall be provided for each individual recommended 

redaction. Generalized conclusions of competitive harm are not a sufficient basis for the CMS FOIA 

office to invoke the exemption and thereby protect the Contractor’s interest.

All CD/DVDs shall be mailed to the CMS FOIA Officer (address below) within thirty (30) calendar days of 

contract award and within thirty (30) calendar days of a CMS request, i.e. existing or modified contracts. All 

CD/DVD files shall be submitted as Portable Document Format (.pdf) files. 

CD/DVD and File Naming Conventions: The Contractor shall name the CD/DVD with the Contract Number 

and utilize the following CD/DVD file naming conventions:

HHSM-500-2013-xxxxxx – Highlighted

HHSM-500-2013-xxxxxx – Redacted

HHSM-500-2013-xxxxxx – Pre-Disclosure Concerns

CD/DVD shall be mailed to the CMS FOIA Officer at:
Medicare MEC Notices 37 of 48

4571-S (R1) (11/18)

Centers for Medicare & Medicaid Services

Freedom of Information Act Office

ATTN: CMS FOIA Officer

Mailstop: N2-20-16

7500 Security Boulevard

Baltimore, MD 21244-1850

Copy– Correspondence Only (No CD/DVD):

Contracting Officer

Contracting Officer’s Representative (COR)

It should be noted that the CMS FOIA Office makes the final determination as to what information is released to 

the public, after considering any feedback from OAGM and/or the Contractor.
Medicare MEC Notices 38 of 48

4571-S (R1) (11/18)

CMS SECURITY CLAUSE

FAR 52.204-9 Personal Identity Verification of Contractor Personnel.

As prescribed in 4.1303, insert the following clause:

PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (JAN 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract 

that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget 

(OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor 

employees in connection with performance under this contract. The Contractor shall return such identification to 

the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with 

these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts 

when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility 

and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime 

Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph 

(b) of this section, unless otherwise approved in writing by the Contracting Officer.

(End of clause)

FAR 52.222-54 Employment Eligibility Verification.

As prescribed in 22.1803, Insert the following clause:

EMPLOYMENT ELIGIBILITY VERIFICATION (OCT 2015)

(a) Definitions. As used in this clause—

“Commercially available off-the-shelf (COTS) item”—

(1) Means any item of supply that is—

(i) A commercial item (as defined in paragraph (1) of the definition at 2.101);

(ii) Sold in substantial quantities in the commercial marketplace; and

(iii) Offered to the Government, without modification, in the same form in which it is sold in the 

commercial marketplace; and
Medicare MEC Notices 39 of 48

4571-S (R1) (11/18)

(2) Does not include bulk cargo, as defined in 46 U.S.C. 40102(4), such as agricultural products and 

petroleum products. Per 46 CFR 525.1 (c)(2), “bulk cargo” means cargo that is loaded and carried in bulk onboard 

ship without mark or count, in a loose unpackaged form, having homogenous characteristics. Bulk cargo loaded 

into intermodal equipment, except LASH or Seabee barges, is subject to mark and count and, therefore, ceases to 

be bulk cargo.

“Employee assigned to the contract” means an employee who was hired after November 6, 1986 (after 

November 27, 2009 in the Commonwealth of the Northern Mariana Islands), who is directly performing work, in 

the United States, under a contract that is required to include the clause prescribed at 22.1803. An employee is 

not considered to be directly performing work under a contract if the employee—

(1) Normally performs support work, such as indirect or overhead functions; and

(2) Does not perform any substantial duties applicable to the contract.

“Subcontract” means any contract, as defined in 2.101, entered into by a subcontractor to furnish supplies or 

services for performance of a prime contract or a subcontract. It includes but is not limited to purchase orders, and 

changes and modifications to purchase orders.

“Subcontractor” means any supplier, distributor, vendor, or firm that furnishes supplies or services to or for a 

prime Contractor or another subcontractor.

“United States”, as defined in 8 U.S.C. 1101(a)(38), means the 50 States, the District of Columbia, Puerto 

Rico, Guam, the Commonwealth of the Northern Mariana Islands, and the U.S. Virgin Islands.

(b) Enrollment and verification requirements.

(1) If the Contractor is not enrolled as a Federal Contractor in E-Verify at time of contract award, the 

Contractor shall—

(i) Enroll. Enroll as a Federal Contractor in the E-Verify program within 30 calendar days of contract 

award;

(ii) Verify all new employees. Within 90 calendar days of enrollment in the E-Verify program, begin to 

use E-Verify to initiate verification of employment eligibility of all new hires of the Contractor, who are working 

in the United States, whether or not assigned to the contract, within 3 business days after the date of hire (but see 

paragraph (b)(3) of this section); and

(iii) Verify employees assigned to the contract. For each employee assigned to the contract, initiate 

verification within 90 calendar days after date of enrollment or within 30 calendar days of the employee’s 

assignment to the contract, whichever date is later (but see paragraph (b)(4) of this section).

(2) If the Contractor is enrolled as a Federal Contractor in E-Verify at time of contract award, the Contractor 

shall use E-Verify to initiate verification of employment eligibility of—

(i) All new employees. 

(A) Enrolled 90 calendar days or more. The Contractor shall initiate verification of all new hires of the 

Contractor, who are working in the United States, whether or not assigned to the contract, within 3 business days 

after the date of hire (but see paragraph (b)(3) of this section); or 
Medicare MEC Notices 40 of 48

4571-S (R1) (11/18)

(B) Enrolled less than 90 calendar days. Within 90 calendar days after enrollment as a Federal 

Contractor in E-Verify, the Contractor shall initiate verification of all new hires of the Contractor, who are 

working in the United States, whether or not assigned to the contract, within 3 business days after the date of hire 

(but see paragraph (b)(3) of this section); or 

(ii) Employees assigned to the contract. For each employee assigned to the contract, the Contractor shall 

initiate verification within 90 calendar days after date of contract award or within 30 days after assignment to the 

contract, whichever date is later (but see paragraph (b)(4) of this section). 

(3) If the Contractor is an institution of higher education (as defined at 20 U.S.C. 1001(a)); a State or local 

government or the government of a Federally recognized Indian tribe; or a surety performing under a takeover 

agreement entered into with a Federal agency pursuant to a performance bond, the Contractor may choose to 

verify only employees assigned to the contract, whether existing employees or new hires. The Contractor shall 

follow the applicable verification requirements at (b)(1) or (b)(2) respectively, except that any requirement for 

verification of new employees applies only to new employees assigned to the contract. 

(4) Option to verify employment eligibility of all employees. The Contractor may elect to verify all existing 

employees hired after November 6, 1986 (after November 27, 2009, in the Commonwealth of the Northern 

Mariana Islands), rather than just those employees assigned to the contract. The Contractor shall initiate 

verification for each existing employee working in the United States who was hired after November 6, 1986 (after 

November 27, 2009, in the Commonwealth of the Northern Mariana Islands), within 180 calendar days of—

(i) Enrollment in the E-Verify program; or

(ii) Notification to E-Verify Operations of the Contractor’s decision to exercise this option, using the 

contact information provided in the E-Verify program Memorandum of Understanding (MOU).

(5) The Contractor shall comply, for the period of performance of this contract, with the requirements of the 

E-Verify program MOU. 

(i) The Department of Homeland Security (DHS) or the Social Security Administration (SSA) may 

terminate the Contractor’s MOU and deny access to the E-Verify system in accordance with the terms of the 

MOU. In such case, the Contractor will be referred to a suspension or debarment official. 

(ii) During the period between termination of the MOU and a decision by the suspension or debarment 

official whether to suspend or debar, the Contractor is excused from its obligations under paragraph (b) of this 

clause. If the suspension or debarment official determines not to suspend or debar the Contractor, then the 

Contractor must reenroll in E-Verify.

(c) Web site. Information on registration for and use of the E-Verify program can be obtained via the Internet at 

the Department of Homeland Security Web site: http://www.dhs.gov/E-Verify. 

(d) Individuals previously verified. The Contractor is not required by this clause to perform additional 

employment verification using E-Verify for any employee—

(1) Whose employment eligibility was previously verified by the Contractor through the E-Verify program;
Medicare MEC Notices 41 of 48

4571-S (R1) (11/18)

(2) Who has been granted and holds an active U.S. Government security clearance for access to confidential, 

secret, or top secret information in accordance with the National Industrial Security Program Operating Manual; 

or

(3) Who has undergone a completed background investigation and been issued credentials pursuant to 

Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal 

Employees and Contractors. 

(e) Subcontracts. The Contractor shall include the requirements of this clause, including this paragraph (e) 

(appropriately modified for identification of the parties), in each subcontract that—

(1) Is for—

(i) Commercial or noncommercial services (except for commercial services that are part of the purchase 

of a COTS item (or an item that would be a COTS item, but for minor modifications), performed by the COTS 

provider, and are normally provided for that COTS item); or 

(ii) Construction;

(2) Has a value of more than $3,500; and

(3) Includes work performed in the United States.

(End of clause)

CMS SECURITY CLAUSE (APR 2016)

a. Applicability

In accordance with OMB Memorandum M-05-24, Implementation of Homeland Security Presidential 

Directive 12 (HSPD-12): Policy for a Common Identification Standard for Federal Employees and 

Contractors, dated August 27, 2004, and Federal Information Processing Standard (FIPS) PUB Number 201-

2, Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate 

security assurance for multiple applications by efficiently verifying the claimed identity of individuals seeking 

physical access to Federally controlled government facilities and/or logical access to federally controlled 

information systems. Contractors that require routine physical access to a CMS facility and/or routine access 

to a CMS federally controlled information system will be required to obtain a CMS issued PIV, PIV-I or 

Locally Based Physical Access card. FIPS PUB 201-2 specifies the architecture and technical requirements 

for a common identification standard for Federal employees and Contractors.

When a PIV or PIV-I card is provided, it shall be used in conjunction with a compliant card reader and 

middleware for logical system access. The Contractor shall (1) Include FIPS 201-2 compliant, HSPD-12 card 

readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR 52.204-9, Personal 

Identity Verification of Contractor Personnel.

b. Definitions

“Agency Access” means access to CMS facilities, sensitive information, information systems or other CMS 

resources.

“Applicant” is a Contractor employee for whom the Contractor submits an application for a CMS 

identification card.
Medicare MEC Notices 42 of 48

4571-S (R1) (11/18)

“Contractor Employee” means prime Contractor and subcontractor employees who require agency access to 

perform work under a CMS contract.

“Official station”— As defined by Federal Travel Regulations, An area defined by the agency that includes 

the location where the employee regularly performs his or her duties or an invitational traveler’s home or 

regular place of business. The area may be a mileage radius around a particular point, a geographic boundary, 

or any other definite domain, provided no part of the area is more than 50 miles from where the employee 

regularly performs his or her duties or from an invitational traveler’s home or regular place of business. If the

employee’s work involves recurring travel or varies on a recurring basis, the location where the work 

activities of the employee’s position of record are based is considered the regular place of work.

“Federal Identification Card” (or “ID card”) means a federal government issued or accepted identification 

card such as a Personal Identity Verification (PIV) card, Personal Identity Verification-Interoperable (PIV-I) 

card, or a Local-Based Physical Access Card issued by CMS, or a Local-Based Physical Access Card issued 

by another Federal agency and approved by CMS. “Issuing Office” means the CMS entity that issues 

identification cards to Contractor employees.

“Locally Based Physical Access Card” means an access Card that is graphically personalized for visual 

identification, that does not contain an embedded computer chip, and is only used for physical access.

“Local Security Servicing Organization” means the CMS entity that provides security services to the CMS 

organization sponsoring the contract, Division of Physical Security and Strategic Information (DPSSI).

“Logical Access” means the ability for the Contractor to interact with CMS information systems, databases, 

digital infrastructure, or data via access control procedures such as identification, authentication, and 

authorization.

“Personal Identity Verification (PIV) card,” as defined in FIPS PUB 201-2, is a physical artifact (e.g., identity 

card, “smart” card) issued to an individual that contains a PIV Card Application which stores identity 

credentials (e.g., photograph, cryptographic keys, digitized fingerprint representation) so that the claimed 

identity of the cardholder can be verified against the stored credentials by another person (human readable 

and verifiable) or an automated process (computer readable and verifiable).

“Personal Identity Verification-Interoperable (PIV-I) card” similar to a PIV card, is a physical artifact (e.g., 

identity card, “smart” card) issued to an individual that contains a PIV Card Application which stores 

identity credentials (e.g., photograph, cryptographic keys, digitized fingerprint representation) so that the 

claimed identity of the cardholder can be verified against the stored credentials by another person (human 

readable and verifiable) or an automated process (computer readable and verifiable). PIV-I cards are issued 

by a non-federal government entity to non-federal government staff. PIV-I cards are issued in a manner that 

allows federal relying parties to trust the cards. The PIV-I cards uses the same standards of vetting and 

issuance developed by the U.S. government for its employees

c. Screening of Contractor Employees

i. Contractor Screening of Applicants
Medicare MEC Notices 43 of 48

4571-S (R1) (11/18)

1.Contractor Responsibility: The Contractor shall pre-screen individuals designated for 

employment under any CMS contract by verifying minimum suitability requirements to 

ensure that only qualified candidates are considered for contract employment. At the 

discretion of the government, the government reserves the right to request and/or review 

Contractor employee vetting processes. The federal minimum suitability requirements can be 

found below in section (c)(2)—Suitability Requirements, and are also contained in 5 CFR 

731.202. The Contractor shall exercise due diligence in pre-screening all employees prior to 

submission to CMS for agency access.

2.Alien Status: The Contractor shall monitor an alien’s (foreign nationals) continued 

authorization for employment in the United States. If requested by the Agency, the 

Contractor shall provide documentation to the Contracting Officer (CO) or the Contracting 

Officer’s Representative (COR) that validates that the Employment Eligibility Verification 

(e-Verify) requirement has been met for each Contractor or sub-Contractor employee 

working on the contract in accordance with Federal Acquisition Regulation (FAR) 52.222-54 

– Employment Eligibility Verification.

3.Residency Requirement: All CMS Contractor applicants shall have lived in the United States 

at least three (3) out of the last five (5) years prior to submitting an application for a Federal 

ID Card. CMS will process background investigations for foreign nationals in accordance 

with Office of Personnel Management (OPM) guidance. Contractor employees who worked 

for the U.S. Government as an employee overseas in a Federal or military capacity; and/or 

been a dependent of a U.S. Federal or military employee serving overseas, must be able to 

provide state-side reference coverage. State-side coverage information is required to make a 

suitability or security determination. Examples of state-side coverage information include: 

the state-side address of the company headquarters where the applicant’s personnel file is 

located, the state-side address of the Professor in charge of the applicant’s “Study Abroad” 

program, the religious organization, charity, educational, or other non-profit organization 

records for the applicant’s overseas missions, and/or the state-side addresses of anyone who 

worked or studied with the applicant while overseas.

4.Selective Service Registration: All males born after December 31, 1959, must meet the 

Federal Selective Service System requirements as established on www.sss.gov.

ii. Identification Card Application Process

ID Card Sponsor: The CMS Contracting Officer’s Representative (COR) will be the CMS ID card 

Sponsor and point of contact for the Contractor’s application for a CMS ID card. The COR will review 

and approve/deny the HHS ID Badge Request before the form is submitted to the CMS, Office of 

Support Services and Operations, (OSSO), Division of Personnel Security Services (DPS), for processing. 

If approved, an applicant may be issued either a Personal Identity Verification (PIV) or PIV- I card that 

meets the standards of HSPD-12 or a Local-Based Physical Access Card.
Medicare MEC Notices 44 of 48

4571-S (R1) (11/18)

Contractor Application Required Submissions: All applicants shall submit an HHS ID Badge Request 

form for issuance of a Federal ID Card. Unless otherwise directed by the ID Card Sponsor or DPS, 

applicants are required to electronically submit the request form via CMS’ Enterprise User 

Administration (EUA) Electronic Front-end Interface (EFI) system, which is located at 

https://eua.cms.gov/efi. To assist users with the application process, a user’s guide is located 

at:https://www.cms.gov/About-CMS/Contracting-WithCMS/ContractingGeneralInformation/Contracting-Policy-and-Resources.html.

The EUA users guide link should be used to obtain the most current instructional guidance.

PIV Training: Contractors who need PIV or PIV-I card shall complete HHS PIV Applicant Training, 

which is found at https://www.cms.gov/About-CMS/Contracting-WithCMS/ContractingGeneralInformation/Contracting-Policy-and-Resources.html. A copy of the completion 

certificate shall be included with the EFI application.

CMS Applicant Evaluations: CMS will evaluate an applicant’s required access level. Once the review 

is complete and accepted for further processing, the applicant will be contacted by DPS to submit the 

below information, as applicable.

1. e-QIP: Contractor employees will be required to submit information into e-QIP, a web-based 

automated system that is designed to facilitate the processing of standard investigative forms used 

when conducting background investigations for Federal security, suitability, fitness and 

credentialing purposes.

2. Fingerprints: Instructions for obtaining fingerprints will be provided by CMS, OSSO, DPS.

3. OF 306: Contractor employees may be required to complete the Optional Form (OF) 306, 

Declaration for Federal Employment which can be found at 

https://www.opm.gov/forms/pdf_fill/of0306.PDF.

4. Access to Restricted Area(s): The CMS COR will initiate all Federal ID card holders’ physical 

access requests via Physical Access Control System (PACS) Central at https://pam.cms.local.

Suitability Requirements: CMS may decline to grant agency access to a Contractor employee 

including, but not limited to, any of the criteria cited below:

1. Misconduct or negligence in employment;

2. Criminal or dishonest conduct;

3. Material, intentional false statement, or deception or fraud in examination or appointment;

4. Refusal to furnish testimony as required by § 5.4 of 5 CFR 731.202;

5. Alcohol abuse, without evidence of substantial rehabilitation, of a nature and duration that 

suggests that the applicant or appointee would be prevented from performing the duties of the 

position in question, or would constitute a direct threat to the property or safety of the applicant or 

appointee or others;

6. Illegal use of narcotics, drugs, or other controlled substances without evidence of substantial 

rehabilitation;
Medicare MEC Notices 45 of 48

4571-S (R1) (11/18)

7. Knowing and willful engagement in acts or activities designed to overthrow the U.S. Government 

by force; and

8. Any statutory or regulatory bar which prevents the lawful employment of the person involved in 

the position in question.

Badge Issuance: Upon approval of the badging application process and prior to starting work on the 

contract, applicants whose official station is located within 50 miles from CMS’ central office or one of 

its regional offices will be contacted to appear in person, at least two times (estimated at one hour for each 

visit), and shall provide two (2) original forms of identity source documents in order to generate the 

badge/ID. The identity source documents shall come from the list of acceptable documents included in 

FIPS 201-2, located at http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf. At least one (1) 

document shall be a valid State or Federal government-issued picture ID. PIV-I mobile enrollment 

stations will be made available for applicants that have an official station more than 50 miles from CMS 

or any of its regional offices, and the employee will not need to travel to a CMS Office. The Contractor 

will be contacted by CMS for further instructions on the badging process in this scenario.

d. CMS Position Designation Assessment

CMS will assign a risk and sensitivity level designation analysis to the overall contract and/or to 

Contractor employee positions by category, group or individual. The risk and sensitivity level 

designations will be the basis for determining the level and type of personnel security investigations 

required for Contractor employees. At a minimum, the FBI National Criminal History Check (fingerprint 

check) must be favorably adjudicated. Additionally, the OPM e-QIP and other required forms must be 

accepted by DPS before a CMS identification card will be issued.

e. Post Badging Training Requirements:

Contractor employees that receive an HHS ID Badge are expected to complete the following online trainings 

each year, according to the timeframes indicated below, and annually thereafter. The below list is not all 

inclusive and the COR may indicate training that must be taken in addition to the below:

i. Security and Insider Threat Awareness and Training (30 days after receiving badge): This 

course outlines the role of Contractors with regard to protecting information and ensuring the 

secure operation of CMS federally controlled information systems. Estimated time to complete 

is one hour.

ii. Computer Based Training (CBT) (within 3 days of approved EUA account): This training 

offers several modules to familiarize contractor employees with features of CMS’ webinar 

service. Estimated time to complete is one hour.

f. Background Investigation and Adjudication

Upon contract award and receipt of an HHS ID Badge Request, CMS will initiate the Agency Access 

procedures, to include a background investigation.

CMS may accept favorable background investigation adjudications from other Federal agencies when 

there has been no break in service. A favorable adjudication does not preclude CMS from initiating a 

new investigation when deemed necessary. Each CMS sponsored Contractor shall use the OPM e-QIP 

system to complete any required investigative forms.
Medicare MEC Notices 46 of 48

4571-S (R1) (11/18)

The Contractor remains fully responsible for ensuring contract performance pending completion of 

background investigations of Contractor personnel. Employees that do not require access to CMS 

federally controlled information systems, facilities, or sensitive information in order to perform their 

duties may begin work on a contract immediately and need not submit an HHS ID Badge Request.

i. Failure to cooperate with OPM or Agency representatives during the background investigation 

process is considered grounds for removal from the contract.

ii. DPS may provide written notification to the Contractor employee, with a copy to the COR, of all 

suitability/non-suitability decisions. A CMS adjudicative decision (based on criminal history 

results or completed investigation results) is final, and is not subject to appeal.

iii. Contractor personnel for whom DPS determines to be ineligible for ID issuance will be required 

to cease working on the contract immediately.

iv. The Contractor shall immediately submit an adverse information report, in writing to the CO with 

a copy to the COR, of any adverse information regarding any of its employees that may impact 

their ability to perform under this contract. Reports should be based on reliable and substantiated 

information, not on rumor or innuendo. The report shall include, at a minimum, the Contractor 

employee’s name and associated contract number along with the adverse information. The COR 

will forward the adverse information report to the DPS for review and/or action.

v. At the Agency’s discretion, Contractor personnel may be provided an opportunity to explain or 

refute unfavorable information before an adjudicative decision is rendered on whether or not to 

withdraw the Federal ID from the individual in question. Under the provision of the Privacy Act 

of 1974, Contractor personnel may request a copy of their own investigation by submitting a 

written request to the OPM Federal Investigative Services (FIS) Freedom of Information (FOI) 

office. The following OPM-FOI link is being provided to afford one the instructions for 

obtaining a copy of one’s file: https://www.opm.gov/investigations/freedom-of-information-andprivacy-act-requests/.

g. Background Investigation Cost

The government will bear the cost of background investigations that are performed at the direction of CMS’ 

personnel security representatives by the Federal government’s approved and designated background 

investigation service provider, the OPM.

At the Agency’s discretion, if an investigated Contractor employee leaves the employment of the Contractor, 

or otherwise is no longer associated with the contract within one (1) year from the date the background 

investigation was completed, the Contractor may be required to reimburse CMS for the full cost of the 

investigation. Depending upon the type of background investigation conducted and the cost incurred by 

CMS, the Contractor cost will be determined based upon the current OPM fiscal year billing rates, which can 

be found at http://www.opm.gov/investigations/background-investigations/federal-investigations-notices. 

The amount to be paid by the Contractor shall be due and payable when the CO submits a written letter 

notifying the Contractor as to the cost of the investigation. The Contractor shall pay the amount due within 

thirty (30) days of the date of the CO’s letter by check, made payable to the “United States Treasury.” The 

Contractor shall provide a copy of the CO’s letter as an attachment to the check and submit both to the 

Office of Financial Management at the following address:
Medicare MEC Notices 47 of 48

4571-S (R1) (11/18)

Centers for Medicare & Medicaid Services

PO Box 7520

Baltimore, Maryland 21207

h. Identification Card Custody and Control

The Contractor is responsible for the custody and control of all forms of Federal identification issued by 

CMS to Contractor employees. The Contractor shall immediately notify the COR when a Contractor 

employee no longer requires agency access due to transfer, completion of a project, retirement, removal 

from work on the contract, or termination of employment. Return all CMS Federal ID cards to:

The Centers for Medicare and Medicaid Services

Attn: DPS, Mailstop: SL-17-06

7500 Security Boulevard

Baltimore, Maryland 21244

The Contractor shall also ensure that Contractor employees comply with CMS requirements concerning 

the renewal, loss, theft, or damage of an ID card.

Failure to comply with the requirements for custody and control of CMS issued ID cards may result in a 

delay in withholding final payment or contract termination, based on the potential for serious harm caused 

by inappropriate access to CMS facilities, sensitive information, information systems or other CMS 

resources.

i. Renewal: A Contractor employee’s CMS issued ID card is valid for a maximum of five (5) years 

and 9 months or until the contract expiration date (including option periods), whichever occurs 

first. The renewal process should begin six weeks before the ID card expiration date by contacting 

the COR. If an ID card is not renewed before it expires, the Contractor employee will be required 

to sign-in daily for facility access and may have limited access to information systems and other 

resources. Contractor ID card certificate(s) require yearly updates from the issuance date. The 

yearly updates should be coordinated between the contractor and the COR.

ii. Lost/Stolen: Immediately upon detection that an ID card is lost or stolen, the Contractor or 

Contractor employee shall report a lost or stolen ID card to the COR and the local security 

servicing organization at SECURITY@cms.hhs.gov. The Contractor shall also submit an Incident 

Report within 48 hours, to the COR, DPS at Badging@cms.hhs.gov, and the local security 

servicing organization. The Incident Report shall describe the circumstances of the loss or theft. 

If the loss or theft is reported by the Contractor to the local police, a copy of the police report shall 

be provided to the COR. The Contractor employee shall sign in daily for facility access and may 

have limited access to information systems and other resources until the replacement card is 

issued.

iii. Replacement: An ID card will be replaced if it is damaged, contains incorrect data, or is lost or 

stolen for more than three (3) days, provided there is a continuing need for agency access to 

perform work under the contract.
Medicare MEC Notices 48 of 48

4571-S (R1) (11/18)

In the event that the PIV card or certificate(s) are not renewed in a timely fashion, or the ID card requires 

replacement due to being lost, stolen, or damaged, the contractor employee will go through the “Badge 

Issuance” process again as described in above in section (c)(2). In any of these events, contact your COR 

to coordinate the appropriate next steps.

i. Surrender ID Cards/Access Cards, Government Equipment

CMS reserves the right to suspend or withdraw ID card access at any time for any reason. Access will be 

restored upon the resolution of the issue(s).

Upon notification that routine access to CMS facilities, sensitive information, federally controlled 

information systems or other CMS resources is no longer required, the Contractor shall surrender the CMS 

issued ID card, access card, keys, computer equipment, and other government property to the CMS COR or 

directly to CMS at the address referenced above in section (f). DPS Contractor personnel who do not return 

their government issued property within 48 hours of the last day of authorized access to CMS, may be 

permanently barred from CMS systems and facilities and may be subject to fines and penalties, as 

authorized by applicable Federal or State laws.