The Department of Health and Human Services, Phoenix Area Indian Health Service (IHS), is soliciting quotes for an Emergency Mass Notification System. This Request for Quote (RFQ-25-PHX-060) is a 100% set-aside for Indian Small Business Economic Enterprise (ISBEE)/Native American-owned Small Businesses. The successful offeror will provide installation, implementation, training, and ongoing service for a base year plus four option years. All new IT systems must operate in a pure IPv6 network environment, complying with NIST USGv6 Program standards. Proposals must be submitted electronically, be firm fixed-price, and include a letter of authorization from an authorized reseller. Evaluation criteria include technical capability, delivery, past performance (minimum of 3, maximum of 5 examples), and price. Technical and past performance are significantly more important than price. The government will only consider new OEM equipment; gray market items are strictly prohibited. Invoicing will be processed through the Invoice Processing Platform (IPP).

This document outlines a Business Associate Agreement (BAA) between the Indian Health Service (IHS), a Covered Entity, and a Vendor, a Business Associate, as mandated by 45 C.F.R. § 164.502(e) of HIPAA. The agreement defines terms like PHI, HIPAA Rules, and Master Patient Index (MPI). It details the Business Associate's obligations, including safeguarding PHI, reporting unauthorized uses, disclosures, and breaches (within 1 hour for confirmed breaches and 30 days for unsecured PHI breaches), providing individual access to PHI, accounting for disclosures, and amending PHI. The Business Associate must ensure subcontractors comply with the same terms. Permitted uses of PHI are limited to contract functions, treatment, payment, and healthcare operations, or as required by law. The Covered Entity must inform the Business Associate of privacy practice changes or restrictions. The agreement's term aligns with the underlying contract, with provisions for termination for cause. Upon termination, the Business Associate must return or destroy PHI and indemnify the Covered Entity for HIPAA non-compliance. The agreement is incorporated into the main contract and requires amendments for HIPAA compliance.

The Phoenix Area Indian Health Service is seeking a Cloud-Based Notification System (SaaS) for critical event management, enabling 24/7/365 mass notifications and robust contact management. The system must be FedRAMP certified, off-the-shelf, scalable for at least 2,500 subscribers, and offer tiered administration with flexible role-based access. Key functionalities include multi-channel notifications (email, SMS, web, social media, fax, voice), polling, live voice recording, and geo-targeted alerts. The solution needs extensive reporting, data encryption (FIPS 140-2 compliant), and adherence to NIST 800-53 security frameworks, with an RTO of 15 minutes and RPO of 24 hours. The vendor must provide annual maintenance, technical support, a dedicated Technical Account Manager, and training. Crucially, the system and all associated services, documentation, and support must comply with Revised Section 508 and WCAG 2.0 Level AA accessibility standards, ensuring comparable access for individuals with disabilities. The contract includes provisions for data privacy, confidentiality, and a one-year base period with four option years.

The Indian Health Service (IHS) requires offerors to self-certify their status as an "Indian Economic Enterprise" (IEE) in accordance with the Buy Indian Act (25 U.S.C. 47) for solicitations, sources sought, and RFIs. This certification must be maintained throughout the offer, award, and contract performance periods. Failure to meet IEE criteria necessitates immediate written notification to the Contracting Officer. While self-certification is required, Contracting Officers may request additional documentation, and awards are subject to protest regarding eligibility. Successful offerors must also be registered with the System for Award Management (SAM). Providing false information is a violation of law, subject to penalties under 18 U.S.C. 1001 for false information and 31 U.S.C. 3729-3731 and 18 U.S.C. 287 for false claims. The form requires the offeror to state whether they meet the IEE definition, along with the name of the 51% owner, certifying signature, print name, federally recognized tribal entity name, business name, and Unique Entity Identifier (UEI) Number.

This government file outlines the administrative and contractual requirements for federal acquisitions, specifically focusing on the Indian Health Service (IHS). It details contractor registration with the System for Award Management (SAM), electronic payment methods, and monthly invoicing procedures. Key provisions include explicit invoice requirements, electronic submission via IPP, and a strict policy prohibiting contractors from billing IHS beneficiaries. The document also addresses special contract requirements such as cultural sensitivity when serving patients, performance evaluation, and post-award monitoring, including a mandatory Quality Control Program. The period of performance is a base year with four one-year options. The roles and authorities of the Contracting Officer (CO) and Contracting Officer Representative (COR) are clearly defined, emphasizing that only the CO can modify contract terms. Information technology security and mandatory annual security awareness training (ISSA) for all IHS system users are also covered. The contract incorporates various Federal Acquisition Regulation (FAR) clauses by reference, including those related to commercial products and services, evaluation criteria, contract terms and conditions, options to extend, limitations on subcontracting, and continuity of services, with specific clauses on business ethics, whistleblower protections, and combating human trafficking explicitly marked as applicable.

This document is a combined synopsis/solicitation (RFQ-25-PHX-002) for commercial items, specifically issued as a Request for Quotation (RFQ) under Simplified Acquisition Procedures (FAR 13.106-2). It targets Indian Economic Enterprise/Indian Small Business Economic Enterprise concerns. Quotes must be written, on an all-or-none basis, and adhere to FAR and HHSAR provisions. Key information required from offerers includes CAGE Code, UEI Number, Tax Identification, FOB Point, and Discount Terms. A 60-day acceptance period acknowledgment is mandatory. The NAICS Code is 517810, with a size standard of $40M. Attachments include Instructions to Offerors, a Business Associate Agreement, a 2025 Tax Exemption Letter, a Statement of Work, an IEE Representation Form, and Provisions and Clauses.