Records Management Obligations

30.10.2 - Records Management Obligations (Rev. 13718; Issued: 04-10-26; Effective: 05-11-26; Implementation: 09-14-26) A. Applicability1 1 NARA's metadata requirements for digitization are comprehensively outlined in 36 CFR Subpart E (Electronic Records Management) and specifically detailed in NARA's guidance documents including "Metadata Guidance for This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records regardless of the medium in which the record exists. B. Requirements 1. Contractor shall comply with all applicable records management laws and regulations, as well as NARA records policies, including but not limited to the Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. § 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion. 2. In accordance with 36 CFR § 1222.32, all data created for Government use and delivered to, or falling under the legal control of the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. § 552), as amended, and the Privacy Act of 1974 (5 U.S.C. § 552a), and shall be managed and scheduled for disposition only as permitted by statute or regulation. 3. In accordance with 36 CFR § 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and shall be managed in accordance with Federal law. Electronic records and associated metadata shall be accompanied by sufficient technical documentation to permit understanding and use of the records and data. 4. CMS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of CMS or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Contracting Officer and the Agency Records Officer. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. § 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor shall report to CMS within 30 calendar days. 5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in contracts awarded by CMS Office of Acquisition & Grants Management (OAGM). The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards the Transfer of Permanent Electronic Records" and related technical bulletins. For complete technical specifications and implementation guidance, refer to 36 CFR § 1236.10 through § 1236.34 and current NARA bulletins available at: https://www.archives.gov/records-mgmt/policy/transfer-guidance.html are established to ensure the security and confidentiality of this information, data, documentary material, records and equipment are properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Contracting Officer and Agency Records Officer. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to CMS control, or the Contractor shall safeguard it until otherwise directed. records returned to the Government shall be hand carried, mailed via certified mail, emailed, or securely electronically transmitted to the Contracting Officer or the Agency Records Officer. Destruction of records is expressly prohibited unless in accordance with Paragraph (4). 6. The Contractor (and any sub-contractor) is required to abide by Government and CMS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information. 7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with CMS policy. 8. The Contractor shall not create or maintain any records containing any non-public CMS information that are not specifically tied to or authorized by the contract. 9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption or exclusion to the Freedom of Information Act. 10. CMS owns the rights to all data and records produced as part of all contracts. All deliverables under the contract are the property of the U.S. Government for which CMS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables shall be identified as required by FAR 52.227-11 through FAR 52.227-20. 11. Training. All Contractor employees assigned to CMS contracts who create, work with, or otherwise handle records are required to take annual CMS provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training. All contractor employees who have access to (1) Department of Health and Human Services (HHS) Federal Information or a Federal information system or (2) personally identifiable information shall complete the CMS provided records management training required by the Department of Health and Human Services (HHS) before performing any work under their contract, and annually thereafter. The Contractor shall also ensure any applicable subcontractor compliance with this training requirement. Contractor employees are expected to complete any new training requirements enacted by HHS or CMS whereby access to the course material has been provided. These courses are at no additional cost to the contract and the contractor is not required to provide documentation on such training unless specifically requested. The Government does not anticipate a contractor to develop a system specifically designed to track and monitor such trainings but will address the requirements under overall contract management and adherence to regulations as noted in the Contractor Performance Assessment Reporting System (CPARS). Training Records. The contractor shall maintain training records for all its employees working under this contract in accordance with HHS policy. D. Flow-down of requirements to subcontractors 1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts awarded by CMS OAGM and require written subcontractor acknowledgment of same. 2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.