HHSAR CLASS DEVIATION 2026-27

Signature Date: 9/28/2026

1.  EFFECTIVE DATE:

December 1, 2026

2.  EXPIRATION DATE:

This CD is effective until incorporated into the HHSAR, superseded, or otherwise rescinded.

3.  PURPOSE:

This HHSAR CD implements requirements to comply with EO 14275, Restoring Common Sense to Federal Procurement, and the Revolutionary FAR Overhaul (RFO) initiative. This CD revises HHSAR part 324 and applicable portions of 352 to align with the FAR Council’s RFO model deviation text for FAR parts 24 and 52.

This HHSAR CD supersedes and rescinds the part 324 deviation guidance in HHSAR CD 2024-01 Amendment 1, entitled “Part 339, Acquisition of Information Technology; Other Parts; Supply Chain Risk Management,” signed and effective on March 1, 2024.

4.  APPLICABILITY:

The requirements in this CD are applicable to all HHS Divisions for applicable solicitations, contracts, and orders.

5.  ROLES AND RESPONSIBILITIES:

Heads of the Contracting Activities (HCAs) must ensure this CD is disseminated to the acquisition workforce and ensure compliance with the requirements in the CD. Additionally, HCAs must review and update any applicable internal procedures and guidance to reflect the policies and guidance contained herein.

6.  BACKGROUND:

On April 15, 2025, EO 14275, Restoring Common Sense to Federal Procurement, was signed. Section 2 of the EO establishes the policy that the FAR “should only contain provisions required by statute or essential to sound procurement, and any FAR provisions that do not advance these objectives should be removed.”

Under the RFO initiative, the FAR is being updated to:

• Remove language that is not required by statute
• Remove duplicative or outdated language
• Clarify or provide more plain language
• Revise language for the new FAR framework
• Retain language necessary for governmentwide acquisition standards.

The FAR Council released their RFO FAR part 24 model deviation text and affected part 52 solicitation provisions and contract clauses on September 4, 2025.

These changes flow down to and directly impact the HHSAR and require immediate updates.

41 U.S.C. 1707(a)(1) requires that a procurement policy, regulation, procedure, or form, including an amendment or modification, may not take effect until 60 days after it is published for public comment in the Federal Register if it “(A) relates to the expenditure of appropriated funds; and (B)(i) has a significant effect beyond the internal operating procedures of the agency issuing the policy, regulation, procedure, or form; or (ii) has a significant cost or administrative impact on contractors or offerors.”

However, to ensure alignment with recently issued EOs, it is necessary to issue this CD in advance of a proposed rule to ensure HHS solicitations, contracts, and orders consistently reflect the policies and priorities of the Administration. HHS intends on developing a rule after the release of this CD.

7.  POLICY/GUIDANCE:

HHS contracting staff must comply with the following:

1. Follow the RFO HHSAR part 324 deviation text, including the corresponding part 352 deviation text, instead of HHSAR parts 324 and corresponding 352 as codified at 48 CFR Chapter 3. The RFO HHSAR deviation text is shown in the Attachment listed in Section 11.
   • Clean (without markup) versions of RFO HHSAR deviation texts are available at https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/hhsar-overhaul/index.html.
2. When issuing new solicitations, contracts, or orders:

   1. Do not include the following clauses and provisions:

      Note: The codified HHSAR part 324 contains two associated part 352 clauses. In addition, this HHSAR CD supersedes and rescinds any previously deviated clauses or provisions associated with HHSAR part 324. Therefore, the codified clauses and deviated clauses below should no longer be used.

      • Clause 352.224-70 Privacy Act (DEC 2015)
      • Clause 352.224-71 Confidential Information (DEC 2015)
      • Clause 352.224-70 Notification of System of Records Notice (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Clause 352.224-71 Confidential Information (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
   2. Include, if applicable, the following deviated clause and provision using the deviated text shown in the Attachment listed in Section 11:
      • Not Applicable (N/A) – no deviated provision or clauses added.
3. For open solicitations:
   1. No action needed. Contracting officers may continue to enforce the deviated clauses listed in B.1 if they were included in solicitations issued before December 1, 2026, and in contracts and orders resulting from those solicitations.
4. For existing contracts and orders:
   1. No action needed. Contracting officers can continue to enforce the deviated clauses listed in B.1 if they were included in contracts or orders awarded prior to December 1, 2026.

8.  AUTHORITY:

This CD is issued under the authority of RFO FAR 1.304, Class deviations; RFO HHSAR 301.103, Authority; and RFO HHSAR 301.302, Policy.

9.  SUMMARY OF HHSAR CHANGES:

To implement or align with the requirements of the RFO, the HHSAR is deviated, renumbered, revised, and updated with plain language edits. Notable changes are summarized below, and all changes are reflected in the Attachment listed in Section 11.

• HHSAR Part 324 – Protection of Privacy and Freedom of Information
  • Subpart 324.1 – Protection of Individual Privacy
    • Section 324.103 Procedures for the Privacy Act. Updated the heading “Procedures.” Removed existing content as it was determined unnecessary or more appropriate for internal agency guidance, and retained only an HHS-specific reference to the HHS rules implementing the Privacy Act.
    • Section 324.104 Restrictions on Contractor Access to Government or Third Party Information. Removed this section and existing content.
    • Section 324.105 Contract clauses. Removed this section and existing content as the two unique clauses prescribed in the section were determined as unnecessary or better addressed as contract-specific requirements.
  • Subpart 324.1 – Freedom of Information Act
    • Section 324.203 Policy. Added this subpart and section to add reference and link to HHS regulation impellent of FOIA.
  • Subpart 324.70 – Health Insurance Portability and Accountability Act of 1996
    • Revised the subpart title to “Health Insurance Portability and Accountability Act Requirements”
    • Section 324.7000 Scope of subpart. Revised content for citation consistency and plain-language readability; removed unnecessary statutory background; and added a reference to the HHS HIPAA website so contracting personnel, contractors, and the public can easily locate additional information
    • Section 324.7001 Policy on Compliance with HIPAA business associate contract requirements. Revised heading to “Compliance with HIPAA business associate contract requirements.” Revised content to improve organization, citation consistency, and plain-language readability; and clarified the circumstances under which HHS health care components and contracting officers must address HIPAA business associate contract requirements.
• HHSAR Part 352 – Solicitation Provisions and Contract Clauses
  • Clause 352.224-70 Privacy Act
    • Removed the clause and reserved the clause number.
    • This clause is unnecessary as it largely duplicates and repeats contract terms and conditions that are already sufficiently covered in FAR provision 52.224-1, Privacy Act Notification, and FAR clause 52.224-2, Privacy Act.
  • Clause 352.224-71 Confidential Information
    • Removed the clause and reserved the clause number.
    • The clause’s substantive requirements are being moved out of the HHSAR as they are better addressed as contract-specific requirements, consistent with the broader effort to reduce HHS-unique regulatory clauses while preserving necessary protections.

10.  CONTACT:

Acquisition workforce members with questions regarding this CD should contact their cognizant Division Acquisition Office or Acquisition Policy Council (APC) Representative(s), as appropriate.

The current list of APC Representatives may be found on the Acquisition Councils and Workgroups Page of the HHS Acquisition Portal (HHSAP). (Note: The HHSAP is accessible only by HHS employees and contractors on the HHS network. It is not publicly accessible.)

All other questions should be directed to Acquisition_Policy@hhs.gov.

11.  ATTACHMENT(S):

Attachment 1 – RFO HHSAR Part 324 & Applicable Part 352 Deviation Text