HHSAR CLASS DEVIATION 2026-28

Signature Date: 9/28/2026

1.  EFFECTIVE DATE:

December 1, 2026

2.  EXPIRATION DATE:

This CD is effective until incorporated into the HHSAR, superseded, or otherwise rescinded.

3.  PURPOSE:

This HHSAR CD implements requirements to comply with EO 14275, Restoring Common Sense to Federal Procurement, and the Revolutionary FAR Overhaul (RFO) initiative. This CD revises HHSAR part 339 and applicable portions of 352 to align with the FAR Council’s RFO model deviation text for FAR parts 39 and 52.

This HHSAR CD supersedes and rescinds the deviation guidance in the following HHSAR CDs:

• HHSAR CD 2023-01, entitled “Standards for Health Information Technology,” issued on December 20, 2022; and
• Deviation guidance related to HHSAR part 339 in HHSAR CD 2024-01 Amendment 1, entitled “Part 339, Acquisition of Information Technology; Other Parts; Supply Chain Risk Management,” signed and effective on March 1, 2024.

4.  APPLICABILITY:

The requirements in this CD are applicable to all HHS Divisions for applicable solicitations, contracts, and orders.

5.  ROLES AND RESPONSIBILITIES:

Heads of the Contracting Activities (HCAs) must ensure this CD is disseminated to the acquisition workforce and ensure compliance with the requirements in the CD. Additionally, HCAs must review and update any applicable internal procedures and guidance to reflect the policies and guidance contained herein.

6.  BACKGROUND:

On April 15, 2025, EO 14275, Restoring Common Sense to Federal Procurement, was signed. Section 2 of the EO establishes the policy that the FAR “should only contain provisions required by statute or essential to sound procurement, and any FAR provisions that do not advance these objectives should be removed.”

Under the RFO initiative, the FAR is being updated to:

• Remove language that is not required by statute
• Remove duplicative or outdated language
• Clarify or provide more plain language
• Revise language for the new FAR framework
• Retain language necessary for governmentwide acquisition standards.

The FAR Council released their RFO FAR part 39 model deviation text and affected part 52 solicitation provisions and contract clauses on June 12, 2025.

These changes flow down to and directly impact the HHSAR and require immediate updates.

41 U.S.C. 1707(a)(1) requires that a procurement policy, regulation, procedure, or form, including an amendment or modification, may not take effect until 60 days after it is published for public comment in the Federal Register if it “(A) relates to the expenditure of appropriated funds; and (B)(i) has a significant effect beyond the internal operating procedures of the agency issuing the policy, regulation, procedure, or form; or (ii) has a significant cost or administrative impact on contractors or offerors.”

However, to ensure alignment with recently issued EOs, it is necessary to issue this CD in advance of a proposed rule to ensure HHS solicitations, contracts, and orders consistently reflect the policies and priorities of the Administration. HHS intends on developing a rule after the release of this CD.

7.  POLICY/GUIDANCE:

HHS contracting staff must comply with the following:

1. Follow the RFO HHSAR part 339 deviation text, including the corresponding part 352 deviation text, instead of HHSAR parts 339 and corresponding 352 as codified at 48 CFR Chapter 3. The RFO HHSAR deviation text is shown in the Attachment listed in Section 11.
   • Clean (without markup) versions of RFO HHSAR deviation texts are available at https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/hhsar-overhaul/index.html.
2. When issuing new solicitations, contracts, or orders:

   1. Do not include the following clause and provision:

      Note: The codified HHSAR part 339 contains two associated part 352 clause and provision. In addition, this HHSAR CD supersedes and rescinds any previously deviated clauses or provisions associated with HHSAR part 339. Therefore, the codified clause and provision, along with the deviated clauses and provisions listed below should no longer be used.

      • Provision 352.239-73 Electronic Information and Technology Accessibility Notice (DEC 2015)
      • Clause 352.239-74 Electronic Information and Technology Accessibility (DEC 2015)
      • Clause 352.239-70 Standards for Health Information Technology (DEC 2022) (DEVIATION) (Deviated version from the December 20, 2022 HHSAR CD 2023-01 and now superseded and rescinded by this class deviation.)
      • Clause 352.239-71 Security Requirements for Information Technology Resources (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Provision 352.239-72 Information System Security Plan and Accreditation (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Clause 352.239-73 Information System Design and Development (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Clause 352.239-74 Information System Hosting, Operation, Maintenance, or Use (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Clause 352.239-75 Security Controls Compliance Testing (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Clause 352.239-76 Security Requirements for Government-Owned Contractor-Operated and Contractor-Owned Contractor-Operated Resources (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Clause 352.239-77 Cloud Computing Services (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Provision 352.239-78 Information and Communication Technology Accessibility Notice (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
      • Clause 352.239-79 Information and Communication Technology Accessibility (FEB 2024) (DEVIATION) (Deviated version from the March 1, 2024 HHSAR CD 2024-01 Amendment 1 and now superseded and rescinded by this class deviation.)
   2. Include, if applicable, the following deviated clauses using the deviated text shown in the Attachment listed in Section 11:
      • 352.239-70 Standards for Health Information Technology (DEC 2026) (RFO DEVIATION)
      • 352.239-71 Information and Communication Technology Accessibility (DEC 2026) (RFO DEVIATION)
3. For open solicitations:
   1. No action needed. Contracting officers may continue to enforce the deviated clauses and provisions listed in B.1 if they were included in solicitations issued before December 1, 2026, and in contracts and orders resulting from those solicitations.
4. For existing contracts and orders:
   1. No action needed. Contracting officers can continue to enforce the deviated clauses listed in B.1 if the clauses were included in contracts or orders awarded prior to December 1, 2026.

8.  AUTHORITY:

This CD is issued under the authority of RFO FAR 1.304, Class deviations; RFO HHSAR 301.103, Authority; and RFO HHSAR 301.302, Policy.

9.  SUMMARY OF HHSAR CHANGES:

To implement or align with the requirements of the RFO, the HHSAR is deviated, renumbered, revised, and updated with plain language edits. Notable changes are summarized below, and all changes are reflected in the Attachment listed in Section 11.

• HHSAR Part 339 – Acquisition of Information Technology
  • Updated the part title to “Acquisition of Information and Communication Technology” to align with the RFO FAR part title.
  • Subpart 339.1 - General
    • Updated the subpart title to “Presolicitation” to align with the RFO FAR title.
    • Section 339.101 Policy. Updated the heading to “Management of risk.” Removed existing content and replaced it with a new a paragraph (a).
    • Section 339.170 HHS ICT accessibility requirements. Added this new section and underlying subsections 339.170-1 (Policy) and 339.170-2 (Contract clause).
      • HHS unique ICT accessibility policy and requirements are now addressed in this section, including the prescription for the new consolidated clause 352.239-71, Information and Communication Technology Accessibility.
  • Subpart 339.2 – Electronic and Information Technology
    • Reserved subpart number and removed its underlying sections, subsections, and content.
    • The relevant ICT accessibility guidance to remain in regulations are now captured in new section 339.170. All other existing content was determined unnecessary or more appropriate for internal agency guidance.
  • Subpart 339.70 – Standards for Health Information Technology
    • Added this new subpart to implement requirements to procure health information technology (health IT) that meets standards and implementation specifications (standards) adopted by the Office of the National Coordinator for Health Information Technology (ONC) under section 3004 of the Public Health Service Act (PHSA), consistent with sections 13111 and 13112 of the HITECH Act (Pub. L. 111-5) to advance health IT alignment.
• HHSAR Part 352 – Solicitation Provisions and Contract Clauses
  • Clause 352.239-70 Standards for Health Information Technology
    • Added this clause to implement standards and implementation specifications (standards) adopted by the ONC on health IT procurements.
  • Clause 352.239-71 Information and Communication Technology Accessibility
    • Added a new consolidated clause that replaces the separate HHSAR accessibility provision and clause and establishes streamlined pre-award and post-award ICT accessibility requirements.
    • The new clause incorporates current HHS ICT accessibility requirements while allowing acquisition-specific accessibility standards, submission instructions, and evaluation requirements to be addressed in the solicitation and contract, as applicable.
  • Provision 352.239-73 Electronic Information and Technology Accessibility Notice
    • Removed the provision and reserved the provision number.
    • The substantive pre-award accessibility obligations previously addressed in this provision are incorporated into new HHSAR clause 352.239-71; while acquisition-specific accessibility submission instructions and evaluation requirements were not carried forward because they are more appropriately addressed in the solicitation.
  • Clause 352.239-74 Electronic and Information Technology Accessibility
    • Removed the clause and reserved the clause number.
    • The substantive post-award accessibility obligations previously addressed in this clause are incorporated into new HHSAR clause 352.239-71; while acquisition-specific accessibility standards, specifications, documentation requirements, and other performance requirements were not carried forward because they are more appropriately identified in the solicitation, contract, order, or applicable requirements document, as appropriate.

10.  CONTACT:

Acquisition workforce members with questions regarding this CD should contact their cognizant Division Acquisition Office or Acquisition Policy Council (APC) Representative(s), as appropriate.

The current list of APC Representatives may be found on the Acquisition Councils and Workgroups Page of the HHS Acquisition Portal (HHSAP). (Note: The HHSAP is accessible only by HHS employees and contractors on the HHS network. It is not publicly accessible.)

All other questions should be directed to Acquisition_Policy@hhs.gov.

11.  ATTACHMENT(S):

Attachment 1 – RFO HHSAR Part 339 & Applicable Part 352 Deviation Text