HHSAR CLASS DEVIATION 2026-29

Signature Date: 9/28/2026

1.  EFFECTIVE DATE:

December 1, 2026

2.  EXPIRATION DATE:

This CD is effective until incorporated into the HHSAR, superseded, or otherwise rescinded.

3.  PURPOSE:

This HHSAR CD implements requirements to comply with EO 14275, Restoring Common Sense to Federal Procurement, and the Revolutionary FAR Overhaul (RFO) initiative. This CD revises HHSAR part 340 and applicable portions of 352 to align with the FAR Council’s RFO model deviation text for FAR parts 40 and 52.

4.  APPLICABILITY:

The requirements in this CD are applicable to all HHS Divisions for applicable solicitations, contracts, and orders.

5.  ROLES AND RESPONSIBILITIES:

Heads of the Contracting Activities (HCAs) must ensure this CD is disseminated to the acquisition workforce and ensure compliance with the requirements in the CD. Additionally, HCAs must review and update any applicable internal procedures and guidance to reflect the policies and guidance contained herein.

6.  BACKGROUND:

On April 15, 2025, EO 14275, Restoring Common Sense to Federal Procurement, was signed. Section 2 of the EO establishes the policy that the FAR “should only contain provisions required by statute or essential to sound procurement, and any FAR provisions that do not advance these objectives should be removed.”

Under the RFO initiative, the FAR is being updated to:

• Remove language that is not required by statute
• Remove duplicative or outdated language
• Clarify or provide more plain language
• Revise language for the new FAR framework
• Retain language necessary for governmentwide acquisition standards.

The FAR Council released their RFO FAR part 40 model deviation text and affected part 52 solicitation provisions and contract clauses on August 14, 2025.

These changes flow down to and directly impact the HHSAR and require immediate updates.

41 U.S.C. 1707(a)(1) requires that a procurement policy, regulation, procedure, or form, including an amendment or modification, may not take effect until 60 days after it is published for public comment in the Federal Register if it “(A) relates to the expenditure of appropriated funds; and (B)(i) has a significant effect beyond the internal operating procedures of the agency issuing the policy, regulation, procedure, or form; or (ii) has a significant cost or administrative impact on contractors or offerors.”

However, to ensure alignment with recently issued EOs, it is necessary to issue this CD in advance of a proposed rule to ensure HHS solicitations, contracts, and orders consistently reflect the policies and priorities of the Administration. HHS intends on developing a rule after the release of this CD.

7.  POLICY/GUIDANCE:

HHS contracting staff must comply with the following:

1. Follow the RFO HHSAR part 340 deviation text, including the corresponding part 352 deviation text, instead of HHSAR parts 340 and corresponding 352 as codified at 48 CFR Chapter 3. The RFO HHSAR deviation text is shown in the Attachment listed in Section 11.
   • Clean (without markup) versions of RFO HHSAR deviation texts are available at https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/hhsar-overhaul/index.html.
2. When issuing new solicitations, contracts, or orders:
   1. Do not include the following clause and provision:
      • Not Applicable (N/A) – The codified HHSAR part 340 contains no text and therefore has no associated part 352 clauses or provisions.
        • NOTE: In alignment with the RFO FAR structure, HHS supply chain risk assessment requirements are located in HHSAR part 340. Prior to December 1, supply chain risk assessment requirements were addressed in HHSAR part 304. Because of this relationship, please also review HHSAR CD 2026-26 (RFO Parts 304 & 352) for related guidance.
   2. Include, if applicable, the following deviated clause and provision using the deviated text shown in the Attachment listed in Section 11:
      • Clause 352.240-70 Supply Chain Risk Assessment (OCT 2026) (RFO DEVIATION)
      • Clause 352.240-71 Basic Safeguarding of HHS Information (OCT 2026) (RFO DEVIATION)
3. For open solicitations: See the “NOTE” in B.1 above.
4. For existing contracts and orders: See the “NOTE” in B.1 above.

8.  AUTHORITY:

This CD is issued under the authority of RFO FAR 1.304, Class deviations; RFO HHSAR 301.103, Authority; and RFO HHSAR 301.302, Policy.

9.  SUMMARY OF HHSAR CHANGES:

To implement or align with the requirements of the RFO, the HHSAR is deviated, renumbered, revised, and updated with plain language edits. Notable changes are summarized below, and all changes are reflected in the Attachment listed in Section 11.

• HHSAR Part 340 – Information Security and Supply Chain Security
  • Subpart 340.3 – Safeguarding Information
    • Section 340.370 Basic safeguarding of HHS information. Added this new HHS-unique section to establish requirements for safeguarding HHS information, including the prescription for use of the new clause at 352.240-71.
  • Subpart 340.70 – Supply Chain Risk Assessments
    • Added this new HHS-unique subpart to implement requirements for conducting supply chain risk assessments for mission-critical acquisitions, including the prescription for use of the new clause at 352.240-70.
• HHSAR Part 352 – Solicitation Provisions and Contract Clauses
  • 352.240-70 Supply Chain Risk Assessment
    • Added this new clause to implement supply chain risk assessment requirements for mission-critical acquisitions.
  • 352.240-71 Basic Safeguarding of HHS Information
    • Added this new clause to establish a small set of baseline safeguarding requirements when handling HHS information and require compliance with the specific safeguarding and handling requirements identified elsewhere in the contract.

10.  CONTACT:

Acquisition workforce members with questions regarding this CD should contact their cognizant Division Acquisition Office or Acquisition Policy Council (APC) Representative(s), as appropriate.

The current list of APC Representatives may be found on the Acquisition Councils and Workgroups Page of the HHS Acquisition Portal (HHSAP). (Note: The HHSAP is accessible only by HHS employees and contractors on the HHS network. It is not publicly accessible.)

All other questions should be directed to Acquisition_Policy@hhs.gov.

11.  ATTACHMENT(S):

Attachment 1 – RFO HHSAR Part 340 & Applicable Part 352 Deviation Text