Effective Date: 12/01/2026 (see HHSAR CD 2026-28)
Subpart 339.1 – Presolicitation
339.101 Management of risk.
339.170 HHS ICT accessibility requirements.
339.170-1 Policy.
339.170-2 Contract clause.
Subpart 339.2 [Reserved]
Subpart 339.70 – Standards for Health Information Technology
339.7000 Scope of subpart.
339.7001 Definitions.
339.7002 Policy.
339.7003 Contract clause.
Subpart 339.1 – Presolicitation
339.101 Management of risk.
(a) Before soliciting for or entering into an information technology contract, requiring activities and contracting officers must ensure compliance with HHS and Division review and clearance requirements (e.g., Information Technology Acquisition Reviews, etc.) and ensure acquisitions include the appropriate contract requirements.
339.170 HHS ICT accessibility requirements.
339.170-1 Policy.
When acquiring information and communication technology (ICT) supplies and services, HHS will identify in the solicitation and contract the applicable ICT accessibility standards at 36 CFR 1194.1, including any exceptions or exemptions that may apply. The solicitation and contract will also describe how ICT accessibility conformance will be considered in the evaluation and what documentation the offeror must provide to assist the Government in determining conformance.
339.170-2 Contract clause.
Insert the clause at 352.239-71, Information and Communication Technology Accessibility, in all contracts and orders.
Subpart 339.2 [Reserved]
Subpart 339.70 – Standards for Health Information Technology
339.7000 Scope of subpart.
(a) This subpart implements and aligns requirements related to the procurement of health information technology (health IT) with standards and implementation specifications (standards) adopted by the HHS, Office of the National Coordinator for Health Information Technology (ONC) under section 3004 of the Public Health Service Act (PHSA), consistent with sections 13111 and 13112 of the HITECH Act (Pub. L. 111-5) to advance health IT alignment.
(b) This subpart provides policies and procedures for solicitations and contracts issued by or on behalf of HHS entities that—
(1) Support the direct exchange of individually identifiable health information between agencies and with non-Federal entities;
(2) Are with health care providers, health plans, or health insurance issuers, as these terms are defined in 42 U.S.C. 300jj and 300gg-91; or
(3) Support providers, health plans, or health insurance issuers to implement, acquire, or upgrade health IT.
339.7001 Definitions.
As used in this subpart—
Health information technology (health IT) means hardware, software, integrated technologies or related licenses, intellectual property, upgrades, or packaged solutions sold as services that are designed for or support the use by health care entities or patients for the electronic creation, maintenance, access, or exchange of health information. (42 U.S.C. 300jj(5))
Individually identifiable health information means any information, including demographic information collected from an individual, that—
(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental health condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
(i) Identifies the individual; or
(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual. (42 U.S.C. 300jj(8), 1320d(6))
ONC Health Information Technology Certification Program means the voluntary certification program administered by ONC using a third-party conformity assessment program for health IT. Certification criteria for the Program are found in 45 CFR part 170, subpart C, and incorporate standards and implementation specifications in 45 CFR part 170 subpart B.
339.7002 Policy.
(a) Contracting officers must not award a contract unless the offeror/quoter/contractor agrees, by submission of an offer (or a quote) and execution of the contract, that—
(1) For any work performed under the contract that includes implementing, acquiring, or upgrading health IT the offeror/quoter/contractor must utilize health IT that—
(i) Meets standards and implementation specifications adopted in 45 CFR part 170, subpart B, if such standards and implementation specifications can support work performed under the contract; or
(ii) Is certified under the ONC Health Information Technology Certification Program, if certified technology can support work performed under the contract (see certification criteria in 45 CFR part 170, subpart C), and the health IT is used by an eligible professional in an ambulatory setting, or a hospital, eligible for incentives to adopt health IT under sections 4101, 4102, and 4201 of the HITECH Act.
(b) If standards and implementation specifications adopted in 45 CFR part 170, subpart B, cannot support the work as specified in the contract, the offeror/quoter/contractor is encouraged to use health IT that meets non-proprietary standards and implementation specifications developed by consensus-based standards development organizations. This may include standards identified in the ONC Interoperability Standards Advisory, available at https://www.healthit.gov/isa/.
339.7003 Contract clause.
Insert the clause at 352.239-70, Standards for Health Information Technology, in solicitations and contracts issued by or on behalf of HHS entities that—
(a) Support the direct exchange of individually identifiable health information between agencies and with non-Federal entities;
(b) Are with health care providers, health plans, or health insurance issuers, as these terms are defined in 42 U.S.C. 300jj and 300gg-91; or
(c) Support health care providers, health plans, or health insurance issuers to implement, acquire, or upgrade health IT.