On July 15, 2014, the Department of Defense (“DOD”) issued a proposed rule setting forth a new framework for audits of contractor accounting systems, estimating systems, and material management and accounting systems. The proposed rule seeks to relieve some of the burden from the Defense Contract Management Agency and Defense Contract Audit Agency, which have been laboring under audit backlogs. The proposed rule would require contractors to annually review these three business systems and self-report any identified deficiencies, and also would call for certain audit responsibilities to be outsourced to third-party Certified Public Accountants.

Although efforts to reduce the audit backlog are a positive development for companies doing business with the government, contractors should be aware of aspects of the proposed rule that may introduce new costs and complications. For example, contractors would be responsible both for covering the costs of third-party audits and for reporting to DOD any material deficiencies that are discovered. Additionally, although the government would not be conducting the initial audit, DOD could still perform its own review of the contractor’s third-party audit, and contracting officers would retain significant discretion in determining the depth of review, documents to be requested, and penalties, if any, to be imposed. C&B 2 provides a detailed summary of the proposed rule and its implications for government contractors.

HRSA PUBLISHES INTERPRETIVE RULE ADDRESSING TREATMENT OF ORPHANDRUGS IN 340B DRUG DISCOUNT PROGRAM

On July 23, 2014, the Health Resources and Services Administration (“HRSA”) published in the Federal Register an interpretive rule setting forth the agency’s view that drug manufacturers are required to provide discounts to certain 340B entities on orphan drugspreviously reported, the U.S. District Court for the District of Columbia permanently enjoined HRSA from implementing regulations that required pharmaceutical manufacturers to offer orphan drugs to covered hospitals at reduced prices if the drugs were used to treat non-orphan conditions. The Court did not, however, invalidate HRSA’s interpretation of the statute; it vacated the regulation on the grounds that HRSA lacked the authority to engage in such rulemaking. On July 16, 2014, HRSA announced that it would stand by its interpretation of the statute and publish an interpretive rule. Last week’s Federal Register publication is the result of this effort. 4 when used for non-orphan indications. 

INTELLIGENCE AUTHORIZATION ACT DIRECTS INTELLIGENCE COMMUNITY TOPROMULGATE CYBERSECURITY RAPID REPORTING REQUIREMENTS

On July 7, 2014, President Obama signed the 2014 Intelligence Authorization Act (“IAA”) into law, starting a 90-day clock for the Director of National Intelligence (“DNI”) to promulgate regulations addressing the requirement that “cleared intelligence contractors” report any “successful penetration” of their networks and information systems. Pursuant to Section 325 of the IAA, DNI’s forthcoming regulations will require cleared intelligence contractors to report the following information to a designated element of the Intelligence Community (“IC”) following a penetration of the contractor’s covered network or information system:

• A description of the technique or method used in such penetration;
• A sample of the malicious software, if discovered and isolated by the contractor, involved in such penetration; and
• A summary of information created by or for an element of the IC that has been potentially compromised. 

The regulations are expected to specify how quickly the cleared intelligence contractors will need to report this information; DOD has already imposed a 72-hour reporting requirement in similar regulations.

In addition to setting forth rapid reporting requirements, the new regulations will implement the IAA’s requirement that intelligence community contractors allow IC personnel access to their equipment or information in the event of a ”successful penetration” of a covered network so that the IC personnel can conduct a forensic analysis of the breach. Section 325 of the IAA requires that any new regulations provide for the “reasonable protection of trade secrets, commercial or financial information” and prohibit the dissemination of information obtained by a forensic analysis without the consent of the contractor. It does not, however, address whether the IC can use information obtained during the forensic analysis for other purposes, such as responsibility or past performance determinations. 

HHS TO IMPLEMENT NEW ACQUISITION INITIATIVE 

The department of Health and Human Services (“HHS”) recently announced a new initiative to encourage innovative and efficient ways to procure information technology. The program, referred to as the HHS Buyers Club, aims to facilitate a more streamlined and agile process for the procurement of IT services. Although HHS has not released details of the program, officials have hinted at what it might entail. For example, rather than requiring offerors to draft lengthy written submissions reciting how they will meet specific RFP requirements, the Buyers Club program envisions a process in which offerors submit “short concept proposals,” followed by actual prototypes, so that contracting officers can develop a more concrete sense of each offerors capabilities. In this way, the program would shift away from telling contractors exactly what to do and focus instead on the outcomes the agency wants to achieve. The success of the Buyers Club initiative, and its impact on government contractors, remains to be seen. But given the scheduling and budget problems plaguing many federal IT procurements, contractors should anticipate that agencies will continue to explore alternative approaches to managing their IT procurements.

CASE DIGEST 

Government Liable for Breach of Contract Following Statutorily-Required Termination (Cardiosom LLC v. United States, No. 08-533C (June 30, 2014))

The Court of Federal Claims recently ruled that a contractor could seek damages following a termination of its contract by an act of Congress. In March 2008, the Centers for Medicare & Medicaid Services (“CMS”) awarded a contract to Cardiosom LLC to supply durable medical equipment to Medicare recipients. In July 2008, Congress passed legislation amending the Medicare statute and directing HHS to cancel certain contracts, including Cardiosom’s. Cardiosom filed a breach of contract action seeking damages for both out-of-pocket expenses incurred in preparing to perform the CMS contract and lost profits. The government responded that language in Cardiosom’s contract, under the heading “Compliance with Laws and Regulations,” and stating that the contract was “subject to any changes in the Medicare statute or regulations that affect the Medicare program,” precluded the recovery of any damages arising from the contract’s termination. The government argued that this provision effectively shifted the risk of a legislative termination of the contract - such as the July 2008 amendment to the Medicare statute - to Cardiosom.