Performance Work Statement..pdf

CUI//PROCURE

PERFORMANCE WORK STATEMENT

IRWIN ARMY COMMUNITY HOSPITAL

FORT RILEY, KS

22 JUNE 2026

SECTION 1 GENERAL

1. GENERAL REQUIREMENTS

1.1. Scope of Work. Services non-personal the contractor shall furnish all labor, personnel, supervision, management, equipment, transportation, materials, supplies, certification, and training, except as specified herein as government-furnished, to provide laundry services to Irwin Army Community Hospital (IACH) 650 Huebner Road, Fort Riley, Kansas 66442. The contractor shall collect soiled laundry, provide laundry services, and deliver clean laundry in accordance with the scope of this Performance Work Statement (PWS) and its Technical Exhibits.

1.2. Contractor Experience and Personnel.

1.2.1. Point of Contact. The contractor shall provide a point of contact responsible for the performance of the work.

The name of this person and an alternate who shall act for the contractor when the primary is absent shall be designated in writing to the contracting officer no later than the start of the contract.

1.2.1.1. The point of contact and the alternate shall have full authority to act on behalf of the contractor on all contract matters relating to the daily operation of this contract.

1.2.1.2. The point of contact and alternate must be able to read, write, speak, and understand English well enough to satisfy all contract administration requirements.

1.3. Security Requirements. Unaccompanied access to IACH is not authorized without written consent from Government personnel. Contractor's personnel shall wear picture identification. Upon award of contract, IACH will provide contractor with post vehicle permits.

1.4. Quality Control. The contractor shall properly clean all items so that each item is free of visible stains, visible lint, and objectionable odors. The contractor shall establish and maintain a complete quality control program to assure requirements of the contract are met as specified.

1.5. Quality Assurance. The Government will evaluate the contractor's completed work to ensure it is accomplished in accordance with the standards required by this contract.

1.6. Performance Evaluation Meetings. The Contractor or designated alternate, Contracting Officer, Contracting Administrator, and Contracting Officers Representative (COR) shall meet during the performance of this contract as required by any party.

1.7. Physical Security. The contractor shall be responsible for safeguarding any and all government property either provided for use or being serviced under the provisions of this contract. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.8. Hours of Operation. Normal duty hours for the purpose of this contract are 7:00 A.M. to 4:00 P.M. Monday through Friday. Pickup and delivery schedules will be in accordance with Exhibit 2.

1.9. Gate Control. The award of this contract does not bestow a right to have access to any military installation.

Unscheduled gate closures by the Security Police may occur at any time and personnel entering or leaving the installation may experience delays. Privately owned vehicles of the contractors' personnel as well as contractor owned vehicles are subject to search while on federal installations pursuant to current directives. Any violation of installation regulation or of state or federal statute may result in the termination of the privilege to enter one or more military installations.

1.10. The contracting officer has identified all or a portion of the contractor services performed under this contract as essential contractor services in support of mission essential functions. The contractor provided services that have been determined to be essential contractor services in support of mission essential functions are listed in attachment 1, Mission Essential Contractor Services dated 01 March 2026.

Section 2 DEFINITIONS

2. DEFINITIONS

2.1 Definitions of special terms and phrases used in this PWS are as follows:

2.1.1 Clean. Finished articles are dry and free of visible soil, lint, and objectionable spots and stains are removed without damaging the fabric and have been treated as defined in paragraph 2.1.7. Tape and other adhesives shall be removed prior to or during the laundering process.

2.1.2 Contaminated Laundry. All soiled laundry originating from the Medical Treatment Facility (MTR) is categorized as contaminated. In accordance with the "Infection Prevention & Control" section (Linen and Laundry subsection) of The Joint Commission (TJC) Manual, the Contractor is responsible for properly handling the contaminated laundry.

2.1.3 Contracting Officer's Representative and Assistant Contracting Officer's Representative (COR/ACOR). The COR/ACOR are the medical facility personnel responsible for assisting in administration of the Government's quality assurance portion of the contract. These personnel are designated in writing by the Contracting Officer to be responsible for quality assurance, inspection, surveillance documentation and acceptance of Contractor's performance.

A copy of the letter of designation will be provided to the Contractor.

2.1.4 Contractor Quality Control. Actions taken by a contractor to control the production of services to meet the requirements of the PBWS.

2.1.5 Government Quality Assurance. Those actions taken by the Government to ensure services meet the requirements of the PWS.

2.1.6 Laundering. The process by which soiled fabric items are cleaned and treated. The term includes cleaning by mechanical action in appropriate temperature water with solutions of detergents and other additives, ironing, and/or pressing. These additives include repellent treating, bleaching, bluing, rinsing, chemical rinse (sour, fabric softener, and any other agent for controlling the growth of microorganisms, such as molds and bacteria), starching, ironing, and pressing. The appropriate products and procedures are to be determined by the contractor for the various types of fabric and nature of soil.

2.1.7 Medical Treatment Facility (MTF). Those activities providing outpatient and/or inpatient health care services for authorized personnel.

2.1.8. Quality Control. Those actions taken by the contractor to control the production of goods or services so that they meet the requirements of this contract.

Section 3 GOVERNMENT-FURNISHED PROPERTY AND SERVICES

3. GOVERNMENT-FURNISHED PROPERTY AND SERVICES. The Government shall provide, without cost, the items listed below:

3.1. Telephone. Contractor personnel shall be allowed the use of a government telephone for local calls upon request.

3.2. The government shall provide the laundry tickets, carts, basket and weight scales at the hospital and laundry bags.

SECTION 4 CONTRACTOR-FURNISHED ITEMS

4. CONTRACTOR-FURNISHED ITEMS:

4.1. The contractor shall provide any and all property or services necessary for the performance of this contract, which is not specifically identified in this contract as furnished by the Government. Such property or services shall include, but is in no way limited to facilities, tools, materials, equipment, clothing racks, vehicles, soaps, detergents, bleaches, starches, sizing, spotting agents, rust-proof hangers, marking tapes, pad covers, packaging, and marking materials.

4.2. In addition, the contractor shall provide all appropriate protective clothing as required by OSHA.

SECTION 5 SPECIFIC TASKS AND STANDARDS

5.1 GENERAL. The contractor shall furnish all personnel, supervision, tools, materials, equipment, transportation and other replenishment supplies and services necessary to provide laundry services for Irwin Army Community Hospital, 650 Huebner Road, Fort Riley, Kansas in accordance with all local, state and federal laws and the requirements of this PWS. All services performed must meet the prescribed standards to be regarded as acceptable. Services considered unacceptable shall be re-performed at no additional charge to the Government.

5.2 SPECIFIC TASKS. The following specific tasks are to be performed by the contractor.

5.2.1 Task. Pickup and delivery of laundry from and to Irwin Army Community Hospital.

5.2.1.1 Standard. The contractor shall pick up soiled laundry and items for laundering and deliver clean laundry items in accordance with Exhibit 2. The Turnaround time for all items shall be no longer than 24 hours, (e.g. Items picked up Monday shall be returned Tuesday.)

5.2.1.2 Standard. Upon pickup, soiled laundry will be accounted for by Government-designated personnel and the contractor personnel who will record the counts and or weight on a Government laundry ticket supplied by the contractor. Documentation will be accomplished prior to pick up and removal of soiled laundry by the contractor. The Contractor shall verify the counts and countersign the ticket to indicate agreement. Contractor personnel shall be responsible for physically transferring soiled linen into the Contractor's vehicle. A copy of each completed soiled laundry ticket will be furnished to the Government.

5.2.1.3 Standard. Upon delivery, laundered items will be counted and or weighed by Government-designated personnel and contractor personnel at the time of delivery to Irwin Army Community Hospital and recorded on a Government laundry ticket supplied by the contractor. The contractor and Government shall verify counts and jointly sign the ticket to indicate agreement with those weights. A copy of each completed clean laundry ticket shall be furnished to the Government and the contractor.

5.2.2 Task. The Contractor shall transport linen in a Contractor provided vehicle.

5.2.2.1 Standard. The vehicle interior shall be cleaned and sanitized before loading the clean articles. Interior of vehicle shall be free of any holes to prevent dust and dirt during transportation.

5.2.3 Task. The contractor shall transport linen in Government provided laundry carts.

5.2.3.1 Standard. Soiled items and clean items shall not be transported in the same vehicle or laundry cart at the same time.

5.2.3.2 Standard. All clean items are to be protected from contamination and soiling during transit to Irwin Army Community Hospital. After transporting dirty/soiled/contaminated laundry, the laundry transport carts shall be cleaned and sanitized before loading the clean articles.

5.2.4 Task. The Contractor shall perform all work in a professional and sanitary manner.

5.2.4.1 Standard. Delivery of clean and finished articles shall be done under sanitary conditions.

5.2.4.2 Standard. The items shall be clean in the sense of being free from soil, stains, and objectionable odors.

5.2.4.3 Standard. All clean items shall be free from excess cleaning chemicals, bacteria, fungi, and other microorganisms, including pathogens or disease-producing organisms.

5.2.4.4 Standard. Every laundered item shall be clean, soft, and dry, and free of lint, scorch marks, and other damage to the fabric.

5.2.4.5 Standard. White fabrics shall be white and free of yellow or gray tints. Colors shall be bright and clear.

5.2.4.6 Standard. Articles shall smell fresh and clean and be free of objectionable odors, such as cleaning chemicals, mold, mildew, bacteria, body odor, and other unclean elements.

5.2.4.7 Standard. Fabrics shall be free of excess soap, bleach, and other chemicals.

5.2.4.8 Standard. Items processed on flat work and irons, such as tablecloths and napkins shall be machine-finished (ironed) so that the surfaces are smooth and without "rough-dry", spots, wrinkles, or “tails". Flat work shall be free of wrinkles and creases when received by the customer at the delivery point.

5.2.5 Task. The Contractor shall be responsible for all finish work operations as prescribed in this PWS.

5.2.5.1 Standard. The Contractor shall assemble completed work into bundles and wrap the bundles and prepare hanger work for return to MTF as indicated in Technical Exhibit

5.2.6 Task. The Contractor shall deliver clean laundry that is ready for service.

5.2.6.1 Standard: The Contractor shall re-perform unacceptable laundry at no cost to the Government.

5.2.6.2 Standard. Notwithstanding the provisions of this contract covering inspection and acceptance, any items found not meeting the requirements of paragraph 5.2.4 shall be re-cleaned at no additional cost to the Government. Such items, when found by the Irwin Army Community Hospital personnel, as packages are opened, will be identified by the COR to the Contractor's representative as soon as possible after the unsatisfactory condition is discovered. After these items are re-cleaned, the contractor shall pack these items separately and identify them by marking “Attention

COR".

5.2.6.3 Standard. Reworked items shall not be included in pickup or delivery weights.

5.2.7 Task. The Contractor shall package clean laundry.

5.2.7.1 Standard. Packaging of clean laundry will be performed as indicated in Technical Exhibit 1.

5.2.8 Task. The Contractor shall process lab coats and smocks.

5.2.8.1 Standard. Doctor/PA and lab coats and smocks shall be lightly starched and washed and hung by individual coat on hangers and covered individually with plastic film bags that do not exceed the bottom of the coat.

5.2.8.2 Standard. Lab coats and smocks shall be arranged by size and color.

5.2.8.3 Standard. Hangers shall be rust free and of a type not to stain garments.

5.2.9 Task. The Contractor shall process hospital duty whites.

5.2.9.1 Standard. Hospital Duty Whites shall be lightly starched, washed, pressed, and hung by individual ticket on hangers and covered individually with plastic film bags.

5.2.10 Task. The Contractor shall process color coded and sized items.

5.2.10.1 Standard. All items that have color coding and sizing shall be folded and bundled by item color or code color and packaged by size respectively, in accordance with Technical Exhibit 1. Examples are, but not limited to: Scrubs, pajamas, napkins, table clothes, and operating gowns. Example of bundles: Small cranberry color table clothes would be bundled together; small purple color table clothes would be bundled together but not mixed with small cranberry table clothes; or green scrub shirts with orange bands would be bundled together and not mixed with other scrub color bands.

5.2.11 Task. The Contractor shall use laundry tickets for receiving, marking, and classifying.

5.2.11.1 Standard. The Contractor shall provide a completed laundry ticket for laundry items picked up from Irwin Army Community Hospital at the time of pick up. Obtain completed laundry ticket receipt for laundered items delivered at the time of delivery. Each form will be completely filled out with nomenclature, size and quantity; date and time of pickup or delivery; with original maintained by the Government and a copy provided to the Contractor at time of pickup or delivery. Count for laundered items shall be agreed upon prior to Contractor’s departure from the MTF. Contractor and Government personnel shall both sign laundry ticket verifying the count. All disagreements in the count will be directed to the Contracting Officer for resolution.

5.2.12 Unserviceable Articles: The government will make the final determination regarding the serviceability of all linen. The contractor is responsible for identifying and sorting out all torn, badly worn, stained, soiled, and non-repairable items. These items shall be returned to the Government in bundles that are clearly marked with the word, “Unserviceable”, for classification. The Government will keep all unserviceable items at its facility and will determine disposition. The Government may require the Contractor to dye selected unserviceable linen brown on an as needed basis. The Government shall coordinate this service at least one work day ahead of time with the Contractor.

This service shall be accomplished within normal delivery service. Unserviceable or dyed articles shall not be allowed to accumulate at the contractor's facility and should be returned within 24 hours after being identified or dyed.

Unserviceable items resulting from laundry machine malfunction, use of wrong wash formulas, excessive drier heat, or any other damage or loss done at the laundry facility shall be replaced at contractor's expense.

5.3 Wash Formulas: The Contractor shall furnish to the Contracting Officer for approval a report of wash formulas to be used to clean all items provided to the Contractor for laundry services under this contract. The report shall list chemicals contained in the wash formulas. Approved wash formulas shall not be changed without proper approval of the Contracting Officer. The wash formula report shall be provided to the government with the proposal and will be approved by the contracting officer prior to start of performance.

5.4 Quality Control Plan (QCP): The contractor shall establish and maintain a complete QCP to ensure the requirements of this contract are provided as specified. Offeror shall submit a Quality Control Plan with its technical capabilities package, per Addendum to FAR 52.212-1. The CO will notify the contractor of acceptance or required modifications to the plan. The contractor shall make appropriate modification at no additional cost to the Government and obtain acceptance of the plan by the CO.

5.5. Performance Requirements Summary.

Performance Objective PWS Para Performance Threshold

Turn-around time shall not exceed 24 hours. 5.2.1.1 Shall meet turn-around time at least 95% of the time within each calendar month.

Completed soiled laundry ticket shall be furnished upon pickup before departure. 5.2.1.2

Shall furnish soiled laundry ticket upon pickup of soiled laundry 100% of the time within each calendar month.

Completed clean laundry ticket shall be furnished upon delivery before departure. 5.2.1.3

Shall furnish clean laundry ticket upon delivery of laundry 100% of the time within each calendar month.

Vehicle interior shall be cleaned and sanitized before loading clean articles. 5.2.2.1 Shall meet requirement at least 100% of the time within each calendar month.

Soiled items and clean items shall not be transported in the same vehicle or laundry cart at the same time.

5.2.3.1 Shall meet requirement at least 100% of the time within each calendar month.

Cleaned laundry items shall be clean in the sense of being free from soil, stains, and objectionable odors.

5.2.4.2 Shall meet requirement at least 95% of the time within each calendar month.

Flat work shall be free of wrinkles and creases when received by customer. 5.2.4.8 Shall meet requirement at least 90% of the time within each calendar month.

The Contractor shall re-perform unacceptable laundry at no cost to the Government. 5.2.6.1

Shall provide acceptable laundry, not requiring re-performance, at least 95% of the time within each calendar month.

Packaging of clean laundry will be performed as indicated in Tech Exhibit 1. 5.2.7.1 Shall meet requirement at least 95% of the time within each calendar month.

All items that have color, color coding, and sizes will be packaged by item color or code color and packaged by size as indicated in Tech Exhibit 1.

5.2.10.1

Shall meet requirement at least 95% of the time within each calendar month.

ATTACHMENT 1

01 March 2026

ESSENTIAL CONTRACT SERVICES

a. The contractor provided services that have been determined to be essential contractor services in support of the mission essential functions are:

1. Emergency Room Patients and Staffing

2. Operating Room Patients and Staffing

3. In-Patient and Support Staffing

4. Laboratory Support Staffing

5. Hospital Housekeeping

6. Linen/Laundry

7. Nutrition Care

EXHIBIT 1

IDENTIFICATION, STANDARD PACKAGING AND METHOD OF FINISH FOR

IRWIN ARMY COMMUNITY HOSPITAL

The following are the routine requirements for packaging of laundry and the method of finishing for this contract (quantities, packaging and finishes are at local discretion). Any other special packaging requirements or methods of finishing will be specified in writing at the time that service is requested.

Definitions of Abbreviations for special handling methods of finish are as follows:

A Air Dried (No Heat) B Bagged on Hanger BU Bundled & Shrink Wrap FWI Flat Work Iron F Fold H Press and Hang L Light Starch O On Hanger and Delivered Hung P Press S Sort by Color and Size

The items listed below will be included in the yearly laundry service. Types of items are not limited to only the items listed below, but do indicate the items to be processed. These figures are based on an estimate, which may vary either higher or lower.

ITEMS TO BE LAUNDERED ESTIMATED

QUANTITY PER YEAR

NUMBER

PER BUNDLE

SPECIAL

HANDLING

METHODS

Hospital Linen Bag, Linen Hamper, blue, vinyl 50 Per Day A, Place in Cart Bedspread, Lt weight, WH 2,420 5 FWI, F, BU Blanket, Bed Cotton, White, 66" x90"

12,590 3 F, BU

Blanket, Infant, Striped 11,970 10 F, BU Curtain, Cubicle, various sizes 300 1 FWI, F, BU Crib Cover, Green 355 5 F, BU Eye Drape, Large (2" hole) 22"x22" 150 10 F, BU Eye Drape, green, w/hole, Small 150 10 F, BU Gown, Maternity, pink or pattern 1,410 5 S, F, BU Gown, Patient, Adult, All Sizes 25,945 10 S, F, BU Gown, White, Surgical, All Sizes 935 5 S, F, BU Gown, Oper Surg Green, All Sizes 1,740 5 S, F, BU Pad, Mattress 9,090 5 F, BU PJ, adult, Bottom, Various sizes 100 10 S, F, BU PJ, adult, Top, Various Sizes 60 10 S, F, BU PJ, Child, Bottom, 4 sizes by color

190 10 S, F, BU

PJ, Child, Top, 4 sizes by color 260 10 S, F, BU Pillow, Bed, vinyl 240 1 A, BU Pillowcase, Cotton, Blue 14,875 25 FWI, F, BU Pillowcase, Cotton, Green 10,735 25 FWI, F, BU Undershirt, Infant 4,920 10 F, BU

Robe, Seersucker, Med and Large 2,350 5 S, F, BU Scrub, Pant, Green, Sized 19,000 10 S, F, BU Scrub, Pant, Four Colors/sized 5,000 10 S, F, BU Scrub, Shirt, Green, Sized 19,365 10 S, F, BU Scrub, Shirt, Four Colors/sized 5,000 10 S, F, BU Sheet, Fitted, White, Cotton 6,300 5 F, BU Sheet, Flat, Green, Cotton 23,520 10 FWI, F, BU Sheet, Flat, White, Cotton 46,870 10 FWI, F, BU Towel, Bath (Green) 34,315 10 F, BU Towel, Bath (Hospital Property) 33,485 10 F, BU Towel, Hand, Green Misty 19,845 25 F, BU Towel, Surgical, Cecil Blue 16,710 25 F, BU Under-pad with wing 500 5 F, BU Wash Cloth, 13" x 13", White 23,100 25 BU Wrapper, Green, Five Sizes 10,555 10 S, F, BU

Special Items Apron, Dining Facility 500 Per Ticket L, H, O, B Coat, Lab or Physician, White, Sized

3,000 Per Ticket L, S, H, O, B

Coat, Lab or physician, Colors, Sized

4,200 Per Ticket L, S, H, O, B

Dying of Unserviceable Linen 500 Pounds Per Order Place in Cart Napkin, Various Colors 200 10 L, S, P, BU Shirt, White, Duty Uniform, sized 3,250 Per Ticket L, H, O, B Table Clothes, Various sizes and color

140 5 L, S, FWI, BU

Trouser, White, Duty Uniform, Sized

3,250 Per Ticket L, H, O, B

END OF THE PERFORMANCE WORK STATEMENT

SUPPLEMENT TO THE PERFORMANCE WORK STATEMENT

1. GOVERNMENT HOLIDAYS:

New Year’s Day, January 1st Martin Luther King, Jr.’s Birthday, 3rd Monday in January President’s Day, 3rd Monday in February Memorial Day, Last Monday in May Juneteenth, June 19th Independence Day, July 4th Labor Day, 1st Monday in September Columbus Day, 2nd Monday in October Veteran’s Day, November 11th Thanksgiving Day, 4th Thursday in November Christmas Day, December 25th

Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contractor is scheduled to perform maintenance is closed due to a holiday declared by an Executive Order and the contractor is not required to report in, contractor shall service equipment on the available day staff will be present. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

2. INVOICING AND PAYMENT

The contractor shall submit an itemized invoice no more than 30 days after the preventive maintenance service is completed, in accordance with DFARS 252.232-7003 & 252.232-7006, for services rendered under this contract.

Information regarding Wide Area Workflow is available on the Internet at https://piee.eb.mil.

3. TOBACCO FREE MEDICAL CAMPUS (TFMC)

The contractor shall ensure that all contract personnel comply with the U.S. Army Medical Command and MTF smoking policies while performing services under this contract. Smoking restrictions will apply at any location or building where health care activities are performed under this contract.

In accordance with Army Regulation 600-63, paragraph 7-3, 14 April 2015; Operations Order 15-48 (Army Medical Command (MEDCOM) Tobacco Free Living – USAMEDCOM), 8 May 2015; and any Operations Order, regulation or other instruction implementing, defining or otherwise addressing the Tobacco Free Medical Campus (TFMC) on any military installation or DoD-controlled location, contractor personnel are prohibited from using any tobacco product on or within any TFMC while performing under this contract. TFMCs are established at each installation or DoD-controlled location and include: (1) any property or non-residential building that is operated, maintained or assigned to support medical activities, including but not limited to, hospitals, medical laboratories, outpatient clinics (including medical, dental, and veterinary facilities), or aid stations operating for the primary purpose of delivering medical care and services for DOD eligible beneficiaries and /or meeting the mission of the Army Medical Command; (2) all other facilities in which medical activities or administration take place, to include HQ MEDCOM and Defense Health Headquarters; (3) all internal roadways, sidewalks and parking lots; and (4) all sidewalks, parking lots and grounds external but adjacent to the building or related to the migratory corridors surrounding the medical facility. The contractor shall obtain from the GPOC any orders, regulations, instructions or other documents implementing, defining or otherwise addressing the TFMC for any given installation or DoD-controlled location where contractor personnel may perform under this contract and shall instruct contractor personnel on the TFMC limitations for installations or DoD-controlled locations where they may perform under this contract.

4. EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE PROGRAM Exclusion from Participation in Federal Health Care Programs (October 2015)

a. The contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at h ttp://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at h ttp://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of- H ealthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

b. Prior to start of contract performance, the contractor shall (a) query the Lists to determine whether the name of any person the contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the contractor has queried the Lists and no such names appear on either of the Lists.

c. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

d. The contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of contractor personnel working in the MTF against the Lists, as specified in OTSG/MEDCOM Policy Memo 15-037. The government will notify the contractor in the event any contractor personnel working in the MTF appear on either of the Lists.

e. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the contractor shall (a) in cases where the contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

https://piee.eb.mil/ http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-

f. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

g. The contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a- 7a): There are steep civil monetary penalties associated with billing the government for providing items or services by a person on either of the Lists, and with failing to return to the government any overpayments received for provision of such items or services.

Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP.

The Special Advisory Bulletin may be found at h ttp://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

4. Personally Identifiable Information, Protected Health Information, and Federal Information Requirements (Revised 10/27/2020)

General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The contractor shall also comply with requirements relating to records management as described herein.

This contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

1. DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S.

Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management When creating and maintaining official government records, the contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter http://www.dtic.mil/whs/directives

XII, Subchapter B – Records Management. The contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA) The contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier.

Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and government confirmation of contractor authority to operate the applicable system(s), the contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA) If DHA data is stored on a contractor owned system, a PIA is required from the contractor.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data) http://www.foia.gov/ mailto:DHA.FOIA@mail.mil http://www.defenselink.mil/privacy/documents/pa1974.pdf mailto:DHA.PrivacyAct@mail.mil

The contractor shall consult with the DHA Privacy Office to determine if the contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the contractor must gain approval from the DHA Privacy Board. Thus, the contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSA for De-Identified Data DSA for PHI DSA for PII Without PHI DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (Applies if contract requirements may include human subject research) This contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

7. Privacy Act and HIPAA Training The contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

8. HIPAA Business Associate Provisions

8.1 Business Associate – General Provisions

The contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-http://www.tricare.mil/tma/privacy/Templates.aspx https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS

Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS. b.i. and (3)b.ii.

9. Breach Response [This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference.

9.1 Definitions Related to Breach response

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral

PII/PHI).

9.1.3 A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

How the event was discovered.

Did the information stay within the covered entity’s control.

Was the information actually accessed/viewed; and Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4 A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

9.1.5 A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;

The unauthorized person who used the PHI or to whom the disclosure was made;

Whether the PHI was actually acquired or viewed; and The extent to which the risk to the PHI has been mitigated.

9.1.6 A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

9.2 General

9.2.1 The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

9.2.2 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the contractor shall implement these breach response requirements immediately upon the contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach

vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

9.2.4 In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency Readiness Team (US-CERT) reporting (see paragraph 9.3).