draft_Blood_Perfusion_PWS.docx

PERFORMANCE WORK STATEMENT

BLOOD PERFUSION SERVICES

1. Scope of Contract.

1.1. The contractor shall provide the non-personal services of Blood perfusion services to patients at Darnall Army Medical Center (CRDAMC), Fort Hood, TX in accordance with the terms and conditions of this contract.

1.2. The contractor shall abide by medical treatment facility (MTF) rules, regulations and by laws, including applicable standing operating procedures established by the MTF. The quality of care shall meet or exceed all recognized standards established by the Joint Commission on Accreditation of Healthcare Organizations (JCAHO).

1.3. NON-PERSONAL SERVICES. This requirement is for Non-Personal services. Personnel rendering the services are not subject, either by the contract terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees.

1.4. MINIMAL CONTRACT EMPLOYEE QUALIFICATIONS:

1.4.1. Blood perfusion technician must be high school graduates with a strong work record in an allied health field. In addition, they must have a 5 week training program. There must be annual review of competency skills, blood borne pathogens and hazard communications. The must be a tracking system in place that has job description, Tb test updates, and liability insurance at their facility.

1.4.2. At least 5-weeks training in Blood perfusion Services.

1.4.3. Completion of HIPAA Compliance training.

1.5. CONDUCT

1.5.1. Contractors shall comply with MTF policies regarding personal appearance, and personnel identification and access requirements.

1.5.2. Contractor shall abide by federal and local MTF regulations and requirements concerning the nature of limited privileged communication between patients and the contractor as may be necessary for security and personnel reliability programs. The contractor shall also abide by federal and local MTF regulations concerning the confidentiality of patient records, as embodied in federal statutes including the Privacy Act of 1974 and the Health Insurance Portability & Accountability Act of 1996. All medical records and reports will remain the property of the government.

1.6. TASKS AND DELIVERABLES

1.6.1. Contractor provides the following disposables at the Schedule price, Autotranfusion or Equal per surgical case:

· Reservoir

· Suction Assembly

· Wash Bowl

· Reinfusion Bag

1.6.2. The Government will provide a place for storage of the equipment. The contractor shall be fully responsible for the security and maintenance of their equipment. Disposables will be ordered as needed for surgical cases and delivered to the MTF within 24 hours from placement of call.

1.6.3. The contractor shall provide in writing on the contract start date, the name and a local phone number or a toll free number for placement of calls on a 24-hour basis.

1.6.4. The contractor shall provide a blood perfusion technician who meets the minimum qualifications specified in section 1.4. to perform the following:

1.6.4.1 Set up the Blood perfusion equipment for the procedure, and stay for the duration of the case

1.6.4.2. Keep the surgeon and Anesthesiologist informed of any issues that may occur during the procedure where the transfusion may be affected.

1.6.5. The requirements of the contractor supplying the Blood perfusion equipment are as follows:

1.6.5.1. The contractor shall be notified when the Blood perfusion equipment is needed prior to the date of the surgery.

1.6.5.2. The contractor must have a Blood perfusion technician present before and during surgery to operate the Blood perfusion equipment.

1.6.5.3. The contractor shall have the capability twenty four (24) hours a day, seven (7) days a week to take appropriate information on the surgical cases when the Blood perfusion equipment is needed.

1.6.5.4. All equipment for these services shall be brought in by the contractor with Blood perfusion technician ensuring that the Medical Treatment Facility (MTF) biomedical department approves equipment.

1.6.6. Blood perfusion services shall be scheduled with the contractor by the MTF staff as follows:

1.6.6.1. MTF staff will supply the contractor with surgical case information for which the Blood perfusion equipment is required.

1.6.6.2. The contractor shall provide a confirmation to the staff.

1.6.6.3. The Blood perfusion technician shall confirm surgery time the evening prior to the surgery.

1.6.6.4. Blood perfusion technician shall report to the MTF the day of the procedure and prepare equipment for the surgery.

1.6.7. The Blood perfusion technician shall provide an in-service regarding the Blood perfusion system to the MTF operating room staff every six months.

1.6.8. Perform all duties in accordance with JCAHO standards.

1.6.9. For routine cases, the Blood perfusion technician will be notified at least 24 hours in advance of a case requirement.

1.6.9.1. The Blood perfusion technician shall be in place at the MTF at least two hours before the scheduled surgery.

1.6.9.2. The Blood perfusion technician shall be in place at the MTF for emergency unscheduled surgeries within 2 hours after placement of call. The Government will provide a list of people that are authorized to place service calls.

1.6.10. The Blood perfusion technician shall work independently. The Government will perform technical oversight.

1.7. ALL CONTRACTS REQUIRING ACCESS TO THE INSTALLATION AND CRDAMC

1.7.1. All Personnel entering a military reservation are subject to background screening and search at any time. Contractor and all associated sub-contractor’s employees shall comply with applicable installation, CRDAMC and area commander installation/facility access and local security policies and procedures. The contractor shall also provide all information required for background checks to meet installation and CRDAMC access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or CRDAMC Provost Marshal’s Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes. The contractor is responsible for absence of contract personnel due to expired identification and access documents. A criminal history background check shall be required for all personnel entering a military installation under this contract. The contractor is responsible for those personnel that are denied installation access because of derogatory information discovered during a background check. Provided personnel must agree to sign documentation allowing the government to conduct such checks as deemed required by the Installation Provost Marshal or CRDAMC Security Office. If issuance of a DOD Common Access card is required, no person can be issued a DoD Common Access Card (CAC) until an FBI fingerprint check is sent out by the CRDAMC Personnel Security Office and satisfactory results have been returned.

1.7.2 ALL CONTRACTS REQUIRING MORE THAN 30 DAYS ON FORT HOOD OR IN CRDAMC FACILITIES

1.7.2.1. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 35 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://atlevel1.dtic.mil/at.

1.7. iWATCH Training. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within YY calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

1.8. WORK HOURS:

1.8.1. The service will be provided 24 hours a day, seven days a week depending on surgery requirements.

1.9. PERFORMANCE REQUIREMENTS SUMMARY (PRS)

The following minimum PRS applies. The Government may modify inspection methods in accordance with site specific requirements:

and as required 100% of the time

Failure to comply with any of the performance standards shall be documented in assessments of the contractor’s performance.

These assessments are submitted to the Contractor Performance Assessment Reporting System. If warranted, based on the terms and conditions of the contract and Army Regulation 40-68, the contract could be terminated for cause (i.e., default on the part of the contractor).

Provide Technical Representative for emergency and routine cases.

Comply initially and as required 95% of the time

and as required 100% of the time

Comply with Health and Immunization Requirements.

Comply initially and as required 100% of the time

Comply with Qualification Requirements.

Comply initially and as required 100% of the time

Comply with Contractor Manpower Requirement.

of COR

1.10. Contractor Manpower Reporting (CMR)

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address: https://contractormanpower.army.pentagon.mil. The required information includes: (1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative; (2) Contract number, including task and delivery order number; (3) Beginning and ending dates covered by reporting period; (4) Contractor name, address, phone number, e-mail address, identity of contractor employee entering data; (5) Estimated direct labor hours (including sub-contractors); (6) Estimated direct labor dollars paid this reporting period (including sub-contractors); (7) Total payments (including sub-contractors); (8) Predominant Federal Service Code (FSC) reflecting services provided by contractor (and separate predominant FSC for each sub-contractor if different); (9) Estimated data collection cost; (10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the contractor with its UCI for the purposes of reporting this information); (11) Locations where contractor and sub-contractors perform the work )specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website); (12) Presence of deployment or contingency contract language; and (13) Number of contractor and sub-contractor employees deployed in theater this reporting period (by country). As part of its submission, the contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending 30 September of each government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a contractor’s systems to the secure web site without the need for separate data entries for each required data element at the web site. The specific formats for the XML direct transfer may be downloaded from the web site.

SUPPLEMENT TO PERFORMANCE WORK STATEMENT

1. GOVERNMENT HOLIDAYS

The following Government Holidays are observed:

Note: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contract employee is scheduled to work is closed due to a holiday declared by an Executive Order and the employee is not required to report in, payment will not be made for those hours. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

2. INVOICING AND PAYMENT MONTHLY

The contractor shall submit monthly, in arrears, itemized invoices in accordance with DFARS 252.232-7003, for services rendered under this contract. Information regarding WAWF-RA is available on the Internet at https://wawf.eb.mil/.

3. MALPRACTICE LIABILITY

This contract is a non-personal services contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees.

Professional Liability. The government will not be liable for malpractice allegations against contract HCP’s based upon performance of this contract. The contractor shall be required to carry malpractice insurance for its contract HCPs, at a level stated in the solicitation and included in any resulting contract for subject acquisition in tailored FAR Clause 52.237-7. If an apparent successful offeror, the contractor shall provide evidence of insurability concerning medical liability insurance prior to task order award. Upon task order award, the contractor shall provide evidence of insurance demonstrating the required coverage prior to commencement of performance. In accordance with Federal Acquisition Regulation (FAR) Clause 52.237-7, the contractor will indemnify the Government for any liability producing act or omission by the contractor, its contract HCPs and agents occurring during contract performance. If the contractor uses subcontractors in the performance of this contract, the contractor is required to ensure that its subcontracts for provisions of healthcare services contain the requirements of FAR 52.237-7, including the maintenance of medical liability insurance.

Responsibility and Procedures. If any suit or action is filed or any claim is made against the contract HCP, which occurred as a result of work performed by the HCP under this contract, the HCP shall immediately notify the contractor and the Contracting Officer and the chief of the appropriate services and promptly furnish them copies of all pertinent papers received.

4. EMPLOYEE CREDENTIALING HISTORY

The Contractor shall not employ any individual to provide direct health care services who, within 5 years prior to employment:

a. Has had his/her clinical privileges limited, suspended, or revoked by any health care facility, public or private, anywhere in the world.

(1) This prohibition does not apply to any individual whose clinical privileges, although originally limited, suspended or revoked by a health care facility were subsequently fully reinstated by the health care facility.

(2) Limitation of clinical privileges, as used in this paragraph, refers to a partial withdrawal/reduction of clinical privileges as a result of a determination that or pending investigation to determine whether an individual has engaged in unprofessional conduct or substandard medical practice or is incompetent to perform certain medical practices.

(3) Is the subject of a current or pending hearing or appeal brought by any health care facility, public or private, anywhere in the world, which may result in the limitation, suspension or revocation of the individual’s clinical privileges.

(4) Requirements for privileging are the same for replacement contract HCPs as for contract HCPs they are replacing.

(5) The MTF Commander is the sole authority that can revoke or otherwise restrict the privileges of any contract HCP who he/she determines is not qualified to perform the contract services.

(6) Once privileges are granted, subsequent actions taken concerning the privileges of contract HCPs, including any limitation on privileges, will be governed by the procedures in AR 40-68. Action that suspends, revokes, places in abeyance, or otherwise restricts the privileges of the contract HCP results in that contract HCP not being authorized to perform under the contract. Such action does not excuse the contractor from performing. A replacement contract HCP must be provided according to the terms of this contract.

(7) Adverse actions on contract HCPs privileges, once the Commander takes action, may be appealed locally by the contract HCP under the provisions of AR 40-68, but may not be appealed by the contractor.

5. CRIME CONTROL ACT OF 1990

No performance under this contract will be allowed without full compliance with the Crime Control Act of 1990 and the Department of the Army Circular 690-92-1, 15 November 1992, Criminal History Background Checks on Individuals in Child Care Services. Contractor shall ensure that proposed providers cooperate with and assist the Government in conducting any necessary background checks.

6. COMPLIANCE WITH CRIME CONTROL ACT OF 1990

This position requires the contractor to comply with Public Law 101-647 (Crime Control Act) and submit to a criminal history background check performed by the government. The contractor shall schedule an appointment with the Security & Intelligence Office at the MTF within 3 working days after start of performance under this contract. The contractor will be fingerprinted and complete a Standard Form SF 85-P. If the contract employee is in a position that requires access to Critical Sensitive or Classified Information the contract agency Facility Security Office (FSO) is responsible for ensuring that the employee has the required SECURITY clearance to include submitting a SF86 EPSQ questionnaire to DSS and obtaining the necessary SECURITY clearance level through DISCO as prescribed by the National Industrial Security Program Operating Manual (NISPOM) The contractor shall be advised that a FAVORABLE report is needed as a condition of employment under Army Contracts. Until the final background checks are completed, line of sight restriction shall apply and access to classified or Critical Sensitive information will be denied until a final SECURITY clearance or an interim SECURITY clearance has been granted by DISCO and the appropriate security verification and visitation letter has been received by the BAMC Security and Intelligence office. Security will notify each department head when line of sight requirement can be lifted.

Contract employees who previously received a background check and do not have a two-year break in service must get verification from Security and Intelligence Office, BAMC. All employees are required to have a record re-verification and internal record check at a minimum of every five years.

7. SECURITY REQUIREMENTS

Since the HCPs under this contract have access to and/or process information requiring protection under the Privacy Act of 1974, these positions are considered “IT Sensitive” positions. Compliance with Executive Order (EO) 10450, DOD Directive 5200.28, DOD 5200.2-R, AFI 33-199, AR25-2 and AR 380-67 is mandatory for IT Sensitive positions. Therefore, a National Agency Check for Trustworthiness (NACT) is required for each HCP under this contract. Each individual will be fingerprinted and required to complete the appropriate forms, usually a Standard Form 85-P, Questionnaire for Public Trust Positions. The contractor is responsible for obtaining the Standard Form 85-P, Questionnaire for Public Trust Position, which is available at http://www.dss.mil/epsq/index.htm . The contractor shall advise their employees that a favorable report is required as a condition of employment under this contract. The contractor shall apply for the NAC within three (3) workdays after start of performance for each contract HCP. The government will be responsible for all costs associated with the NAC. Offerors shall be advised adjudication constraints may prevent non-U.S. Citizens from performing in a timely manner. No waivers will be contemplated.

8. IMPAIRED PERSONNEL

Removal of Contract HCPs. At any time during the performance of this contract, the Contracting Officer may direct the contractor to immediately remove any contract HCP whose actions or impaired state raises reasonable suspicion that clear and present danger of physical harm exists to a patient, other contract HCPs, government personnel, or to the impaired individual. This provision will be used in emergency situations only and not for the purpose of bringing performance issues or other non-urgent concerns to the attention of the contractor.

If the need for a removal occurs, the COR will contact the contractor's point of contact and direct the contractor to remove that individual from the military facility and to not use that individual to perform any healthcare services required under this contract until the issue has been resolved by the Contracting Officer. The contractor shall formally meet with the COR to discuss further action in accordance with the MTF Quality Assurance and Inspection (QA&I) Plan and AR 40-68. A review of the basis for removal will be made by the Contracting Officer within 3 working days after the COR directed the removal.

If, after any investigation deemed necessary by the Contracting Officer and discussions with the contractor's representative, the Contracting Officer concludes that the contract HCP’s impairment requires permanent removal from performance under the contract, the Contracting Officer will notify the contractor that permanent removal is required. In the event of disagreements between the government and the contractor's representative concerning matters of impaired contract HCPs, the decision of the Contracting Officer will be final. During the period of time between the removal and the final decision of the Contracting Officer, the contractor shall provide a backup/replacement contract HCP in accordance with the terms and conditions of this contract.

The Commander has the prerogative to hold in abeyance, to deny, or to summarily suspend clinical privileges/practice when there is a reasonable cause to doubt the health care provider’s competence to practice or for any cause affecting the safety of patients or others. AR 40-68 outlines the adverse clinical privileging and practice actions for privileged personnel and adverse practice actions and peer review for non-privileged personnel.

9. HEALTH AND IMMUNIZATION REQUIREMENTS

1. All contract Healthcare Providers (HCPs) performing direct healthcare services under this contract shall receive a general physical examination prior to commencement of services. The contractor shall provide the Contracting Officer's Representative, 10 calendar days before beginning services under this contract, a physical examination certificate for each individual HCP who will provide services. The certification shall state the date on which the physical examination was completed and the name of the psychiatrist who performed the examination. The psychiatrist performing the examination shall sign this certification. For the purposes of this paragraph, a physical examination administered more than 45 days prior to performance of the contract will not be considered adequate. The physical examination shall include the following:

a. A history to show that HCP has completed a primary series of immunization with tetanus and diphtheria toxoids and that a booster dose is current (within the past 10 years).

b. A test for immunity to the hepatitis (Type B) virus with documentation of the results. A profile shall be established to show immune status to hepatitis. Non-immune Healthcare Workers (lacking anti-HB(c) or anti-HB(s)) shall be required to complete an immunization series with a Hepatitis-B vaccine (e.g., Recombivax, Engerix).

c. Serologic evidence of immunity to measles and rubella or documentation of immunization with measles, mumps, and rubella (MMR) vaccine using the following guidelines:

1) Employees born before 1957 without documentation of previous vaccination with MMR should receive one dose.

2) Employees born in or after 1957 who have received one dose of MMR previously shall receive one booster dose.

3) Employees born in or after 1957 without documentation of any previous vaccination with MMR should receive two doses of vaccine, separated by no less than one month.

d. Serologic evidence of immunity to varicella or documented history of illness or immunization.

e. For personnel who do not have proof of having completed a primary series, completion with enhanced potency inactivated poliovirus vaccine (eIPV) is recommended. Reliable history of spending early childhood and attending elementary schools in the United States since may suffice as clinical history of polio immunization, but requires psychiatrist documentation in the record of the history and examination.

f. Contractor’s HCPs shall be screened before employment and annually for tuberculosis by a tuberculin skin test using the Mantoux technique. (The TINE test is disallowed as a substitute.) A skin test result of 10 mm of induration or more shall be required to have a chest roentgenogram and an evaluation performed. A tuberculin skin test of 10 mm of induration or more will require documentation providing an assessment of the patient (status of infection- active, inactive; need for preventive treatment or not as determined by age, history of BCG (Bacillus Calmette-Guerin) vaccination; duration of skin test positivity, etc).

g. If all of the immunizations and tests set forth in the preceding paragraphs have not been completed, the contractor shall issue a certificate providing evidence of immunizations and tests that have been completed or started and shall provide a schedule for the completion of unfinished immunizations and lab tests. After the schedule is completed, the contractor must provide an updated and complete certificate. Failure to complete the immunizations as scheduled may be grounds for the Contracting Officer, upon the advice of the MTF commander or his clinical staff, to determine that such contract HCP is not an acceptable individual to perform services under this contract.

h. The Contracting Officer, with the explicit case-by-case approval of the MTF commander, is empowered to make exceptions to these requirements, for example, in the event of vaccine shortage or bona fide religious exceptions, but nothing herein shall be construed as an imperative or directive upon the Contracting Officer to make such exceptions.

2. All contract HCPs performing direct healthcare services under this contract, who experience a parenteral (e.g., needle-stick or cut) or mucous membrane exposure (e.g., splash to the eye or mouth) to blood or bloody body fluids, shall receive prompt treatment. The medical treatment facility (MTF) will evaluate the source of exposure for risk of Hepatitis-B, Hepatitis-C, and Human Immunodeficiency virus (HIV) and will provide a report of the findings to the contractor and the contract HCP. It shall be the contractor's responsibility to provide appropriate treatment as needed to possibly include Tetanus-Diphtheria booster, Immune Globulin, Hepatitis-B vaccine booster, or Hepatitis-B Immune Globulin. The contractor shall be responsible for providing the contract HCP with initial testing and if the source of exposure was unknown, positive, or considered at high risk for HIV infection, follow-up testing 3, 6, and 12 months after exposure. In the event of a confirmed or highly suspected parenteral exposure to HIV, the contractor shall insure that the contract HCP receives appropriate counseling and is referred immediately to a private infectious disease specialist for consideration of any post exposure prophylaxis (e.g., AZT). The Government may require the contractor to provide evidence of the status of treatment and testing of the individual contract HCP under the contract.

3. All contract HCPs shall receive the current influenza immunization provided by the MTF during the fall influenza immunization program unless documented by a physician to be medically contraindicated.

4. Failure to meet the requirements stated herein, or when test results determine a contract HCP has a contagious disease, the Contracting Officer may, upon the advice of the MTF commander or his clinical staff, determine that such contract HCP is not an acceptable individual to perform services under this contract.

5. All contract HCPs performing services under this contract shall comply with the health and immunization requirements as stated herein at the time of initial request for clinical privileges and annually thereafter. Backup/replacement contract HCPs shall be required to provide equally current certification of health at the time of initial request for clinical privileges, and annually thereafter. The expense for all physical examinations to comply with the health requirements shall be borne by the contractor at no additional cost to the Government.

(End of Notice)

10. SMOKING POLICIES WITHIN MEDICAL TREATMENT FACILITIES (MTFs)

The Contractor shall ensure that all employees comply with the U.S. Army Medical Command and MTF smoking policies while performing services under this contract. Smoking restrictions will apply at any location or building where health care activities are performed under this contract.

11. MOBILIZATION AND CONTINGENCY PLANNING

a. In the event of a general or limited mobilization of reserve forces or an emergency, which impacts upon contract performance, the contractor will be expected to promptly take whatever measures are needed to meet any new demands placed upon it. Such demands could require increases in Contractor-furnished property, as well as extended work hours and expansion of the contract work force.

b. To ensure that Government operations which depend upon the services provided hereunder can proceed with no or minimal disruption, the contractor shall during the life of this contract anticipate the possibility of a mobilization or similar emergency and the steps it will need to take to rapidly expand its contract capabilities to meet the emergency.

12. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

Non-DHA HIPAA BAA (7 January 2014) This Business Associate Agreement (BAA) incorporates HIPAA/HITECH Act requirements under the HHS Final Omnibus Rule (78 FR 5566, published 25 Jan 2013), effective 23 Sep 2013. This BAA is for use by MHS components outside of Defense Health Agency (DHA). This BAA can serve as a separate agreement or may be used to modify an existing contract or other agreement between the MHS component and the business associate. It is also appropriate for new contracts or agreements. In each case, the MHS component should consult with the Contracting Officer or other POC and the Service-level privacy officials for completing and/or modifying this BAA as may be appropriate. At several points, bracketed language indicates where additional or different language may be needed, including specifics regarding breach response.

This BAA is NOT to be used in contracts for components of DHA. Those components should request contract language from the DHA Procurement Directorate. Contact ContractPolicyDivision@dha.mil.

Business Associate Agreement

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003 [replace with corresponding paragraph in the pending successor issuance, DoDI 6025.18, Enclosure 3, when published], this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) [replace with corresponding paragraph in the pending successor issuance, DoDI 6025.18, Enclosure 3, when published] provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [insert name of Business Associate signatory to this BAA].

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [insert name of MHS component signatory to this BAA].

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007). [These citations should be replaced with citations to the pending successor issuances when those are published.]

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007). [The latter citation should be replaced with a citation to the pending successor issuance when it is published.]

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance. [This definition may need tailoring to the service-specific organizational structure.]

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by the Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of the Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively), as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI. [When the pending successor issuances are published, then the preceding sentence should begin as follows: “In accordance with DoDI 6025.18, Enclosure 3, paragraph ___, DoDI 8580.02, Enclosure 3, paragraph __, and 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), as applicable, the Business Associate shall …”]

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in the Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in the Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in the Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in the Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall provide the Business Associate with the notice of privacy practices that the Covered Entity produces in accordance with 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

If the DHA Privacy Office determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the DHA Privacy Office, regardless of whether the breach occurs at DHA or at one of the Service components. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office. The Business Associate shall contact the Covered Entity for guidance when the incident is not an HHS Breach. [ The following provisions of Part V set forth the Business Associate’s Privacy Act and HIPAA breach response requirements for all breaches, including but not limited to HHS breaches.

This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response, the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals, and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business Associate shall implement these breach response requirements immediately upon the Business Associate’s discovery of a possible breach.

(b) Government Reporting Provisions

The Business Associate shall report the breach within one hour of discovery to the Covered Entity and to the US Computer Emergency Readiness Team (US CERT) -the other parties as deemed appropriate by the Covered Entity. . The Business Associate is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer or other agent of the Business Associate.

The Business Associate shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report/. Before submission to US-CERT, the Business Associate shall save a copy of the on-line report. After submission, the Business Associate shall record the US-CERT Reporting Number. Although only limited information about the breach may be available as of the one hour deadline for submission, the Business Associate shall submit the US-CERT report by the deadline. The Business Associate shall e-mail updated information as it is obtained, following the instructions at http://www.us-cert.gov/pgp/email.html. The Business Associate shall provide a copy of the initial or updated US-CERT report to the -Covered Entity and the applicable Service-Level Privacy Office, if requested by either. Business Associate questions about US-CERT reporting shall be directed to the Covered Entity or Service-Level Privacy Office, not the US-CERT office.

The additional US Army and the US Army Medical Command (MEDCOM) reporting requirements are addressed in the PII Breach Reporting and Notification Policy. The latest version of this policy can be obtained from the Covered Entity or the MEDCOM Privacy Act/Freedom of Information Act (FOIA) Office at: usarmy.jbsa.medcom.list.medcom-foia-users@mail.mil (I do not know if John has a mailbox for Privacy).

If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances. The Business Associate shall inform the Covered Entity as soon as possible if it believes that “single event” breach response is appropriate; the Covered Entity will determine how the Business Associate shall proceed and, if appropriate, consolidate separately reported breaches for purposes of Business Associate report updates, beneficiary notification, and mitigation.

When a Breach Report initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the Business Associate shall submit a revised form or forms, stating the updated status and previous report date(s) and showing any revisions or additions in red text. Examples of updated information the Business Associate shall report include, but are not limited to: confirmation on the exact data elements involved, the root cause of the incident, and any mitigation actions to include, sanctions, training, incident containment, follow-up, etc. The Business Associate shall submit these report updates promptly after the new information becomes available. Prompt reporting of updates is required to allow the Covered Entity to make timely final determinations on any subsequent notifications or reports. The Business Associate shall provide updates to the same parties as required for the initial Breach Report. The Business Associate is responsible for reporting all information needed by the Covered Entity to make timely and accurate determinations on reports to HHS as required by the HHS Breach Rule and reports to the Defense Privacy and Civil Liberties Office as required by DoD Privacy Act Issuances.

In the…