Questions for 15BCTS21Q00000024.pdf

Questions regarding the Federal Bureau of Prisons solicitation

15BCTS21Q00000024

February 23, 2021

Question:

Using the recent events of COVID-19, our company believes we can serve many of the untreated population through tele-psychiatry and tele-counseling services.

Would the Federal Bureau of Prison Community Treatment Services/Contracting be interested in allowing our company to bid on contracts for underserved areas using telehealth technology?

Answer:

Please review the Technical Quotation Information packet in the solicitation(s) where it addresses the tele-health opportunity.

The contractor must meet the requirements of the Statement of Work. A physical site with staff present with the inmate while tele-health is happening is required. This allows for services during the current pandemic, however there will be a resumption of services in person and tele-health when it is safe to do so.

CTS is allowing the use of tele-health services with Contractors during COVID-19 contingency operations, and not as the ONLY services to be provided during the course of the 5 year contract.

All treatment services must be provided face-to-face, other than pre-approved telehealth or remote communication sessions. All services require in-person clinical interactions between the client and an appropriately licensed and Bureau-approved staff member.

VIDEO CONFERENCING GUIDELINES FOR TELEHEALTH. Contractors must follow the guidelines below in order to deliver secure telehealth services:

· Use a secure, trusted platform for videoconferencing.

· Verify devices and software use the latest security patches and updates. Install the latest antivirus, anti-malware, and firewall software to your devices. The underlying network must provide security.

· Verify device uses security features such as passphrases and two-factor authentication. Preferably, your device will not store any client data locally, but if it must, it should be encrypted.

· Verify your audio and video transmission is encrypted. The Federal Information Processing Standard (FIPS) 140-2 is used by the U.S. government to accredit encryption standards. Encryption strengths and types can change.

· When partnering with 3rd party telehealth vendors, verify if their encryption meets the FIPS 140-2 certified 256-bit standard; that any peer-to-peer videoconferencing (streamed endpoint-to-endpoint) is not stored or intercepted by the company in any way; and that any recorded videoconferences or—if available—text-based chat sessions near the chat window are stored locally, on your own HIPAA-compliant device or electronic record keeping system, in order to safeguard any electronic protected health information or PHI.

· Choose a software solution that is HIPAA-compliant, as many popular, free products are not.

Compliance with HIPAA (Health Insurance Portability and Accountability Act of 1996) is essential. HIPAA sets a minimum federal standard for the security of health information. States may also set privacy laws that can be even stricter; check any relevant statute for the state in which you practice. Just because software says its HIPAA-compliant isn’t enough. HIPAA compliance may also be dependent on the interface of your videoconferencing software with other aspects of your practice, such as EHRs.

· It is recommended to use a broadband internet connection that, at minimum, has a transmission speed of at least five (5) MB upload/download to avoid pixilation, frequent buffering, and other video and audio difficulties associated with slow and insufficient transmission. Higher speeds might be required for newer technologies that use HD capabilities.

· When reviewing software options, you will notice that many vendors require a “business associate agreement,” (BAA) to ensure HIPAA compliance. Contact the vendor and confirm what such an agreement entails.

Telehealth. Telehealth services (e.g. psychiatry and counseling) may be approved for use in remote locations, locations deemed as acceptable by the Bureau, or during a national public health emergency. Telehealth services will only be reimbursed when delivered via live video. The client’s location at the time services are received via telehealth is known as the “originating site.” Clients shall only receive telehealth sessions at approved originating sites. The performance site or other suitable locations, as deemed necessary, e.g., RRC, residence for those on home confinement or FLM, may be authorized by the FAC COR as originating sites.

The Contractor must provide a plan that specifically addresses the telehealth policies and regulations for the state where services will be rendered. At the performance site (originating site), the Contractor must identify the location where clients will receive telehealth to ensure sessions are conducted in a secure and confidential setting. If the originating site is at a location other than the performance site, the Contractor is expected to make reasonable efforts to ensure telehealth sessions are conducted in a secure and confidential setting.

CTS must approve the use of telehealth prior to the provision of services. It is solely the Contractor’s responsibility to clearly provide the necessary information for approval. The Contractor must submit evidence that the communication system and software application that will be used meet the Bureau’s electronic security requirements: HIPAA-compliant, FIPS 140-2 certified, 256-bit encryption, and housed in Continental United States.