Attachment_1_-_HIMD_SOW.docx

Attachment 1

HEALTH INFORMATION MANAGEMENT SUPPORT SERVICES

STATEMENT OF WORK

PROJECT TITLE: HEALTH INFORMATION MANAGEMENT SUPPORT SERVICES

SECTION 1

GENERAL INFORMATION

1. Introduction. This Statement of Work (SOW) consists of requirements associated with providing health information management associated customer service hours, diagnostic and procedural coding and abstracting, and dictation and transcription of medical reports, letters, and pathology reports to support patient care services and clinical research in a federally funded research hospital.

Task 1 outlines specific requirements for the Customer Service, Task 2 outlines diagnostic and procedural coding and abstracting requirements and Task 3 outlines dictation and transcription of medical reports, letters, and pathology reports.

1.1 Background Information.

1.1.1 The National Institutes of Health, Clinical Center, Health Information Management Department (NIH, CC, HIMD) seeks a contractor to assist in efficient customer service, diagnostic and procedural coding and abstracting, and transcription medical reports, letters, and pathology reports in order to provide the best patient care support services possible.

The NIH Clinical Center (CC) is a 240-bed federally funded, biomedical research hospital located on the NIH campus in Bethesda, Maryland. At the NIH Clinical Center, clinical research participants—more than 500,000 since the hospital opened in 1953—are active partners in medical discovery, a partnership that has resulted in a long list of medical milestones, including development of chemotherapy for cancer; the first use of an immunotoxin to treat a malignancy (hairy cell leukemia); identification of the genes that cause kidney cancer, leading to the development of six new, targeted treatments for advanced kidney cancer; the demonstration that lithium helps depression; the first gene therapy; the first treatment of AIDS (with AZT); and the development of tests to detect AIDS/HIV and hepatitis viruses in blood, which led to a safer blood supply. Patients come from all 50 states and from around the world.

Currently, there are about 1,600 clinical research studies in progress at the NIH Clinical Center. About half are studies of the natural history of disease, especially rare diseases, which often are not studied anywhere else. What researchers learn by studying rare diseases often adds to the basic understanding of common diseases. Most other studies are clinical trials, which often are the first tests of new drugs and therapies in people. The clinical trials at the NIH Clinical Center are predominantly Phase I and Phase II, often first-in-human to test safety and efficacy. Although the Clinical Center is fully funded by the Federal Government and does not rely on other revenue streams, it is not insulated from the cost pressures and inflation of the health care industry. The vision of the NIH Clinical Center is to serve as the nation’s premier research hospital for conducting clinical research to improve the health of human kind. It also serves as a national resource for clinical research by developing diagnostic and therapeutic interventions, enhancing systems to ensure the safe, efficient, and ethical conduct of clinical research, training clinical researchers, and leading the response to the nation’s public health needs.

1.2 Project Objectives.

1.2.1 The NIH, CC, HIMD is responsible for maintaining complete and accurate medical records used for patient care, clinical research, and medicolegal purposes for all Clinical Center patients. Each Clinical Center patient is assigned a unique medical record number. All documentation is identified by this medical record number and maintained in the electronic medical record for each patient. Contract staff shall be responsible for the prompt, complete and accurate releasing of patient medical records, assisting customers with the FollowMyHealth® patient portal, and assisting all customers with a variety of questions and tasks presented to the HIMD.

The NIH, CC, HIMD is responsible for the coding and abstracting of data elements for a variety of patient visit types. These visits are related to patients’ inpatient hospital admissions, day hospital visits, ambulatory surgery, other intensive outpatient procedures, outpatient visits called First Registration, and Interventional Radiology procedure visits. The coding schemes used are Current Procedural Terminology Version 4, (CPT-4), Healthcare Common Procedure System, (HCPCS), International Classification of Diseases, Tenth Clinical Modification (ICD-10-CM) and ICD-10-PCS Procedural Classification System.

The NIH, CC, HIMD is responsible for providing dictation and transcription services for a variety of specialized medical reports related to patients’ inpatient hospital admissions, day hospital visits, outpatient clinic visits, ambulatory surgery, and other complex diagnostic medical studies. Such reports may be categorized into three groups including medical reports, pathology reports, and letters to outside physicians. Dictated reports and letters include information consisting of technical terminology and phraseology from all medical and scientific disciplines, which the NIH allied health professionals involved in the care of the patient wish to document in the patient’s medical record regarding diagnosis, past or present treatment, future care and research protocol findings.

1.2.2 Contractor staff, including subcontractors, shall complete the tasks outlined in this statement of work in full accordance with the policies and procedures established by the HIMD in order to provide customer service, diagnostic and procedural coding and abstracting, and transcription of medical reports, letters, and pathology reports. It is imperative that these tasks are handled in a timely and accurate manner. For this reason, the completion schedule and scheduled quality assurance and control audits established in this contract shall be strictly adhered to. The contractor bears responsibility for the accuracy of work performed. Errors are not acceptable and must immediately be corrected if discovered by either the government or the contractor, and a complete tracking system for assignments and errors shall be enacted by the contractor.

1.3 Scope of Work. The contractor shall provide all personnel, supervision, and other items and services necessary to promptly and accurately provide customer service, diagnostic and procedural coding and abstracting, and transcription of medical reports, letters, and pathology reports as identified by the government. The contractor shall perform to the standards of this contract. The estimated quantities of work are listed in Sections 4, 5, and 6 of this Statement of Work. This contract shall cover an initial 12month period of performance, with 4 additional successive 12month option periods.

Work during the initial contract year will be phased in. Coding and abstracting services will begin immediately upon award. Customer service support for health information management and portal support services will begin on July 1, 2019 and dictation and transcription services will begin on 10/1/19.

All work performed under this contract and/or any subcontracts must be completed from United States based office environments with no overseas services provided. It is acceptable for the contractor to subcontract out services if necessary. Any subcontractors must perform the work according to the requirements specified in this statement of work.

1.4 Clinical Center Health Information Management Department Information Systems Overview. The NIH, CC, HIMD relies on several integrated and interfaced information systems to support daily operations. To support these processes, the HIMD utilizes the following health information systems software applications:

AllScripts Sunrise Clinical Manager (SCM) – the CC’s hospital information system (HIS) provides patient information retrieval, medical order entry, and clinical results retrieval. SCM includes Admission, Discharge, and Transfer (ADT) functionality and is utilized by prescribers and health care providers specifically to enter medical orders, enter medication administrations, to enter clinical documentation, and review results/clinical documentation. The system is also referred to as the Clinical Center’s Clinical Research Information System (CRIS).

Citrix – software application utilized throughout the NIH Clinical Center to provide remote access to clinical applications over the NIH network and the Internet. The contractor is required to access the coding and abstracting software via the NIH/CC’s Citrix application.

3M™ Coding and Reimbursement Encoder - software application utilized by the coding team to assist in assigning CPT-4, HCPCS, ICD-10-CM, and ICD-10 PCS codes to all types of patient visits. DRG assignment and APC/DRG assignment is calculated based on codes entered into Encoder and edits reviewed. This software application also gives the coder online access to various coding and medical reference material. See Section 10.9.1 for complete listing.

3M™ ClinTrac - abstracting software application is used by the coding team to record UHDDS specific data elements as well as NIH specific data elements such as rare disease data.

3M™ ChartRelease - a tool designed for HIM professionals to expertly manage an in-house release of information (ROI) operation.

3M™ ChartLinc – facilitates the flow of Admission, Discharge, Transfer (ADT) Information between the CC’s hospital information system and the HIMD’s transcription software applications. ChartLinc also facilitates the upload of transcribed, edited, and completed medical and diagnostic reports to the CC’s hospital information system.

3M™ ChartScript – a repository that houses all transcribed medical reports and letters.

3M™ Transcription Client - full-featured, browser-based transcription platform utilized for transcription of dictated medical and diagnostic reports and letters as well as editing of transcribed documents.

Soft Computer Corporation (SCC) – the Laboratory Information System (LIS) application which includes the SoftPath module for Anatomic Pathology result reporting. Anatomic Pathology reports will be transcribed directly into the SCC, SoftPath application.

3M™ SyncStream – back end speech recognition service hosted at the 3M™ data center. Dictated reports and letters pass through this system and convert dictated speech into an editable text document in the 3M™ Transcription Client application. Edits made to these presented documents are utilized by the system to enhance and improve the accuracy of the speech recognition service in subsequent dictations completed by each individual clinician.

3M™ VoiceScript – intermediary voice file storage system. Voice files along with pertinent dictation information (clinician identification, date, time, etc.) are passed from the central dictation system, through a voice file exporting system to the VoiceScript server. VoiceScript then passes files on to 3M™ back-end speech recognition service.

Virtual Private Network (VPN) – such accounts are required for contractor staff working remotely from the Clinical Center and accessing applications related to providing the transcription/medical editing-related services under this contract.

4th Dimension (4D) – a relational database utilized to track admission, discharge and new patient registration letters sent to patients and their authorized referring clinicians.

1.5 Personnel.

1.5.1 The contractor shall provide a regional contract manager who shall be responsible for the oversight and supervision of all contractor and subcontractor staff responsible for the performance of work. The name of this person, and an alternate or alternates who shall act for the contractor when the manager is absent shall be designated in writing to the CC, HIMD, Contracting Officer’s Representative (COR) or their designee.

1.5.2 The regional contract manager (contract manager) must be onsite within the NIH, CC, HIMD office for a minimum of 25 hours per week. An office with desktop computing equipment will be provided by the NIH, CC, HIMD for this individual.

1.5.3 The contractor/subcontractor shall also provide an onsite team leader in the NIH, CC, HIMD on a full time basis (Monday through Friday). The team leader will be responsible for providing guidance for onsite contract customer service representatives and will be trained on all task functions relating to onsite work conducted in the HIMD in order to provide back-up support as necessary. This individual will also be responsible for training new onsite customer service staff and performing duties for contractor customer service staff during periods of absenteeism as necessary.

1.5.4 The contractor/subcontractor shall appoint an individual to serve as the manager or liaison for items identified in Tasks 2 and 3. This liaison will assist in the communication between HIMD staff and contractor staff performing these tasks. These liaisons will work remotely from the NIH, CC, HIMD and will not have office space available onsite in the NIH CC HIMD. The use of onsite space may be requested on an infrequent basis if needed for meetings.

1.5.5 The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

1.5.6 The contract manager or alternate shall be available during normal duty hours (7:00 am to 6:00 pm) within 60 minutes of notification by the Government to meet in the HIMD with government personnel (designated by the CC, HIMD, COR or their designee). After normal business hours, the manager or alternate shall be available within 90 minutes of notification by the Government.

1.5.7 The contractor shall provide the NIH, CC, HIMD, COR or their designee with a 24hour emergency telephone number where representatives of the contractor can be contacted by the Government in the event of a need for emergency report transcription or in the event of extraordinary or unforeseen circumstances that require communication between the Government and the contractor.

1.5.8 The contract manager and alternate or alternates must be able to read, write, speak and understand English.

1.5.9 The contract manager, onsite team lead, and offsite managers shall be available for monthly meetings via WebEx as requested by the NIH, CC, HIMD, COR or their designee. Meetings shall occur no less than on a quarterly basis.

1.5.10 Employees: The contractor, including subcontractors, shall not employ persons for work on this contract if such employee is identified to the NIH, CC, HIMD, COR or their designee as a potential threat to the health, safety, security, general well-being, or operational mission of the NIH, CC, HIMD, or its staff and customers.

1.5.11 Contractor employees, including subcontractors, shall present a neat appearance and be easily recognized as such. Contractor employees, including subcontractors, shall submit the required information for submission into the NIH Enterprise Directory, required background check, obtain an NIH identifying badge, which shall include as a minimum the person’s name and the name of the contractor. Each employee shall wear the badge on their outer garments at all times. As contractor employees, including subcontractors, terminate their employment, each is required to turn in their NIH identifying badge on their final day of employment. The contractor shall return these badges to the Government.

1.5.12 The contractor, including subcontractors, shall not employ any person who is an employee of the US Government if employing that person would create a conflict of interest.

1.5.13 Contractors, including subcontractors, must adhere to the Department of Labor Wage Determination as issued for their County and State. Contractors, including subcontractors, will be required to pay their medical coders at the Occupation Code Title of “12190 Medical Record Technician” hourly rate plus all fringe benefits. Contractors, including subcontractors, are required to provide a statement in their evaluation information indicating their compliance with their appropriate Department of Labor Wage Determination. Failure to provide this statement will result in the quote being deemed non-responsive to the solicitation. Contractor will be required to show that the employees working on the NIH contract are considered their direct employees and that they are paid the appropriate wage rate as determined by the Department of Labor.

1.5.14 Contractors, including subcontractors, must adhere to the Department of Labor Wage Determination as issued for their County and State. Contractors will be required to pay their medical transcriptionists at the Occupation Code Title of “12195 Medical Transcriptionists” hourly rate plus all fringe benefits. Contractors are required to provide a statement in their evaluation information indicating their compliance with their appropriate Department of Labor Wage Determination. Failure to provide this statement will result in the quote being deemed non-responsive to the solicitation. Contractor will be required to show that the employees working on the NIH contract are considered their direct employees and that they are paid the appropriate wage rate as determined by the Department of Labor.

1.5.15 Security Requirements. All personnel employed by the contractor, including subcontractors, in the performance of this contract, or any representative of the contractor entering the NIH properties, shall abide by all security regulations of the NIH. The government reserves the right to direct the removal of an employee for misconduct or security reasons. This action does not relieve the contractor from total performance of the contract tasks specified herein.

1.5.16 The contractor shall instruct employees to register their vehicles for use and parking on the NIH campus, when working onsite at the NIH, CC, HIMD, during the duration of the contract, and shall instruct terminated employees to turn their parking validation device in on their last day of employment.

1.5.17 The contractor shall instruct employees driving on NIH property to have a valid automobile driver’s license.

1.5.18 The contractor shall instruct employees to park vehicles in designated NIH parking spaces when working onsite at the NIH, CC, HIMD.

1.5.19 Employee Training. Contractors, including subcontractors, who will be working onsite at the NIH, CC, HIMD shall attend NIH Clinical Center orientation and receive written and/or verbal Privacy Act training prior to allowing employees access to medical records. Such training shall be arranged through coordination with the NIH, CC, HIMD, COR or their designee.

1.5.20 Initial training for contractor employees, including subcontractors, will be coordinated and provided by the NIH, CC, HIMD, COR and/or their designee. This initial training will be conducted between the hours of 7:00 am and 5:00 pm. Monday through Friday and is anticipated to require 40 hours of hands on training. This training will provide instructions on all duties listed in this Statement of Work. Further training for any new and/or replacement contractor employees, including subcontractors, will be the responsibility of the contractor manager. This training can be conducted via WebEx application and is not required to be done onsite.

1.5.21 Contractor employees, including subcontractors, shall receive training via a Confidentiality In-service, Privacy and Security training and a Fire Drill & Safety In-service administered by the government within one year of their date of hire by the contractor and annually each year thereafter. Those missing this training shall not be permitted to work on behalf of the contractor on the NIH, CC, HIMD premises until such training is completed.

1.5.22 All contract/subcontract staff whether working onsite in the NIH, CC, HIMD or remotely will be required to obtain an NIH identification badge (Personal Identification Verification (PIV) badge) to access any NIH, CC, HIMD resources. This process requires fingerprinting at a Health and Human Services fingerprinting collection site. Contractor/subcontractor staff have the option of obtaining these services and completing the process for obtaining a PIV badge on the main NIH campus in Bethesda, Maryland or through one of the remote sites. There are not remote site locations available in all states and on occasion, staff may be required to travel two to three hours to complete this process. The process may require up to two trips to obtain the final identification badge. Information about these remote sites is available here: https://www.ors.od.nih.gov/ser/dpsac/badge/Pages/badgingremote.aspx. This process can take up to three weeks to complete. Until the staff member has a badge, he/she will be unable to access NIH resources.

1.5.23 Newly hired contractor employees, including subcontractors, shall be paired with experienced employees for a minimum of 1 week beginning on their first day and prior to completing assignments independently to ensure thorough understanding of proper procedures.

1.5.24 Contractor employees, including subcontractors, shall utilize and exhaust all reference material to resolve problems prior to returning work to the NIH, CC, HIMD, COR or their designee, unless otherwise directed in the contract.

1.5.25 Contractor employees, including subcontractors, shall sign an E-mail and Computer Use Statement prior to their first day of work and annually each year thereafter. Such statements requiring signature are to be obtained from the NIH, CC, HIMD, COR or their designee. The contractor shall submit the completed original E-mail and Computer Use Statement to the CC, HIMD, COR or their designee within 10 business days of completion of each Statement.

1.5.26 Contractors, including subcontractors, may be cross-trained as necessary and as determined by the contractor in order to ensure all tasks in this statement of work are provided as described.

1.5.27 Key personnel shall be identified by the contractor and may not be replaced without prior notification and approval of the NIH, CC, HIMD, COR or their designee. These key personnel include liaison and information technology personnel. All key personnel must be in place and fully qualified prior to award of this contract.

1.5.28 The NIH, CC, HIMD requires that the contractor permanently maintain a manager or liaison, fully trained and aware of the requirements of the dictation and transcription tasks in this contract (also refer to item 1.5.4 above). The individual assigned to this position shall have a minimum of three years of direct experience working in the electronic medical transcription service field. Identification of qualifications and experience must be submitted with this proposal. The worksite for this individual will be remote from the NIH, CC, HIMD office.

1.5.29 The information technology personnel shall have a minimum of five years’ experience working in the health information management field including experience handling security measures and information systems infrastructure specified in this contract. Identification of qualifications and experience must be submitted with this proposal.

1.5.30 Personnel performing duties associated with Task 3 in this Statement of Work (other management staff, medical language specialists (transcriptionists), speech analysts, medical editors, quality assurance personnel, and other clerical support staff) shall be identified by number of personnel, number of hours per week, and tour of duty.

1.5.31 Initial training for contractor staff, including subcontractors, on all applications to be utilized during the transcription and editing processes of medical reports and letters (Citrix, 3M™, and SCM) will be provided by the HIMD. Initial training for contractor, or subcontractor, staff on all applications to be utilized during the transcription and editing processes of pathology reports (SCC and Citrix) will be coordinated by the HIMD and the Laboratory of Pathology staff. Any additional training requirements for newly hired staff or retraining of existing staff will be the responsibility of the contractor.

1.5.32 Contractor staff, or subcontractors, employed by the contractor at the commencement of this requirement performing duties associated with Task 3 in this Statement of Work without prior experience utilizing the transcription platforms/applications described in this requirement, will be trained to utilize the Citrix, 3M™, SCM, and SCC systems through HIMD staff. General application functionality and basic transcription and report editing procedures will be reviewed. Any required training will be conducted in the HIMD facilities and/or remotely via a web-based training module. Intensive training will be provided lasting approximately 20 hours and will be conducted Monday through Friday between the hours of 7:00 am and 4:00 pm. Training will be coordinated by the HIMD staff; however, it may be conducted by application experts from the HIMD, Laboratory of Pathology, and/or the Department of Clinical Research Informatics.

1.5.33 Transition-In Planning/Staffing for Task 3. The Contractor shall submit a transition-in plan with their proposal that is in sufficient detail to identify all transition-in actions, documentation, and staffing proposed to prepare the workforce to assume 50% operation on the first full operational performance day of contract performance. The other 50% will be performed by the incumbent contractor for a period of 6 months to assure continuity of current production standards. During the Transition-In period the contractor will receive training on all information systems to be utilized as part of this contract.

1.5.34 Transition-Out for Task 3. During the 30 calendar day period immediately prior to the end of the contract (if the contractor is not awarded the subsequent contract for this service), the contractor shall permit the successor contractor and the successor contractor’s employees to observe and become familiar with any and all operations under the contract. The contractor shall fully cooperate with the successor contractor and the government so as not to interfere with their work duties. The contractor shall ensure that government furnished equipment and files are in a condition equal to or better than when the contractor began this contract.

1.5.35 Transition from Incumbent Contractor to New Contractor for Task 3. In the event that the incumbent contractor is not awarded the new contract, there must be a smooth transition of work between the two entities while maintaining the amount of transcription that must be performed under the contract. During this six month transition phase, each contractor will be responsible for 50% of the total incoming dictations. Within this six month window the new contractor will be responsible for the setup of their dictation system in the Clinical Center Data Center and any mandatory training required for staff members to become familiar with NIH and Clinical Center information systems required to perform contract duties. Once this six month period is over the new contractor shall be fully prepared to perform the full amount of work required.

1.6 Quality Control.

1.6.1 The contractor shall provide a Quality Control Plan that contains measures adequate to ensure high quality work production for all tasks covered in this statement of work to the NIH, CC, HIMD, COR or their designee for acceptance not later than the post-award conference which shall be conducted within five business days following contract execution. The NIH, CC, HIMD, COR or their designee will notify the contractor of acceptance or required modifications to the plan within 5 business days after its receipt. The contractor shall make appropriate modifications and obtain acceptance of the plan by the NIH, CC, HIMD, COR or their designee within 5 business days after resubmission of the plan to the government.

1.5

1.6.2 The person(s) on the contractor's staff responsible for quality control must be thoroughly familiar with the contract specifications and requirements regarding customer service, diagnostic and procedural coding and abstracting, and dictation and transcription services.

1.6.2.1 Contents of Quality Control Plan.

1.6 1.6.1 1.6.2 1.6.2.1

1.6.2.1.1 A description of the audit system shall include specifics as to the areas to be audited on both a scheduled and unscheduled basis, frequency of audits, and the title and organizational placement of the auditors. Additionally, control procedures for any government provided keys and/or lock-releasing identification badges shall be included.

1.6.2.1.2 A description of the methods to be used for identifying and preventing errors in the quality of service performed.

1.6.2.1.3 A description of the records to be kept to document audits and corrective or preventive actions taken.

1.6.2.1.4 The records of audits shall be kept and made available to the government throughout the contract performance period.

1.7 Quality Assurance. The government will evaluate the contractor's performance under this contract and will follow the methods of auditing specified in this Statement of Work. Government personnel will record all audit observations. The contractor shall rectify any deficiencies within 24 hours of written notification by the government and provide written documentation regarding the resolution to the NIH, CC, HIMD, COR.

1.8 Physical Security. The contractor shall be responsible for safeguarding all government property provided for contractor use. At the end of each work period, all government facilities, equipment and materials shall be secured.

1.8.1 The contractor shall prohibit the use of lock releasing identification badges by contractor, or subcontractor, employees other than those assigned directly to said employees by the NIH.

1.8.2 NIH INFORMATION AND PHYSICAL ACCESS SECURITY

This acquisition requires the Contractor to:

1. access, or use, Personally Identifiable Information (PII), including instances of remote access to or physical removal of such information beyond agency premises or control.

2. have regular or prolonged physical access to a “Federally-controlled facility,” as defined in FAR Subpart 2.1.

The Contractor and all subcontractors performing under this acquisition shall comply with the following requirements:

a. Security Categories and Levels

Overall Level: [ ] Low [ ] Moderate [ X ] High

b. Position Sensitivity Designations

The following sensitivity level(s), clearance type(s), and investigation requirements apply to this contract:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (BI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ X ] Level 1: Non-Sensitive Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Agency Check and Inquiry Investigation (NACI).

The Contractor shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Project Officer, with a copy to the Contracting Officer, within 14 calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at https://ocio.nih.gov/InfoSecurity/public/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx

Suitability Investigations are required for contractors who will need access to NIH information systems and/or to NIH physical space. However, contractors who do not need access to NIH physical space will not need an NIH ID Badge. Each contract employee needing a suitability investigation will be contacted via email by the NIH Office of Personnel Security and Access Control (DPSAC) within 30 days. The DPSAC email message will contain instructions regarding fingerprinting as well as links to the electronic forms contract employees must complete.

Additional information can be found at the following website: http://idbadge.nih.gov/background/index.asp

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

c. Information Security Training c.1 Mandatory Training

All employees having access to (1) Federal information or a Federal information system or (2) personally identifiable information, shall complete the NIH Information Security Awareness Training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, employees having access to the information identified above shall complete an annual NIH-specified refresher course during the life of this contract. The Contractor shall also ensure subcontractor compliance with this training requirement.

c.2 Role-based Training

HHS requires role-based training when responsibilities associated with a given role or position, could, upon execution, have the potential to adversely impact the security posture of one or more HHS systems. Read further guidance at: Secure One HHS Memorandum on Role-Based Training Requirement“

For additional information see the following: http://prod.ocio.nih.gov/InfoSecurity/training/MandatoryInfoSecTraining/Pages/RoleBasedTraining.aspx

The Contractor shall maintain a list of all information security training completed by each contractor/subcontractor employee working under this contract. The list shall be provided to the Project Officer and/or Contracting Officer upon request.

d. Rules of Behavior

The Contractor shall ensure that all employees, including subcontractor employees, comply with the NIH Information Technology General Rules of Behavior, which are available at http://prod.ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx .

e. Personnel Security Responsibilities

1. The Contractor shall notify the Contracting Officer, Project Officer, and I/C ISSO within five working days before a new employee assumes a position that requires a suitability determination or when an employee with a suitability determination or security clearance stops working under this contract. The Government will initiate a background investigation on new employees requiring suitability determination and will stop pending background investigations for employees that no longer work under this acquisition.

2. The Contractor shall provide the Project Officer with the name, position title, e-mail address, and phone number of all new contract employees working under the contract and provide the name, position title and suitability determination level held by the former incumbent. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

3. The Contractor shall provide the Project Officer with the name, position title, and suitability determination level held by or pending for departing employees.

Perform and document the actions identified in the Contractor Employee Separation Checklist (attached) when a Contractor/subcontractor employee terminates work under this contract. All documentation shall be made available to the Project Officer and/or Contracting Officer upon request.

f. Commitment to Protect Non-Public Departmental Information and Data

1. Contractor Agreement

The Contractor, and any subcontractors performing under this contract, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

2. Contractor Employee Non-Disclosure Agreement

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the Commitment to Protect Non-Public Information – Contractor Employee Agreement A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under this acquisition.

g. Loss and/or Disclosure of Personally Identifiable Information (PII) – Notification of Data Breach

The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident Response Team via email (IRT@mail.nih.gov) within one hour of discovering the incident. The Contractor shall follow-up with IRT by completing and submitting one of the following two forms within three (3) work days:

h. Data Encryption

The following encryption requirements apply to all laptop computers containing HHS data at rest and/or HHS data in transit. The date by which the Contractor shall be in compliance will be set by the Project Officer, however, device encryption shall occur before any sensitive data is stored on the laptop computer/mobile device, or within 45 days of the start of the contract, whichever occurs first.

1. The Contractor shall secure all laptop computers used on behalf of the government using a Federal Information Processing Standard (FIPS) 140-2 compliant whole-disk encryption solution. The cryptographic module used by an encryption or other cryptographic product must be tested and validated under the Cryptographic Module Validation Program to confirm compliance with the requirements of FIPS PUB 140-2 (as amended). For additional information, refer to http://csrc.nist.gov/cryptval.

2. The Contractor shall secure all mobile devices, including non-HHS laptops and portable media that contain sensitive HHS information by using a FIPS 140-2 compliant product. Data at rest includes all HHS data regardless of where it is stored.

3. The Contractor shall use a FIPS 140-2 compliant key recovery mechanism so that encrypted information can be decrypted and accessed by authorized personnel. Use of encryption keys which are not recoverable by authorized personnel is prohibited. Key recovery is required by “OMB Guidance to Federal Agencies on Data Availability and Encryption”, November 26, 2001, http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf.

Encryption key management shall comply with all HHS and NIH policies (http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf) and shall provide adequate protection to prevent unauthorized decryption of the information.

All media used to store information shall be encrypted until it is sanitized or destroyed in accordance with NIH procedures. Contact the NIH Center for Information Technology for assistance (http://cit.nih.gov/ProductsAndServices/ServiceCatalog/Services.htm?Service=Media+Sanitization+Service).

i. Physical Access Security

In accordance with OMB Memorandum M-05-24, the Contractor shall ensure that background investigations are conducted for all contractor/subcontractor personnel who have (1) access to sensitive information, (2) access to Federal information systems, (3) regular or prolonged physical access to Federally-controlled facilities, or (4) any combination thereof. OMB Memorandum M-05-24 is available at http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf. Agency personal identification verification policy and procedures are identified below:

HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook (02-01-05): http://www.hhs.gov/oamp/policies/personnel_security_suitability_handbook.html

j. Using Secure Computers to Access Federal Information

1. The Contractor shall use an USGCB compliant computer when processing information on behalf of the Federal government.

2. The Contractor shall install computer virus detection software on all computers used to access information on behalf of the Federal government. Virus detection software and virus detection signatures shall be kept current.

k. Special Information Security Requirements for Foreign Contractors/Subcontractors

When foreign contractors/subcontractors perform work under this acquisition at non-US Federal Government facilities, provisions of HSPD-12 do NOT apply.

l. REFERENCES: INFORMATION SECURITY INCLUDING PERSONALLY IDENTIFIABLE INFORMATION

m. REFERENCES: PHYSICAL ACCESS SECURITY

1.9 Hours of Operation:

1.9.1 Normal Hours of Operation. The contractor, or subcontractor, shall perform the services required under this contract during the following hours for Task 1: Monday through Friday, 7:00 a.m. to 6:00 p.m.; during hours mutually agreed upon by the contractor and the NIH, CC, HIMD, COR for Task 2; and during hours necessary to support the incoming dictation volume and required turnaround times for Task 3. The contractor and any subcontractor(s) must ensure that staff are available for educational/training sessions and other meetings as required by the government.

1.9.2 Hours of operation and completion of work shall not be adjusted or waived to account for periods of absence by contractor staff unless there is prior approval by the NIH, CC, HIMD COR.

1.9.3 Holidays. The contractor is not required to provide services on the following federal holidays: New Year's Day, Martin Luther King’s Birthday, President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day.

1.9.4 Inclement Weather. Some NIH, CC, HIMD employees are designated as “emergency” employees by the CC. As such, they are required to follow instructions for reporting to work as is dictated by the Federal Government’s Office of Personnel Management. The NIH, CC, HIMD will work with the contractor to determine which, if any, of the onsite contract staff will be required to report for work as emergency employees during periods of inclement weather. Instructions for reporting to work may be obtained by contacting the CC, HIMD, COR or their designee whenever necessary. Both absence and non-completion of work by “emergency” contract staff during times of inclement weather shall only be excused by the NIH, CC, HIMD, COR or their designee. Any remote contract workers shall continue to work despite the operating status of the NIH’s facility.

1.9.5 The contractor, or subcontractor, shall allow the NIH, CC, HIMD, COR or their designee or their designated representative unsupervised access to contractor materials and records on government property during normal government duty hours.

1.9.6 Conservation of Utilities. The contractor, or subcontractor, shall make sure employees practice utilities conservation. The contractor shall be responsible for operating under conditions that prevent the waste of utilities to include the following.

1.9.6.1 Lights shall be used only in areas where work is actually being performed.

1.9.6.2 Employees shall turn off lights prior to leaving assigned work areas.

1.9.6.3 Personal computers shall be logged off prior to leaving assigned work areas.

1.9.7 All contractor, or subcontractor, work areas and equipment shall be returned in the original condition and to the original place found prior to the beginning of contractor shift before departing for each period worked.

1.9.8 Contractor, or subcontractor, employees shall not use cellular telephones in HIMD work areas if working during normal NIH, CC, HIMD business hours. The NIH, CC, HIMD’s normal business hours are 7:00 am to 6:00 pm Monday through Friday.

1.9.9 The contractor shall propose options to address the event of an emergent situation when access to the Internet is not possible.

1.8 1.9 1.9.2 1.9.3 1.9.4 1.9.5

SECTION 2

CONFIDENTIALITY

2.1 Confidentiality Preservation. The contractor shall preserve the confidentiality of all patient and medical information-related materials and all material pertaining to this contract and is prohibited from using any of this material or equipment provided by the government for advertising, publication or any other use except as stipulated by this contract for the express purpose of providing medical record management services to the National Institutes of Health.

2.2 Security of Patient and Medical Information while Contractor on NIH Campus. All such material shall be kept in a controlled access, secure area within the NIH, CC, HIMD and shall not be left unsecured during work and nonwork hours.

2.3 Confidentiality Training. All contractor employees, or subcontractors, shall receive training via a Confidentiality In-service within one year of their date of hire by the contractor. Those missing this training shall not be permitted to work on the NIH premises until such training is completed.

2.4 Removal of Patient and Medical Information. All material and information furnished by the government to the contractor for the use in the performance of this contract must be kept in the NIH, CC, HIMD (with the exception of the government furnished computers designated in Task 1) and must be returned to the NIH, CC, HIMD, COR or their designee upon request.

SECTION 3

DEFINITIONS

3.1 General Definitions.

3.1.1 NIH, CC, HIMD, COR or their designee. Refers to NIH, CC, HIMD’s designated Contracting Officer’s Representative (COR) or their designee for these requirements.

3.1.2 Error. A service output that does not meet the standard of performance specified in the contract for that service.

3.1.3 Quality Control/Assurance. A planned and systematic pattern of all actions necessary to provide confidence that adequate technical requirements are established; products and services conform to established technical requirements; and satisfactory performance is achieved.

3.1.4 Quality Assurance Evaluator. A functionally qualified person who performs quality assurance functions for a contracted service.

3.1.5 Quality Control. Those actions taken by a contractor, or subcontractor, to control the production of outputs to ensure that they conform to the contract requirements.

3.1.6 Random Sampling. A sampling method where each service output in a lot has an equal chance of being selected for quality assurance audit.

3.1.7 Sample. A sample consists of one or more service outputs drawn from a large number for quality assurance audit.

3.1.8 Audit. Validation of all or part of contractor work against source records, paper documents or computer data.

3.1.9 Customer. Any individual or agency with a valid need for access to the HIMD. Should the contractor, or subcontractor, encounter HIMD customers during non-HIMD business hours, contractor shall immediately explain to customer that contractor is not permitted or qualified to assist customer. Contractor shall refer all customers to Admissions Section of Outpatient Department, CC for assistance.

3.2 Technical Definitions.

3.2.1 Medical Record Number. CC patient medical record numbers are 7 digits in length and appear as “XX-XX-XX-X”. The first two digits are known as tertiary digits. The second two digits are known as secondary digits. The third two digits are known as terminal digits. The final number is known as the check digit. Each medical record number is filed numerically according to the following order:

1. Terminal Digits

2. Secondary Digits

3. Tertiary Digits

The final number is a computer check digit that is not used in the terminal digit filing system.

3.2.2 Protocol Consent. Informed consent document reviewed with and signed by patients, principal investigator and a witness, prior to participation on a NIH research study.

3.2.3 Transmittal or Certification Letter. A computer generated letter that provides instructions regarding which material to copy and the name and address of the person that the information is to be sent. This letter is attached to the released material and sent to the requestor.

3.2.4 NIH Clinical Center FollowMyHealth® Patient Portal. An Internet based system designed to provide NIH Clinical Center patients with electronic access to key medical information regarding the care they received at the Clinical Center.

3.2.5 NIH Clinical Center Referring Clinician Portal. An Internet based system designed to provide clinicians who refer patients to the NIH CC with electronic access to key medical information regarding their patients.

3.2.6 MD Report. A clinician’s name and contact information in CRIS. Each NIH CC patient can designate up to two authorized outside providers to receive ongoing medical updates regarding their care while at the NIH CC.

3.2.7 Authorization for the Release of Medical Information. NIH CC approved form that enables patients/authorized individuals to designate who they would like to receive a copy of their medical record.

3.2.8 Admission Notification Letter. A letter sent to patients’ referring clinicians, providing them with notification…