QandA_2016N18001_CCE.pdf

RFP# 2016-N-18001

WORLD TRADE CENTER HEALTH PROGRAM, CLINICAL CENTERS OF EXCELLENCE

QUESTIONS & ANSWERS

Clarification:

p.2. C.1.2 in the PWS: The offeror must direct their proposal at only a single cohort type (general responders, responders associated with FDNY, or survivors)

Budget:

Q1. Solicitation (SOL), p2, Section B, What is the unit price versus the extended price?

A1. The CLIN structure of all Firm Fixed Price CLINs in this SOL are hereby changed to Cost Plus Fixed Fee, therefore there will not be a reference to a unit price or an extended price.

Q2. SOL, p10, Responder clinics currently do not perform coordination of benefits, is that a requirement in the new contract period? What is the criteria for COB for certified patients who are responders?

A2. See SOL p57 Section 5.4 Draft Coordination of Benefit Recovery Plan.

Q3. SOL, p10, Are we required to include cost estimates for the PII Security Plan/FISMA with this proposal, and if so are they included in the Operations and Management fixed price budget plan?

A3. Yes. All costs for services and activities required under the base period and option periods shall be included in the

Business Proposal. The Operations and Management CLIN is now cost plus fixed fee.

Reports and deliverables:

Q4. SOL, p11 Report Content: Administrative Services (from the predecessor contract) was replaced with

Operations and Management and Case Management was added as a stand-alone category. The list of reportable activities does not list case management as a separate reportable scope but deliverables were included in both

Administrative and Member Services. Operations and Management does not exist as reportable activities—will this affect how we budget or just how we report?

A4. A budget is anticipated for all CLINs for all periods. The Government expects transparency in reporting in an effort to distinguish and determine for what services costs are being allocated.

Q5. C.12.3 Quarterly, Semi-Annually, and Annual Reports. Please clarify the purpose and contents of the following and distinguish among them: Monthly Administrative Services Report; Monthly Member Services

Report; Quarterly Internal Audit Report; Semi-Annual Report; Annual Report.

A5. See Attachment 1 PWS Section C.12, p.34-40.

Q6. SOL, p55, Technical/Management Proposal: There is an 85 page limit for this section of the proposal with exclusions listed for two of the PWS plans indicated for submission with the proposal. Are the Draft Project

Management Plan, Draft Quality Assurance Plan, Draft Operations Manual and Draft Coordination of Benefits

Plan (If applicable) to be included in the body of the proposal with an 85 page limit?

A6. Yes these draft plans are to be included in the technical proposal; however, the page limit will be increased to 100 pages.

Q7. SOL, p57, Past/Present Performance: Will 3 CPARS reports from the WTC Health Program fulfill this requirement? If not, can references be submitted on behalf of other institutional endeavors?

A7. See SOL p57-58. Offers will submit at least 3 references using the Past/Present Performance Reference Questionnaire.

Q8. SOL, p11, Report Content: How is it anticipated we can compute monthly costs associated with each reporting category? Is it based on personnel costs alone, or are we to include other cost factors?

A8. The Government expects transparency in reporting in an effort to distinguish and determine for what services costs are being allocated.

Q9. Attachment #1, Operations Manual, p7, PWS: What constitutes evidentiary documentation for Federal audits and Security Certification and Accreditation of contractor provided systems?

A9. See SOL section K p43-50.

Q10. Attachment #1, p8, Risk Management Plan: Does the Risk Management Plan center around FISMA and cyber security or does it reflect health care risk management such as malpractice, or is it related to continuous quality improvement? Please clarify.

A10. All of these elements should be included in an offeror’s Risk Management Plan.

Q11. Attachment #1, p17, Training: Some personnel training has costs associated with that training, can these costs be budgeted and if so, under what category? Can CME/CEU credit costs be included for WTC physicians and nurses?

A11. No. The federal government will not pay for any training except training required to comply with the program policy and procedures. CME/CEU costs for maintaining accreditation and licensure are not costs which will be covered by this contract.

Q12. Attachment #1, p23, C3.7.4: Please clarify what is meant by patient centered medical home as it relates to the

WTCHP, since this terminology is used for primary care models and not WTC related care delivery. The statement implies that all patients receive care through a patient centered medical home.

A12. The CCE operates like a good medical neighbor to a patient centered medical home, assuming the member has this home through their personal insurance coverage. The care coordination is to connect the CCE to the non-participating primary or specialty care providers when necessary to optimize disease management for the conditions certified for coverage under the WTC Health Program.

Q13. Attachment #1, p30, C.9: Is the Draft QASP Plan in addition to the quarterly internal audit? Historically, the

QASP was in addition to the internal quarterly audit, and was designed and conducted by NIOSH.

A13. Yes.

Q14. C.9 Clinical Center of Excellence Services Summary Table/Quality Assurance Surveillance Plan (QASP).

Please clarify the purpose and contents of the QASP Report.

A14. The offeror shall submit a draft Quality Assurance Surveillance Plan as part of the QAP based on suggested metrics.

Q15. Attachment #4: What/who needs to be considered for inclusion in the ACH Vendor/Miscellaneous Payment

Enrollment?

A15. The ACH Vendor/Miscellaneous Payment Enrollment Form is used to provide Automated Clearing House payments to Federal Contractors. Any contractor not enrolled will not receive contract payments.

Q16. For the purposes of completing the 508 template, can you clarify if it only applies to public access or does it include our employees even though they are not Federal employees?

A16. 508 applies to the full vendor hosted Government system.

Q17. Are the costs associated with IT Security and FISMA considered part of the fixed price Admin budget? This is a potentially high cost item that currently suffers from a lack of clarity with regard to the institutional specifics needed to comply. We would like to know if this can be listed as an unknown cost in the list of assumptions for Vol.

II? Can this area of the budget be submitted outside of the fixed cost area or can costs be negotiated upon NIOSH being able to fully identify what each CCE will be responsible for?

A17. No costs may be submitted as unknown. All periods and all activities shall be priced in the Business Proposal. There is no Administrative Services budget. Offerors shall propose and place cost elements where they find it appropriate pursuant to their understanding of the Performance Work Statement. The government would however, anticipate that these elements be captured under the Operations & Management CLIN which is now a cost plus fixed fee CLIN type.

Q18. Can you advise where expenses associated with requesting certifications from NIOSH for members (securing records, communicating with outside specialists, completing necessary paperwork, submitting to NIOSH, etc.) are captured within the budget – within Admin? Member Services? Case Mgmt.?

A18. Offerors shall propose and place cost elements where they find it appropriate pursuant to their understanding of the

Performance Work Statement. If offerors lack the clarity of what is meant by Operations & Management, Member

Services, and/or Case Management, then this would be a potential question for follow-up.

Q19. C.3.1.8 Cost Tracking and Invoicing. What kinds of expenses are permitted in this contract under the following categories? Food, Travel, Member, Staff, NIOSH meetings, Other meetings, Training/Professional Development, Licensure and professional certifications, Continuing Professional Education -- CME, Nursing, Conferences other than NIOSH research meetings.

A19. Offerors shall propose and place cost elements where they find it appropriate pursuant to their understanding of the

Performance Work Statement. Only costs which are allowable to the extent they are reasonable, allocable, and allowable under the FAR are permitted. See FAR Part 31.204 Application of Principles and Procedures.

Q20. Can you confirm that it is the responsibility of the HPS contractor to certify external providers? To train external providers?

A20. Yes for enrolling and credentialing of external providers. The initial enrollment will cover the limited care model of the program, fee structure and no out of pocket expense for the member. However, the CCE will need to specify extent of services authorized and coordinate with providers on referrals to remain within the constraints of the program.

Q21. Can you confirm that the claims repository and limited case mgmt. services previously provided by a subcontractor (Health Smart) to the CCE will now be provided by a sub- contractor of NIOSH and if so, what is the anticipated start date? Can you advise if a transition phase will be needed and if so for how long? We are trying to determine if we need to include costs associated with these services in this solicitation response.

A21. Offerors shall only address the activities as listed in the Performance Work Statement.

Q22. Page 9 of the Performance Work Statement, heading C.3.1.9 Subcontracting: Would vendors who have a contract with the institution (but not the CCE directly) but may be used by the CCE to assist in supporting operational functions be considered a “subcontractor” as identified in this section? For example, a vendor who provides A22. Any organization performing an element of a potential contract which is not the prime contractor would be considered a subcontractor.

Q23. For references, are CDC and NIOSH permitted to complete reference forms on our behalf? Can we use our

CPAR evals for this section?

A23. See SOL p57-58. Offers will submit at least 3 references using the Past/Present Performance Reference

Questionnaire. Any CDC individual not participating in the source selection or evaluation of proposals may serve as a reference.

Q24. In # 13 of the Scope of Work: it states that care coordination and case management will include medical management decisions made by non-participating providers when these decisions impact conditions managed by the

CCE. CCE’s do not serve as primary care facilities so we would like more clarity regarding the specifics of our responsibility in identifying these situations?

A24. If through direct patient care service or case management interface, the CCE learns that external medical management decisions are adversely impacting a member’s certified health condition, the CCE is expected to educate the member and reach out to the other provider in a good faith effort to coordinate and optimize disease control (health outcome).

Page limits:

Q25. Operations Manual – Please clarify whether or not you want the entire Operations manual submitted as an attachment. To include it within the 85 page limit would be impossible as it by itself exceeds this count.

A25. A “draft” Operations Manual is clarified to mean an explanatory outline or summary of what the proposer would include in the full Operations Manual (due 60 days post award) to demonstrate technical understanding of the breadth and depth of implementation needs to be in compliance with Program policies and procedures (as per online reference to the

Program Policy and Procedure Manual). The page limit has hereby been increased to 100 pages.

Q26. Page 55 of the Solicitation document; heading L.11: Technical/Management Proposal Instructions: In this section it is stated that Volume 1: Technical/Management Proposal has a page limit of 85 pages. Do these 85 pages include the Project Management Plan and Operations Manual, or should those be attached in the appendix?

A26. Those plans are included in the technical proposal and subject to the technical proposal page limit which has been increased to 100 pages.

Q27. Solicitation, Section L.11 p.55. Will the Government exclude Cover Letter, Cover Page, and if applicable an

OCI Mitigation Plan from the proposal page count A27. Yes, those elements are excluded from the 100 page count of the technical proposal.

Q28. Solicitation, Section L.11 p. 55, second paragraph. This paragraph lists several items in the Business Proposal that are excluded from page count does not include Representations and Certifications in the list. Will the

Government confirm that Representations and Certifications are also excluded from page count?

A28. Yes, those items are excluded from the page count.

Q29. Solicitation, Section L.11, Tab 5 p.56. Will the Government exclude the draft plans under Sections 5.1, 5.2, 5.3, 5.4, and 5.5 from the page count for Volume I?

A29. No, the draft plans noted in section 5.1-5.4 are included in the 100 page count of the technical proposal and the draft

PII plan is excluded as noted on page 55 of the SOL.

Q30. Solicitation, Section L.11, Tab 6, p.57. On page 55, it states that past performance and references do not count against the page limit; however, page 57 TAB 6 states that past performance is subject to a 2 page limit. Will the

Government please clarify the discrepancy or eliminate the 2 page limit statement on page 57?

A30. The 2 page limit refers to the narrative of the offeror’s past/present performance which is discussed in the paragraph preceding items 1-11.

Q31. L.11 TECHNICAL/MANAGEMENT PROPOSAL INSTRUCTIONS. Are the following deliverables considered part of the 85 page limit:

• Project Management Plan – Yes

• Operations Manual – Yes

• Quality Assurance and Internal Audit Plan – Yes

• Coordination of Benefits Plan – Yes

• PII Security Plan/Information Security Plan – No

• Resumes of Key Personnel – No

• References – No

• Subcontracting Plan – No

A31. The response follows each element above. The technical proposal page count has been changed to 100 pages.

Q32. Please confirm if Fixed Fees can be applied to all CLINs (Operations & Management, Member Services and

Case Management)?

A32. All CLINs are hereby changed to Cost Plus Fixed Fee type CLINs. Yes, Fixed Fee may be applied to all CLINs.

Q33. Section L.9 of solicitation: Solicitation specifies font size, but no specification of font type. Please confirm if a specific font type is required.

A33. A specific font type is not required.

Q34. Section L.9 of solicitation: May we include flow charts and/or organizational charts on larger page size (i.e. 11x

17)?

A34. Flow charts and/or organizational charts may be formatted for paper size up to Ledger, 11 x 17.

Q35. Section L.9 of solicitation: May budget sheets be on larger page size and/or different font size?

A35. The Business Proposal may include sheets formatted for larger paper size up to Legal, 8 ½ x 14.

Q36. Section L.11 of solicitation: Is a draft coordination of benefit recovery plan necessary for those applying for the responders’ population?

A36. A draft coordination of benefit recovery plan with respect to worker’s compensation benefits is necessary for those submitting a proposal for the responders’ population.

Q37. Provide documentation regarding verification of the states in which the Offeror has been authorized to operate as a healthcare provider – Does this mean licenses of our clinicians?

A37. Offerors shall ensure that all credentials, licenses and proof of insurance are up to date and are maintained and available upon request. The SOL shall be modified to reflect this change.

Q38. L.12, Tab 4, page 63 – It indicated a return copy of the Business Associate Agreement needs to be included with response to RFP. Our CCE previously has a signed WTCHP BAA (executed in 2013). Can this previously signed BAA be used to satisfy this solicitation requirement? If a new one needs to be signed, can the outset to the terms we negotiated in 2013 can be retained?

A38. A newly signed BAA must accompany an offeror’s proposal. An offeror may suggest deviations to the BAA included in the RFP, which the government may or may not accept.

Q39. Case Management is listed as a separate CLIN; however, case management and care coordination are listed under member services in the scope of work. Please confirm whether these should be budgeted separately.

A39. Case management and care coordination should be budgeted under the Case Management CLIN.

Q40. Member certification is not listed in any of the CLIN. Please confirm which CLIN this should be listed under.

A40. Member service for services above and beyond the intended services offered within the fee-for-service arrangements for the monitoring exam.

IT Security:

Q41. PWS, Scope of Work, C.14 - Can costs for FISMA implementation be built into budgets?

A41. Yes. All costs for services and activities required under the base period and option periods shall be included in the

Business Proposal.

Q42. Attachment J2 - Can you please confirm whether any access (physical or logical) will be required to Federal information and/or information systems?

A42. No access to federal facilities or information systems will be provided; however, the data and information gathered under this potential contract is considered Federal Information.

Q43. Attachment J.2 p1, Given that this is now a Federal contract, does the government consider all the information collected, processed and stored by the WTCHP contractors to be “federal information”? This has major impact on the scope and applicability of the security and privacy requirements.

A43. The CCE requirement has been a federal contracted effort since 2011. See SOL p34, FAR 52.227-17 Rights in Data –

Special Works and p26, H.4 Dissemination of Information. All information collected, processed and stored is federal information and is owned by WTCHP.

Q44. Attachment J.2 p2, Would the government reconsider changing the overall security categorization to low?

A44. No. Due to the Personally Identifiable Information (PII) and Electronic Protected Health Information (ePHI) this is collected, processed and stored in the federal system that will be hosted at the vendor the data categorization will be moderate.

Q45. Attachment 1, Section C.14 p41 and Attachment 2, Section 1.3 p1 - The PWS lists 7 forms of documentation that will be compiled by the Government from each CCE. In addition to compiling the documentation, is it the expectation that the CCEs will participate in joint exercises with the Government to test the effectiveness of the

CCEs’ plans? For example, each CCE will be required to submit a Business Continuity Plan (BCP) that is compliant with NIST Special Publication 800-34 Rev. 1. The NIST publication requires Plan Testing, Training, and

Exercises (TT&E) in the form of “tabletop” and “functional” exercises. If yes, what is the expected frequency of the exercises? Other than the BCP exercises, are there other ongoing, joint security testing and/or exercise requirements not listed in the PWS or IT Security attachment?

A45. The BCP will be conducted yearly and the results will be submitted to the Government. The Government will have representatives sit in all BCP testing. The level of involvement will depend on the BCP of the CCE. At the very least they will be observers. There is no other defined joint security testing and/or exercise requirements not listed in the PWS or IT

Security attachment at this time. But the Government could institute new ones based on performance of the CCE when it comes to the security of the vendor hosted Government system.

Q46. Attachment 1, Section C.12.1 p35 and Attachment 2, Section 17.5.4 p14 - Does the Government have a specific format that they would like the CCEs to use to guide their plan documents? For example, are there specific

SSP/BCP/SAR/PIA/PTA plan templates that the CDC/NIOSH prefers? Other examples could include controls checklists, inventory templates, etc.

A46. Yes. Once awarded the CCE will be given an introductory security packet that will explain the process. Part of this packet will be templates of all documents that need to be created while building the security package.

Q47. Attachment 2, Section 17.2, p.13. Since FISMA compliance is a new requirement for the CCEs, how long after award will the CCEs have to become compliant with FISMA (i.e. receive ATO). Is there a deadline for completing the ATO?

A47. Yes there is a deadline of 60 days for a completed and reviewed Security Assessment and Authorization (SA&A) package needs to be submitted to Office Chief Information Security Officer (OCISO) after the award of the contract.

Q48. Attachment 2, Section 17.4. p. 13. If a CCE has an ATO from a different Government agency (for example

DoD, DHA), will that ATO be accepted in lieu of a new ATO directly from CDC/NIOSH? Also, if a CCE already has a current ATO in place with CDC/NIOSH (for another contract), would that contractor be required to complete a new ATO for this contract?

A48. Yes a new ATO will be required.

Q49. Attachment 2, Section 17. P. 13. Are there any CDC/NIOSH-specific security policies, in relation to, or above and beyond the FISMA requirements, that an offeror should be aware of?

A49. Currently no, there are no other security policies the offeror needs to be aware of other that is what outlined in the

PWS and Attachment 2. But the Government may have a requirement change for a vendor hosted Federal system at a later date.

Q50. Attachment 2, Section 17.5.3, p.14. Will an offeror be required to submit a technology inventory (i.e. hardware, software, etc.) as part of the IT security requirements (for the purpose of accounting for vulnerabilities and risk mitigation)?

A50. Yes an offeror be required to submit a technology inventory (i.e. hardware, software, etc.) as part of the IT security requirements.

Q51. C.14 FISMA Compliance. How will expenses for FISMA and Authority to Operate (ATO) be handled given that there is a fixed price model for administrative expenses? It is impossible to estimate compliance costs A51. The government would, anticipate that these elements be captured under the Operations & Management CLIN which is now a cost plus fixed fee CLIN type.

Q52. C.14 FISMA Compliance. Does the FISMA/ATO plan have to be submitted with the proposal?

A52. No, the FISMA/ATO plan does not need to be submitted with the proposal. It will be worked on together with the

Government once the CCE is awarded.

Q53. Attachment 1., C.14. pgs. 41-44- FISMA Compliance: When are all IT and FISMA requirements required to be effective? Will a grace period be allowed for institutions still evaluating compliance compatibility and resources needed to achieve compliance?

A53. There is a deadline of 60 days for a completed and reviewed Security Assessment and Authorization (SA&A) package to be submitted to Office Chief Information Security Officer (OCISO) after the award of the contract.

Q54. Will the WTC CCE be provided with a point person to determine which areas of the plan apply to which systems at the individual CCE?

A54. Each offeror will need to have their own resources that will work with multiple Information Security Analyst on the

Government side. It will be the responsibility of the contractor to fill out the required documentation.

Q55. Can the WTC CCE allocate resources to prepare to meet the IT requirements in this application? If so, can resources be adjusted in the future based on the outcome of what portions of the intuition are subject to these requirements?

A55. It is up to each offeror as to how they allocate their resources. For the purposes of business proposal planning any anticipated costs for option years shall be priced.

Q56. Attachment J.2 p2, Does the Roster need to include the names of all IT support personnel (e.g. network, database and system admins), or can the roster be limited to only the clinical and administrative staff directly supporting the WTCHP? We note that our IT organization is very large and listing all IT personnel would overly onerous.

A56. Every staff member that works on any aspect of the vendor hosted Federal system needs to be listed. Before any staff begins it needs to be sent to the Government for approval. The Government also needs to be informed when any staff member leaves. The Government needs to approve any changes of the staff member’s position sensitivity designation.

Q57. Attachment J.2 p3, Do all of our IT support personnel have to complete the mandatory security awareness training hosted by the CDC?

A57. Every staff member that works on any aspect of the vendor hosted Federal system needs to go through security awareness.

Q58. Attachment J.2 p5, Can you please confirm whether all of our IT support personnel including our subcontractors need to sign the NDA (CDC Commitment to Protect Non-Public Information – Contractor Employee

Agreement)?

A58. Every staff member that works on any aspect of the vendor hosted Federal system needs to sign the NDA. It is the prime contractor’s responsibility to ensure that all their subcontractors and their staff comply with all requirements.

Q59. Attachment J.2 p7, Is there a template available for the PII Security Plan?

A59. Yes. Once awarded the CCE will be given an introductory security packet that will explain the process. Part of this packet will be templates of all documents that need to be created while building the security package.

Q60. Attachment J.2 p7, What is the page limit for the PII Security Plan?

A60. None.

Q61. Attachment J.2 p7, Can you please clarify what is meant by “verify the existing risk assessment”? Specifically, are you requesting that we perform a new risk assessment or report on our existing risk assessment process which includes WTCHP support systems?

A61. Part of building the SA&A package with the Government will be doing a risk assessment of the vendor hosted Federal system.

Q62. Attachment J.2 p7, Is there a more concise list available detailing all of the “information protection requirements” in the SOW? We note that there are many security requirements in Attachment J.2.

A62. Currently no there are no other security policies the offeror needs to be aware of other that is what outlined in the

PWS and Attachment 2. But the Government may have a requirement change for a vendor hosted Federal system at a later date.

Q63. Attachment J.2 p8, Can you please confirm whether all of the privacy controls from Appendix J of NIST SP

800-53 Revision 4 apply? If not, which ones are we expected to comply with? We note that the number of privacy controls is quite extensive.

A63. All controls in NIST SP 800-53 Revision 4 apply.

Q64. Attachment J.2 p8, Can you please explain which contractor employees would be designated as Level 5 and

Level 1? Would IT support personnel be designated as Level 5 or 1? We note that our IT support personnel is quite large and question whether the government would want to allocate resources to conduct so many Public Trust

MBI/LBIs.

A64. It is up to the CCE to determine which position needs which sensitivity designation. Then each staff member that fills the position will need to be approved by the Government.

Q65. Attachment J.2 p10, Can the government please confirm whether we are expected to implement HSPD-12 PIV-compliant access cards for logical and physical access to our WTCHP facilities and related information?

A65. A vendor hosted Federal system needs to be accessed and protected to the correct level depending on the rating of the system. Since the system will be rated as a moderate it needs to have 2 factor authentication. If a Federal employee accesses the vendor hosted Federal system then the system must accept the HSPD12 since that is the only way a Federal staff member may access a Federal system.

Q66. Attachment J.2 p13, Is a FIPS 199 assessment still needed given that the overall security categorization has already been designated by the government as moderate.

A66. Yes, a FIPS 199 assessment will still needed.

Q67. Attachment J.2 p13, 45 days to complete a Security Assessment and Authorization is not a realistic milestone given the complexity of the requirements and actions required by us and the government. Can this milestone be revised to +90 days to allow for my time and allocation of sufficient resources?

A67. Yes there is a deadline of 60 days for a completed and reviewed Security Assessment and Authorization (SA&A) package to be submitted to Office Chief Information Security Officer (OCISO) after the award of the contract.

Q68. Attachment J.2 p14, Can you please confirm that the Security Assessment will be undertaken by NIOSH as the independent assessor and that no onsite testing will be required?

A68. Yes, the Security Assessment will be undertaken by NIOSH as the independent assessor. The Government could perform onsite testing based on performance of the CCE when it comes to the security of the vendor hosted Government system.

Q69. Attachment J.2 p16, The adoption of USGCB and related configuration standards is a complex and time intensive task. Would the government accept that only those systems directly supporting the mission of the WTCHP be subject to these standards (as opposed to the entire organization)?

A69. Defining the system boundary is part of the process when building the SA&A package.

Q70. Attachment J.2 p18-24, Can you please confirm that all FedRAMP security requirements do not apply if we do not utilize any cloud service providers to support WTCHP operations?

A70. FedRAMP only applies to a vendor hosted Government system that uses a cloud service provider in its architecture.

Q71. Solicitation p. 56-57 description of TAB 5: Please clarify what is needed for Section 508 Standards and If possible, can the forms which need to be completed be provided?

A71. http://www.hhs.gov/web/section-508# The forms will be provide once the award is made.

Q72. For the purposes of completing the 508 template, can you clarify if it only applies to public access or does it include our employees even though they are not Federal employees?

A72. 508 applies to the full vendor hosted Government system.

Q73. The contract solicitation and PWS section C.14 makes reference for the need to include a plan to have all IT systems meet NIST moderate security and FISMA requirements. Is this a misinterpretation of the solicitation? This will require extensive analyses to come up with specific plan and budget. To avoid risk for all parties involved including NIOSH we propose that this be a requirement for submission 180 days after the award of the contract.

A73. There is a deadline of 60 days for a completed and reviewed Security Assessment and Authorization (SA&A) package to be submitted to Office Chief Information Security Officer (OCISO) after the award of the contract.

Q74. Can a non-profit entity receive a fee?

A74. It is an offeror’s business decision if they choose to charge a fee and it is their responsibility to ensure that they are acting in accordance with the legal framework of their business structure.

Q75. Attachment 1 to the solicitation, the WTC HP CCE Contract Solicitation Performance Work Statement

(PWS), section C.3.4.1 “Licensing and Insurance”, states on page 17 “The CCE shall ensure that all internal providers are properly licensed under applicable state laws and/or regulations and are properly insured with at least minimum amounts of malpractice insurance as required by the provider’s State licensing requirements.” In this section as well as the following section C.3.4.2 “Training” on page 17 does “internal provider” only refer to those providers directly employed by the CCE and not providers employed elsewhere but enrolled in our provider network?

A75. Yes, that is correct. Credentialing and training internal providers (employed to work within the CCE) is required by the CCE. However, this does not absolve the CCE from responsibility in making an appropriate referral to a network provider and to adequately communicate program limits with respect to program-related service – an issue more pertinent to the authorization of services to external network providers.

Q76. Section F.2 “Deliverable Documentation,” on page 11 of the solicitation, suggests that costs must be reported in monthly reports for 23 separate member service functions. Best practice, approved by NIOSH in the current contract for all CCEs has been to report for far fewer higher level categories. Are offerors allowed to propose optional monthly reporting structures based on best practices for reporting on the current clinical centers of excellence contracts?

A76. Offerors may propose items based on experience and practice; however, the government has already determined that greater transparency is needed.

Q77. Section L.11 “Technical/Management Proposal Instructions,” on page 55 of the solicitation, describes that past performance does not count against the page limit of 85 pages. However, on page 58 of 71, the solicitation states after items 1 through 11 that there is a page limit of 2 pages. Can NIOSH clarify whether the 2 page limit is for each reference cited or for the entire past performance section?

A77. The 2 page limit refers to the narrative of the offeror’s past/present performance which is discussed in the paragraph preceding items 1-11.

Q78. Section L.11 “Technical/Management Proposal Instructions,” on page 55 of the solicitation, indicates that offerors “shall include any assumptions used in preparation of their response.” Could the Government elaborate on the types of assumptions they would like detailed in this tab? Does “assumptions” refer to the “proposal assumptions” described in Section L.10 “Proposal Assumptions” on page 54? Or are there other kinds of assumptions that should be described in this tab?

A78. Offers should include any assumptions they have taken to prepare their proposal which would assist in the government in making both a determination of technical acceptability as well as a cost/price realism.

Q79. Figure C.3.5.1 Claims Submission and Processing pg. 19. Please clarify the process for CCE denied claims.

A79. Providers will need to be made aware of this decision and the follow steps to reprocess a claim. After the step of

“CCE or NPN approves or denies claims on portal”, the next step is “HPS contractor adjudicates claims and generates payment file and remittance advice files for transmission to CMS”. The remittance advice files contain paid and denied claims and will be transmitted to the billing providers either electronically, paper, or both, as requested by the provider. The denied claims will have “Result Codes” and descriptions of the codes for use by the providers to decide the course of action that they will take, including acceptance of the denied claim, adjust the claim to conform with WTC Health Program requirements and submit the adjusted claim, or appeal the denied claim with a rationale for the appeal.

Q80. Page 27 of the Performance Work Statement, heading C3.8.1 Quality Assurance and Internal Audits, and Page

30 of the Performance Work Statement, heading C.9 Clinical Center of Excellence Services Summary Table/Quality

Assurance Surveillance Plan (QASP), Page 38, heading C.12.3: Quarterly, Semi-Annually, and Annual Reports: The first section describes a Quality Assurance Plan (QAP) which identifies potential categories for internal audits to evaluate. The latter section describes a QASP with “suggested metrics” for measurement, then proceeds to list on pages 31-33 fourteen performance metrics. The third section lists further audit metrics that are required for inclusion in the quarterly, semi-annual, or annual reports. Please clarify if all of these identified audits are required as reportable, and if so, at what frequency?

A80. Quarterly, semi-annual, or annually accordingly.

Q81. Solicitation, Section L.7 p.52, will the Government provide an extension for the proposal due date?

A81. No.

Q82. Solicitation, Section L.11, Tab 5, p.57. Will the Government accept proposals offering an alternate technical approach?

A82. While offerors may proposal alternative technical approaches, the government has already determined that the approach (es) included in the Performance Work Statement are preferred.

Q83. C.3.7.3 Program Benefits Counseling. Will the Health Program Support (HPS) contractor, as part of its web-based care management system, have fields for documentation of the various components that must be covered in mandated benefits counseling?

A83. It is anticipated that the CCE will be required to provide the labor to enter this information.

Q84. Attachment 1., C.3.1.10 Change Control Process: Can you clarify what Change Control Tracking involves?

Specifically, does this pertain to requesting additional funding for new projects in the future?

A84. The Change Control Process is a system of documentation to track change requests and acceptance of changes on the part of both the government and contractors. Yes, this process would be used for funding requests as well.

Q85. Attachment 1., Section C. “The CCE shall ensure that all prescriptions issued to enrolled members are for

WTC-Certified conditions, medically associated conditions, and in compliance with the Zadroga Act and the PPM.”

Please clarify how the CCE Is expected to control which medications are filled by the program when the Pharmacy

Benefit Manager (PBM) is not overseen by the Clinical Center of Excellence? Does this mean that the CCE is responsible for review of medications that are routed to the CCE for override review, as well as for a retrospective

QA as outlined in the QASP?

A85. Yes. This is specific to prescriptions issued and not prescriptions filled. This means that providers affiliated with a

CCE understand the limits and Program formulary so that they are only prescribing medications that are covered and appropriate for a member’s certified condition. Providers should not be prescribing any meds outside of the Program formulary or for non WTC certified conditions for members.

Q86. “The CCE shall have protocols and procedures in place to ensure compliance with any medication restrictions and requirements as described in the formulary and the PPM for prescription drugs.” Please how this compares with the roles of the WTCHP PBM and what is expected by the CCE vs. the PBM.

A86. The CCE is expected to have its internal protocols that align with the program policy on PBM service. Again, this relates to WTC physicians issuing appropriate prescriptions based on Program policies and for medications only for the

WTC certified condition.

Q87. “The cost of inappropriate prescriptions filled through the Program due to the CCE neglecting to follow these policies and procedures shall be recouped by the WTC Health Program from the CCE’s funding. The CCE is required to include retroactive review findings in the quarterly report.” Please clarify that this pertains to decisions based on the timeline of receipt of medical records, and that if medical records are received later than ideally expected, that the CCE will not be responsible for decisions pertaining to lack of medical record receipt.

A87. It would only be appropriate for a WTC Physician to prescribe medications off of the diagnostic formulary before reviewing medical records and prescribing treatment medications without the appropriate information to prescribe such meds. Use of the diagnostic formulary would be appropriate and therefore not lead to Program recoupment unless the medications are prescribed for a non-WTC certified condition.”

Q88. Attachment 1., C.3 Scope of Work, (20) – p. 6: Please clarify the role of the WTC CCE outreach. Education and enrollment assistance activities as compared the WTC Data Centers and the WTC Health Program. Below are some specific questions as well:

• Q88a. When will NIOSH share their WTC Member Services Outreach and Education Plan?

A88a. Upon award.

• Q88b. Will CCE be responsible to identify potential outreach target groups or will these groups be identified in the strategic outreach plan?

A88b. The CCE will be responsible for identifying sub-sets of the General Responder or Survivor categories.

• Q88c. What is the geographical area for CCE to conduct outreach?

A88c. By law, CCEs serve members in the New York Metropolitan Area. CCE outreach is limited to the NYMA as defined in 42 CFR Part 88. CCEs should refer outreach contacts outside of the NYMA to NIOSH.

• Q88d. WTC website- will that website have to be updated monthly with a new content?

A88d. Not necessarily if there is not any new content to update

• Q88e. Will CCE have to collaborate with DC on their internal newsletters?

A88e. The CCEs should notify the DCs of their plans for a newsletter so that they are aware of the outreach activity. Newsletters should only be sent to the CCEs member population. If a newsletter is expected to be disseminated to a larger population it should be reviewed by all CCEs and the DC, as well as NIOSH.

• Q88f. The intro section in the “Information and Education” paragraph indicates that the CCEs will have to conduct activities with potential members and interact with corresponding DC and the WTCHP

Administrator? What would be the interaction between the CCE and the Administrator?

A88f. Administrator is meant to refer to appropriate NIOSH staff acting on behalf of the Program.

• Q88g. Will CCE be able to provide enrollment assistance?

A88g. Yes. The CCE should provide enrollment assistance.

Q89. Attachment 1. C.3.7.3 Program Benefits Counseling: What specific metrics will be required to provide during benefits counseling monthly calls? Will this be the platform where the CCE report on the number of specific benefits counseling sessions conducted, their types as well as the complaints that the CCE received within that month?

A89. This will be discussed once the benefits counseling team meets, but will include metrics related to how many people were offered benefits counseling, how many members went through benefits counseling, and types of benefits counseling provided. Complaints received by members will be reported in CCE monthly reports not in the benefits counseling report.

Q90. What should the Benefits Counseling Plan entail?

A90. The plan should entail how the CCE will perform the items listed in the solicitation as being required for performing benefits counseling.

Q91. Can you clarify what is expected for “care for non-covered health condition assistance”.

A91. When members present with a condition that is not covered by the WTC Health Program, or the condition is covered but the member does not meet the certification requirements, then the CCE should provide benefits counseling for where the member should seek care for those medical issues. For example, it could be as simple as referring them back to the

Primary Care Physician or referring them to low-cost community based care if the member has limited financial resources.

Q92. Attachment 1., C.3.2, p. 11 “The monitoring examinations shall be conducted by a qualified physician, preferably one specializing in Occupational Medicine” – Please clarify if a Nurse Practitioner can complete the

WTC Monitoring Examination.

A92. Yes.

Q93. Attachment 1., C.3.2, p. 11-12 “As part of the medical monitoring evaluation process, the CCE shall accomplish the following tasks…..Collect primary insurance and submit the information to the appropriate entity to ensure coordination of pharmacy benefits of pharmacy claims when appropriate” – Please confirm that this is not required for CCE’s applying to service WTC responders only.

A93. Yes. It is not required for the responder members.

Q94. Attachment 1., C3.3.1 Data Flow related to treatment services “In addition, the CCE shall have the capability for a medical records locator and other case management tools. This function will facilitate the retrieval of all medical records from any provider for any member within the CCE or their external provider network. Any required data to be used for research shall be reviewed, approved, and transmitted to the corresponding D.C.”

Can you specify what level of detail is required for medical records, particularly those for external provider network services?

A94. Adequate clinical decisions and services should be well documented.

Q95. Can you clarity what level of treatment information is to be transmitted to the Data Centers, and how?

A95. No treatment data would need to be transmitted from the CCE to the DC directly.

Q96. Attachment 1., C-9., Clinical Center of Excellent Summary Services Table/Quality Assurance Surveillance

Plan(QASP) # 11, p. 32– Mentions that the diagnostic plan is only available for 12 months:

• Please clarify that diagnostic claims under the current WTC Health Program Policies (claims which include symptoms) are not limited for 12 months only per member. These types of claims can be received throughout the course of the patients care in the program

• Please clarify how the 12 month diagnostic plan will apply to payment of claims with symptom based ICD codes, if at all.

• Please clarify who will be providing the written request.

• Please clarify which signed release forms.

A96. No treatment data will be required to submit to the DC from the CCE directly. The diagram in the PWS shall be modified to reflect this.

Q97. Solicitation, pg. 58, Section L.12: Is there a preferred budget format for this application? If so, can the format be provided?

A97. There is no preferred budget format.

Q98. Attachment 1., p, 19, Figure C.3.5.1 Claims Submission and Processing: Will a transition period be allowed between the current CCE claims processing vendors and the new WTCHP Support Contract?

A98. This information is not necessary in order to respond to the RFP.

Q99. What will the length of the transition be, and what types of services would be allowed in during the transition?

A99. New awardees would be involved in any incumbents’ transition (out) phase, although this is not contractually considered a transition but just the start of contract services for the new awardees. Transitions are typically 90 days. The program anticipates awardees to be fully functional, providing all services upon commencement of the transition period.

Q100. Will the CCE’s be able to keep existing TPA’s operational during this transition period?

A100. The government anticipates incumbents to maintain continuity of services during the transition. New awardees shall be expected to provide the services as outlined in the Performance Work Statement.

Q101. Attachment 1. C.3.1.1 Project Management Plan: Is there a template or specific format that is required or recommended for the Project Management Plan? Can the level of detail required for this plan be clarified?

A101. Refer to C.1.1.1 Project Management Plan for details. No template will be provided.

Q102. Attachment 1., C.3.1.3, Communication Plan: Is there a particular format for the communications plan, of list of areas that should be addressed in the communications plan?

A102. Refer to C.3.1.3, Communication Plan for details. No template will be provided.

Q103. Solicitation p. 56-57 description of TAB 5:

Please clarify if the following against the 85 page limit in the technical proposal: Communications Plan.

A103. The communications plan is not part of the proposal package. The technical proposal page limit has been extended to 100 pages.

Q104. Please clarify that a Draft of Coordination of Benefit Recovery Plan is not required for those applying to serve WTC CCE Responders Only, and not WTC Survivors.

A104. A draft coordination of benefit recovery plan with respect to worker’s compensation benefits is necessary for those submitting a proposal for the responders’ population.

Q105. If possible, can the forms which need to be completed be provided (for COB and or Workers’ compensation)?

A105. It is the responsibility for the CCE to obtain appropriate forms to execute the service accordingly (i.e., obtain appropriate form from the workers’ compensation board).

Q106. Solicitation Section L, TAB 3: What is expected for supporting documentation pertaining to reasonableness of costs included in this proposal?

A106. The following list is not an exhaustive list of elements an offeror may provide but mere suggestions:

• Previous contract prices for similar services

• Direct labor salary justifications. How does the offerors’ direct labor compare against industry public or private and how is rate adjustment determined

• Fringe benefit structure

• Indirect rate structure

• Government Audits

• Subcontract agreements

• Internal travel policy

• Overtime policy

Q107. Attachment # 1 pg. 35-36 Invoicing detail for each requirement of the monthly reports. Please verify that costs do not need to be allocated for all of the categories specified in this section.

A107. Invoicing detail should contain enough transparency in reporting in an effort to distinguish and determine for what services costs are being allocated.

Q108. Attachment # 1 pg. 35-36 C12.2.1 Member services monthly report C12.2.2 Administrative Services Monthly

Report. The current RFP’s CLINs are not designated by administrative services. Please clarify what CLIN this pertains to.

A108. The Operations and Management CLIN.

Q109. Attachment 1., Figure C.3.3.1 pg. 19 Data flow related to treatment services “Any required data to be used for research shall be reviewed, approved, and transmitted to the corresponding DC” Please clarify what treatment data will need to be submitted.

A109. Refer to Figure C.3.2.1 Data flow related to monitoring examinations in the PWS.

Q110. Attachment 1., Figure C.3.3.1 pg. 16 Data flow related to treatment services “Approval and utilization review for non-emergency inpatient services (i.e., overnight stay), and notification within 48 hours of emergency hospitalization for WTC-related health conditions and medically associated conditions. All approvals shall be done in accordance with the Program’s Policy and Procedures Manual (PPM).