3. PWS.pdf

03 Feb 2025

PERFORMANCE WORK STATEMENT

FOR

AEROSPACE MEDICINE PHYSICIAN/FLIGHT

SURGEON

HQ AETC/SG COMMAND SURGEON

JOINT BASE SAN ANTONIO, TX

TABLE OF CONTENTS

SECTION NUMBER AND TITLE

1.0 INTRODUCTION

2.0 GENERAL INFORMATION

3.0 DESCRIPTION OF SERVICES

4.0 HOURS OF OPERATION

5.0 CONTRACTOR EMPLOYEES

6.0 SERVICE SUMMARY

7.0 QUALITY CONTROL PLAN

8.0 GOVERNMENT FURNISHED PROPERTY/SERVICES

9.0 ORGANIZATIONAL CONFLICT OF INTEREST

10.0 HIPAA BUSINESS ASSOCIATE AGREEMENT (BAA)

PERFORMANCE WORK STATEMENT

FOR

AEROSPACE MEDICINE PHYSICIAN/FLIGHT SURGEON

1.0. INTRODUCTION. The purpose of this PWS is to provide contract support for an Aerospace Medicine Specialist Physician (Flight Surgeon) in support of the Flight Medicine and Physical Standards Branch (SGPF). This includes preparing and delivering slide presentations on matters pertaining to the application of physical standards, certification action, and waiver consideration delegated to this branch by the Office of the Air Force Surgeon General. SGPF also performs data input and updates to an exclusive government provided database on medical certification, waivers, and cases of attrition from training, secondary to medical issues and standards. The Physical Standards Branch serves as the focal point for operational risk analysis for the Force Development Exception to Policy board process which has been delegated to the Air Education Training Command Commander (AETC/CC).

1.1. This contract is a personal services contract and it is intended to create an employer-employee relationship between the Government and the individual contract Aerospace Medicine Physician, only to the extent necessary for providing the services required. The performance of the contracted individual under a personal services contract is subject to day-to-day supervision and control by the agency personnel comparable to that exercised over military and civil service personnel. The contract does not create an employer-employee relationship between the Government and any corporation, partnership, business association or other party or legal entity with which the contract health care provider may be associated.

1.2. Relationship of the Parties. This is a personal services contract as defined in Federal Acquisition Regulation (FAR) 37.104 The physician who furnishes services under this contract is subject to day-to-day supervision and control of employees of the United States. The Flight Commander or appointed individual shall perform as the Government Supervision and control where the services are performed.

1.3. Credentials Requirements

1.3.1. Privileging Requirements. Copies of required certification shall be furnished to the Contracting Officer prior to performance of this contract. Each required document shall be sent in PDF form, one document per PDF, to ensure credentialing as soon as possible.

1.3.2 A copy of the proposed physician's professional resume (curriculum vitae), accompanied by that individual’s sworn affidavit of the truthfulness of same, indicating experience, training, and technical expertise. The resume shall be included with proposal. In the event of personnel changes, provide resume of potential candidates to the Contracting Officer’s Representative (COR) for review, prior to placement.

1.3.3 Annual Training Requirements. All contract employees shall complete any mandatory and annual training required in accordance with DoD, Air Force Instructions, and regulatory agencies (TJC, Health Insurance Portability and Accountability Act (HIPAA) AF

Computer Security Policy, and AF Safety Policy). They shall complete any additional training as dictated by the work-center.

1.3.4 Health Insurance Portability and Accountability Act (HIPAA). Individuals performing services under this contract shall complete HIPAA Act Privacy Rule training and shall be held accountable for complying with the agency's specific health information privacy and security policies and procedures.

2.0. GENERAL INFORMATION. The contractor shall furnish all labor, tools, equipment, materials, supplies, required for the execution and completion of work, management, supervision, transportation, teaching, consultations and reports necessary to provide one aerospace medicine physician for government consultant services and management functions at the United States Air Education Training Command Headquarters Surgeon General Office located on Joint Base San Antonio Randolph (JBSA Randolph), Texas, also referred to as the HQ AETC/SGPF herein. Primary location for this position shall be in the Headquarters AETC Command Surgeon’s Office. Contractor care shall cover the range of services provided in both an aerospace medicine and flight surgeon offices. Performance shall be according to the requirements contained in this Performance Work Statement (PWS), and professional standards of The Joint Commission (TJC), the Air Force Inspection Agency’s Health Services Inspection (HSI), and in accordance with the current Air Force Medical Service Guidelines.

The primary purpose of this contract is to accomplish medical evaluation and adjudication of medical requirements and waivers specifically related to accessions waivers, medical examinations, health assessments, physical evaluation, fitness for duty and disability determinations on various types of cases, and other similar physical medical cases submitted to AETC/SGPS for determination and action. This includes assistance in formulation of responses and dispositions to individual cases as well as making recommendations for development of policies that guide the decisions which are ultimately made by the SG director.

3.0 Description of Services: MAJCOM Resident Aerospace Medicine (RAM) Specialist.

The aerospace medicine physician shall primarily perform the duties as MAJCOM SGPA to include consultation and expert recommendations on the management, administration, and oversight of aeromedical programs for Air Education Training Command. These primary duties include but are not limited to those items listed below.

3.1 Formal Education. Possesses a doctor of medicine degree or a doctor of osteopathy degree from an approved school of medicine or osteopathy.

3.2 Certification.

3.2.1 Board certification in Aerospace Medicine. The ideal candidate shall have demonstrated leadership in the management of aeromedical programs at the group, wing, and enterprise level. The ideal candidate shall have a background in flight operations and in-depth understanding of United States Air Force (USAF) Operations and Maintenance programs.

3.2.2 Customer is seeking an experienced flight surgeon to perform consultation/staff functions at the Major Command (MAJCOM) level. The ideal candidate shall have an in-depth understanding of not only the management of aerospace medicine programs at the enterprise level but also an in-depth understanding of flight operations and maintenance. The ideal candidate shall have a background in flight standards. The ideal candidate shall have experience writing regulatory guidance, reviewing waivers and implementing policy regarding aerospace medicine and leadership experience overseeing aeromedical programs and organizations.

3.2.2.1 Consultation on the execution of the Aerospace Medicine Enterprise (AME) for the 11 AETC bases (Altus, Columbus, Goodfellow, Holloman, Joint Base San Antonio, Keesler, Laughlin, Luke, Maxwell, Sheppard, Vance) and other geographically separated units, to include aerospace medicine, occupational and environmental, preventive medicine and public health programs. Candidate shall provide expert recommendations on implementation and application of Department of Defense (DOD), Air Force (AF), Air Force Medical Service (AFMS) and Air Education Training Command (AETC) guidance and standards for the AME.

3.2.2.2 Case review and risk assessment/stratification for the Force Development Exception to Policy (FDETP) board proceedings. This process may require but is not limited to chart review, review of additional medical documents, coordination with civilian and military medical providers, coordination with submission sources within the line of the Air Force, coordination with higher headquarters (HAF/SG), and consultation with the Aeromedical Consultation Service (ACS) at the USAF School of Aerospace Medicine (USAFASAM).

3.2.2.3 Review compliance of AME programs via the Management Internal Control Toolset (MICT) self-assessment communicators for 11 AETC bases and provide feedback/recommendations.

3.2.2.4 Review, provide quality control and make recommendations on the Flying Class physical waivers for all AETC personnel, via the Aeromedical Information Management Waiver Tracking System (AIMWTS) to the AETC/SG waiver authority.

3.2.2.5 Provide consultation to the Personnel Reliability Assurance Program (PRAP) at 11 AETC bases, to include implementation of Arming Use of Force (AUoF).

3.2.2.6 Provide consultation to the Public Health Emergency Officer (PHEO) plans and programs at 11 AETC bases.

3.2.2.7 Provide consultation for implementation of the Base Operational Medicine Clinic CONOPs.

3.3 Licensure. The Flight Surgeon shall possess a valid, full, active, unrestricted medical license in good standing from any U.S. jurisdiction. There shall not be any history of adverse actions against the applicant in the last 10 years.

3.4 English Language Requirement. The applicant shall be able to read, speak, understand, and write English well enough to effectively communicate with patients and other health care providers and staff.

3.5 Experience. The applicant shall have a minimum of 3 years in the last 10 years of active duty U.S. Military Flight Surgeon experience that shall have included:

3.5.1 Minimum of 5 years of experience in Air Force medical standards to conduct special operational evaluations, including (but not limited to) Preventive Health Assessments for flyers/special duty personnel, initial certification exams for flying/special duty applicants.

3.5.2 Aeromedical disposition for flying/special operational duty.

3.5.3 Conduct adaptability rating assessment for military special duty applicants.

3.5.4 Apply medical, fitness, and profiling standards IAW AFIs DAFMAN 48-123, DAFMAN 36-2905 and AFI 48-133 (including profiling and duty restrictions as Profile Officer).

3.5.5 Knowledge. The applicant shall have knowledge of current regulations including: AFI 48-101, DAFMAN 48-123, DAFMAN 48-149, AFI 36-2905, AFI 48-133, DoD 6130.03.

4.0 HOURS OF OPERATION

Normal Hours of Operation, the contractor shall perform the services required under this contract Monday - Friday, 0730-1630, excluding Federal holidays and other designated non-duty days.

However, if flextime or a compressed work schedule is in effect, work hours shall correspond with Government personnel duty hours. In the event that an occasional special project may occur, the contractor shall be required to work beyond the normal duty hours stated herein if required by the COR (Contracting Officer’s Representative). If that occurs, the COR may alter the work schedule to accommodate the additional hours needed to accomplish the project. 4.1 If flextime or a compressed work schedule is in effect, contractor work hours shall correspond with Government personnel duty hours. Occasional change of work hours may be required to accommodate extraordinary requirements. Extended or compressed schedules that are mutually beneficial and do not exceed 80 work hours in the pay period shall be coordinated through the COR. Government furnished resources shall be available during the hours of duty.

4.2 Federal Holidays. The Contractor shall not be required to work any of the following federal holidays:

New Year’s Day - 1 January Martin Luther King Day - 3rd Monday in January President’s day (observed) - 3rd Monday in February Memorial Day - last Monday in May Juneteenth Day - 19 June

Independence Day - 4 July Labor Day - 1st Monday in September Columbus Day - 2nd Monday in October Veteran’s Day - 11 November Thanksgiving Day - 4th Thursday in November Christmas Day - 25 December

4.3 Performance of Services during Crisis. It has been determined by the Chief, Aerospace Medicine Division that the requirements under this PWS are essential but duties may be executed at agreed to alternate duty location during times of crisis.

4.4 Contract Manager. The Contractor shall provide a contract manager and an alternate who shall be responsible for the performance of the work. These individuals shall have full authority to act for the contractor on all contract matters relating to the daily operation of this contract and shall be designated, in writing, to the Contracting Officer (CO). The alternate contract manager shall act for the contract manager when the manager is absent. The contract manager and alternate contract manager shall have experience in management and supervision.

4.4.1. The contract manager or alternate shall be available within 2 hours to meet on the installation or by telecom with the CO and/or with other government personnel designated by the CO during normal duty hours to discuss issues or concerns.

4.5 Communication. Contractor personnel shall maintain open and professional communication with government personnel at all times. Complaints validated by the Contracting COR shall be reported in writing to the CO and the contractor for action. If the contractor doesn’t address validated complaints brought up by the COR and the CO, it shall be viewed as a performance issue.

5.0 CONTRACTOR EMPLOYEES:

5.1 The contractor shall not employ persons for work on this contract if such employees are identified to the contractor by the Contracting Officer (CO) as a potential threat to the health, safety, security, general well-being or operational mission of the installation and its population.

5.2 The contractor is cautioned that off-duty active military personnel hired under this contract may be subject to permanent change of duty station, change in duty hours, and/or deployment. Military Reservists and National Guard members may be subject to recall to active duty. The sudden absence of this personnel could adversely affect the contractor’s ability to perform; however, their absence at any time shall not constitute an excuse for nonperformance under this contract

5.3 Appearance. Contractor personnel shall present a professional, conservative, and neat appearance. Contractor personnel shall report for duty in a professional manner, in appropriate attire and having complied with socially acceptable standards of personal hygiene. Expected dress is business casual.

5.4 Conflict of Interest. The contractor shall not employ any person who is an employee of the U.S. Government if employing that person would create a conflict of interest, violate DoD 5500.7R Joint Ethics Regulation Chapter 5, or violate any other Air Force regulation, instruction, or policy. The contractor shall not employ any person who is an employee of the Department of the Air Force, either military or civilian, unless such a person seeks and receives approval in accordance with the Department of Defense (DoD) Directive 5500.7 and Air Force policy. If prior military, personnel shall have been discharged under honorable conditions with no administrative actions taken against them.

5.5 The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including:

5.6 DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

5.6.1 Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M

5.6.2 Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems to perform information assurance functions

5.6.3 In the event there is an error in any AFIs, DoDIs etc., in this PWS, the latest version found at http://www.e-publishing.af.mil/ or https://www.esd.whs.mil/dd/dod-issuances/ shall apply

5.7 Security Requirements. Obtaining and Retrieving Identification Media. As prescribed by the DAFFARS 5352.242-9000, Contractor access to Air Force installations, the contractor shall comply with the following requirements:

a. The contractor shall obtain base identification and vehicle passes for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract.

b. No later than three days prior to start of contract work, the contractor shall submit a written request on company letterhead (or e-mail correspondence) to the project manager (with copy to contract administrator) listing the following: project title, project number, contract number, location of work site, contract start and stop dates, work schedule, and names of contractor employees needing access to the base, including full legal name, date of birth, sex, race, SSAN, state issued I.D. Card/Drivers License number, and name of sub-contractor if not employed directly by contractor (Government shall provide template to be used in submitting visitor pass request). The authorized program manager shall endorse the request and forward it to the issuing base pass and registration office or security forces for processing. Contractors shall present government (state or federal) issued ID, and INS Form 9 (I9), before being issued a pass to enter the installation. A Wants and Warrants check is conducted for every person before a pass is issued. Personnel employed by the contractor shall get a pass for their privately owned vehicles at the installation Visitor Reception Center, with proof of following:

(1) Liability Insurance

(2) Current License Plates

(3) Current State Inspection Sticker (If Required)

(4) Valid State Driver License

(5) A phone number for sponsor on base

c. Vehicles owned by the contractor with the company name permanently printed on them are not required to obtain a pass as long as a current work order is presented at the time of entry. However, current liability insurance, state inspection sticker, and registration is required.

The person driving the vehicle shall have a valid operator license for the type of vehicle.

d. The contractor is responsible for ensuring employees report to the installation Visitor Reception Center, to present their Form I-9 (Employment Eligibility Verification).

e. Upon completion or termination of the contract or expiration of the identification passes, the contractor shall ensure that all base identification passes issued to contractor employees are returned to the issuing office. If a contractor employee has been terminated, the pass shall be retrieved and returned to Security Forces so that employee does not have base access. If the pass is not retrieved then SF shall be notified so base access is not

03 Feb 2025 http://www.e-publishing.af.mil/ http://www.esd.whs.mil/dd/dod-issuances/ allowed. Upon completion of the contract return all issued installation access passes to the issuing authority.

f. Failure to comply with these requirements may result in withholding of final payment.

5.8 Pass and Identification. The Host Unit shall ensure the following pass and identification items required for contract performance are obtained for employees and non-government owned vehicles:

a. Installation Access Pass (IAP) (DBIDS), Visitor/Vehicle Pass (DoDM 5200.08, Volume 3, DoD Physical Security Program: Access to DoD Installations), used for contracts for less than one year to include one-day visits (i.e. warranty work).

b. Installation Access Card (IAC) (DBIDS), Civilian Identification Card (DoDM 5200.08, Volume 3, DoD Physical Security Program: Access to DoD Installations), used for contracts for more than one year or more which do not require access to controlled areas or government computer systems.

c. DoD Common Access Card (CAC), (AFI 36-3026), used for contracts for more than one year and requirement exists for access to the government computer systems and software.

CAC applications are accomplished by Trusted Agents via the Trusted Agent Sponsorship System (TASS).

5.9 Suitability Investigations.

a. For contracts requiring IT-Level III computer access, contractor personnel shall successfully complete, as a minimum, a Tier 1 background investigation (formerly known as a NACI), before being issued a CAC and operating government furnished workstations. The contractor shall comply with the DoDM 5200.02, Procedures for the Department of Defense Personnel Security Program, AFPD 17-1 Information Dominance Governance and Management, AFMAN 17-1301, Computer Security and AFI 17-130, Cybersecurity Program Management, requirements. Tier 1 investigations requests are initiated using the Standard Form (SF) 85 and are submitted to the installation Information Protection Office through the using agency’s Security Assistant (SA) within five days of contract start. Tier 1 investigations are provided by the government at no additional cost to the contractor.

b. For contracts requiring IT-Level I and II access with no access to classified material, the contractor shall complete a Tier 5 (formerly SSBI) or Tier 3 (formerly NACLC and ANACI) investigations, respectively. These investigations are submitted using the SF 86, and are submitted to the Information Protection Office through the using agency’s SA within five days of contract start. These investigations are provided by the government at no additional cost to the contractor.

5.9.1 Listing of Employees. The contractor shall maintain a current listing of employees.

The list shall include employee's name, social security number, and date of investigation if service work involves unescorted entry to Air Force restricted or other sensitive areas designated by the installation commander. The list shall be validated and signed by the company supervisor, and provided to the contracting officer prior to the contract start date. Updated listings shall be provided when an employee's status or information changes.

5.9.2 Freedom of Information Act Program (FOIA). The contractor shall comply with DoD Manual 5400.07_AFMAN33-302, DoD Freedom of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding Controlled Unclassified Information (CUI) material. The contractor shall comply with AFI 33-332, Privacy and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013. The contractor shall remove or destroy official records only in accordance with AFI 33-322, Records Management and Information Governance Program.

5.9.3 Reporting Requirements. The contractor shall comply with AFI 71-101, Volume- 1, Criminal Investigations, and Volume-4 Counterintelligence. Contractor personnel shall report to an appropriate authority, any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

5.9.4 Entry Procedures to Controlled/Restricted Areas. Contractor personnel requiring unescorted entry to areas designated as controlled or restricted areas by the installation commander shall comply with installation’s access requirements and shall possess, as a minimum, a favorable suitability determination. These requirements are contained in AFI 31-101, Integrated Defense for installation access procedures and AFMAN 16-1405, for suitability determinations. The contractor shall comply and implement local base procedures for entry to Air Force controlled areas.

5.9.5 Additional Security Requirements. In accordance with DoDM 5200.01, Information Security Program and AFMAN 16-1404, the contractor shall comply with AFSSI 7700, Emission Security (EMSEC) Program; applicable AFKAGs, AFIs, and AFSSIs for Communication Security (COMSEC); and AFI 10-701, Operations Security (OPSEC) Instructions. The contractor shall comply with DoD Standard 22/Force Protection Condition Measures, DoD Standard 25/Level I-AT Awareness Training, and associated tasking contained in DoDI O-2000.16 Vol 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards. Level I AT Awareness training is available for contractor personnel and can be requested by calling the local installation AT Office.

5.9.6 Physical Security. Areas controlled by contractor employees shall comply with base Operations Plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and local search/identification requirements. The contractor shall safeguard all government property, including controlled forms, provided for contractor use. At the close of each work period, government training equipment, ground aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured. During increased FPCONs, contractors may have limited access to the installation and shall expect entrance delays.

5.9.7 Key Control. The contractor shall establish and implement key control procedures in the Quality Control Plan to ensure keys issued to the contractor by the government are properly safeguarded and not used by unauthorized personnel. The contractor shall not duplicate keys issued by the government. Lost keys shall be reported immediately to the contracting officer.

The government replaces lost keys or performs re-keying. The total cost of lost keys, re-keying or lock replacement shall be deducted from the monthly payment due the contractor. The contractor shall ensure its employees do not allow government issued keys to be used by personnel other than current authorized contractor employees. Contractor employees shall not use keys to open work areas for personnel other than contractor employees engaged in performance of their duties, unless authorized by the government functional area chief.

5.9.8 Lock Combinations. The contractor shall establish procedures in local Security Instructions ensuring lock combinations are not revealed to unauthorized persons and ensure the procedures are implemented.

5.10 Traffic Laws. The contractor and their employees shall comply with base traffic regulations.

5.11 Weapons, Firearms, and Ammunition. Contractor personnel are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on any Air Force base.

6.0 SERVICE SUMMARY

6.1 The contract service requirements are summarized in performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimally acceptable levels of service required for each requirement. The SS provides information on contract requirements, the expected level of contractor performance and the expected method of government surveillance and confirmation of services provided. These thresholds are critical to mission success. Procedures as set forth in the Federal Acquisition Regulation (FAR) 52.212-4 (a), Contract Terms and Conditions - Commercial Items, Inspection/Acceptance, shall be used to remedy all deficiencies. The absence of any contract requirements from the SS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the contract. The Government has the right to inspect all services required in the contract.

Performance Objective

PWS

Paragraph Performance

Threshold Method of

Surveillance

1. Consultation for 11 AETC bases (Altus, Columbus, Goodfellow, Holloman, Joint Base San Antonio,

3.2.2.1 90% (monthly) Periodic/Valid customer complaint

Keesler, Laughlin, Luke, Maxwell, Sheppard, Vance) and other geographically separated units of aerospace, occupational, environmental and preventive medicine as well as public health programs, ensuring compliance with all DoD, Air Force (AF), Air Force Medical Service (AFMS), and AETC guidance and standard.

2. Perform Case review and risk assessment/stratification for the Force Development Exception to Policy (FDETP) board proceedings. This process may require but is not limited to chart review, review of additional medical documents, coordination with civilian and military medical providers, coordination with submission sources within the line of the Air Force, coordination with higher headquarters (HAF/SG), and consultation with the Aeromedical Consultation Service (ACS) at the USAF School of Aerospace Medicine (USAFASAM).

3.2.2.2 90% (monthly) Periodic/Valid customer complaint

3. Review compliance of AME programs via the Management Internal Control Toolset (MICT) self-assessment communicators for 11 AETC bases and provide feedback/recommendations.

3.2.2.3 90% (monthly) Quarterly/ Valid customer

4. Review, provide quality control and make recommendations on the Flying Class physical waivers for all AETC personnel, via the Aeromedical Information Management Waiver Tracking System (AIMWTS) to the AETC/SG waiver authority.

3.2.2.4 90% (monthly) Periodic/Valid customer complaint

5. Provide consultation to the Personnel Reliability Assurance Program (PRAP) at 11 AETC bases, to include implementation of Arming Use of Force (AUoF).

3.2.2.5 90% (monthly) Periodic/Valid customer complaint

6. Provide consultation to the Public Health Emergency Officer (PHEO) plans and programs at 11 AETC bases.

3.2.2.6 90% (monthly) Periodic/Valid customer complaint

7. Provide consultation for implementation of the Base Operational Medicine Clinic CONOPS

3.2.2.7 90% (monthly) Periodic/Valid customer

7.0 QUALITY CONTROL PLAN

7.1 General Guidance. Only the Contracting Officer’s Representative (COR) or the designated alternate COR has the authority to inspect, accept, or reject all deliverables.

7.2 Quality Assurance. The government is responsible for evaluating the contractor's performance. For those tasks listed on the Service Summary (SS), the COR shall follow the methods of surveillance specified in the Quality Assurance Surveillance Plan (QASP). The COR shall record all surveillance observations. COR surveillance of tasks not listed in the SS or by methods other than those listed in the SDS may occur during the performance period of this contract on an as-needed basis.

7.3 Quality Meetings. The CO may require the contractor to meet with the CO, contract administrator (CA), COR, and other government personnel as deemed necessary. The contractor may request a meeting with the CO when he or she believes such a meeting is necessary.

7.4 The COR shall record written minutes of any such meetings. A copy of the minutes shall be sent to all attendees via e-mail for their review. A copy of all recorded minutes shall be provided to the contractor, and a copy shall be placed in the official contract file for record keeping purposes. In the event the contractor does not concur with any portion of the minutes, exceptions to the minutes shall be provided, in writing, to the CO within 10 working days following receipt of the minutes. The final resolution to exceptions taken by the contractor resides with the CO.

7.5 Contractor’s Quality Control Plan (QCP): The contractor shall provide and maintain a current QCP, which shall ensure the requirements of the contract are provided as specified. One copy of the QCP shall be provided to the Contracting Officer (CO) as part of the technical proposal. The QCP shall be considered acceptable unless the CO notifies the contractor before award

8.0 GOVERNMENT FURNISHED PROPERTY/SERVICES.

8.1 Government Furnished Facilities. The Government shall furnish or make available facilities in Building 491, JBSA Randolph, TX. Government facilities have been inspected for compliance with Occupational Safety and Health Act (OSHA) and environmental regulations.

The facilities are provided “as-is” and the government does not represent the condition, quality, or completeness of the property. However, no hazards have been identified which would prevent normal use of the facilities or for which workarounds were required. The fact that no such conditions have been identified does not warrant or guarantee that no possible hazard exists, or that workaround procedures shall not be necessary or that the facilities as furnished shall be adequate to meet the responsibilities of the contractor.

8.2 The Government shall provide workspace, office furniture, computer resources, telephones, office supplies, test data, and tools necessary to perform the task. The contractor shall have access to Government regulations, technical manuals, and life cycle/program files.

8.3 Telephone Service. The Government shall provide telephone service in office, not to include a cellular phone. Use of a government-supplied telephone is provided solely for official use government business and shall not be used to transact personal business by contractor personnel.

8.4 Refuse Collection. The Government shall provide established refuse collection service at pre-established pickup locations. It is the responsibility of contractor personnel to transfer refuse from their work area to the predetermined pickup locations.

8.5 Custodial Services. The Government shall provide established restroom cleaning services at pre-established intervals. The contractor is required to maintain their work area(s) in a clean, neat and professional manner conducive with the type of work being performed.

8.6 Utilities. The Government shall furnish electricity, water and sewage services as necessary for accomplishment of work in accordance with this contract. The contractor shall adhere to all base level utility conservation practices or requirements. The contractor shall be responsible for operating under conditions that prevent waste of utilities.

8.7 Security, Fire and Medical Services. The Government shall provide police and fire protection. In the event of a medical emergency, base ambulance services for transporting an injured employee to a local hospital is available on a cost reimbursement basis.

8.8 Electronic Mail Service/Local Area Network (LAN) Connectivity. The Government shall provide electronic mail and LAN capability to facilitate communications with government personnel and the ability to retrieve required information. The existing government computers and hardware may be used by the contractor.

8.9 Base Distribution. The contractor shall use the Base Information Transfer System (BITS) for mail services for official mail only.

8.10 Contractor Furnished Items and Services. Except for those items or services specifically stated in this PWS to be government-furnished, the contractor shall furnish everything required to perform this contract in accordance with all of its terms and conditions. It is the contractor’s responsibility to ensure contractor personnel are familiar with and understand the contents of this PWS as well as the company’s handbooks/handouts, etc. prior to beginning work.

9.0 ORGANIZATIONAL CONFLICT OF INTEREST

9.1 The Contractor shall be cognizant of FAR 9.5, Organizational and Consultant Conflicts of Interest, and FAR 3.101-1, Improper Business Practices and Personal Conflicts of Interest, Standards of Conduct.

9.2 The contractor, as part of this contract, may have access to the financial plan, programmed amounts, and the program objective memorandum (POM) for out year requirements. The contractor agrees to protect all proprietary information, refrain from using the information for any other purpose other than for which it was furnished, and is precluded from providing the services of the requirements that they have access to.

9.3 In order for the government to prevent conflicting roles which might bias the contractor’s judgment or objectivity, and prevent unfair competitive advantage to the contractor, the parties to this contract agree that the contractor and its parent companies, subsidiaries, affiliates, if any, is precluded from providing the services of these requirements that they have access to.

9.4 The contractor, at his discretion, may provide information having a direct bearing upon these restrictions to the Contracting Officer for consideration. Final authority for approvals rests with the Contracting Officer.

9.5 Government business shall be conducted in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. Transactions relating to the expenditure of public funds require the highest degree of public trust and impeccable standard of conduct. The general rule is to avoid strictly any conflict of interest or even the appearance of a conflict of interest in Government-contractor relationships.

10.0 HIPAA BUSINESS ASSOCIATE AGREEMENT (BAA)

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates shall be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals shall be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the Contractor.

Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean AETC/SG.

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45

CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and/or HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of this Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, and corresponding DoD HIPAA Issuances, as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524 and corresponding DoD HIPAA Issuances.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526, and corresponding DoD HIPAA Issuances.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528 and corresponding DoD HIPAA Issuances.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of the HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in this Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in this Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in this Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it shall remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in this Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall notify the Business Associate of any limitation(s) in the notice of privacy practices of the Covered Entity under 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR

164.522 and the corresponding DoD HIPAA Issuances, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

(1) In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall report the breach to the Covered Entity in accordance with Section VII, assess the breach incident, take mitigation actions as applicable, and notify affected individuals, as directed by the Covered Entity.

(2) The Business Associate shall coordinate all investigation actions with the Covered Entity, and at a minimum, follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate shall still comply with breach response requirements under the DoD Privacy Act Issuances.

(3) The Business Associate shall, at no cost to the government, bear any costs associated with a breach of PII/PHI that the Business Associate has caused or is otherwise responsible for addressing.

(b) Government Reporting Provisions

(1) If the Covered Entity determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the Covered Entity, regardless of where the breach occurs... If the Covered Entity determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office.

(2) This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response, the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals, and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business

Associate…