36C10G18R0203-0002002.pdf

36C10G18R0203 Amendment 0002

Attachment 2

REVISED B.7 and C.15

Section B.7, “Health Insurance Portability and Accountability Act (HIPAA) Compliance” is hereby deleted in its entirety and substituted with the following (revisions highlighted in yellow).

B.7 HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

COMPLIANCE

a) As a covered entity, the VA is required to by law to obtain satisfactory assurance of a Business Associate that the Business Associate appropriately safeguards protected health information it receives or creates on behalf of the covered entity.

Contractors and any Subcontractors must adhere to the provisions of Public Law 104-191, HIPAA to include the Administrative Simplification Provisions of the law and associated rules and regulations published by the Department of Health and Human Services (HHS). The Contractor shall comply with all HIPAA-related rules and regulations to include Electronic Transactions, the Standards for Privacy of Individually Identifiable Health Information, and the Security Standards. This includes both the Privacy and Security Rules published by HHS.

As required by HIPAA, HHS has promulgated rules governing the use and disclosure of protected health information by covered entities. The covered entity component of the VA is the Veterans Health Administration (VHA). Business associates must follow VHA privacy policies and practices. All Contractors and business associates must receive privacy training annually. For Contractors and business associates who do not have access to VHA computer systems, this requirement is met by completing VHA National Privacy Policy training, other VHA approved privacy training or Contractor furnished training that meets the requirements of HHS Standards for Privacy of Individually Identifiable Health information as determined by VHA. For Contractors and business associates who are granted access to VHA computer systems, this requirement is met by completing VHA National Privacy Policy training or other VHA approved privacy training. Proof of training is required.

b) Any violation of HIPAA will be reported to the CO, the COR, and the PM in writing within one (1) business day of the Contractor’s discovery of an occurrence. Included in the report will be a description of the occurrence, patient names (if known), location, date and time. A copy of any filed police report will be provided by the Contractor to the CO within one (1) business day of completion.

c) Security must be designed into the system to protect patient information as required by HIPAA. All external network connects to the remote server shall be via encrypted SSL connects, VPN software and hardware. The process and method in which the transmission or routing of VA image data shall be reviewed and approved in accordance with form VA 6500.6. All patient information remains the sole property of the United States government and shall not be used for any purpose other than those stipulated in this contract. The VAMCs shall act as primary custodian of the patient information (including both the image data and the report) for all purposes related to Government records retention requirements. Patient information, including images shall be retained by the Contractor only for the minimum period of time required to comply with any applicable laws, regulations, and the retention policies stated herein. Upon request, the Contractor shall provide the Strategic Acquisition Center (SAC) CO, assigned COR for the applicable facility, Information Security Officer (ISO), or Privacy Officer (PO) with access to information pertaining to the way the Contractor maintains NPOP/VAMC patient data and the steps taken on an ongoing basis to assure the privacy and security thereof. This includes information regarding computer network architecture, configuration of firewall(s), routers, and other pieces of networking equipment, information about installed security software, and audits of patches of known security vulnerabilities. All relevant security-related patches and anti-virus updates shall be installed with seven (7) days of initial release. Patient lists, no matter how developed, shall be treated as privileged information. Lists and names of patients shall not be disclosed or revealed in any way for any use outside the contract of this PWS.

Contractor must meet all VA required security restrictions and Contractor representatives shall undergo all HIPAA/confidentiality related training to comply with V15 requirements.

d) Contractors are not to retain any copies of the sequencing and corresponding clinical data, even unidentified data (i.e., data that has had patient information redacted).

Section C.15, VAAR 852.237-7, “Indemnification and Medical Liability Insurance (JAN

2008), is hereby deleted in its entirety and substituted with the following (revisions highlighted in yellow).

C.15 VAAR 852.237-7 INDEMNIFICATION AND MEDICAL LIABILITY INSURANCE

(JAN 2008)

(a) It is expressly agreed and understood that this is a non- personal services contract, as defined in Federal Acquisition Regulation (FAR) 37.101, under which the professional services rendered by the Contractor or its health-care providers are rendered in its capacity as an independent contractor. The Government may evaluate the quality of professional and administrative services provided but retains no control over professional aspects of the services rendered, including by example, the Contractor's or its health-care providers' professional medical judgment, diagnosis, or specific medical treatments. The Contractor and its health-care providers shall be liable for their liability-producing acts or omissions. The Contractor shall maintain or require all health-care providers performing under this contract to maintain, during the term of this contract, professional liability insurance issued by a responsible insurance carrier of not less than the following amount(s) per specialty per occurrence: $100,000.00. However, if the Contractor is an entity or a subdivision of a State that either provides for self-insurance or limits the liability or the amount of insurance purchased by State entities, then the insurance requirement of this contract shall be fulfilled by incorporating the provisions of the applicable State law.

* Amounts are listed below:

(b) An apparently successful Offeror, upon request of the Contracting Officer, shall, prior to contract award, furnish evidence of the insurability of the Offeror and/or of all health-care providers who will perform under this contract. The submission shall provide evidence of insurability concerning the medical liability insurance required by paragraph

(a) of this clause or the provisions of State law as to self-insurance, or limitations on liability or insurance.

(c) The Contractor shall, prior to commencement of services under the contract, provide to the Contracting Officer Certificates of Insurance or insurance policies evidencing the required insurance coverage and an endorsement stating that any cancellation or material change adversely affecting the Government's interest shall not be effective until 30 days after the insurer or the Contractor gives written notice to the Contracting Officer. Certificates or policies shall be provided for the Contractor and/or each health- care provider who will perform under this contract.

(d) The Contractor shall notify the Contracting Officer if it, or any of the health-care providers performing under this contract, change insurance providers during the performance period of this contract. The notification shall provide evidence that the Contractor and/or health-care providers will meet all the requirements of this clause, including those concerning liability insurance and endorsements. These requirements may be met either under the new policy, or a combination of old and new policies, if applicable.

(e) The Contractor shall insert the substance of this clause, including this paragraph (e), in all subcontracts for health-care services under this contract. The Contractor shall be responsible for compliance by any subcontractor or lower-tier subcontractor with the provisions set forth in paragraph (a) of this clause.