36C10X19R0010-0003001.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 19

0003 04-17-2019

NONE

21703

Strategic Acquisition Center - Frederick Department of Veterans Affairs

5202 Presidents Court, Suite 103 Frederick MD 21703

36C10X

Strategic Acquisition Center - Frederick Department of Veterans Affairs

5202 Presidents Court, Suite 103 Frederick MD 21703

To all Offerors/Bidders

36C10X19R0010

03-26-2019

X x x

See A.1 CONTINUATION PAGE for details.

36C10X19R0010 0003

Table of Contents

A.1 CONTINUATION PAGE

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.2 PERFORMANCE WORK STATEMENT

SECTION E - SOLICITATION PROVISIONS

E.1 ADDENDUM to FAR 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL

ITEMS

E.2 INSTRUCTIONS TO OFFERORS

A.1 CONTINUATION PAGE

The purpose of this amendment is to:

A. Provide a revised response to Question 16 provided in Amendment 0002:

16) Page 8, Section B.2, 5.0 General Requirements: The PWS states, “The contractor shall always be certified or accredited for its credentials verification services by a nationally recognized certifying or accreditation organization (e.g. the National Committee for Quality Assurance (NCQA) or the Utilization Review Accreditation Commission (URAC).”

Can the Government please clarify if by “the contractor” they mean the Prime or a member(s) of the team (subcontractor)? Should the prime contractor hold the NCQA or URAC certification? Is it acceptable if the sub-contractor holds the NCQA or URAC certification?

RESPONSE: Section 5.0 of the PWS has been updated to require the Contractor (e.g. prime, subcontractor) that will be performing the work under Task 2: Credentials verification organization (CVO) services to be the entity certified or accredited for its credentials verification services by a nationally recognized certifying or accrediting organization (e.g., the National Committee for Quality Assurance (NCQA) or the Utilization Review Accreditation Commission (URAC)). This remains a SDVOSB set-aside and offeror must demonstrate its ability and approach to comply with FAR 52.219-14 Limitations on Subcontracting as required in Section E.2.a. Volume 1 – Factor 1: Technical Capability. Sections 5.0 and 7.0 of the PWS, and Section E.2.a. Volume I is updated accordingly.

B. Update Section B.2 PERFORMANCE WORK STATEMENT

C. Update Section E.2 INSTRUCTIONS TO OFFERORS

All changes to the are noted in BLUE for ease of reference.

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.2 PERFORMANCE WORK STATEMENT

1.0 General Overview

The U.S. Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Office of Community Care (OCC), requires services to support and implement certain functions related to VA credentialing and/or monitoring non-VA health care providers that furnish hospital care, medical services, or extended care services to Veterans under VA’s community care program.

A primary goal of VA’s community care program is patient safety for all Veterans served by VA. To achieve this goal, VA must ensure non-VA health care providers are medically qualified and competent to provide care prior to referring Veterans for community care from such providers. The credentials verification services and monitoring services identified in this contract and Performance Work Statement (PWS) directly support and facilitate VA’s efforts to assess and/or monitor the medical qualifications and competence of non-VA health care providers in two broad categories:

1. Providers that furnish hospital care, medical services, or extended care services to Veterans pursuant to Veterans Care Agreements (VCA) entered into by VA under the authority set forth at 38 U.S.C. § 1703A or other contracts or agreements entered into and administered by VA. These providers are referred to in the contract as “non-CCN providers”; and

2. Providers that furnish hospital care, medical services, or extended care services under VA’s Community Care Network (CCN), a contracted network of non-VA providers that is administered by third-party administrators (TPA). These providers are referred to in the contract as “CCN providers.”

The desired outcomes of this contract are to: 1) obtain the information needed for VA to properly assess whether non-CCN providers should be credentialed by VA for purposes of furnishing care to Veterans under VA’s community care program, including whether they are medically qualified, licensed, and competent to provide care to Veterans; 2) establish and operate a credentialing review board that will conduct enhanced reviews of credentialing information, including marginal findings of the credentialing verification process and information asserted and provided in support of provider appeals of VA credentialing determinations, and provide assessments and recommendations to VA’s Credentialing Committee; and 3) monitor CCN and non-CCN providers to ensure they maintain appropriate qualifications, licenses, competence, and status throughout the time they are providing care to Veterans under VA’s community care program.

2.0 Ordering Period

The contract will have a five-year ordering period. The estimated ordering period is May 2019 – May 2024. There are no options.

3.0 Place of Performance

The Contractor shall perform all work under this contract at the Contractor’s location.

4.0 Contract Type

This is a firm-fixed-price (FFP), single award indefinite-delivery indefinite-quantity (IDIQ) contract.

Orders shall be placed as the Government need is identified and funding is available.

5.0 General Requirements

1. The Contractor (e.g. prime, subcontractor) that will be performing the work under Task 2:

Credentials verification organization (CVO) services shall always be certified or accredited for its credentials verification services by a nationally recognized certifying or accrediting organization (e.g., the National Committee for Quality Assurance (NCQA) or the Utilization Review Accreditation Commission (URAC)). If the certification/accreditation is held by any member other than the prime (e.g., subcontractor), the prime will be responsible for notifying the Contracting Officer if a change in the contractor team occurs at any time during performance.

2. The Contractor must always ensure provider credentials verification data and reports are provided in formats that are compatible with VA’s Provider Profile Management System (PPMS). See Section 9.0 below.

6.0 Reporting

The Contractor shall provide monthly reporting to the COR on the following:

1. Any outages of the online database under Task 1 during the preceding month, including the length of time of the outage;

2. Itemized list of new providers with the date of request by VA and date of initial contact/attempt to contact by the Contractor;

3. Itemized list and total number of providers for which the Contractor performed credentials verification services under 7.2.2 during the preceding month, and their graded risk assessment results (e.g., A-Fs), with annotation of the VA facility that requested the services;

4. Summary of efforts monitoring all providers for sanctions and disciplinary actions during the preceding month, with an itemized listing of all providers flagged and the specific reason(s) for being flagged; and

5. Credentialing review board status as detailed in Task 3.

7.0 Tasks

The work performed under this PWS for credentials verification shall follow NCQA and/or URAC accreditation standards. If and when ordered by the Government, the Contractor shall perform the following tasks:

7.1 Task 1: Online database of provider demographic, professional, and credentials data

7.1.1 The Contractor shall maintain a profile-based data collection online database that contains demographic and professional data that is self-reported by providers, as well as data regarding providers’ credentials. The Contractor shall provide VA personnel, and all providers identified by VA, with read-only access to the database. VA personnel will access this database to view provider data and to send provider data to the Contractor in connection with credentials verification services under Task 2. This database eliminates the need for VA personnel to contact providers directly to obtain the demographic information necessary to conduct credentialing. The contractor shall be responsible for ensuring access and password issues are resolved for all users.

Specifically, VA requires:

a. An online demographic and credentials database compliant with nationally recognized certification and/or accreditation standards (e.g., NCQA, URAC). The database shall have self-reporting capability that allows providers to enter required data and VA to obtain provider information from this database.

b. Database licenses for up to 2,000 VA personnel.

c. All provider demographic and credentials data within the database must be exportable in PSV and Excel files.

7.1.2 The Contractor shall provide five virtual live training sessions, at least one to be recorded, for up to 2,000 VA personnel with access to the database. The training shall provide instruction on overall usage of the database, including how to access and export information, and how to use provider credentialing status tracking if available in database.

The Contractor shall record one of the live training sessions for future VA use. The training must be available online via the Contractor’s website or an online video-sharing site (such as YouTube).

Deliverable 7.1.1 Up to 2,000 licenses for VA personnel to access and use online demographic and credentials database.

Deliverable 7.1.2 Five virtual live training sessions on usage of database, including one recorded live training available online.

7.2 Task 2: Credentials verification organization (CVO) services

7.2.1 The Contractor shall develop processes and materials necessary to provide VA with credentials verification services that will inform and facilitate VA’s credentialing process for all non-CCN providers.

The credentials verification services must consist of contacting providers to initiate the credentialing process, collecting and verifying of the information identified in section 7.2.2, below, and providing VA with a risk assessment and analysis of individual providers’ qualifications based on the application of VA-determined criteria to the Contractor’s review of collected and verified information. The Contractor shall use primary source verification (PSV) as a standard practice, and all documentation supporting the verification and risk assessment shall be submitted to VA. The Contractor shall present, for VA’s approval, the criteria that will be used to verify provider information and conduct a risk assessment of each provider, and the Contractor shall develop a process and materials based on those criteria.

A “Provider” will be defined individuals, facilities, and other entities that fall within the scope consistent with NCQA or URAC standards.

7.2.1.1 The Contractor shall develop a credentialing application form to gather all required information from providers. The application form must contain all data elements required by VA.

7.2.1.2 The Contractor shall develop a process for receiving provider information from VA for the purpose of contacting providers to initiate the credentialing process. The process must have two entry points with at least one being electronic. After award, VA will provide the Contractor with an initial list of providers for which the credentialing process must be initiated. Additional providers will be identified by VA throughout performance.

7.2.1.3 The Contractor shall develop a standardized assessment to use for all providers in documenting the results of the credentials verification and risk assessment of the provider, for VA approval. The assessment must include, at a minimum:

a. Overall risk assessment of the provider, expressed in terms of a scaled grading system (e.g., A-F or 1-5).

b. Outcome/categorization of selected verification elements, with score for each (list to be approved by VA, could include all elements) and free text comments as needed

c. Method, source, verification date, and name and/or initials of primary source verification

(PSV) staff

7.2.1.4 The Contractor shall develop and provide two Frequently Asked Questions (FAQ) sheets. The first FAQ sheet will be for use by VA staff and must explain the Contractor’s credentials verification processes and materials and address commonly asked questions. The second FAQ sheet will be for use by providers and must address commonly asked questions on VA’s credentialing process, including the credentials verification processes implemented by the Contractor, how providers submit an application, and the process for providers to appeal VA’s credentialing determinations.

7.2.1.5 The Contractor shall provide five virtual live training sessions, at least one to be recorded, for up to 2,000 VA personnel. The training shall provide instruction on overall credentials verification processes and materials developed by the Contractor under Task 2, including how to complete the required forms, where to send such forms, how to check status of and, track credentials verification actions and progress by the Contractor, credentialing status tracking and timelines.

The Contractor shall record one of the live training sessions for future VA use. The training must be available online via the Contractor’s website or an online video-sharing site (such as YouTube).

7.2.2 The Contractor shall use the processes and materials developed under section 7.2.1 to provide credentials verification services for non-CCN providers. Upon VA request to initiate credentials verification services for a specific provider, the Contractor shall provide all required credentials verification services for that provider, including:

a. Utilize the process developed under section 7.2.1.2 and the application form developed under section 7.2.1.1 to initiate the credentialing process, contact the provider, and obtain all required information.

b. Obtain documentation of and verify the following credentials information, using primary source verification (PSV) as a standard practice:

1. License to practice

2. Drug Enforcement Administration (DEA) and Controlled Dangerous Substances (CDS) certificates

3. Education and training

4. Board certification

5. Work History

6. Malpractice history (NPDB)/ Professional liability claims

7. License sanctions (NPDB)

8. Medicare/Medicaid sanctions (NPDB)

9. Hospital privileges (verified with hospital in selected states)

10. Current malpractice coverage to be of a certain minimum value

11. Current attestation and disclosure questions

12. OIG sanction check

13. SAM and LEIE sanction check

14. Medicare participating/enrolled/ opt-out check

c. Document the results of the credentials verification and conduct and document the risk assessment described in section 7.2.1.3 in accordance with the requirements and process under that section. The Contractor shall complete and submit an assessment that includes the overall graded risk assessment (7.2.1.3) for the provider, along with a summary of the results from the primary and other sources for the credentials verification, to VA. Documentation list to be saved in a location accessible to VA. VA will have unlimited rights, within the meaning of FAR 52.227-14 (May 2014), in all data and documents delivered to VA under Task 2, and VA will retain ownership of all such documents after the contract ends.

7.2.3 The Contractor shall provide the services identified in section 7.2.2 for non-CCN providers that VA decides to re-credential, which generally will occur three years after being initially credentialed. VA will initiate this process in the same manner established under section 7.2.2.

Deliverable 7.2.1 Approved credentialing process (Not Separately Priced (NSP), one-time deliverable), including:

Deliverable 7.2.1.1 Provider application form Deliverable 7.2.1.2 Provider information receipt process Deliverable 7.2.1.3 Approved credentials verification process and standardized assessment Deliverable 7.2.1.4 Frequently Asked Questions (FAQ) sheets (one for VA staff, one for providers) Deliverable 7.2.1.5 Virtual live training sessions (one also recorded) on credentials verification processes and materials developed by the Contractor under Task 2

Deliverable 7.2.2 Completed credential verification package for each provider, including risk assessment Deliverable 7.2.3 Completed re-credential verification package for each provider, including new risk assessment

7.3 Task 3: Operation of credentialing review board and administrative support for VA Credentialing Committee

7.3.1 The Contractor shall establish and operate a peer-level credentialing review board that will conduct enhanced reviews of credentialing information, including marginal findings resulting from the credentials verification process conducted under Task 2, information indicating providers have potentially committed egregious acts, and information asserted and provided in support of provider appeals of VA credentialing determinations, and provide assessments and recommendations to VA’s Credentialing Committee.

As outlined in section 7.2 Task 2, VA will use the credentials verification files and risk assessments provided by the Contractor to determine if individual non-CCN providers are suitable and qualified to be credentialed for purposes of furnishing hospital care, medical services, or extended care services to Veterans under VA’s community care program. VA’s credentialing process will entail automatic acceptance or rejection of certain providers that meet or fail to meet certain criteria. Providers that are not automatically accepted or rejected will be reviewed by a peer-level VA Credentialing Committee.

The Contractor’s credentialing review board shall further evaluate the details of the credential verification files and assessments, as well as other relevant information, for providers that do not meet VA’s established thresholds for being automatically accepted or rejected and other providers that VA requests the board to review on an ad hoc basis (e.g., providers for which the credentialing file indicates potentially egregious acts). Upon request from VA, the Contractor’s credentialing review board shall also evaluate provider appeals of VA credentialing determinations, including reviewing the relevant credentials verification files and assessments, as well as the appeal and any supporting information. For each of the foregoing types of evaluations, the Contractor’s credentialing review board shall be responsible for conducting an enhanced review of each such provider and for providing a written assessment and recommendation to VA for consideration by VA’s Credentialing Committee. VA’s Credentialing Committee will independently determine whether or not to credential the provider and whether or not to grant or deny an appeal.

7.3.2 The Contractor shall provide administrative services to facilitate operations of the VA Credentialing Committee responsible for credentialing determinations for non-CCN providers to include tracking of activities and generating meeting minutes. The contractor shall also draft administrative oversight documents with the input and review by VA. These documents will include Credentialing Bylaws/policy, Credentialing Committee Charter, and documentation of the process and procedures (standard operating procedures (SOPs)) related to credentialing, network approval, or network disapproval of providers. VA will review and approve all documents prior to adoption by Committee.

7.3.3 The Contractor shall provide a status report of the Credentialing Committee activities and reviews to the COR in the monthly status report. The report shall include an aggregate of the total number of files reviewed by the Committee, average time to complete the review from start to finish, and total approved and rejected. The Contractor shall establish an electronic process to disseminate documents and collect individual summaries of provider file reviews. Documents will be disseminated to VAMC staff/cc to Network Management POC, and directly to Credentialing Committee when necessary; summaries of provider files will be collected from VAMC Staff and Network Management.

Deliverable 7.3.1 Establish and operate credentialing review board Deliverable 7.3.1 Enhanced review and written assessment and recommendation to VA’s Credentialing Committee for each provider under review.

Deliverable 7.3.2 Meeting minutes Deliverable 7.3.2 Credentialing Committee by-laws, charter and Standard Operating procedures documents Deliverable 7.3.3 Monthly Credentialing Committee Report Deliverable 7.3.3 The Contractor shall establish an electronic process to disseminate documents and collect individual summaries of provider file reviews.

7.4 Task 4: Monitoring providers

7.4.1 The Contractor shall develop and maintain a process for monitoring licensing sanctions and disciplinary actions against providers from the following sources: National Practitioner Data Bank (NPDB) (non-CCN providers only), state licensing boards, Office of Personnel Management (OPM), and Medicare/Medicaid sources. Following award, the Contractor shall provide a statement and process flow of how monitoring services work to the COR. VA will provide a unique identifier to distinguish CCN providers from non-CCN providers at time of order placement.

7.4.2 The Contractor shall provide a monitoring report of all VA-specified non-CCN providers to the COR weekly. The report shall include at minimum provider/facility name, National Provider Identifier (NPI), Tax ID, date of birth (DOB), state license information, any sanctions or disciplinary actions identified through the sources in 7.4.1, and the reasons for and dates of any identified sanctions or disciplinary actions.

7.4.3 The Contractor shall provide a monitoring report of all VA-specified CCN providers to the COR weekly. The report shall include at minimum provider/facility name, National Provider Identifier (NPI), Tax ID, date of birth (DOB), state license information, any sanctions or disciplinary actions identified through the sources in 7.4.1 (with the exception of NPDB, which does not apply to this task), and the reasons for and dates of any identified sanctions or disciplinary actions.

VA will be responsible for notifying providers (non-CCN and CCN) of negative findings, such as sanctions, found during monitoring.

Deliverable 7.4.1 Monitoring Statement and Process Flow Deliverable 7.4.2 Monitoring of Non-CCN providers Deliverable 7.4.3 Monitoring of CCN providers

8.0 Performance standards; acceptable quality levels; and performance monitoring by VA

The performance standards and acceptable quality levels (AQL) set forth in Attachment A: Quality Assurance Surveillance Plan (QASP) are incorporated by reference into this PWS. The Contractor shall always comply with all performance standards and AQLs set forth in the QASP.

VA will monitor contractor performance in accordance with the performance standards set forth in Attachment A: Quality Assurance Surveillance Plan (QASP).

9.0 Data compatibility with PPMS

The Contractor shall ensure all data elements can be incorporated into the Provider Profile Management System (PPMS), a proprietary system VA built upon Microsoft customer relationship management (CRM) platform, that will be utilized for storing all provider data points, within two months of award.

PPMS will store National Provider Identifier (NPI) numbers and other data elements for all providers subject to the processes described in this contract. NPI numbers will be submitted to the Contractor from PPMS to be utilized for obtaining provider demographic and professional information (Task #1) and credentials verification services (Task #2). Phase I will include sharing information via a report through encrypted email to/from VAMC staff to input credentialing data into PPMS. Phase II will have the Contractor provide the data elements in a format compatible with PPMS to be transmitted through Data Access Service (DAS) to VA personnel who will then feed the information for demographic and professional information and provider overall score (Task #2). Contractor shall submit the VA Credentialing Committee’s written dispositions, meeting minutes, and all supporting documentation from the Credentialing Committee to VA staff to be added to PPMS as appropriate (Task #3). Contractor will conduct ongoing monitoring of providers and submit updates to VA staff when findings occur (Task #4).

10.0 Deliverables

The following table outlines the deliverables required under each task. Each order will outline the specific task(s) required; deliverables will only be assigned and completed according to the orders awarded.

VA will have unlimited rights, within the meaning of FAR 52.227-14 (May 2014), in all data and documents delivered to VA under all tasks within this Performance Work Statement, and VA will retain ownership of all such documents after the contract ends.

Task/Deliverable Description Due Date

7.1.1 Up to 2,000 licenses for VA personnel to access and use online demographic and credentials database

30 calendar days after order effective date

7.1.2 Five virtual live training sessions on usage of database, including one recorded live training available online

Within 45 calendar days of order effective date

7.2.1

Approved credentialing process (NSP, one-time deliverable), including:

Provider application form Provider information receipt process Approved credentialing process and standardized assessment

FAQ sheets (one for VA staff; one for providers)

30 calendar days after order effective date

7.2.1.5 Five virtual live training sessions on usage of database, including one recorded live training available online

Within 45 calendar days of order effective date

7.2.2 Completed credential verification package for each provider, including risk assessment

30 calendar days after receipt of request for provider verification

7.2.3 Completed re-credential verification package for

each provider, including new risk assessment

30 calendar days after receipt of request for provider verification

7.3.1 Establish and operate credentialing review board

5 business days after receipt of VA request for credentialing review board review of one or more cases under 7.3.1

7.3.1 Enhanced review and written assessment and recommendation to VA’s Credentialing Committee for each provider under review

3 business days after assignment to the review board

7.3.2 Meeting minutes for VA Credentialing

Committee

5 business days after meeting

7.3.2

Credentialing Bylaws/policy, Credentialing Committee Charter, and documentation of the process and procedures (standard operating procedures (SOPs))

30 calendar days after order effective date

7.3.2 Monthly Credentialing Committee Report 15th of the month

7.3.2.2

Electronic process to disseminate documents and collect individual summaries of provider file reviews

30 calendar days after order effective date

7.4.1 Monitoring Statement and Process Flow 30 calendar days after order effective date

7.4.2

Monitoring of Non-CCN providers 30 calendar days after order effective date; maintain throughout period of performance reporting weekly to COR

7.4.3

Monitoring of CCN providers 30 calendar days after order effective date; maintain throughout period of performance reporting weekly to COR

11.0 Inherently Governmental Functions

This contract and its associated orders will not be used to acquire services for inherently governmental functions as defined by FAR 7.503. In providing the credentialing services identified in this contract and associated orders, the Contractor will not perform work reserved for performance by Federal employees, and the Government will manage the Contractor consistent with its responsibility to perform all inherently governmental functions and maintain control of its mission and operations in accordance with requirements of OFPP Policy Letter 11‐01.

For those services that include functions “closely associated” with inherently governmental functions as prescribed in the Policy Letter, VA will (1) limit or guide the Contractor’s exercise of discretion and retain control of government operations by both—(i) establishing in the Contract or individual orders specified ranges of acceptable decisions and/or conduct; and (ii) establishing in advance a process for subjecting the Contractor’s discretionary decisions and conduct to meaningful oversight and, whenever necessary, final approval by an agency official; (2) assign a sufficient number of qualified government employees, with expertise to administer or perform the work, to give special management attention to the Contractor’s activities, in particular, to ensure that they do not expand to include inherently governmental functions, are not performed in ways not contemplated by the Contract so as to become inherently governmental, do not undermine the integrity of the government’s decision making process, and do not interfere with Federal employees’ performance of the closely‐associated inherently governmental functions; (3) ensure that the level of oversight and management that would be needed to retain government control of Contractor performance and preclude the transfer of inherently governmental responsibilities to the Contractor will not result in unauthorized personal services as provided by FAR 37.104; (4) ensure that a reasonable identification of contractors and Contractor work products is made whenever there is a risk that Congress, the public, or other persons outside of the government might confuse contractor personnel or work products with government officials or work products, respectively;

and (5) take appropriate steps to avoid or mitigate conflicts of interest, such as by conducting pre‐award conflict of interest reviews, to ensure contract performance is in accordance with objective standards and contract specifications, and developing a conflict of interest mitigation plan, if needed, that identifies the conflict and specific actions that will be taken to lessen the potential for conflict of interest or reduce the risk involved with a potential conflict of interest.

In providing credentialing services and a credentialing review board, the Contractor is advised that Contractor personnel shall be responsible for gathering and researching provider data and making recommendations to VA OCC and the VA Credentialing Committee on each provider reviewed. All information shall be submitted to VA for VA review and final determinations. The Contractor shall not make any final determinations or decisions regarding whether providers will be credentialed by VA for purposes of furnishing hospital care, medical services, or extended care services under VA’s community care program.

12.0 Government Furnished Equipment, Information, and Facilities

The Government will provide all information required for the Contractor to provide reports and data in formats compatible with PPMS, along with certain provider information necessary to contact providers to initiate credentialing.

There will be no Government furnished equipment or facilities.

13.0 Security

The Contractor will have access to VA sensitive information and Personal Identifiable Information (PII) for health care providers in performance of this contract. Contractor personnel shall be required to have background investigations or Personal Identity Verification (PIV) badges. The C&A requirements do not apply, and that a Security Accreditation Package is not required.

Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program).

The Contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and all applicable VA Directives and Handbooks regarding information and information system security, including any delineated in this contract.

a. The Contractor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system).

Such issues shall be remediated as quickly as is practical, but in no event longer than 5 days.

b. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 5 days.

c. Consistent with the requirements of 38 U.S.C. §5725, a Contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

d. This Contract is subject to the statutory requirement to assess liquidated damages against the contactor and/or subcontractor under 38 U.S.C. §5725 in the event of a breach of Sensitive Personal Information (SPI)/Personally Identifiable Information (PII). Such liquidated damages shall be assessed at $37.50 per affected Veteran or beneficiary. A breach in this context includes the unauthorized acquisition, access, use, or disclosure of SPI which compromises not only the information’s security or privacy but that of the Veteran or beneficiary as well as the potential exposure or wrongful disclosure of such information as a result of a failure to follow proper data security controls and protocols.

POSITION/TASK RISK DESIGNATION LEVEL(S):

Position Sensitivity Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Suitability and Security Program,” Appendix A)

Low / Tier 1 Tier 1 / National Agency Check with Written Inquiries (NACI) A Tier 1/NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), Federal Bureau of Investigation (FBI) name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate / Tier 2 Tier 2 / Moderate Background Investigation (MBI) A Tier 2/MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High / Tier 4 Tier 4 / Background Investigation (BI) A Tier 4/BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task:

Task Number Tier1 / Low / NACI Tier 2 / Moderate / MBI Tier 4 / High / BI

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

Office of Inspector General Cooperation

The Contractor shall cooperate with the VA Office of the Inspector General (OIG) in the areas of facilities access, audits, security incident notification, and hosting location. Specifically, the Contractor (and any Subcontractors) shall:

1. Provide the Contracting Officer, designated representative of the Contracting Officer, and representatives of the agency's Office of Inspector General, full and free access to the Contractor's (and Subcontractors') facilities, installations, operations documentation, databases, and personnel used for contract hosting services. This access shall be provided to the extent required to carry out audits, inspections, investigations, or other reviews to ensure compliance with contractual requirements for IT and information security, and to safeguard against threats and hazards to the integrity, availability, and confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor).

2. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the Contracting Officer or the agency Office of Inspector General as described in subparagraph (1).

Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (per agency policy) to Contractor facilities, systems, data and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review. The Contractor's (and any Subcontractors') cooperation with audits, inspections, investigations, and reviews conducted under this clause will be provided at no additional cost to the Government.

3. Preserve such data, records, logs and other evidence which are reasonably necessary to conduct a thorough investigation of any computer security incident. A computer security incident (as defined in NIST SP 800-61, Computer Security Incident Handling Guide), including but not limited to those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor), or to the function of information systems operated by the Contractor (or Subcontractor) in the performance of this contract.

4. Promptly notify the designated agency representative in the event of any computer security incident as described in paragraph (3) above. This notification requirement is in addition to any other notification requirements which may be required by law or this contract. Established Federal agency timeframes for reporting security incidents to the United States Computer Emergency Readiness Team (US- CERT), although not exhaustive, serve as a useful guideline for determining whether reports under this paragraph are made promptly. (See NIST SP 800-61, Computer Security Incident Handling Guide, Appendix J).

5. Provide to the requestor (Contracting Officer, a representative of the Contracting Officer, or the agency Office of Inspector General) Government data, information, or records under the control of or in the possession of the Contractor pursuant to this contract, which the Agency, including the Office of Inspector General, may request in furtherance of other audits, inspections, investigations, reviews or litigation in which the Agency or the Office of Inspector General is involved. Requests for production under this paragraph shall specify a deadline not less than 10 days for compliance which will determine whether response to the request has been made in a timely manner. Unless expressly provided otherwise elsewhere in this contract, the production of data, information, or records under this paragraph will be at no additional cost to the Government.

6. Include the substance of this section in any subcontract which would require or otherwise result in

Subcontractor employees having access to agency information in the possession or under the control of the Contractor (or Subcontractor), or access to information systems operated by the Contractor (or Subcontractor) in the performance of this contract.

7. Ensure that all hosting services pertaining to this contract are performed within the United States of

America, including the storage of agency data, information, and records under the control of or in the possession of the Contractor pursuant to this contract.

SECTION E - SOLICITATION PROVISIONS

E.1 ADDENDUM to FAR 52.212-1 INSTRUCTIONS TO OFFERORS—

COMMERCIAL ITEMS

Provisions that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

The following provisions are incorporated into 52.212-1 as an addendum to this solicitation:

E.2 INSTRUCTIONS TO OFFERORS

In addition to information provided by FAR Clause 52.212-1 Instructions to Offers – Commercial Items, the following instructions to offerors apply:

1. All proposal intentions, questions, and proposals shall be submitted via email to the Contracting Officer and the Contracting Specialist via email to Riley.Bender@va.gov and Lindi.Sylvester@va.gov.

2. All questions from offerors regarding this solicitation shall be submitted on or before date/time specified on the SF1449, Block 20. Only written questions will be accepted. It is requested that all questions be combined into one Microsoft Word document per offeror.

3. Proposals shall be submitted to the Contracting Officer and the Contracting Specialist via email to Riley.Bender@va.gov and Lindi.Sylvester@va.gov on or before date/time specified on the SF1449, Block 8. Proposal received after the due date/time will be considered late in accordance with FAR 52.212-1(f). Failure to provide any of the required Volumes as indicated below will result in immediate elimination of the proposal from consideration.

4. Format:

The submission shall be clearly indexed and logically assembled. Each volume shall be clearly identified and shall begin at the top of a page. All pages of each volume shall be appropriately numbered and identified by the complete company name, date and solicitation number in the header and/or footer.

Proposal page limitations are applicable to this procurement. The table below indicates the maximum page count (when applicable) for each volume of the offeror’s proposal. All files will be submitted as a Microsoft Excel (.XLS), Microsoft Word (.doc, .docx), or Acrobat (PDF) file or compatible as indicated in the table. Page size shall be no greater than 8 1/2" x 11". The top, bottom, left and right margins shall be a minimum of one inch each. Font size shall be no smaller than 12-point. Times New Roman fonts are required. Characters shall be set at no less than normal spacing and 100% scale. Tables and illustrations may use a reduced font size not less than 8-point and may be landscape. Line spacing shall be set at no less than single space. Each paragraph shall be separated by at least one blank line. Page numbers, company logos, and headers and footers are not bound by the 12-point font requirement. Footnotes to text shall not be used. The use of hyperlinks in proposals is prohibited.

If the offeror submits annexes, documentation, attachments or the like, not specifically required by this solicitation, such will count against the offeror’s page limitations unless otherwise indicated in the specific Volume instructions below. Pages in violation of these instructions, either by exceeding the margin, font or spacing restrictions or by exceeding the total page limit for a particular volume, will not be evaluated. Pages not evaluated due to violation of the margin, font or spacing restrictions will not count against the page limitations. The page count will be determined by counting the pages in the order they appear in the print layout view.

mailto:Riley.Bender@va.gov mailto:Lindi.Sylvester@va.gov

5. File Packaging:

Proposal shall be submitted as individual files. Compressed (zipped) files shall not be accepted.

6. Content Requirements:

All information shall be confined to the appropriate file. The offeror shall confine submissions to essential matters, sufficient to define the proposal and provide an adequate basis for evaluation. Offerors are responsible for including sufficient details, in a concise manner, to permit a complete and accurate evaluation of each proposal.

7. Proposals submitted in response to this solicitation shall contain the following in separate volumes:

Volume Number Evaluation Factor File Name Page Limitations

Volume I Technical Capability [Offeror Name] Tech.doc/pdf

15 pages, excluding the documentary proof of accreditation and/or certification

Volume II Performance Risk [Offeror Name] Perf.doc/pdf

5 pages, excluding Past Performance Questionnaires (PPQs)

Volume III

Price (including SF1449, amendments (SF 30s) & terms and conditions and/or assumptions

[Offeror Name] Attachment BPrice.xls/.xlsx

[Offeror Name] Price.doc/.docx/.pdf

None for Attachment C

Narrative: 1 page;

SF1449, SF30s, & terms and conditions and/or assumptions will not be included in the page count

The cover page, table of contents, and/or a glossary of abbreviations or acronyms will not be included in the page count of any Volume. Under no circumstances shall any pricing be included in any non- Price volume.

a. VOLUME I - FACTOR 1: TECHNICAL CAPABILITY

The offeror shall submit a Technical Capability volume which shall address in detail how the offeror proposes to accomplish each of the Performance Work Statement (PWS) tasks.