36C10X19R0010-001.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. DUNS: DUNS+4:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 66

36C10X19R0010 03-26-2019

Riley Bender, Riley.Bender@va.gov 240-215-0580 04-12-2019

2:00 PM ET

Strategic Acquisition Center - Frederick Department of Veterans Affairs 5202 Presidents Court, Suite 103

Frederick MD 21703

X 100

X

541611

$15 Million

N/A

X

Office of Community Care

Strategic Acquisition Center - Frederick

5202 Presidents Court, Suite 103

Frederick MD 21703

TBD

See B.1 Contact Administration Data

Credentials Verification Services Department of Veterans Affairs - Office of Community Care

Questions shall be submitted to Riley.Bender@va.gov and Lindi.Sylvester@va.gov by April 2, 2019 at 2:00 PM ET.

The result of this solicitation will be a single award IDIQ contract.

X X

Lindi Sylvester Contracting Officer

36C10X19R0010

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

SECTION B – CONTRACT ADMINISTRATION

B.1 CONTRACT ADMINISTRATION DATA

B.2 PERFORMANCE WORK STATEMENT

B.3 PRICE SCHEDULE

SECTION C – CONTRACT CLAUSES

C.1 VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

LANGUANGE

C.2 FAR 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL ITEMS (OCT

2018) C.3 ADDENDUM to FAR 52.212-4 CONTRACT TERMS AND CONDITIONS—

COMMERCIAL ITEMS

C.4 FAR 52.216-18 ORDERING (OCT 1995)

C.5 FAR 52.216-19 ORDER LIMITATIONS (OCT 1995)

C.6 FAR 52.216-22 INDEFINITE QUANTITY (OCT 1995)

C.7 FAR 52.219-14 LIMITATIONS ON SUBCONTRACTING (JAN 2017)

C.8 FAR 52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS

SUBCONTRACTORS

C.9 VAAR 852.219-10 VA NOTICE OF TOTAL SERVICE-DISABLED VETERAN-OWNED

SMALL BUSINESS SET-ASIDE (JUL 2016) (DEVIATION)

C.10 VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING—MONITORING AND

COMPLIANCE (JUL 2018) (DEVIATION)

C.11 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.12 VAAR 852.237-70 CONTRACTOR RESPONSIBILITIES (APR 1984)

C.13 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.14 FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (JAN 2019)

C.15 MANDATORY WRITTEN DISCLOSURES

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 ADDENDUM to FAR 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL

ITEMS

E.2 INSTRUCTIONS TO OFFERORS

E.3 FAR 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT

2018)

E.4 FAR 52.216-1 TYPE OF CONTRACT (APR 1984)

E.5 FAR 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.6 VAAR 852.233-71 ALTERNATE PROTEST PROCEDURE (JAN 1998)

E.7 FAR 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

36C10X19R0010

E.8 FAR 52.212-2 EVALUATION—COMMERCIAL ITEMS (OCT 2014)

E.9 FAR 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL ITEMS (OCT 2018)

36C10X19R0010 Section B

SECTION B – CONTRACT ADMINISTRATION

B.1 CONTRACT ADMINISTRATION DATA

A. Contract Administration: All contract administration matters will be handled by the following individuals:

(1) CONTRACTOR: TBD

(2) GOVERNMENT:

a. The Contracting Officer (CO) for this contract (hereafter “the CO”) is as follows:

Lindi Sylvester, Contracting Officer Office of Acquisition Operations Strategic Acquisition Center – Frederick

b. The CO is responsible for providing overall scope oversight, maintaining communication between Contractor and VA, ensuring contract compliance, and administering the contract and any modifications. The CO is also responsible for ensuring that task orders issued under the contract (hereafter referred to as “orders”) are within the scope of the contract, issuing and administering all orders, overseeing payment or rejection of invoices, and ensuring that annual performance evaluations are completed either at the contract or order level.

c. The CO is the only person with authority to obligate the Government under the contract or any order, authorize changes to terms or conditions of the contract or any order, or otherwise bind the Government under the contract or any order.

d. The CO reserves the right to designate a Contracting Officer’s Representative (COR) at the contract or order level. The CO will issue a designation letter to the COR and the contractor to ensure that all parties understand the limited authority of the COR. In no event will the COR have authority to obligate or bind the Government or change the terms and conditions of the contract or any order.

e. An initial order will be placed at time of contract award for the minimum guaranteed quantities listed in subsection B.1.C.(1) below. Subsequent orders, if any, will be placed according to the Government’s need and availability of funding.

B. Task Order Procedures:

The Contractor shall provide services according to the delivery and performance requirements specified in the Performance Work Statement of the contract. Orders shall specify all applicable tasks, along with the associated deliverables and quantities required.

(1) VA will follow the ordering procedures and requirements in FAR 16.505(a) that are applicable to single award IDIQ contracts, including those set forth at FAR 16.505(a)(2) and 16.505(a)(7).

(2) As the Government identifies a need, the CO will issue an order to the contractor for the specific tasks and quantities required. The CO is the only person authorized to issue orders.

The order may include additional or more specific information and requirements than the contract Performance Work Statement. Any conflicts between the terms of an order and the terms of the contract shall be resolved by giving precedence to the terms of the contract.

(3) Orders will be issued on the SF 1449 via email.

(4) Prices are determined at the contract level and shall remain firm fixed prices throughout the ordering period. Orders shall be placed according to the contract CLINs and prices.

(5) An order is not fully executed until the CO signs the order, after which the fully executed order will be sent via email to the Contractor. The Contractor is not authorized to commence performance at any time prior to issuance of a fully executed order. The Contractor’s failure to begin performance within the timeframe required may result in the termination of the order.

(6) The Contractor shall not perform or provide services that are not expressly identified in the contract and applicable order.

C. Minimum Guaranteed Quantities and Maximum Quantities:

(1) The minimum guaranteed quantities for this contract are stated as number of units and are set forth in the following table. Orders beyond the minimum will be determined by the Government’s need. The Government has no obligation to issue orders for services beyond the minimum guaranteed quantities.

Contract Line Item Description Minimum Quantity Task 1 - Online demographic and credential database Access to database, priced each/per VA user, per year

Task 1 - Online database Virtual live training sessions

Task 2 – Credentials verification services New Providers, priced per provider

5,100

Task 2 – Credentials verification services Re-Credentialing Providers (every three years), priced per provider

Task 2- Credentialing verification services Virtual live training on utilizing Credentialing Verification Services

Task 3 - Credentials review board Operation of credentialing review board and administrative support for VA Credentialing Committee, priced monthly

Task 4 - Monitoring providers Monitor non-CCN providers, priced per provider, per year

5,100

Task 4 - Monitoring providers Monitor CCN providers, priced per provider, per year

Monthly Status Reporting Monthly reporting on all aspects of IDIQ and current orders, priced by each month

(2) The maximum quantities for this contract are stated as number of units and are set forth in the following table. These maximum quantities are for the entire five-year ordering period of the contract. The Government does not guarantee, and is not obligated to order, any quantities beyond the minimums identified in subsection B.1.C(1) above.

Contract Line Item Description Maximum Quantity Task 1 - Online demographic and credential database Access database, priced each/per VA user, per year

10,000

Task 1 - Online database Virtual live training sessions

Task 2 - Credentials verification services New Providers, priced per provider

129,451

Task 2 - Credentials verification services Re-Credentialing Providers (every three years), priced per provider

85,085

Task 2 - Credentials verification services Virtual live training on utilizing Credentialing Verification Services

Task 3 - Credentialing review board Operation of credentialing review board and administrative support for VA Credentialing Committee, priced monthly

Task 4 - Monitoring providers Monitor non-CCN providers, priced per provider, per year

494,101

Task 4 - Monitoring providers Monitor CCN providers, priced per provider, per year

2,283,545

Monthly Status Reporting Monthly reporting on all aspects of IDIQ and current orders, priced by each month

D. Invoicing:

(1) All payments by the Government to the contractor will be made in accordance with 52.232-

33, Payment by Electronic Funds Transfer – System for Award Management (Oct 2018).

(2) All invoices shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests (Nov 2018). Invoices shall be submitted monthly in arrears, upon Government final inspection/acceptance by the COR. Specific invoicing instructions will be specified in each order.

E. Acknowledgment of Amendments (solicitation only): The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PERFORMANCE WORK STATEMENT

1.0 General Overview

The U.S. Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Office of Community Care (OCC), requires services to support and implement certain functions related to VA credentialing and/or monitoring non-VA health care providers that furnish hospital care, medical services, or extended care services to Veterans under VA’s community care program.

A primary goal of VA’s community care program is patient safety for all Veterans served by VA. To achieve this goal, VA must ensure non-VA health care providers are medically qualified and competent to provide care prior to referring Veterans for community care from such providers. The credentials verification services and monitoring services identified in this contract and Performance Work Statement (PWS) directly support and facilitate VA’s efforts to assess and/or monitor the medical qualifications and competence of non-VA health care providers in two broad categories:

1. Providers that furnish hospital care, medical services, or extended care services to Veterans pursuant to Veterans Care Agreements (VCA) entered into by VA under the authority set forth at 38 U.S.C. § 1703A or other contracts or agreements entered into and administered by VA. These providers are referred to in the contract as “non-CCN providers”; and

2. Providers that furnish hospital care, medical services, or extended care services under VA’s Community Care Network (CCN), a contracted network of non-VA providers that is administered by third-party administrators (TPA). These providers are referred to in the contract as “CCN providers.”

The desired outcomes of this contract are to: 1) obtain the information needed for VA to properly assess whether non-CCN providers should be credentialed by VA for purposes of furnishing care to Veterans under VA’s community care program, including whether they are medically qualified, licensed, and competent to provide care to Veterans; 2) establish and operate a credentialing review board that will conduct enhanced reviews of credentialing information, including marginal findings of the credentialing verification process and information asserted and provided in support of provider appeals of VA credentialing determinations, and provide assessments and recommendations to VA’s Credentialing Committee; and 3) monitor CCN and non-CCN providers to ensure they maintain appropriate qualifications, licenses, competence, and status throughout the time they are providing care to Veterans under VA’s community care program.

2.0 Ordering Period

The contract will have a five-year ordering period. The estimated ordering period is May 2019 – May 2024. There are no options.

3.0 Place of Performance

The Contractor shall perform all work under this contract at the Contractor’s location.

4.0 Contract Type

This is a firm-fixed-price (FFP), single award indefinite-delivery indefinite-quantity (IDIQ) contract.

Orders shall be placed as the Government need is identified and funding is available.

5.0 General Requirements

1. The Contractor shall always be certified or accredited for its credentials verification services by a nationally recognized certifying or accrediting organization (e.g., the National Committee for Quality Assurance (NCQA) or the Utilization Review Accreditation Commission (URAC)).

2. The Contractor must always ensure provider credentials verification data and reports are provided in formats that are compatible with VA’s Provider Profile Management System (PPMS). See Section 9.0 below.

6.0 Reporting

The Contractor shall provide monthly reporting to the COR on the following:

1. Any outages of the online database under Task 1 during the preceding month, including the length of time of the outage;

2. Itemized list of new providers with the date of request by VA and date of initial contact/attempt to contact by the Contractor;

3. Itemized list and total number of providers for which the Contractor performed credentials verification services under 7.2.2 during the preceding month, and their graded risk assessment results (e.g., A-Fs), with annotation of the VA facility that requested the services;

4. Summary of efforts monitoring all providers for sanctions and disciplinary actions during the preceding month, with an itemized listing of all providers flagged and the specific reason(s) for being flagged; and

5. Credentialing review board status as detailed in Task 3.

7.0 Tasks

If and when ordered by the Government, the Contractor shall perform the following tasks:

7.1 Task 1: Online database of provider demographic, professional, and credentials data

7.1.1 The Contractor shall maintain a profile-based data collection online database that contains demographic and professional data that is self-reported by providers, as well as data regarding providers’ credentials. The Contractor shall provide VA personnel, and all providers identified by VA, with access to the database. VA personnel will access this database to view provider data and to send provider data to the Contractor in connection with credentials verification services under Task 2. This database eliminates the need for VA personnel to contact providers directly to obtain the demographic information necessary to conduct credentialing.

Specifically, VA requires:

a. An online demographic and credentials database compliant with nationally recognized certification and/or accreditation standards (e.g., NCQA, URAC). The database shall have self-reporting capability that allows providers to enter required data and VA to obtain provider information from this database.

b. Database licenses for up to 2,000 VA personnel.

c. All provider demographic and credentials data within the database must be exportable in PSV and Excel files.

7.1.2 The Contractor shall provide five virtual live training sessions, at least one to be recorded, for up to 2,000 VA personnel with access to the database. The training shall provide instruction on overall usage of the database, including how to access and export information, and how to use provider credentialing status tracking if available in database.

The Contractor shall record one of the live training sessions for future VA use. The training must be available online via the Contractor’s website or an online video-sharing site (such as YouTube).

Deliverable 7.1.1 Up to 2,000 licenses for VA personnel to access and use online demographic and credentials database.

Deliverable 7.1.2 Five virtual live training sessions on usage of database, including one recorded live training available online.

7.2 Task 2: Credentials verification organization (CVO) services

7.2.1 The Contractor shall develop processes and materials necessary to provide VA with credentials verification services that will inform and facilitate VA’s credentialing process for all non-CCN providers.

The credentials verification services must consist of contacting providers to initiate the credentialing process, collecting and verifying of the information identified in section 7.2.2, below, and providing VA with a risk assessment and analysis of individual providers’ qualifications based on the application of VA-determined criteria to the Contractor’s review of collected and verified information. The Contractor shall use primary source verification as a standard practice, and all documentation supporting the verification and risk assessment shall be submitted to VA. The Contractor shall present, for VA’s approval, the criteria that will be used to verify provider information and conduct a risk assessment of each provider, and the Contractor shall develop a process and materials based on those criteria.

7.2.1.1 The Contractor shall develop a credentialing application form to gather all required information from providers. The application form must contain all data elements required by VA.

7.2.1.2 The Contractor shall develop a process for receiving provider information from VA for the purpose of contacting providers to initiate the credentialing process. The process must have two entry points with at least one being electronic. After award, VA will provide the Contractor with an initial list of providers for which the credentialing process must be initiated. Additional providers will be identified by VA throughout performance.

7.2.1.3 The Contractor shall develop a standardized assessment to use for all providers in documenting the results of the credentials verification and risk assessment of the provider, for VA approval. The assessment must include, at a minimum:

a. Overall risk assessment of the provider, expressed in terms of a scaled grading system (e.g., A-F or 1-5).

b. Outcome/categorization of selected verification elements, with score for each (list to be approved by VA, could include all elements) and free text comments as needed

c. Method, source, verification date, and name and/or initials of primary source verification staff

7.2.1.4 The Contractor shall develop and provide two Frequently Asked Questions (FAQ) sheets. The first FAQ sheet will be for use by VA staff and must explain the Contractor’s credentials verification processes and materials and address commonly asked questions. The second FAQ sheet will be for use by providers and must address commonly asked questions on VA’s credentialing process, including the credentials verification processes implemented by the Contractor, how providers submit an application, and the process for providers to appeal VA’s credentialing determinations.

7.2.1.5 The Contractor shall provide five virtual live training sessions, at least one to be recorded, for up to 2,000 VA personnel. The training shall provide instruction on overall credentials verification processes and materials developed by the Contractor under Task 2, including how to complete the required forms, where to send such forms, how to check status of and, track credentials verification actions and progress by the Contractor, credentialing status tracking and timelines.

The Contractor shall record one of the live training sessions for future VA use. The training must be available online via the Contractor’s website or an online video-sharing site (such as YouTube).

7.2.2 The Contractor shall use the processes and materials developed under section 7.2.1 to provide credentials verification services for non-CCN providers. Upon VA request to initiate credentials verification services for a specific provider, the Contractor shall provide all required credentials verification services for that provider, including:

a. Utilize the process developed under section 7.2.1.2 and the application form developed under section 7.2.1.1 to initiate the credentialing process, contact the provider, and obtain all required information.

b. Obtain documentation of and verify the following credentials information, using primary source verification as a standard practice:

1. License to practice

2. Drug Enforcement Administration (DEA) and Controlled Dangerous Substances (CDS) certificates

3. Education and training

4. Board certification

5. Work History

6. Malpractice history (NPDB)/ Professional liability claims

7. License sanctions (NPDB)

8. Medicare/Medicaid sanctions (NPDB)

9. Hospital privileges (verified with hospital in selected states)

10. Current malpractice coverage to be of a certain minimum value

11. Current attestation and disclosure questions

12. OIG sanction check

13. SAM and LEIE sanction check

14. Medicare participating/enrolled/ opt-out check

c. Document the results of the credentials verification and conduct and document the risk assessment described in section 7.2.1.3 in accordance with the requirements and process under that section. The Contractor shall complete and submit an assessment that includes the overall graded risk assessment (7.2.1.3) for the provider, along with a summary of the results from the primary and other sources for the credentials verification, to VA. Documentation list to be saved in a location accessible to VA. VA will have unlimited rights, within the meaning of FAR 52.227-14 (May 2014), in all data and documents delivered to VA under Task 2, and VA will retain ownership of all such documents after the contract ends.

7.2.3 The Contractor shall provide the services identified in section 7.2.2 for non-CCN providers that VA decides to re-credential, which generally will occur three years after being initially credentialed. VA will initiate this process in the same manner established under section 7.2.2.

Deliverable 7.2.1 Approved credentialing process (Not Separately Priced (NSP), one-time deliverable), including:

Deliverable 7.2.1.1 Provider application form Deliverable 7.2.1.2 Provider information receipt process Deliverable 7.2.1.3 Approved credentials verification process and standardized assessment Deliverable 7.2.1.4 Frequently Asked Questions (FAQ) sheets (one for VA staff, one for providers) Deliverable 7.2.1.5 Virtual live training sessions (one also recorded) on credentials verification processes and materials developed by the Contractor under Task 2

Deliverable 7.2.2 Completed credential verification package for each provider, including risk assessment Deliverable 7.2.3 Completed re-credential verification package for each provider, including new risk assessment

7.3 Task 3: Operation of credentialing review board and administrative support for VA Credentialing Committee

7.3.1 The Contractor shall establish and operate a credentialing review board that will conduct enhanced reviews of credentialing information, including marginal findings resulting from the credentials verification process conducted under Task 2, information indicating providers have potentially committed egregious acts, and information asserted and provided in support of provider appeals of VA credentialing determinations, and provide assessments and recommendations to VA’s Credentialing Committee.

As outlined in section 7.2 Task 2, VA will use the credentials verification files and risk assessments provided by the Contractor to determine if individual non-CCN providers are suitable and qualified to be credentialed for purposes of furnishing hospital care, medical services, or extended care services to Veterans under VA’s community care program. VA’s credentialing process will entail automatic acceptance or rejection of certain providers that meet or fail to meet certain criteria. Providers that are not automatically accepted or rejected will be reviewed by a VA Credentialing Committee.

The Contractor’s credentialing review board shall further evaluate the details of the credential verification files and assessments, as well as other relevant information, for providers that do not meet VA’s established thresholds for being automatically accepted or rejected and other providers that VA requests the board to review on an ad hoc basis (e.g., providers for which the credentialing file indicates potentially egregious acts). Upon request from VA, the Contractor’s credentialing review board shall also evaluate provider appeals of VA credentialing determinations, including reviewing the relevant credentials verification files and assessments, as well as the appeal and any supporting information. For each of the foregoing types of evaluations, the Contractor’s credentialing review board shall be responsible for conducting an enhanced review of each such provider and for providing a written assessment and recommendation to VA for consideration by VA’s Credentialing Committee. VA’s Credentialing Committee will independently determine whether or not to credential the provider and whether or not to grant or deny an appeal.

7.3.2 The Contractor shall provide administrative services to facilitate operations of the VA Credentialing Committee responsible for credentialing determinations for non-CCN providers to include tracking of activities, generating meeting minutes, and sending notification letters to providers to inform them of VA Credentialing Committee decisions. The contractor shall also draft administrative oversight documents with the input and review by VA. These documents will include Credentialing Bylaws/policy, Credentialing Committee Charter, and documentation of the process and procedures (standard operating procedures (SOPs)) related to credentialing, network approval, or network disapproval of providers. VA will review and approve all documents prior to adoption by Committee.

7.3.3 The Contractor shall provide a status report of the Credentialing Committee activities and reviews to the COR in the monthly status report. The report shall include an aggregate of the total number of files reviewed by the Committee, average time to complete the review from start to finish, and total approved and rejected. The Contractor shall establish an electronic process to disseminate documents and collect individual summaries of provider file reviews.

Deliverable 7.3.1 Establish and operate credentialing review board Deliverable 7.3.1 Enhanced review and written assessment and recommendation to VA’s Credentialing Committee for each provider under review.

Deliverable 7.3.2 Meeting minutes Deliverable 7.3.2 Credentialing Committee by-laws, charter and Standard Operating procedures documents Deliverable 7.3.3 Monthly Credentialing Committee Report Deliverable 7.3.3 The Contractor shall establish an electronic process to disseminate documents and collect individual summaries of provider file reviews.

7.4 Task 4: Monitoring providers

7.4.1 The Contractor shall develop and maintain a process for monitoring licensing sanctions and disciplinary actions against providers from the following sources: National Practitioner Data Bank (NPDB) (non-CCN providers only), state licensing boards, Office of Personnel Management (OPM), and Medicare/Medicaid sources. Following award, the Contractor shall provide a statement and process flow of how monitoring services work to the COR.

7.4.2 The Contractor shall provide a monitoring report of all VA-specified non-CCN providers to the COR weekly. The report shall include at minimum provider/facility name, National Provider Identifier (NPI), Tax ID, date of birth (DOB), state license information, any sanctions or disciplinary actions identified through the sources in 7.4.1, and the reasons for and dates of any identified sanctions or disciplinary actions.

7.4.3 The Contractor shall provide a monitoring report of all VA-specified CCN providers to the COR weekly. The report shall include at minimum provider/facility name, National Provider Identifier (NPI), Tax ID, date of birth (DOB), state license information, any sanctions or disciplinary actions identified through the sources in 7.4.1 (with the exception of NPDB, which does not apply to this task), and the reasons for and dates of any identified sanctions or disciplinary actions.

Deliverable 7.4.1 Monitoring Statement and Process Flow Deliverable 7.4.2 Monitoring of Non-CCN providers Deliverable 7.4.3 Monitoring of CCN providers

8.0 Performance standards; acceptable quality levels; and performance monitoring by VA

The performance standards and acceptable quality levels (AQL) set forth in Attachment A: Quality Assurance Surveillance Plan (QASP) are incorporated by reference into this PWS. The Contractor shall always comply with all performance standards and AQLs set forth in the QASP.

VA will monitor contractor performance in accordance with the performance standards set forth in Attachment A: Quality Assurance Surveillance Plan (QASP).

9.0 Data compatibility with PPMS

The Contractor shall ensure all data elements can be incorporated into the Provider Profile Management System (PPMS), a proprietary system VA built upon Microsoft customer relationship management (CRM) platform, that will be utilized for storing all provider data points, within two months of award.

PPMS will store National Provider Identifier (NPI) numbers and other data elements for all providers subject to the processes described in this contract. NPI numbers will be submitted to the Contractor from PPMS to be utilized for obtaining provider demographic and professional information (Task #1) and credentials verification services (Task #2). Phase I will include sharing information via a report through encrypted email to/from VAMC staff to input credentialing data into PPMS. Phase II will have the Contractor provide the data elements in a format compatible with PPMS to be transmitted through Data Access Service (DAS) to VA personnel who will then feed the information for demographic and professional information and provider overall score (Task #2). Contractor shall submit the VA Credentialing Committee’s written dispositions, meeting minutes, and all supporting documentation from the Credentialing Committee to VA staff to be added to PPMS as appropriate (Task #3). Contractor will conduct ongoing monitoring of providers and submit updates to VA staff when findings occur (Task #4).

10.0 Deliverables

The following table outlines the deliverables required under each task. Each order will outline the specific task(s) required; deliverables will only be assigned and completed according to the orders awarded.

VA will have unlimited rights, within the meaning of FAR 52.227-14 (May 2014), in all data and documents delivered to VA under all tasks within this Performance Work Statement, and VA will retain ownership of all such documents after the contract ends.

Task/Deliverable Description Due Date

7.1.1 Up to 2,000 licenses for VA personnel to access and use online demographic and credentials database

30 calendar days after order effective date

7.1.2 Five virtual live training sessions on usage of database, including one recorded live training available online

Within 45 calendar days of order effective date

7.2.1

Approved credentialing process (NSP, one-time deliverable), including:

Provider application form Provider information receipt process Approved credentialing process and standardized assessment

FAQ sheets (one for VA staff; one for providers)

30 calendar days after order effective date

7.2.1.5 Five virtual live training sessions on usage of database, including one recorded live training available online

Within 45 calendar days of order effective date

7.2.2 Completed credential verification package for each provider, including risk assessment

30 calendar days after receipt of request for provider verification

7.2.3 Completed re-credential verification package for

each provider, including new risk assessment

30 calendar days after receipt of request for provider verification

7.3.1

Establish and operate credentialing review board

5 business days after receipt of VA request for credentialing review board review of one or more cases under 7.3.1

7.3.1 Enhanced review and written assessment and recommendation to VA’s Credentialing Committee for each provider under review

3 business days after assignment to the review board

7.3.2 Meeting minutes for VA Credentialing

Committee

5 business days after meeting

7.3.2

Credentialing Bylaws/policy, Credentialing Committee Charter, and documentation of the process and procedures (standard operating procedures (SOPs))

30 calendar days after order effective date

7.3.2 Monthly Credentialing Committee Report 15th of the month

7.3.2.2

Electronic process to disseminate documents and collect individual summaries of provider file reviews

30 calendar days after order effective date

7.4.1 Monitoring Statement and Process Flow 30 calendar days after order effective date

7.4.2

Monitoring of Non-CCN providers 30 calendar days after order effective date; maintain throughout period of performance reporting weekly to COR

7.4.3

Monitoring of CCN providers 30 calendar days after order effective date; maintain throughout period of performance reporting weekly to COR

11.0 Inherently Governmental Functions

This contract and its associated orders will not be used to acquire services for inherently governmental functions as defined by FAR 7.503. In providing the credentialing services identified in this contract and associated orders, the Contractor will not perform work reserved for performance by Federal employees, and the Government will manage the Contractor consistent with its responsibility to perform all inherently governmental functions and maintain control of its mission and operations in accordance with requirements of OFPP Policy Letter 11‐01.

For those services that include functions “closely associated” with inherently governmental functions as prescribed in the Policy Letter, VA will (1) limit or guide the Contractor’s exercise of discretion and retain control of government operations by both—(i) establishing in the Contract or individual orders specified ranges of acceptable decisions and/or conduct; and (ii) establishing in advance a process for subjecting the Contractor’s discretionary decisions and conduct to meaningful oversight and, whenever necessary, final approval by an agency official; (2) assign a sufficient number of qualified government employees, with expertise to administer or perform the work, to give special management attention to the Contractor’s activities, in particular, to ensure that they do not expand to include inherently governmental functions, are not performed in ways not contemplated by the Contract so as to become inherently governmental, do not undermine the integrity of the government’s decision making process, and do not interfere with Federal employees’ performance of the closely‐associated inherently governmental functions; (3) ensure that the level of oversight and management that would be needed to retain government control of Contractor performance and preclude the transfer of inherently governmental responsibilities to the Contractor will not result in unauthorized personal services as provided by FAR 37.104; (4) ensure that a reasonable identification of contractors and Contractor work products is made whenever there is a risk that Congress, the public, or other persons outside of the government might confuse contractor personnel or work products with government officials or work products, respectively;

and (5) take appropriate steps to avoid or mitigate conflicts of interest, such as by conducting pre‐award conflict of interest reviews, to ensure contract performance is in accordance with objective standards and contract specifications, and developing a conflict of interest mitigation plan, if needed, that identifies the conflict and specific actions that will be taken to lessen the potential for conflict of interest or reduce the risk involved with a potential conflict of interest.

In providing credentialing services and a credentialing review board, the Contractor is advised that Contractor personnel shall be responsible for gathering and researching provider data and making recommendations to VA OCC and the VA Credentialing Committee on each provider reviewed. All information shall be submitted to VA for VA review and final determinations. The Contractor shall not make any final determinations or decisions regarding whether providers will be credentialed by VA for purposes of furnishing hospital care, medical services, or extended care services under VA’s community care program.

12.0 Government Furnished Equipment, Information, and Facilities

The Government will provide all information required for the Contractor to provide reports and data in formats compatible with PPMS, along with certain provider information necessary to contact providers to initiate credentialing.

There will be no Government furnished equipment or facilities.

13.0 Security

The Contractor will have access to VA sensitive information and Personal Identifiable Information (PII) for health care providers in performance of this contract. Contractor personnel shall be required to have background investigations or Personal Identity Verification (PIV) badges. The C&A requirements do not apply, and that a Security Accreditation Package is not required.

Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program).

The Contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and all applicable VA Directives and Handbooks regarding information and information system security, including any delineated in this contract.

a. The Contractor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system).

Such issues shall be remediated as quickly as is practical, but in no event longer than 5 days.

b. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 5 days.

c. Consistent with the requirements of 38 U.S.C. §5725, a Contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

d. This Contract is subject to the statutory requirement to assess liquidated damages against the contactor and/or subcontractor under 38 U.S.C. §5725 in the event of a breach of Sensitive Personal Information (SPI)/Personally Identifiable Information (PII). Such liquidated damages shall be assessed at $37.50 per affected Veteran or beneficiary. A breach in this context includes the unauthorized acquisition, access, use, or disclosure of SPI which compromises not only the information’s security or privacy but that of the Veteran or beneficiary as well as the potential exposure or wrongful disclosure of such information as a result of a failure to follow proper data security controls and protocols.

POSITION/TASK RISK DESIGNATION LEVEL(S):

Position Sensitivity Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Suitability and Security Program,” Appendix A)

Low / Tier 1 Tier 1 / National Agency Check with Written Inquiries (NACI) A Tier 1/NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), Federal Bureau of Investigation (FBI) name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate / Tier 2 Tier 2 / Moderate Background Investigation (MBI) A Tier 2/MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High / Tier 4 Tier 4 / Background Investigation (BI) A Tier 4/BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task:

Task Number Tier1 / Low / NACI Tier 2 / Moderate / MBI Tier 4 / High / BI

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

Office of Inspector General Cooperation

The Contractor shall cooperate with the VA Office of the Inspector General (OIG) in the areas of facilities access, audits, security incident notification, and hosting location. Specifically, the Contractor (and any Subcontractors) shall:

1. Provide the Contracting Officer, designated representative of the Contracting Officer, and representatives of the agency's Office of Inspector General, full and free access to the Contractor's (and Subcontractors') facilities, installations, operations documentation, databases, and personnel used for contract hosting services. This access shall be provided to the extent required to carry out audits, inspections, investigations, or other reviews to ensure compliance with contractual requirements for IT and information security, and to safeguard against threats and hazards to the integrity, availability, and confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor).

2. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the Contracting Officer or the agency Office of Inspector General as described in subparagraph (1).

Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (per agency policy) to Contractor facilities, systems, data and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review. The Contractor's (and any Subcontractors') cooperation with audits, inspections, investigations, and reviews conducted under this clause will be provided at no additional cost to the Government.

3. Preserve such data, records, logs and other evidence which are reasonably necessary to conduct a thorough investigation of any computer security incident. A computer security incident (as defined in NIST SP 800-61, Computer Security Incident Handling Guide), including but not limited to those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor), or to the function of information systems operated by the Contractor (or Subcontractor) in the performance of this contract.

4. Promptly notify the designated agency representative in the event of any computer security incident as described in paragraph (3) above. This notification requirement is in addition to any other notification requirements which may be required by law or this contract. Established Federal agency timeframes for reporting security incidents to the United States Computer Emergency Readiness Team (US- CERT), although not exhaustive, serve as a useful guideline for determining whether reports under this paragraph are made promptly. (See NIST SP 800-61, Computer Security Incident Handling Guide, Appendix J).

5. Provide to the requestor (Contracting Officer, a representative of the Contracting Officer, or the agency Office of Inspector General) Government data, information, or records under the control of or in the possession of the Contractor pursuant to this contract, which the Agency, including the Office of Inspector General, may request in furtherance of other audits, inspections, investigations, reviews or litigation in which the Agency or the Office of Inspector General is involved. Requests for production under this paragraph shall specify a deadline not less than 10 days for compliance which will determine whether response to the request has been made in a timely manner. Unless expressly provided otherwise elsewhere in this contract, the production of data, information, or records under this paragraph will be at no additional cost to the Government.

6. Include the substance of this section in any subcontract which would require or otherwise result in Subcontractor employees having access to agency information in the possession or under the control of the Contractor (or Subcontractor), or access to information systems operated by the Contractor (or Subcontractor) in the performance of this contract.

7. Ensure that all hosting services pertaining to this contract are performed within the United States of

America, including the storage of agency data, information, and records under the control of or in the possession of the Contractor…