36C24719Q0348-001.docx

WJB Dorn VA Medical Center Community Based Outpatient Clinic (CBOC) Contracted Community Pharmacy Services

Performance Work Statement

(PWS)

Quality Assurance Surveillance Plan (QASP)

Performance Work Statement

Community Pharmacy Services for the WJB Dorn VAMC Community-Based Outpatient Clinics (CBOC)

IN ADDITION TO THE BASIC CONTRACT, THE FOLLOWING PARAGRAPHS APPLY.

1. GENERAL

1.1. Description of Work

1.1.1 The contractor shall provide community pharmacy services filling prescriptions within a five (5) mile radius or adjacent to the premises of the Department of Veterans Affairs Community Based Outpatient Clinics (CBOC) assigned to the WJB Dorn VA Medical Center.

1.1.2 This requirement is for non-personal services; contract personnel performing under this contract shall perform services under the control and general supervision of the Contracting Officer Representative (COR) and /or the Chief, Community-Based Care Service.

1.2 CBOC Locations:

1.3 Pharmacy Disaster Relief Plan:

1.3.1 In the event of a natural disaster (hurricane, tornado, fire, earthquake, flooding, etc) or man-made disaster (pharmacy moving locations or shut down, major water leak/damage, terrorism, etc), the contractor shall provide Disaster Relief for eligible patients with a Veterans Health Identification Card (VHIC) in need of an emergency supply of medications that allows the Veteran to receive a 30 day supply at any retail pharmacy open to the public with a written prescription or active VA prescription bottle, not older than 6 months. This does not include controlled substances.

1.3.2 The Disaster Relief Plan will be activated upon notification of the COR or the VA Contracting Officer.

1.3.3 The Disaster Relief Plan will be activated within two hours of notification.

1.4 Performance Measure

1.4.1 Outcome. The contractor will provide qualified personnel who will fulfill the requirement to provide Pharmacy services at a standard enabling the WJB Dorn VAMC to provide such services at a high level of quality.

1.4.2 Standards. Services shall include the dispensing of pharmaceuticals as prescribed by clinic staff. Primarily, new prescriptions will be filled. In rare instances, where refills may be necessary, the Pharmacy filling the prescription will be provided a pre-authorization by the CBOC Clinical Pharmacist. Unless otherwise pre-authorized, prescription fills will be limited to a maximum of a ten day supply. Prescriptions filled under this contract will be, to the extent permitted by law, the least expensive drug product the pharmacy has in stock. Generic drugs will be dispensed whenever possible. A product is not considered a generic equivalent unless the strength, quantity and dosage are the same as the brand name. The generic name must be displayed on all labels for all medication. The authorized pharmacy will provide the date of filling, quantity provided (if other than the prescribed quantity), prescription number and name or initials of the responsible pharmacist. The contractor shall be paid only for those prescriptions that are approved by the VA Clinic. A point of contact (POC) for this contract will be designated within 5 days of the contract award, and the Contracting Officer notified of the POC in writing. The name and address of the local servicing pharmacy will be provided to the Contracting Officer within 10 days of contract award.

1.4.3 How Measured. Representatives of the VA are authorized to visit the premises of any pharmacy filling VA prescriptions under the contractor’s plan during business hours for the purpose of auditing and evaluation, which may include the inspection of clinical records. The VA will randomly audit all billings.

2. PERIOD OF PERFORMANCE

Base Year with Four (4) Options Years

3. ADVERSE DRUG EVENTS

All adverse drug events reported to the contractor’s pharmacies by beneficiaries of the VA will be reported to the WJB Dorn VA Medical Center’s Pharmacy Service via phone (803-776-4000 extension 7068) or fax (803-695-6738). Adverse drug events include dispensing errors, drug allergies, and adverse drug reactions. Pharmaceutical care provided to beneficiaries under this contract shall meet all standards applicable to Medicaid recipients in the State where the services are provided and standards set forth in The Joint Commission’s (TJC) current accreditation manual for Ambulatory Care/Pharmaceutical Services.

4. QUALITY OF SERVICE

Contractor will provide a high level of quality service to both patients and providers. Communication with providers should be open and immediate in order to resolve professional issues. Patient satisfaction is paramount – procedural issues should be immediately resolved with the designated Contracting Officer’s Representative (COR).

5. REPORTS

An electronic Excel document and/or hard copy shall be delivered to the COR and Contracting Officer on a monthly basis, providing the following minimum information:

Scripts *Generic Paid Claims *Brand Paid Claims *Total Charge

Total to Date

*Total Charge – the dollar amount invoiced to the VA for that month/year *Generic Paid Claims – the dollar amount invoiced for Generic prescriptions *Brand Name Paid Claims – the dollar amount invoiced for Brand Name prescriptions *Multi Paid Claims – the dollar amount invoiced for Multi (Brand/Generic) prescriptions *No. of Scripts – the number of prescriptions serviced by the Vendor

6. QUALIFICATIONS

6.1. Contractor’s personnel assigned to perform the services covered by this contract shall be licensed in the State, Territory, or Commonwealth of the United States or the District of Columbia and all licenses held by the personnel working on this contract shall be full and unrestricted licenses. If the Contractor uses other companies to perform the services required by this contract, the Contractor must assure those other companies’ personnel assigned to perform the services covered by this contract are licensed in the State, Territory, or Commonwealth of the United States or the District of Columbia and all licenses held by the personnel working on this contract are full and unrestricted licenses.

6.2. Business Associate Agreement. A Business Associate Agreement must be returned to the Contracting Officer (Attachment 2) within 7 days of award notification.

7. CONTRACTOR FURNISHED PROPERTY AND PERSONNEL SERVICES

7.1 The contractor will be responsible for protecting the personnel furnishing services under this contract. To carry out this responsibility the Contractor will provide the following for these personnel: workers compensation, professional liability insurance, health examinations, income tax withholdings, and social security payments.

7.2 The parties agree that the Contractor, its employees, agents and subcontractors will not be considered VA employees for any purpose and will be considered employees of the Contractor. The responsibility for any leave, including any sick leave, professional development or vacation time, is the responsibility of the contractor. The Government may evaluate the quality of professional and administrative services provided, but retains no control over the medical, professional aspects of services rendered (e.g., professional judgments, diagnosis for specific medical treatment).

8. MONITORING

8.1 Contracting Officer’s Representative (COR) will designate appropriate VAMC personnel to monitor Contractor employee(s) work hours/services through one or a combination of the following mechanisms:

8.1.1 The COR will be responsible for verifying contract compliance. Any incidents of Contractor non-compliance as evidenced by the monitoring procedures shall be forwarded immediately to the Contracting Officer.

8.1.2 Documentation of services performed shall be reviewed prior to certifying payment. The COR will perform periodic spot checks and document with the using service to ensure reports monitoring. VAMC will pay only for services actually performed and in strict accordance with the schedule of price/costs. Contract monitoring and record keeping procedures shall be sufficient to ensure proper payment and allow audit verification that services were provided.

9. CONTRACTOR FURNISHED PROPERTY

Contractor Furnished Items and Services. The Contractor shall furnish all necessary items and services required to perform this contract in accordance with the terms of this PWS and the contract except for those items or services specifically stated to be Government furnished.

10. PAYMENT

10.1 Payment will be made monthly in arrears for services rendered after receipt of a proper invoice. Invoices must be submitted within 30 days of service, to include total charges for the period and the contract number. Invoices will be accompanied by supporting documents to include:

· Patient’s Name

· Patients Social Security Number (last four is acceptable)

· Prescription number

· Provider name

· Name of medication

· NDC number of the dispensed drug

· Contractor’s charge

· Date prescription filled

10.1.2 Invoices should be sent to:

Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor and submitted through Tungsten Network (formerly known as OB10) http://www.tungsten-network.com/us/en/

· Invoice Number and Date

· Contractor’s Name and Address

· Accurate Purchase Order Number

· Supply or Service provided

· Period Supply or Service Provided

· Total Amount Due

Please begin submitting your electronic invoices through the Tungsten Network for payment processing, free of charge.

If you have questions about the e-invoicing program or Tungsten Network, contact information is as follows:

· Tungsten e-Invoice Setup Information: 1-877-489-6135

· Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com

· FSC e-Invoice Contact Information: 1-877-353-9791

· FSC e-invoice email: vafsccshd@va.gov

Web Address: HTTP://WWW.FSC.VA.GOV/EINVOICE.ASP

10.1.3 The WJB Dorn VAMC will only pay for services actually performed and in strict accordance with the Schedule of price/costs shown in the contract.

10.1.4 Invoices rendered by the Contractor to the VAMC for services furnished VAMC patient or beneficiary shall be billed under the terms of this contract. Neither the beneficiary, his insurer nor any third party shall be billed.

10.1.5 VA beneficiaries shall not under any circumstances be charged nor their insurance companies charged for services rendered by the contractor even if VA does not pay for those services. This provision shall survive the termination or ending of the contract

11. DATA SECURITY INFORMATION GATHERED OR CREATED IN PERFORMANCE OF SERVICES

11.1. Information, including, but not limited to, veteran individually-identifiable information (ii) and personal healthcare information (PHI), gathered or created by the Contractor in the performance of this contract is the exclusive property of VA and must be received, gathered, stored, backed up, maintained, used, disclosed and disposed of in accordance with the terms of this contract and applicable federal and VA information confidentiality and security laws, regulations and policies, including VA Directive and Handbook number 6500.

11.2. The Contractor shall provide access to VA information only to employees, subcontractors, and affiliates only: (1) to the extent necessary to perform the services specified in this contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of this contract, and (3) only to individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same VA information. These restrictions include the same level of background investigations, where applicable.

11.3. ALL VAIII AND PHI INFORMATION STORED ON BOTH VA AND NON-VA EQUIPMENT MUST BE ENCRYPTED I ACCODRANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA). Federal standards established by U.S. Department of Commerce apply, including Federal Information Processing Standard 200 (FIPS200), and National Institute of Standards and Technology Special Publication 800-37, Guide for the Security Certification and Accreditation. Contractors and subcontractors shall document compliance and make the document available upon request of the Contracting Officer or COR. Contractor and subcontractors shall allow physical inspection by VA personnel to assess its physical and environmental security controls.

11.4. Contractor and its subcontractors must ensure that VAIII and PHI is secure at all times and will ensure proper security is used on contractor or subcontractor computers with VA III or PHI information is stored. To avoid risk of loss or theft, VA III and PHI shall NOT be transferred by contractor or its subcontractors to paper, diskettes, CDs, DVDs, USB flash drives, external computer drives, computer notebooks, home computers or any other medium, and shall NOT be removed from the contractor for subcontractor site under any circumstances without specific written authorization of the VA Information Security Officer. The authorized VA III or PHI recipient shall back up files to protect their loss. Back-ups shall be locked and secured. VA III and PHI shall NOT be transferred between contractor or subcontractor computer unless permission is granted by VA for such transfer of data and secure encrypted transmission methods approved by the VA Information Security Officer are utilized. Contractor employees shall be required to sign VA National Rules of Behavior before they can be authorized access to VA information systems.

11.5. The Contractor shall immediately (on the date of discovery of the incident) report any incident of theft, loss or comprise of VA sensitive information to the Contracting Officer, the Contracting Officer’s Technical Representative and any other VA Official designated b the Contracting Officer. This report shall be in writing and contain the fullest explanation possible and all the details of the incident available to the contractor. VA must receive notice from the contractor on the date contractor discovers incident.

11.6. HIPPA Compliance. The Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI).

11.7. Security Considerations: A security clearance will not be required for this acquisition.

12. ACCESS AUTOMATED DATA PROCESSING FILES:

In performance of official duties the Contractor’s employee(s) have regular access to printed and electronic files containing sensitive data, which must be protected under the provisions of the Privacy Act of 1974 (5 USC 552a), and other applicable laws, Federal Regulations, Veterans Affairs statutes and policies. The Contractor’s employee(s) are responsible for (1) protecting that data from unauthorized release or from loss, alteration, or unauthorized deletion and (2) following all applicable regulations and instructions regarding access to computerized files, release of access codes, etc., as set out in a computer access agreement which the Contractor’s employee(s) sign.

13. CONTRACT ADMINISTRATION DATA:

The Contracting Officer is the only person authorized to approve changes or modify any of the requirements under this contract. The Contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer is authorized to make commitments or issue changes, which will affect price, quantity, or quality of performance of this contract. In the event the contractor effects any such change at the direction of any person other than the contracting officer, the change shall be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

14. DESIGNATION OF CONTRACTING OFFICER’S REPRESENTATIVE:

A VA Medical Center representative of the Contracting Officer shall be designated to represent the Contracting Officer in furnishing technical guidance and advice regarding the work being performed under this task order. The foregoing is to be construed as authorization to interpret or furnish advice or information to the Contractor relative to the financial or legal aspects of the task order. Enforcement of these segments is vested and is the sole responsibility of the WJB Dorn VAMC Contracting Officer.

15. KEY PERSONNEL AND TEMPORARY EMERGENCY SUBSTITUTIONS:

15.1. The Contractor shall assign to this task order key personnel that will perform under this contract.

16. TERMINATION FOR CONVENIENCE: In accordance with FAR 52.212-4 (l) The Government reserves the right to terminate this contract, or any part hereof, for its sole convenience.

17. RECORDS MANAGEMENT LANGUAGE FOR CONTRACTS: The following standard items relate to records generated in executing the contract and should be included in a typical Electronic Information Systems (EIS) procurement contract:

17.1. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

17.2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

17.3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

17.4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

17.5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

17.6. The Government Agency owns the rights to all data/records produced as part of this contract.

17.7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

17.8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

17.9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

18. CHANGES:

Any changes referencing the above requirements will be communicated to and approved by the contracting specialist/officer and the contractor in writing throughout the life of the contract.

19. DESTRUCTION OF GOVERNMENT PROPERTY:

Subject to the terms of the contract and the circumstances surrounding the particular case, the contractor may be liable for shortages, loss, damages, or destruction of Government property. The contractor may also be liable when the use or consumption of Government property unreasonably exceeds the allowances provided for by the task order, the bill of material or other appropriate criteria. The contractor shall investigate and report to management at the VA Medical Center all cases of loss, damage or destruction of Government property in its possession or control as soon as the facts become known or when requested by the property administrator at the VA Medical Center. A report shall also be furnished when completed and accepted products or end items are lost, damaged, or destroyed while in the contractor’s possession or control. The contractor shall require any of its subcontractors possessing or controlling Government property accountable under the contract to investigate and report all instances of loss, damage, or destruction of such property.

20. VA INFORMATION CUSTODIAL LANGUAGE

20.1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

20.2. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

20.3. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

20.4. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

20.5. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

20.6. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

20.7. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

21. LIQUIDATED DAMAGES FOR DATA BREACH

21.1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

21.2. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

21.3. Each risk analysis shall address all relevant information concerning the data breach, including the following:

21.3.1. Nature of the event (loss, theft, unauthorized access);

21.3.2. Description of the event, including:

21.3.2.1. Date of occurrence;

21.3.2.2. Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

21.3.2.3. Number of individuals affected or potentially affected;

21.3.2.4. Names of individuals or groups affected or potentially affected;

21.3.2.5. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

21.3.2.6. Amount of time the data has been out of VA control;

21.3.2.7. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

21.3.2.8. Known misuses of data containing sensitive personal information, if any;

21.3.2.9. Assessment of the potential harm to the affected individuals;

21.3.2.10. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

21.3.2.11. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

21.3.3. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

21.3.3.1. Notification;

21.3.3.2. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

21.3.3.3. Data breach analysis;

21.3.3.4. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

21.3.3.5. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

21.3.3.6. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

Performance Requirements:

Task

Surveillance

General Contract Requirements (Service Radius)

Written notification received within 5 days of contract award or within 5 days of a change in POC.

General Contract Requirements (Pharmacies)

Written notification received within 10 days of contract award.

timely professional and courteous service with no valid complaints

Medication Compliance (Approval)

No non-approved medications issued without pre-authorization

Verification and/or documentation provided by Contractor

Medication Compliance (Refill)

Verification and/or documentation provided by Contractor

10.1.

Monthly billing reviews and certification conducted by the COR observations

Invoice Billing (Supporting Information) 10.1.

Patient Name Patient Social Security Number (last four is acceptable) Prescription number Provider name Name of medication NDC number of the dispensed drug Contractor’s charge Date prescription filled

Monthly billing reviews and certification conducted by the COR observations

Invoice Billing (Supporting Information Delivery) Section 5.

10 & 10.1.

Monthly billing reviews and certification conducted by the COR observations