36C24721Q1079 0001.docx

5. PROJECT NUMBER (if applicable)

CODE

7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer) 508A

DEPARTMENT OF VETERANS AFFAIRS

VETERANS HEALTH ADMINISTRATION

Network Contracting Office (NCO) 7 2957 CLAIRMONT ROAD NE, Suite 1200 Atlanta

GA

30329 508A

DEPARTMENT OF VETERANS AFFAIRS

VETERANS HEALTH ADMINISTRATION

Network Contracting Office (NCO) 7 2957 CLAIRMONT ROAD NE, Suite 1200 Atlanta

GA

30329 To all Offerors/Bidders

36C24721Q1079 09-02-2021

X X X

See CONTINUATION Page X The amendment 0001 is issued to answer questions related to the RFQ.

See page 2 - 3 for Vendor Questions and Government Answers.

Additionally, a revised PWS is attached.

Tanjia Dotson Contracting Officer

VA-VHA-2021-60B8B5B5

CONTINUATION PAGE

VENDOR QUESTIONS AND GOVERNMENT ANSWERS (IN BOLD)

1) Is the due date 9/8/21 at 5:00pm ET or 9/10/21 at 5:00pm ET? The SAM notice says 9/10, the SF1449 says 9/8. Please confirm.

9/8/2021 at 5:00 pm is the due date. The Solicitation takes precedence.

2) I am hoping to find out if there is an incumbent contractor currently performing these services, if similar services have been performed in the past, or if this is a new requirement.

This is a new contract request for onsite Otolaryngology [Ear/Nose/Throat (ENT)] physician services. This is not a bundled requirement, and no organizational conflicts of interest are applicable.

3) If this is a follow-on requirement, could you please provide the previous contract or task order number?

N/A

4) Para 2.9.2 - requires two providers be onsite where B.2 CLIN 0001 hours for 1 FTE provider. Is the requirement for 1 or 2 providers onsite?

Requirement will be for one (1) at this time

5) Para 2.9.3 - Please remove the requirement in the highlighted text.

This is an unrealistic expectation given we are only staffing one FTE provider. This can be removed

6) Para 3.2.5 - Off Hours coverage. Compare with B.2 CLIN 0002. Given there are only 700 hours allocated to being on-call, what is the schedule rotation our provider can expect both weekdays and weekends?

At this time call is very limited since there would be only one (1) provider.

7) B.2 Price Cost Schedule - How are call back hours to be billed?

This will be based on invoicing of actual time spent at the facility and will be captured when signing in and out.

8) What is the on-call rotation/schedule?

Call is very limited at this time due to lack of staffing; however, call may be established in the near future.

9) Is there 24-hr weekend/holiday on-call requirement? Section 3.1 just states 1630-0800 hours for on-call.

Not at this time; however, will be needed in the near future

10) Will you accept Board Eligible? Additional Instructions to Offerors section 1.a.ii on page 50 states ii. “Board Certification (Or Documentation Demonstrating Board Eligibility)”

Applicants must be “Board Certified”. Board eligible cannot take call.

11) The provider is required to report 20 minutes before schedule shift, is this time billable/payable?

The candidate would report 10 minutes prior to start of the shift. This is documented by signing in and out.

12) What is the average number of patients seen per day?

14-18 per day.

13) Section B.3 DESCRIPTION/SPECIFICATIONS/WORK STATEMENT is blank…do you have a Statement of Work for this position?

I have attached a revised PWS.

PERFORMANCE WORK STATEMENT

OTOLAYRNGOLOGY (ENT) PHYSICIAN

1.0. INTRODUCTION

1.1. The Contractor shall provide a full range of Otolaryngology (ENT) care for the Columbia VA Healthcare System. The Contractor shall provide Board Certified/Board Eligible Otolaryngologist (ENT) Physician’s in accordance with the standards of The Joint Commission and the professional standards of Columbia VA Healthcare System. Services specified shall be performed in accordance with established principles and ethics of the medical profession, VA Directives, and any other publications that may be specified.

2.0. CONTRACT DESCRIPTION / REQUIREMENT / OBJECTIVE

2.1. Duties include but are not limited to the following: Shall provide onsite care to include clinical coverage, consultation, evaluation, assessment, treatment and minor or major surgical procedures. Services shall be provided at a minimum of forty (40) hours per week (or more when required) which shall provide clinical coverage, call coverage, call backs, pre-operative and post-operative evaluations and Operating Room (OR) procedures. This shall include medical rounds/case conferences and didactic teaching if required. Medical documentation in the electronic patient record as mandated by the Medical Staff Bylaws shall be included.

2.2. All services rendered by the Contractor and Contractor employees are rendered as non-personal service with the Department of Veterans Affairs. The Government shall evaluate the quality of service provided. All persons performing services shall remain employees of the Contractor and be evaluated by the Chief of Surgery at the Columbia VA Healthcare System.

3.0. GLOSSARY / DEFINITIONS:

3.1. AQL - Acceptable Quality Level

3.2. BA – Business Agreement

3.3. CO - Contracting Officer: The person executing this contract on behalf of the Government and the only person authorized to make changes to the contract.

3.4. COT - Contracting Officer Technician

3.5. COR - Contracting Officer’s Representative: Person or persons delegated to act on behalf of the Contracting Officer within the limits of his/her delegated authority.

3.6. CPRS – Computerized Patient Record System

3.7. CVAHCS - Columbia VA Health Care System

3.8. JCAHO - Joint Commission on the Accreditation of Healthcare Organizations

3.9. Leave - Time off work

3.10. QA&I - Quality Assessment and Improvement

3.11. QASP - Quality Assurance Surveillance Plan

3.12. TJC - Total Joint Chief of Staff

3.13. VA - Veterans Affairs

3.14. VHA - Veterans Healthcare Administration

3.15. VISTA – Integrated Funds Distribution Control Point (IFCAP) computerized system utilized by the VA to conduct local facility work.

3.16. W.J.B. Dorn VAMC – W.J.B. Dorn Veterans Affairs Medical Center

4.0. SCHEDULE / PERFORMANCE LOCATION AND HOURS

4.1. Primary place of performance is the Columbia VA Health Care System located at 6439 Garners Ferry Road, Columbia, S.C. 29209.

4.2. The Contractor shall be required, as deemed necessary by the Contracting Officer Representative (COR), to furnish emergency services during national holidays and/or during non-working hours. The hours of work may be flexible based on surgical and clinical schedules required. Services shall be responsible for consultations to Otolaryngology (ENT) and shall be available to discuss and/or examine patients when consults are requested on a twenty-four/seven (24/7) basis, including federal holidays.

4.4. The number of weekends, nights, holidays, and on-call hours shall vary depending on the needs of the Intensive Otolaryngology (ENT) Sections. The services shall be approximately eighty (80) to eighty-four (84) hours per pay period (fourteen (14) calendar days). If circumstances require the Contract Provider to remain on duty longer than the scheduled tour (or call-back to provide emergency services), the Contractor shall invoice in accordance with the rates negotiated. Any hours that deviate from the tour of duty stated herein shall be approved in advance by COR.

4.4.1. Shifts are not a requirement at this time as contractor is expected to be available Monday-Friday from 0800-1630 unless providing on call coverage, call backs or an emergency should arise.

4.5. A record keeping system of contracted hours worked shall be established by the Contracting Officer Representative. The payments for any regular leave, sick leave, holiday or vacation time, are the responsibility of the Contractor.

5.0. PERFORMANCE REQUIREMENTS

5.1. A Contracting Officers Representative shall be delegated to this procurement. Scheduling of work performance shall be arranged through the designated COR assigned.

5.2. All services shall be performed in accordance with the standards of The Joint Commission and the professional standards of Columbia VA Healthcare System policies and procedures, VA regulations, and Rules and Bylaws of the medical staff at the facility.

5.3. Orientation: Contract Providers shall be required to attend an employee orientation at the W.J.B. Dorn VAMC located in Columbia, SC prior to the start of any provided services. Orientation attendance shall be properly documented.

5.4. The Contract Provider shall be under the direction of the Section Chief of Surgery Services at the Columbia VA Healthcare System.

5.5. The Contract Provider shall participate in quality management and utilization review activities, as required for staff clinical conferences and shall attend medical staff and service-level meetings as specified by the Service Chief.

5.6. The contractor shall provide qualified personnel who shall provide services that meet or exceed currently recognized standards as established by the JCAHO.

· A full range of Otolaryngology (ENT) services to include serving as the attending physician for inpatient services on a twenty-four (24) hour basis.

· Perform evaluations involving complete history and physical examinations and the ordering of laboratory studies relevant to the patient’s medical problem.

· Supervise and assist mid-level providers and ancillary health personnel in their evaluation and management of patients.

· Perform acquisition of material from all orifices to include but not limited to venous blood, fluid collection, and localized abscesses presenting to the skin.

· Perform venous and arterial puncture.

· Perform peer reviews as requested.

· Services shall be rendered in the Intensive Care Units.

· Services shall be provided in other inpatient and outpatient areas throughout the facility including the Emergency Department and Intensive Care Units.

5.7. The Contractor shall document all care according to appropriate medical care standards and where applicable to Joint Commission regulations. The physician must be proficient in the use of CPRS and VISTA.

6.0. QUALIFICATIONS/CREDENTIALING:

6.1. Prior to the commencement of any services, the Contractor shall provide a written certification that all practitioners who perform the required services shall be mentally and physically able to fulfill responsibilities of the work to be performed.

6.2. Contract Providers to perform the services shall possess an unrestricted license in a State, Territory, or Commonwealth of the United States of the District of Columbia. The qualifications of such personnel shall be subject to review by the VA Chief of Staff, or designee, and approved by the VA Facility Director. Former adverse actions against a license shall be considered grounds for determining the Contractor to be unacceptable for this type of service.

6.3. All contracted healthcare providers shall hold a Doctor of Medicine Degree from an accredited college or university approved by the Department of Education and shall provide this upon request.

6.4. All contracted healthcare providers shall be Board Certified and maintain a current certification in Basic Life Support and Advanced Cardiac Life Support.

The Contractor shall be responsible for obtaining and maintaining all re-certifications.

6.5. The contract providers are required to have experience with providing patient care in multi-specialty Otolaryngology (ENT) units. The Government specifically reserves the right to reject any of the Contractor’s personnel and refuse them permission to provide services.

6.6. Contract providers providing services shall meet all qualifications outlined in the VA Credentialing and Privileging Regulations in accordance with VHA Handbook 1100.19. Contract providers may not begin seeing patients until credentialing and privileging requirements according to TJC requirements and VA procedures have been met and necessary documents signed by the VA Facility Director.

6.7. Any sub-contractor(s) utilized by the contractor(s) for the provision of services required is mandated to meet the same qualifications specified herein for the contractor(s). The contractor(s) is mandated to obtain approval from the Contracting Officer with input from the COR for any sub-contractor(s) to be utilized for the provision of services required.

6.8. The Contract Provider shall possess basic proficiency in spoken and written English.

6.9. The Contractor shall assume full responsibility for the protection of its personnel furnishing services. The Contractor shall provide at a minimum the following:

· Worker’s Compensation

· Malpractice Insurance

· Employee Health/Infection Control Program and appropriate Immunizations,

· Income Tax Withholding and Social Security

NOTE: Prior to performing work the Contractor shall provide copies of current PPD and proof of Covid-19 Vaccination (Within one year: Proof of chicken pox – positive Varicella titer, proof of measles, mumps, rubella – positive MMR titer, hepatitis B vaccine series or a signed declination.

6.10. The Contractor shall maintain during the term of this service Professional Liability Insurance issued by a responsible insurance carrier of not less than $1,000,000 per specialty occurrence (reference VAAR Clause 852.237-7). At the request of the Contracting Officer, the Contractor shall furnish evidence of its insurability concerning this medical liability insurance requirement.

7.0. PERFORMANCE STANDARDS AND QUALITY MEASUREMENT

7.1. The Columbia VA Healthcare System shall evaluate the Contractor’s performance utilizing the quality assessment and improvement procedures established by W.J.B. Dorn VAMC. The Contractor and the contract providers shall be required to participate in the Columbia VA Healthcare System Quality Improvement Program as specified in the Columbia VA Healthcare System QA&I Plan.

7.2. Qualitative Standards. The contract providers shall participate in and be subject to the W.J.B. Dorn VAMC and Medical Department Quality Improvement Standards/Program. These quality important standards are consistent with current TJC monitoring and evaluation of the quality and appropriateness of medical care.

7.3. The Contractor shall furnish a statement in writing to the Contracting Officer at close out of each contracted year to include a summary of the contractor’s actions and statement that all requirements of the contract were fulfilled as agreed. A summary evaluation of contract performance based upon the compliance or non-compliance of service requires as evidenced under the monitoring procedures shall be forwarded by the VA Monitoring Official to the Contracting Officer prior to exercising any option year. Reference the Quality Assurance Surveillance Plan (QASP).

7.4. Performance standards define desired services. The Government performs surveillance to determine if the Contractor exceeds, meets, or does not meet these standards. The Government shall use these standards to determine Contractor performance and shall compare Contractor performance to the Acceptable Quality Level (AQL). The Quality Assurance Surveillance Plan (QASP) method of surveillance shall be by random inspection.

7.5. Other performance evaluation factors may be monitored that are not quantified by numerical measurements shall include:

· Contractor providing personnel exceeding the minimum qualification standards.

· No inappropriate prescriptions; patient customer service comments.

· Provider and Contractor relationship with VA hospital staff/Government contracting personnel.

Compliance with VA Hospital policy and procedures related to patient care.

The QASP and its performance objectives are as follows:

Paragraph Location

Standard

4.2.

4.4.

5.6.

Providing necessary Physician’s to fulfill requirements of the facility.

8.0. INVOICE PROCEDURES:

8.1. The Contractor shall provide invoices within thirty (30) calendar days after services have been rendered.

8.2. Payment for any holidays and leave, including sick leave, shall not be paid by the Government.

8.3. Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor and submitted through Tungsten Network (formerly known as OB10) http://www.tungsten-network.com/us/en/. A properly prepared invoice shall contain:

· Invoice Number and Date

· Contractor’s Name and Address

· Accurate Purchase Order Number

· Supply or Service provided

· Period Supply or Service Provided

· Total Amount Due

· Tungsten e-Invoice Setup Information: 1-877-489-6135

· Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com

· FSC e-Invoice Contact Information: 1-877-353-9791

· FSC e-invoice email: vafsccshd@va.gov

8.6. Web Address: HTTP://WWW.FSC.VA.GOV/EINVOICE.ASP

9.0. DATA SECURITY - INFORMATION GATHERED OR CREATED IN PERFORMANCE OF SERVICES

9.1. Information, including, but not limited to, veteran individually-identifiable information (iii) and personal healthcare information (PHI), gathered or created by the Contractor in the performance of this contract is the exclusive property of VA and must be received, gathered, stored, backed up, maintained, used, disclosed and disposed of in accordance with the terms of this contract and applicable federal and VA information confidentiality and security laws, regulations and policies, including VA Directive and Handbook number 6500.

9.2. The Contractor shall provide access to VA information only to employees, sub-contractors, and affiliates only: (1) to the extent necessary to perform the services specified in this contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of this contract, and (3) only to individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same VA information. These restrictions include the same level of background investigations, where applicable.

9.3. ALL VA III AND PHI INFORMATION STORED ON BOTH VA AND NON-VA EQUIPMENT MUST BE ENCRYPTED IN ACCORDANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA). Federal standards established by U.S. Department of Commerce apply, including Federal Information Processing Standard 200 (FIPS200), and National Institute of Standards and Technology Special Publication 800-37, Guide for the Security, Certification and Accreditation. Contractors and sub-contractors shall document compliance and make the document available upon request of the Contracting Officer or COR. Contractor and sub-contractors shall allow physical inspection by VA personnel to assess its physical and environmental security controls.

9.4. Contractor and its sub-contractors must ensure that VA III and PHI is secure at all times and will ensure proper security is used on contractor or sub-contractor computers with VA III or PHI information is stored. To avoid risk of loss or theft, VA III and PHI shall NOT be transferred by contractor or its sub-contractors to paper, diskettes, CDs, DVDs, USB flash drives, external computer drives, computer notebooks, home computers or any other medium, and shall NOT be removed from the contractor for sub-contractor site under any circumstances without specific written authorization of the VA Information Security Officer. The authorized VA III or PHI recipient shall back up files to protect their loss. Back-ups shall be locked and secured. VA III and PHI shall NOT be transferred between contractor or sub-contractor computer unless permission is granted by VA for such transfer of data and secure encrypted transmission methods approved by the VA Information Security Officer are utilized. Contractor employees shall be required to sign VA National Rules of Behavior before they can be authorized access to VA information systems.

9.5. The Contractor shall immediately (on the date of discovery of the incident) report any incident of theft, loss or comprise of VA sensitive information to the Contracting Officer, the Contracting Officer’s Technical Representative and any other VA Official designated by the Contracting Officer. This report shall be in writing and contain the fullest explanation possible and all the details of the incident available to the Contractor. VA must receive notice from the contractor on the date contractor discovers incident.

10.0. HHS/OIG:

10.1. To ensure that the individuals providing services have not engaged in fraud or abuse regarding Sections 1128 and 1128A of the Social Security Act regarding federal health care programs, the contractor is required to check the Health and Human Service – Office of Inspector General, List of excluded individuals/entities on the OIG Website (www.hhs.gov/oig) for each person providing services under this contract. Further the contractor is required to certify in its proposal that all persons listed in the contractor’s proposal have been compared against the OIG list and are not listed. During the performance the Contractor is prohibited from using any individual or business listed on the List of Excluded Individuals/Entities.

11.0. HIPPA COMPLIANCE:

11.1. The Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). A Business Associate Agreement is not required in this case.

12.0. LIABILITY

12.1. VA beneficiaries shall not under any circumstances be charged nor their insurance companies charged for services rendered by the Contractor even if the VA does not pay for those services. This provision shall survive the termination or ending of the contracted service.

13.0. MEDICAL RECORDS

13.1. Contractor shall provide health care to patients seeking such care from or through VA. As such, contractor is considered part of the Department health activity for purposes of the following statues and the VA regulations implementing these statues: The Privacy Act, 5.U.S.C. § 552a, and 38 U.S.C. §s 5701, 7705 and 7332. Contractor and its employees may have access to VA patient medical records to the extent necessary for the contract or to perform this contract. Notwithstanding any other provision of this contract, contractor and its employees may disclose patient treatment records only pursuant to explicit disclosure authority for VA. Contractor and its employees are subject to the penalties and liabilities provided statutes and regulations for unauthorized disclosures of such records and their contents.” “Records created by the contractor in the course of treating VA patients under this agreement are the property of the VA and shall not be accessed, released, transferred or destroyed except in accordance with applicable federal law and regulations.” Upon the expiration of this contract or termination of the contract, the contractor will promptly provide the VA with the individually identified VA patient treatment records.

14.0. RESIDENT SUPERVISION

14.1. All resident supervision provided under this contract requires compliance with VHA Handbook 1400.1 (Attachment 3).

15.0. PROCUREMENT REVIEW

15.1. For required procurement review purposes, the offeror shall state if the service Will ___ or will not___ be provided by a former VA Employee who left service with the VA less than two years ago.

BUSINESS ASSOCIATE AGREEMENT BETWEEN THE DEPARTMENT OF VETERANS AFFAIRS VETERANS HEALTH ADMINISTRATION, COLUMBIA, VA HEALTH CARE SYSTEM, AND CONTRACTING PROVIDER

Purpose. The purpose of this Business Associate Agreement (Agreement) is to establish requirements for the Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Columbia, VA Health Care System and CONTRACTING PROVIDER in accordance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH) Act, and the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”), 45 C.F.R. Parts 160 and 164, for the Use and Disclosure of Protected Health Information (PHI) under the terms and conditions specified below.

Scope. Under this Agreement and other applicable contracts or agreements, CONTRACTING PROVIDER will provide Vascular SERVICES to, for, or on behalf of COLUMBIA, VA HEALTH CARE SYSTEM.

In order for CONTRACTING PROVIDER to provide such services, COLUMBIA, VA HEALTH CARE SYSTEM will disclose PHI to CONTRACTING PROVIDER, and CONTRACTING PROVIDER will use or disclose PHI in accordance with this Agreement.

Definitions. Unless otherwise provided, the following terms used in this Agreement have the same meaning as defined by the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (PHI), Required by Law, Secretary, Security Incident, Sub-contractor, Unsecured Protected Health Information, and Use.

“Business Associate” shall have the same meaning as described at 45 C.F.R. § 160.103. For the purposes of this Agreement, Business Associate shall refer to CONTRACTING PROVIDER, including its employees, officers, or any other agents that create, receive, maintain, or transmit PHI as described below.

“Covered Entity” shall have the same meaning as the term is defined at 45 C.F.R. § 160.103. For the purposes of this Agreement, Covered Entity shall refer to COLUMBIA, VA HEALTH CARE SYSTEM.

“Protected Health Information” or “PHI” shall have the same meaning as described at 45 C.F.R. § 160.103. “Protected Health Information” and “PHI” as used in this Agreement include “Electronic Protected Health Information” and “EPHI.” For the purposes of this Agreement and unless otherwise provided, the term shall also refer to PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity or receives from Covered Entity or another Business Associate.

“Sub-contractor” shall have the same meaning as the term is defined at 45 C.F.R. § 160.103. For the purposes of this Agreement, Sub-contractor shall refer to a contractor of any person or entity, other than Covered Entity, that creates, receives, maintains, or transmits PHI under the terms of this Agreement.

Terms and Conditions. Covered Entity and Business Associate agree as follows:

1. Ownership of PHI. PHI is and remains the property of Covered Entity as long as Business Associate creates, receives, maintains, or transmits PHI, regardless of whether a compliant Business Associate agreement is in place.

2. Use and Disclosure of PHI by Business Associate. Unless otherwise provided, Business Associate:

A. May not use or disclose PHI other than as permitted or required by this Agreement, or in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity, except that it may use or disclose PHI:

(1) As required by law or to carry out its legal responsibilities;

(2) For the proper management and administration of Business Associate; or

(3) To provide Data Aggregation services relating to the health care operations of Covered Entity.

B. Must use or disclose PHI in a manner that complies with Covered Entity’s minimum necessary policies and procedures.

C. May de-identify PHI created or received by Business Associate under this Agreement at the request of the Covered Entity, provided that the de-identification conforms to the requirements of the HIPAA Privacy Rule.

3. Obligations of Business Associate. In connection with any Use or Disclosure of PHI, Business Associate must:

A. Consult with Covered Entity before using or disclosing PHI whenever Business Associate is uncertain whether the Use or Disclosure is authorized under this Agreement.

B. Implement appropriate administrative, physical, and technical safeguards and controls to protect PHI and document applicable policies and procedures to prevent any Use or Disclosure of PHI other than as provided by this Agreement.

C. Provide satisfactory assurances that PHI created or received by Business Associate under this Agreement is protected to the greatest extent feasible.

D. Notify Covered Entity within twenty-four (24) hours of Business Associate’s discovery of any potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this Agreement, including any Breach of PHI.

(1) Any incident as described above will be treated as discovered as of the first day on which such event is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate.

(2) Notification shall be sent to the Selina Bland, CPM Privacy/FOIA Officer, selina.bland@va.gov and to the VHA Health Information Access Office, Business Associate Program Manager by email at VHABAAIssues@va.gov.

(3) Business Associate shall not notify individuals or the Department of Health and Human Services directly unless Business Associate is not acting as an agent of Covered Entity but in its capacity as a Covered Entity itself.

E. Provide a written report to Covered Entity of any potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this Agreement, including any Breach of PHI, within ten (10) business days of the initial notification.

(1) The written report of an incident as described above will document the following:

(a) The identity of each Individual whose PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, disclosed, modified, or destroyed;

(b) A description of what occurred, including the date of the incident and the date of the discovery of the incident (if known);

(c) A description of the types of secured or unsecured PHI that was involved;

(d) A description of what is being done to investigate the incident, to mitigate further harm to Individuals, and to protect against future incidents; and

(e) Any other information as required by 45 C.F.R. §§ 164.404(c) and 164.410.

(2) The written report shall be addressed to:

Ms. Selina Bland, CPM, VHA Privacy/FOIA Officer of Columbia, VA Health Care System, 6439 Garners Ferry Road, Columbia, SC and submitted by email to Selina.bland@va.gov and to the VHA Health Information Access Office, Business Associate Program Manager at VHABAAIssues@va.gov.

F. To the greatest extent feasible, mitigate any harm due to a Use or Disclosure of PHI by Business Associate in violation of this Agreement that is known or, by exercising reasonable diligence, should have been known to Business Associate.

G. Use only contractors and Sub-contractors that are physically located within a jurisdiction subject to the laws of the United States, and ensure that no contractor or Sub-contractor maintains, processes, uses, or discloses PHI in any way that will remove the information from such jurisdiction. Any modification to this provision must be approved by Covered Entity in advance and in writing.

H. Enter into Business Associate Agreements with contractors and Sub-contractors as appropriate under the HIPAA Rules and this Agreement. Business Associate:

(1) Must ensure that the terms of any Agreement between Business Associate and a contractor or Sub-contractor are at least as restrictive as Business Associate Agreement between Business Associate and Covered Entity.

(2) Must ensure that contractors and Sub-contractors agree to the same restrictions and conditions that apply to Business Associate and obtain satisfactory written assurances from them that they agree to those restrictions and conditions.

(3) May not amend any terms of such Agreement without Covered Entity’s prior written approval.

I. Within five (5) business days of a written request from Covered Entity:

(1) Make available information for Covered Entity to respond to an Individual’s request for access to PHI about him/her.

(2) Make available information for Covered Entity to respond to an Individual’s request for amendment of PHI about him/her and, as determined by and under the direction of Covered Entity, incorporate any amendment to the PHI.

(3) Make available PHI for Covered Entity to respond to an Individual’s request for an accounting of Disclosures of PHI about him/her.

J. Business Associate may not take any action concerning an individual’s request for access, amendment, or accounting other than as instructed by Covered Entity.

K. To the extent Business Associate is required to carry out Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the provisions that apply to Covered Entity in the performance of such obligations.

L. Provide to the Secretary of Health and Human Services and to Covered Entity records related to Use or Disclosure of PHI, including its policies, procedures, and practices, for the purpose of determining Covered Entity’s, Business Associate’s, or a Sub-contractor’s compliance with the HIPAA Rules.

M. Upon completion or termination of the applicable contract(s) or agreement(s), return or destroy, as determined by and under the direction of Covered Entity, all PHI and other VA data created or received by Business Associate during the performance of the contract(s) or agreement(s). No such information will be retained by Business Associate unless retention is required by law or specifically permitted by Covered Entity. If return or destruction is not feasible, Business Associate shall continue to protect the PHI in accordance with the Agreement and use or disclose the information only for the purpose of making the return or destruction feasible, or as required by law or specifically permitted by Covered Entity. Business Associate shall provide written assurance that either all PHI has been returned or destroyed, or any information retained will be safeguarded and used and disclosed only as permitted under this paragraph.

N. Be liable to Covered Entity for civil or criminal penalties imposed on Covered Entity, in accordance with 45 C.F.R. §§ 164.402 and 164.410, and with the HITECH Act, 42 U.S.C. §§ 17931(b), 17934(c), for any violation of the HIPAA Rules or this Agreement by Business Associate.

4. Obligations of Covered Entity. Covered Entity agrees that it:

A. Will not request Business Associate to make any Use or Disclosure of PHI in a manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if made by Covered Entity, except as permitted under Section 2 of this Agreement.

B. Will promptly notify Business Associate in writing of any restrictions on Covered Entity’s authority to use or disclose PHI that may limit Business Associate’s Use or Disclosure of PHI or otherwise affect its ability to fulfill its obligations under this Agreement.

C. Has obtained or will obtain from Individuals any authorization necessary for Business Associate to fulfill its obligations under this Agreement.

D. Will promptly notify Business Associate in writing of any change in Covered Entity’s Notice of Privacy Practices, or any modification or revocation of an Individual’s authorization to use or disclose PHI, if such change or revocation may limit Business Associate’s Use and Disclosure of PHI or otherwise affect its ability to perform its obligations under this Agreement.

5. Amendment. Business Associate and Covered Entity will take such action as is necessary to amend this Agreement for Covered Entity to comply with the requirements of the HIPAA Rules or other applicable law.

6. Termination.

A. Automatic Termination. This Agreement will automatically terminate upon completion of Business Associate’s duties under all underlying Agreements or by termination of such underlying Agreements.

B. Termination Upon Review. This Agreement may be terminated by Covered Entity, at its discretion, upon review as provided by Section 9 of this Agreement.

C. Termination for Cause. In the event of a material breach by Business Associate, Covered Entity:

(1) Will provide an opportunity for Business Associate to cure the breach or end the violation within the time specified by Covered Entity, and;

(2) May terminate this Agreement and underlying contract(s) if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity.

D. Effect of Termination. Termination of this Agreement will result in cessation of activities by Business Associate involving PHI under this Agreement.

E. Survival. The obligations of Business Associate under this Section shall survive the termination of this Agreement as long as Business Associate creates, receives, maintains, or transmits PHI, regardless of whether a compliant Business Associate Agreement is in place.

7. No Third-Party Beneficiaries. Nothing expressed or implied in this Agreement confers any rights, remedies, obligations, or liabilities whatsoever upon any person or entity other than Covered Entity and Business Associate, including their respective successors or assigns.

8. Other Applicable Law. This Agreement does not abrogate any responsibilities of the parties under any other applicable law.

9. Review Date. The provisions of this Agreement will be reviewed by Covered Entity every two years from Effective Date to determine the applicability and accuracy of the Agreement based on the circumstances that exist at the time of review.

10. Effective Date. This Agreement shall be effective on the last signature date below.

Department of Veterans Affairs COMPANY/ORGANIZATION Veterans’ Health Administration

COLUMBIA, VA HEALTH CARE SYSTEM

By: Brenda S Currier By:

Name: Name:

Title: Contracting Officers Representative Title:

Date: March 19, 2021 Date: