36C25718Q0458-001.docx

SOUTH TEXAS VETERANS HEALTH CARE SYSTEM

PERFORMANCE WORK STATEMENT FOR

Lease of Community Based Outpatient Clinic Emergent Prescriptions

1. INTRODUCTION AND SCOPE OF WORK:

a. Introduction: South Texas Veterans Health Care System (STVHCS) is committed to providing Veteran patients served by Community Based Outpatient Clinics (CBOC’s) a way to have emergent prescription needs filled quickly near where they live to preclude the need to drive longer distances to Department of Veterans Affairs (VA) pharmacies. Once a Veteran patient’s emergent prescription need is met, subsequent refills can be provided by mail from a VA pharmacy.

(1) Background: Pharmacy requirements exist for STVHCS to provide a mechanism whereby a Veteran patient seen at a Community Based Outpatient Clinic (CBOC) without an onsite pharmacy may receive pharmacy services from a contracted Pharmacy Benefits Management (PBM) company. The PBM is expected to provide formulary management for a list of medications approved by VA Pharmacy and supply a retail pharmacy network that can fill/dispense prescriptions on an emergent basis until therapy is complete or the patient’s assigned VA Pharmacy can deliver a standard supply for continuation of therapy.

b. Scope of Work: The PBM Contractor must always provide pharmacy services for formulary management and supply a retail pharmacy network to fill/dispense emergent prescriptions up to a ten (10) days’ supply per the requirements defined in this Performance Work Statement (PWS).

The PBM Contractor must always ensure that its network retail pharmacies dispense prescriptions in accordance with VA Pharmacy program’s mandatory generic substitution policy, VHA Handbook 1108.08 (http://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=2417).

2. REQUIREMENTS:

a. Type of Contract: Indefinite delivery/indefinite quantity, firm fixed price contract with a base year and up to four option years.

b. General Requirements: General requirements are for non-personal services; contract personnel performing under this contract shall perform services under the control and general supervision of the Chief, Pharmacy Service, STVHCS and/or the Contracting Officer’s Representative (COR).

a. To provide First Fill prescriptions service for STVHCS facilities to include urgent/emergent vaccinations at a flat administration injection fee.

b. To provide Emergency prescriptions services up to thirty (30) days’ supply for VISN 17 facilities.

c. Specific Requirements:

(1) The contractor will provide qualified personnel who will fulfill the requirement to provide pharmacy services to include urgent/emergent vaccinations with a flat administration of injection fee enabling STVHCS to provide such services at a high level of quality.

(2) Services shall include the formulary management and dispensing of pharmaceuticals reflected on the STVHCS urgent/emergent pharmaceutical formulary listing as prescribed by authorized CBOC staff. CBOC providers prescribing urgent/emergent medications for Veterans from the formulary listing will complete a VA Initial Fill Certificate that will contain the Veteran’s full name, and a 9-digit identifier consisting of the last four digits of his/her Social Security Number, the first letter of his/her last name, and his/her four-digit birth year. The Veteran will take this certificate to a local contracted retail pharmacy to have the urgent/emergent prescription filled.

(3) The Contractor’s network retail pharmacies must always follow established clinical protocol for registration of new patients to determine a Veteran’s allergy and previous drug history.

(4) The Contractor must establish procedures that include instructions for prescribing a maximum ten (10)-day supply of medication(s) without refills when it is determined medically urgent/emergent by the CBOC providers. Retail pharmacy network prescriptions that are not dispensed to the Veteran must always be reversed seven (7) days after the date they were filled. The network retail pharmacies must always provide Veterans the same quality of services provided to beneficiaries of other commercial clients, to the extent allowed by federal law/regulation and this contract.

(5) The Contractor must always ensure that all pharmacy documents, and the receipt of the medication by the Veteran or the individual authorized by the Veteran, are in accordance with all applicable state and federal laws. The Contractor must always ensure that network retail pharmacies have procedures to reasonably assess the validity of prescriptions ordered by fax, telephone, and e-prescribing.

3. Period of Performance:

a. Base Year: April 1, 2018 through March 31, 2019 with up to four (1) Option Year as indicated below.

b. Option Year One: April 1, 2019 through March 31, 2020

4. REFERENCES:

a. Federal Standards and Guidance:

(1) The Health Insurance Portability and Accountability Act (HIPAA) of 1996,Computer Security Act of 1987, Public Law 10-235

(2) OMB Circular A-123 – “Internal Control Systems”

(3) OMB Circular A-130 – “Management of Federal Information Resources,” Appendix III, “Security of Federal Automated Information Resources”

(4) 5 U.S.C. 552a, Privacy Act of 1974, 5 United States Code 552a, Public Law 99-08.

(5) 5 U.S.C. 552, Freedom of Information Act, 5 United States Code 552, Public Law

(6) 18 U.S.C. 1030 (a) (3), Fraud and related activity in connection with computers.

(7) Electronic Communications Privacy Act of 1986, Public Law 99-08, 100 Stat. 1848.

b. Agency Policy and Guidelines:

(1) VA Directive 6210, “Automated Information Systems (AIS) Security Procedures”

(2) VA Directive 6214, “Information Technology Security Certification and Accreditation Program”

c. Local Policies:

(1) STVHCS Policy Memo IT-11-01, Internet Guidelines

(2) STVHCS Policy Memo IT-11-04 Modems

(3) STVHCS Policy Memo IT-12-07, Service Level Automated Information Systems

(4) STVHCS Policy Memo 001-12-06, Remote VPN Access

(5) STVHCS Policy Memo 003-11-04, Automated Information Systems (AIS)

(6) STVHCS Policy Memo 003-14-10, Information Security Program Policy

(7) STVHCS Policy Memo 003-10-11, Information Systems Security Incident Reporting

(8) STVHCS Policy Memo 003-10-12, Sensitive Record Access and Tracking

4. SCHEDULE OF DELIVERABLES: The Contractor must always be prepared to comply with requests for information, including those originating from Congress, using company letterhead, complete sentences, and professional English. The Contractor must always comply with the request of Government and independent auditors during audits of this contract and all associated contract documentation, including but not limited to, invoices and medical records.

a. Delivery Address

Deliverables must always be submitted to the COR designated in the COR appointment letter, unless otherwise specified in the PWS.

b. Method of Delivery

Electronic copies must always be delivered using Microsoft Office suite of tools (for example, Word, Excel, PowerPoint, Project, or Access format) unless otherwise specified in the PWS or by the CO/COR.

c. Government Acceptance

The COR will have (10) business days after receipt to review deliverables, notate deficiencies, or make other comments. The Contractor must always have five (5) business days after receipt of returned deliverables to make corrections. Upon receipt of the resubmitted deliverables, the COR will have five (5) business days for final review prior to acceptance or providing documented reasons for rejection for failure to comply with Contract requirements. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor must always have five (5) business days to correct the rejected deliverable and return it per delivery instructions.

d. Schedule of Deliverables

Monthly deliverables must always be delivered on the 10th day after the end of the previous month, unless otherwise specified in the PWS.

Quarterly deliverables: VA’s fiscal year begins October 1 and ends on September 30. The initial quarterly deliverable will be delivered on the 15th day of VA Fiscal quarter following SCHD.

Task

5. QUALITY ASSURANCE SURVEILLANCE PROGRAM (QASP): The contractor will ensure quality pharmacy services are provided timely, by qualified and competent staff, and that any related PHI and EPHI is safe-guarded always in accordance with VA requirements.

6. SECURITY CONSIDERATIONS: Safeguarding PHI and EPHI is a primary concern for VA staff and must be a primary concern for contractor personnel providing services under this contract. The contractor will ensure that should contractor personnel cause and/or identify a breach of PHI or EPHI, such will be reported immediately to the Chief, Pharmacy Service, South Texas Veterans Health Care System and/or the COR.

7. PRIVACY INFORMATION: The C&A requirements do not apply, and a Security Accreditation Package is not required.

a. Information Systems Officer, Information Protection: The contractor will not have access to VA Desktop computers, nor will they have access to online resources belonging to the government while conducting services.

b. Privacy Officer: The contractor will have access to Veterans’ patient health information in the form of a Veteran’s full name, a 9-digit identifier consisting of the last four digits of his/her Social Security Number, first letter of his/her last name, and four-digit birth year provided by the VA CBOC via a hardcopy initial prescription fill certificate. The contractor will not have the capability of accessing other patient information during the services provided to the VA.

(1) SECURITY INCIDENT INVESTIGATION

(a) The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

(b) To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

(c) With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

(d) In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

(2) LIQUIDATED DAMAGES FOR DATA BREACH

(a) Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

(b) The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

(c) Each risk analysis shall address all relevant information concerning the data breach, including the following:

(b) data elements involved, including any PII, such as full name, social security number date of birth, home address, account number, disability code;

5. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(d) Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $31.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

c. Records Manager:

(1) Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

(2) Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

(3) Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

(4) Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

(5) Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

(6) The Government Agency owns the rights to all data/records produced as part of this contract.

(7) The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

(8) Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

(9) No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

(10) Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

8. CONTRACT DOCUMENTS, EXIBITS, OR ATTACHMENTS

a. VISN 17 Locations and POC contact information.

Disaster Response Protocols PBM Contractor Contacts:

Customer Care – XXX-XXX-XXXX

Normal Operating Hours

Disaster Response Operating

Disaster Response Account Manager

Plan Parameters:

If you receive a call from the VISN or Retail Pharmacist:

Q: What are the criteria for a veteran who needs a non-emergent prescription refill or new prescription?

A: Veterans should contact their home VA to provide updated address information, and request refills/renewals as they normally would. For any veteran unable to reach their home VA they should call the PBM Contractor at 1-XXX-XXX-XXXX

Q: What are the criteria for re-filling urgent medications?

A: At this time, the criteria for filling these emergency fills and refills are:

1. Veteran must have either:

a. An empty vial of medications from a VA Pharmacy that is not older than 6 months and it indicates there are refills available.

b. A new prescription on a valid VA prescription form.

2. The medication is not a controlled substance

3. Veteran must present a valid ID that confirms they are the person to whom the vial or prescription belongs.

Q: How many days’ supply will be given?

A: PBM Contractor will confirm that the pharmacy is not to dispense more than a 30-day supply of any medication.

Q: What if the Veteran doesn’t have a current vial, how can he/she get refills?

A: The veteran should go to the nearest VA facility for assistance. If the veteran cannot access a VA facility, the retail pharmacy may call PBM Contractor Customer Care Center (XXX-XXX-XXXX) and a representative will provide the retail pharmacist the proper certificate number, all processing information (BIN#, etc.), and the number to a VA Pharmacist to verify drug and criteria over the phone to dispense those prescriptions.

Q: What is the number to reach a VA Pharmacist directly? (DO NOT GIVE THIS OUT TO VETERANS OR PHARMACIES)

210-379-3344 (cell)

TBD

Q: What is the number to reach a VA Pharmacist?

A: Veteran should call STVHCS Pharmacy Refill line at 1-800-209-7377 and talk to a representative. The veteran will receive a phone call from the pharmacy by the next duty day.

Q: Where is your network? Where do I send the veteran to get refills?

A: PBM Contractor has opened our pharmacy network to include any big chain drug stores within its retail pharmacy network. All they will need is their ID card and the old prescription vial. The Pharmacist will call our toll-free number to get the information needed to fill the request.

Q: I am trying to process a refill request and am having trouble with the information. Is there special processing information I need?

A: Yes, all claims processed during this emergency program are to be processed using the following certificate and group number.

a. Submit claims to _________

b. BIN# ______

c. Person Code ___

d. RXGRP# ___________

e. Processor Control # _______

Q: I have a prescription for a controlled substance. Are you able to help me fill that?

A: Unfortunately, all controlled substance prescriptions must go through the appropriate VAMC Emergency Department

If you receive a call from a Veteran:

Q: I am trying to fill my urgent prescription, where can I go?

A: You can take your prescription bottle to any big chain drug stores within the retail pharmacy network. All they will need is your ID card and the old prescription bottle to fill the prescription as long as it is emergent. The Pharmacist will call our toll-free number to get the information needed to fill the request.

Q: I can’t find my old prescription bottle. How can I refill my medications?

A: If the veteran cannot access a VA facility, the retail pharmacy may call the PBM Contractor Customer Care Center (XXX-XXX-XXXX) and a representative will provide the retail pharmacist the proper certificate number, all processing information (BIN#, etc.), and the number to a VA Pharmacist to verify drug and criteria over the phone to dispense those prescriptions.

Group Numbers affected:

b. Attachment 1 Approved Medication List for Urgent-Emergent Drug Formulary

V171STVHCS - Drug Coverage

Flag for OTC

otc

5-day supply limit

WARFARIN NA SOLUTION

Zostavax Vaccination Vial 19400 Unit