36C25918Q9515-000.docx

FedBizOpps Sources Sought Notice

CLASSIFICATION CODE

SUBJECT

CONTRACTING OFFICE'S

ZIP-CODE

SOLICITATION NUMBER

RESPONSE DATE (MM-DD-YYYY)

ARCHIVE

DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS

SET-ASIDE

NAICS CODE

CONTRACTING OFFICE

ADDRESS

POINT OF CONTACT

(POC Information Automatically Filled from User Profile Unless Entered)

DESCRIPTION

See Attachment

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

GENERAL INFORMATION

PLACE OF PERFORMANCE

* = Required Field FedBizOpps Sources Sought Notice Rev. March 2010 R AN-98 Home Health Pricing 80111 36C25918Q9515 04-18-2018 N 524291 Department of Veterans Affairs Network Contracting Office

NCO 19

6162 South Willow Drive, Suite 300 Greenwood Village CO 80111 Erica A Blake erica.blake@va.gov Department of Veterans Affairs CBO Field Office 3773 Cherry Creek North Drive Suite 495 Denver, CO 80209 United States erica.blake@va.gov erica.blake@va.gov

Office: SAO West

Response Date:

April 18, 2018 @ 4PM EST

Original Set Aside:

100% SDVOSB/VOSB

Classification Code:

R499 – Professional Services

NAICS Code:

524291 – Claims Adjusting

Size Standard:

$20.5 Million

SYNOPSIS

THIS IS NOT A SOLICITATION: This is a Sources Sought notice utilizing simplified acquisition procedures allowed by FAR Part 13.5 to conduct market research IAW FAR Part 10. This Sources Sought is issued solely for informational planning purposes only and does not constitute a Request for Quote (RFQ) or any promise to issue a RFQ or commit the Government to a contract for any supply or service. The Department of Veteran Health Administration (VHA) is not seeking proposals now and will not accept unsolicited costs incurred in response to this Sources Sought. All costs associated with responding to this Source Sought shall be at the interested vendor’s expense. Not responding to this Sources Sought does not preclude participation in any future RFQ, if any is issued. Any information submitted by respondents to this Sources Sought is strictly voluntary. All submissions shall become the property of the VA and shall not be returned. This announcement is based upon the best information available and is subject to future modification.

Contracting Office Address:

Network Contracting Office 19 Rocky Mountain Acquisition Center 6162 South Willow Drive, Suite 300 Greenwood Village, CO 80111

Point of Contact:

Erica A Blake / erica.blake@va.gov

OVERVIEW

The Department of Veterans (VA), Veteran’s Health Administration (VHA) Office of Community Care (OCC) is looking to establish a contract with a contractor that can receive and price outpatient electronic web portal Home Health (HH) and Purchased Skilled Home Care (PSHC) claims pricing from any VHA facility; utilizing, Medicare (CMS) fee schedules within five seconds. This contract supports the AN-98 regulatory change to 38 CFR 17.56 and affects changes to outpatient healthcare claims for over 10,000 HH and PSHC providers who do not have existing negotiated contracts with VA.

Please respond to this Sources Sought if your company can perform this requirement in accordance with FAR Part 52.219-14 Limitations on Subcontracting (Nov 2011).

As prescribed in 19.508(e) or 19.811-3(e), insert the following clause:

Limitations on Subcontracting (Nov 2011)

(a) This clause does not apply to the unrestricted portion of a partial set-aside.

(b) Applicability. This clause applies only to—

(1) Contracts that have been set aside or reserved for small business concerns or 8(a) concerns;

(2) Part or parts of a multiple-award contract that have been set aside for small business concerns or 8(a) concerns; and

(3) Orders set aside for small business or 8(a) concerns under multiple-award contracts as described in 8.405-5 and 16.505(b)(2)(i)(F).

(c) By submission of an offer and execution of a contract, the Offeror/Contractor agrees that in performance of the contract in the case of a contract for—

(1) Services (except construction). At least 50 percent of the cost of contract performance incurred for personnel shall be expended for employees of the concern.

(2) Supplies (other than procurement from a nonmanufacturer of such supplies). The concern shall perform work for at least 50 percent of the cost of manufacturing the supplies, not including the cost of materials.

(3) General construction. The concern will perform at least 15 percent of the cost of the contract, not including the cost of materials, with its own employees.

(4) Construction by special trade contractors. The concern will perform at least 25 percent of the cost of the contract, not including the cost of materials, with its own employees.

(End of clause)

SPECIFIC RESPONSE INSTRUCTIONS

Please submit your Sources Sought response in accordance with the following:

1) No more than 25 pages (excluding transmittal page). Include the name, email address and phone number of the appropriate representative of your company;

2) Submit your response via email to Erica A. Blake / erica.blake@va.gov

3) Submit your response by 4:00 P.M. (EST) on April 18, 2018;

4) Mark your response as “Proprietary Information” if the information is considered business sensitive; and

5) NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS SOURCES SOUGHT. The Government will not review any other information or attachments included, that are more than the page limit.

INFORMATION REQUESTED FROM INDUSTRY

In response to the Sources Sought, interested contractors shall submit the following information:

1. Company Information/Socio-Economic Status

a. Provide your company size and POC information

b. The VA is utilizing NAICS Code 524291 – Claims Adjusting that has a size standard of $25 Million. Please identify any other NAICS codes your company believes would better represent this scope of work that is included in the attached Performance Work Statement (PWS).

c. Indicate whether your company, Sub-Contractors, teaming partners, joint ventures have a Federal Socio-Economic Status, e.g., Small Business, Service-Disabled Veteran Owned Small Business, Veteran Owned Small business, Women-Owned Small Business, Disadvantaged Small business, and Hub Zone. If Service Disabled or Veteran Owned Small business, is your company and or partners registered in VA’s VetBiz repository?

d. Provide the following information on a maximum of 3 similar projects dealing with the services listed in the PWS. All projects referenced must have been completed within the last 3 years for which the responder was a prime or subcontractor.

1. The name, address, and value of each project

2. The Prime Contract Type, Firm Fixed-Price, Cost Reimbursement or Time and Material

3. The name, telephone and address of the owner of each project

4. A description of each project, including difficulties and successes

5. Your company’s role and services provided for each project.

e. Provide an overview of proposed solution(s); including, a description of the capabilities/qualification/skills your company possesses for each of the below statements:

1. Assessment of capabilities to perform requirements noted in the Sources Sought

2. Assessment of the types of changes required to accomplish the goals.

3. Approach to be utilized to develop necessary changes to the systems to meet the organizational goals

4. Draft schedule to complete necessary changes.

f. Provide a description of teaming partners, and/or joint ventures that your company would consider performing work.

1. Provide your commercial price history and rough order of magnitude for the same or comparable services

2. Provide any other relative information.

3. Identify the federal contract vehicles

4. Provide GSA contract number with dates of contract.

PERFORMANCE WORK STATEMENT

Department of Veteran Affairs Veteran’s Health Administration Office of Community Care AN-98 Home Health Pricing Sole Source Bridge Contract

1. Scope: The Department of Veterans (VA), Veteran’s Health Administration (VHA) Office of Community Care (OCC) is looking to establish a contract with a contractor that can receive and price outpatient electronic web portal Home Health (HH) and Purchased Skilled Home Care (PSHC) claims pricing from any VHA facility; utilizing, Medicare (CMS) fee schedules within five seconds. This contract supports the AN-98 regulatory change to 38 CFR 17.56 and affects changes to outpatient healthcare claims for over 10,000 HH and PSHC providers who do not have existing negotiated contracts with VA.

The contractor shall price PSHC claims that contain CMS Health Insurance Prospective Payment System (HIPPS) codes; complying with applicable CMS guidelines for the HIPPS methodology and have the ability to process between five to eight-thousand eligible HH outpatient fee claims each month for 152 Veterans Integrated Service Networks (VISN’s) within 21 regions of the United States (U.S.) and its’ U.S. territories. Claims related to services provided in foreign countries and certain services provided in the state of Alaska have been deemed third party contracts between VA Medical Centers, various providers, and 3rd party administrators under the Choice/Community Care Network and are not subject to the requirements of this contract.

The Contractor shall work with the Program Office (PO) and Contracting Officer Representative (COR) to provide HH and PSCH claims pricing. At no time shall the Contractor direct, change, or engage in the formulation of VA policy. The VA is solely responsible to review the Contractor’s recommendations and to make decisions concerning the formulation of policy.

2. Background: The VA is one of the world’s largest health care delivery organizations in the world and as a part of an integrated strategy to provide Veterans with timely access to quality health care services where all VA healthcare facilities are authorized to pay for health care services acquired from community health care providers. Services are provided to eligible Veterans from community care providers when the VA determines that medically necessary services are not available in an emergency or can be provided on a timely basis.

The VA manages the authorization, claims processing, and reimbursement for HH services through the Office of Community Care, Claims Adjudication and Reimbursement (CAR) division. The VA amended 38 CFR Section 17.56 that states that the VA cannot supersede pre-negotiated PSHC claim rates; however, all new rates must be pre-negotiated with the VA. This amendment standardized payment processing; utilizing Medicare fee schedules and prospective payment systems (PPS) for the payment of HH that had been covered by CMS.

3. Period of Performance (POP): The POP shall be from the date of award for a one 12-month base period-year period, and four consecutive 12-month option years.

4. Place of Performance: Work shall take place within a secure Veterans Affairs Network shared drive via CITRIX Access Gateway (CAG) located within 21 regions of the United States (U.S.)

5. Tasks: The contractor shall:

5.1 Provide services to administer pricing of VA outpatient claims IAW applicable CMS reimbursement pricing methodologies for HH and PSHC and shall provide:

5.1.1 Configuration of all benefits, codes, and fee schedules

5.1.2 Unstructured text data from claims

5.1.3 Medicare eligibility source files

5.1.4 Inbound EDI claim submission files for electronic claim submissions

5.1.5 Configuration of all processing/adjudication logic; including pending claims, adjustments and understandable denial code descriptions

5.1.6 Provider data demographics

6. Key General Requirements and Assumptions: The Contractor shall:

6.1 Adhere to VA security and network requirements

6.2 Maintain yearly VA training requirements for Privacy Training and Rules of Behavior

6.3 Indicate ability to maintain continuous VA network connections

6.4 Develop a detailed project plan

6.4.1 The pricing plan shall outline sufficient resource and technologies; including;

6.4.1.1 Web applications

6.4.2.1 Databases

6.4.3.1 Secured IT systems

6.5 Provide pricing reports

6.5.1 Hard copy (PDF)

6.5.2 Soft copy (RFT, HMTL, etc.)

6.6 Receive and electronically VA approved price HH and PSCH claims utilizing appropriate CMS payment system methodology.

6.7 Make changes to any applicable CMS HH PSCH fee schedule that conflicts with VA guidelines.

6.8 Provide CMS subject matter expertise when requested.

6.9 Provide the ability to differentiate between report HH and PSCH claims and the ability to differentiate between regulatory and program claims – i.e., AN-98 and Veteran Choice Program claims.

6.10 Provide monthly invoicing capability that are inputted to the contractor’s secure web portal for CMS pricing and the invoices shall:

6.10.1 List contract costs

6.10.2 Annotate proportionate HH and PSCH costs

6.10.2 Calculate the proportional HH and PSCH costs

7. Section- 508 Compliance: In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board), pursuant to Section 508(2) (A) of the Rehabilitation Act Amendments of 1998, established Information Technology accessibility standards for the Federal Government.

7.1 Section 508(a)(1) requires that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows individuals with disabilities who are Federal employees to have access to and use of information and data that is comparable to the access to and use of the information and data by Federal employees who are not individuals with disabilities; and individuals with disabilities who are members of the public seeking information or services from a Federal department or agency to have access to and use of information and data that is comparable to the access to and use of the information and data by such members of the public who are not individuals with disabilities.

7.2 The Contractor shall comply with the following technical standards:

7.2.1 - 1194.21 - Software Applications and Operating Systems

7.2.2 - 1194.22 - Web Based Intranet and Internet Information and Applications

7.2.3 - 1194.23 - Telecommunication Products

7.2.4 - 1194.24 - Video and Multimedia Products

7.2.5 - 1194.25 - Self Contained Closed products

7.2.6 - 1194.26 - Desktop and Portable Computers

7.2.7 - 1194.31 - Functional Performance Criteria

7.2.8 - 1194.41 - Information, Documentation and Support

7.3 To validate conformance to the above standards the COR shall complete the VA’s Section 508 Determination and Findings Document.

7.3.1 The VA’s Section 508 PO has developed a Conformance Validation Statement (CVS)

7.3.2 The CVS shall be completed by the responsible requiring/procurement official as part of their market research to validate the conformance of the E&IT project ((See Section ten (10) in the Section 508 Determination and Findings Document)).

7.4. If at any time the responsible requiring/procurement official finds that an exception shall apply, the Contractor shall complete and have the Section 508 EIT Exceptions Certification Document signed by the VA Section 508 Coordinator. Once the E&IT is determined to meet all applicable Section 508 standards, the E&IT is validated by the VA’s Section 508 PO in the Department’s Section 508 Testing and Training Center using the information provided by the CVS.

7.5 In the case the VA decides to purchase an application, product or service that cannot be validated for Section 508 prior to purchase, the Contractor agrees to accept all costs for ensuring conformance working with the A Section 508 PO. For future releases or upgrades all steps using the CVS are required and upon validation a signed approval shall be given to the VA Point of Contact (POC) from the VA Section 508 Coordinator.

7.6 Section 508 information is available at http://www.section508.gov/

7.7 The VA Directive and Handbook 6221, Accessible Electronic and Information Technology are posted at: http://www.va.gov/oit/ea/section508/policy.asp

8. Reporting Requirements: The Contractor shall:

8.1 Provide a monthly summary to the COR; identifying inconsistencies and irregularities that impact ongoing deliverables.

8.2 Propose modifications to the reporting requirements to the COR.

8.3 Explain, in writing, to the COR (if for any reason a deliverable cannot be met within the scheduled time frame or adherence to the established schedules cannot be met) the following:

8.3.1 Reasons for the delay

8.3.2 Modified delivery date

8.3.3 Impact on the overall project

8.3.4 A revised project plan with all adjusted dates

8.4 The COR shall brief the incident to the CO, who shall issue a response pursuant to applicable regulations.

9. Level of Effort: The Contractor is encouraged to propose a response consistent with their technical approach for accomplishment of all performance objectives/standards set forth above.

10. Performance Standards:

Each priced deliverable shall be priced independently and billed according to the CLIN structure for each contract year

PWS 11

Review and acceptance by the Government

Deliverables provided IAW the Government approved standard/frequency standard

Each metric has been established to meet mission objectives

PWS 12

Review and acceptance by the Government

Deliverables provided IAW the Government approved standard/frequency standard

11. Priced Deliverables: Each deliverable shall be priced independently and billed as for each contract year:

11.1 Monthly Home Health (HH) Claims

11.2 Monthly Purchased Skilled Home Care (PSHC) Claims

12. Non-Priced Deliverables: The below performance metrics are associated with these deliverables:

Project Plan

100% Accuracy

Submit within 15 business days of contract award

Submit list of employees (names, social security numbers, and home addresses) within 5 business days of contract award

Submit list of employees (names, phone numbers, and home addresses) within 5 business days of contract award

Submit all staff training certificates

Submitted within 15 business days of contract award

Submitted within 30 business days of contract award

Report contains progress/performance of each task, accomplishments, issues/concerns, and the following months proposed activities Submitted on the 5th business day of each month following contract award

Submit real-time pricing within 5 minutes of receipt of claim

Submit real-time pricing within 5 minutes of receipt of claim

13. Security Requirements: The Contractor shall:

13.1 Not divulge or disclose information received and/or discussed regarding data considered proprietary to other Contractors collaborating on or with this effort.

13.2 Be required to complete yearly mandated VA privacy and security training.

13.3 Be required to negotiate agreements with commercial system Contractor’s relating to non-disclosure of Contractor-proprietary information.

13.3.1 If the Contractor uses copyright or otherwise licensed software in any deliverable under this order, the Contractor shall secure unlimited use rights for the Government.

13.3.2 Forward all software licenses on to the Government within 30 business days after completion of the tasks.

13.4 Limit access to the minimum number of employees necessary to perform tasks that are considered sensitive or proprietary in nature.

13.5 Contact the COR, if the Contractor is uncertain of the sensitivity of any information obtained.

13.6 Indoctrinate all personnel employed by the Contractor and any Sub-contractors involved on their roles and responsibilities for proper handling and nondisclosure of sensitive Government or proprietary information.

13.7 Not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information.

13.8 Comply with VA and VHA Security requirements.

13.9 Have or obtain a National Agency Check with Inquiries Clearance (NACI).

14. Information System Hosting, Operation, Maintenance or Use: Outsourcing (Contractor facility, equipment or staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the Contractor's systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA Office of Cyber Security (OCS) Certification PO. Government-owned (facility or equipment) Contractor-operated systems, third (3rd) party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

15. Travel: Travel is not required or authorized.

16. Inspections and Acceptance: All reports shall be approved by the COR.

17. Contract Award Meeting: The Contractor shall not commence performance on the tasks described in the PWS until the CO has conducted a kick off meeting or has advised the Contractor that a kick off meeting has been waived. The Government shall not reimburse the Contractor for any expenses associated with preparing for or executing a kick-off meeting.

18. Changes to the PWS: Any changes to this PWS shall be authorized and approved only through written correspondence from the CO. A copy of each change shall be kept in a project folder along with any other products of the project. Costs incurred by the Contractor, through the actions of parties other than the CO, shall be borne by the Contractor alone.

19. Security and Privacy - Information and Records: The Contractor shall:

19.1 Return all information and records provided to Contractor by the VA, in whatever medium, as well as all information and documents, including drafts, emails, back-up copies, hand-written notes and copies that contain such information and records gathered or created by Contractor (collectively referred to as “VA information”) in the performance of this Contract, regardless of storage media, are the exclusive property of the VA. The Contractor shall not retain any property interest in these materials and shall not use them for any purpose other than performance of this Contract.

19.2 Provide, upon completion or termination of the Contract, all copies of any VA information that it used during work it performed of the Contract or certify that it any/all information it obtained has destroyed. Where immediate return or destruction of the information is not practicable, the Contractor shall return and/or destroy the information within thirty (30) business days of completion or termination of the Contract. All provisions of this Contract concerning the security and protection of VA information that is the subject to this Contract shall continue to apply to the VA information for as long as the Contractor retains it, regardless of whether the Contract has been completed or terminated.

19.3 Not destroy, prior to termination or completion of this Contract, any VA information received from the VA, gathered and/or created in the performance of the Contract without prior written approval by the VA.

19.4 Receive, gather, store, backup, maintain, use, disclose and/or dispose of VA information only in accordance with the terms of the Contract and any applicable federal, VA, confidentiality, security laws, regulations or policies.

19.5 Not make copies of VA information except as necessary to perform duties required of the Contract or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

19.6 Provide access only to VA information to employees, Sub-contractors, and affiliates to:

19.6.1 The extent necessary to perform the services specified of the contract.

19.6.2 Perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the Contract.

19.6.3 Individuals who first satisfy the same conditions, requirements and restrictions that are comparable VA employees shall meet to have access to the same VA information.

19.6.4 Restrictions include the same level of Background Investigations, where applicable.

19.7 Store, transport or transmit VA information only in an encrypted form, using an encryption application that meets the requirements of Federal Information Processing Standards (FIPS) 140-2 or is approved for use by the VA.

19.8 Only use or disclose, except for uses and disclosures of VA information authorized by this Contract for performance of the Contract in response to an order of a court of competent jurisdiction, or with VA’s prior written authorization. The Contractor shall refer all requests for, demands for production of, or inquiries about, VA information to the VA for response.

19.9 Include the statement, “Contractor shall not release information protected by either 38 USC 5705 or 7332 in response to a court order, and shall immediately refer such court orders to VA for response,” if VA information subject to the Contract includes information protected by 38 USC 7332 or 5705.

19.10 Promptly notify the VA, prior to any disclosure pursuant to a court order, of a court order upon its receipt by the Contractor.

19.10.1 Notify the COR by phone and provide the VA a copy of the court order by fax or e-mail within one business day.

19.10.2 If the Contractor cannot notify the VA before being compelled to produce the information under court order, the Contractor shall notify the VA of the disclosure as soon as practical and provide a copy of the court order, a description of the records provided pursuant to the court order, and to whom the Contractor provided the records to under the court order.

19.10.3 The notice shall include the following information to the extent that the Contractor knows it, if it does not show on the face of the court order: the records disclosed pursuant to the order, to whom, where, when, and for what purpose, and any other information that the Contractor reasonably believes is relevant to the disclosure.

19.10.4 If the VA determines that it is appropriate to seek retrieval of information released pursuant to a court order before Contractor notified the VA of the court order, Contractor shall assist the VA in attempting to retrieve VA information involved.

19.11 Inform the VA, by the most expeditious method available to Contractor, of any incident of suspected or actual access to, or disclosure, disposition, alteration or destruction of, VA information not authorized under this Contract (“incident”) within one hour of learning of the incident.

19.11.1 An incident includes the transmission, storage or access of VA information by Contractor or Sub-Contractor employees in violation of applicable VA confidentiality and security requirements.

19.11.2 To the extent known by the Contractor, the Contractor’s notice to the VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information was placed at risk or compromised), and any other information that the Contractor considers relevant.

19.12 Simultaneously report the incident to the appropriate law enforcement entities or jurisdiction. The Contractor, its employees, and its Sub-contractors and their employees shall cooperate with the VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violations associated with any incident.

19.13 Cooperate with the VA in any civil litigation to recover VA information, to obtain monetary or other compensation from a third (3rd) party for damages arising from any incident, or to obtain injunctive relief against any third (3rd) party arising from, or related to, the incident.

19.13.1 In addition to notifying the COR, the VA shall provide the Contractor with the name, title, telephone number, fax number and email address of the VA official to whom the Contractor shall provide all notices required by this Contract.

19.13.2 The VA has the right during normal business hours to inspect the Contractor’s facility, information technology systems and storage and transmission equipment, and software utilized to perform the Contract to ensure that the Contractor is providing for the security of VA data and computer systems in accordance with the terms of this Contract.

19.14 Receive, gather, store, backup, maintain, use, disclose and/or dispose of VA information only in compliance with all applicable FIPS and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST) concerning VA information that is the subject of this Contract. If NIST issues or updates an applicable FIPS or SP after execution of this Contract, the parties agree to negotiate in good faith to implement the FIPS or SP in this Contract.

19.15 Provide appropriate administrative, technical, and physical safeguards to ensure the confidentiality and security of the Veteran’s data and to prevent unauthorized use or access to it.

19.15.1 Sensitive VA information shall not be transmitted by remote access unless VA approved protection mechanisms are used.

19.15.2 All encryption modules used to protect VA data shall be validated by NIST to meet the current version of FIPS 140 (See http://csrc.nist.gov/cryptval/140-1/1401val.htm for a complete list of validated cryptographic modules).

19.15.3 Only approved encryption solutions using validated modules shall be used when protecting data during transmission.

19.15.4 Additional security controls are required to guard VA sensitive information stored on computers used outside VA facilities.

19.15.5 All VA data shall be stored in an encrypted partition on the hard drive and shall be encrypted with FIPS 140 validated software.

19.15.6 The application shall be capable of key recovery and a copy of the encryption keys shall be stored in multiple secure locations.

19.15.7 The Contractor agrees that the data shall not be physically moved or transmitted in any way from the site without first being encrypted and obtaining prior written approval from the VA data owner.

19.15.8 A determination by VA that the Contractor has violated any of the information confidentiality and security provisions of this Contract, including a violation of any applicable FIPS or SP, shall be a basis for VA to terminate the Contract for cause.

19.15.9 If anyone performing this Contract, including employees of Sub-contractors, accesses VA computer systems or data in the performance of the Contract, the VA shall monitor and record all such access activity.

19.15.10 If VA monitoring reveals any information of suspected or potential criminal law violations; the VA shall refer the matter to the appropriate law enforcement authorities for investigation.

19.16 Inform its employees and other individuals performing any part of this Contract that VA shall monitor their actions in accessing or attempting to access VA computer systems and the possible consequences to them for improper access, whether successful or not.

19.17 Ensure that any Sub-contractors or others acting on behalf of or for the Contractor in performing any part of this Contract inform their employees, associates or others acting on their behalf that VA shall monitor their access activities. Execution of this Contract and any sub-contractor agreement that constitutes consent to VA monitoring.

19.18 Ensure that all individuals who shall access VA data or systems in performing the Contract are appropriately trained in the applicable VA confidentiality and security requirements. The Contractor shall document those who have completed the VA training. The Contractor shall contact the COR regarding access to the required VA training.

19.19 Mitigate, to the extent practicable, any harmful effect on individuals whose VA information was accessed or disclosed in an incident.

19.20 Require Sub-contractors, agents, affiliates or others to whom Contractor provides access to VA information for the performance of this Contract to agree to the same VA information confidentiality and security restrictions and conditions that apply to the Contractor before providing access.

20. Protection of Individual Privacy: The Contractor shall:

20.1 Abide by FAR clauses 52.224-1 and 52.224.2.

20.2 Abide by FAR clauses 52.239-1 for Privacy or Security Safeguards.

20.3 Not publish or disclose in any manner, without the CO’s written consent, the details of any safeguards either designed or developed by the Contractor under this Contract or otherwise provided by the Government.

20.3.1 To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

20.3.2 If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party

20.4 Utilize only employees, Sub-contractors or agents who are physically located within a jurisdiction subject to the laws of the U.S.

20.5 Ensure that it does not use or disclose Personal Health Information (PHI) received from a Covered Entity in any way that shall remove the PHI from such jurisdiction.

20.6 Ensure that its employees, Sub-contractors and agents do not use or disclose PHI received from Covered Entity in any way that shall remove the PHI from such jurisdiction.

20.7 Ensure, if the work of the Contractor is deemed to meet the definition of research from the HHS Office of Human Research Protections (OHRP) as well as the Common Rule (38 CFR 16), then the Contractor as well as any Sub-contractors or collaborating institutions shall be covered under Federal Wide Assurances (FWA) or other assurances acceptable to the VA, and the research protocol shall be reviewed and approved by the Contractor’s Institutional Review Board (IRB) of record as well as by IRBs of the collaborating institutions.

20.7.1 Sub-contractors engaged in research shall also hold FWA’s or be covered by the Contractor’s FWA. If all the entities engaged in research are covered under one FWA with a common IRB of record then it would not be necessary to involve more than one IRB.

20.7.2 At its discretion the VA shall submit the research protocol prior to its initiation for review to a VA ad-hoc peer-review committee. This review shall be conducted to ensure that the research incorporates or takes into consideration all VA and Veteran specific concerns and issues that shall impact on the scientific rigor of the study.

20.7.3 All subjects enrolled in the research shall receive protections equivalent or greater as those required by VHA policies including VHA Handbook 1200.5 including appendixes and other applicable VHA 1200 series handbooks. If vulnerable subjects shall be entered the research, appropriate safeguards shall be in place.

20.7.4 If the research project is eligible for a Certificate of Confidentiality, one shall be obtained from NIH (http://grants.nih.gov/grants/policy/coc)

20.7.5 Recruitment of Veteran’s into research projects shall follow the recruitment plan as approved by the IRB.

20.7.5.1 The plan shall require that initial contact with the Veteran be in person or by letter prior to any telephone contact.

20.7.5.2 If a letter is sent to the Veteran it shall provide a telephone number of other means that the Veteran can use to verity the validity of the contact and the study. Social security numbers shall not be requested during a phone contact.

20.7.6 All investigators and research staff interacting with research subjects or working with identifiable health information shall receive training in the ethical conduct of human subject’s research that is equivalent to or exceeds the requirement for VA investigators and research staff. (See handbook VHA 1200.5 for the Requirements for Protections of Human Subjects in Research that is available at http://www1.va.gov/vhapublications/ViewPublication.asp?pub_ID=418).

21. Information System Security: The Contractor shall:

21.1 Ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard Contract language, conditions laws, and regulations.

21.1.1. Firewall and web servers shall meet or exceed the Government minimum requirements for security.

21.1.2 All Government data shall be protected behind an approved firewall.

21.1.3 Any security violations or attempted violations shall be reported to the VA project manager and the VHA Headquarters Information Security Officer as soon as possible.

21.2 Follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation.

22. Information System Design and Development: Information systems are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA policies developed in accordance with the Federal Information Security Management Act (FISMA), HIPAA, NIST, and related VA security and privacy control requirements for Federal Information Systems. This includes standards for the protection of electronic PHI, outlines in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 System Security Categorization (reference Appendix A of VA Handbook 6500, VA information Security Program). During the development cycle, a privacy impact assessment shall be completed, provided the COR, and approved by the VA Privacy Service in accordance with VA Privacy Impact Assessment Handbook 6500.3.

The security controls shall be designated, developed, approved by the VA, and implemented in accordance with the provisions of the VA Security System development life cycle as outlined in NIST Special Publication 800-37 and VA Handbook 6500.

The Contractor shall be required to design, develop, and operate a System of Records or individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

23. Security Training: The Contractor’s employees and Sub-contractors shall (in addition to other VA specific training):

23.1 Complete the VA's on-line Security Awareness Training Course and the Privacy Awareness Training Course annually.

23.2 Provide signed certifications of completion to the CO during each year of the Contract.

24. Contractor Responsibility: All Contractor employees who require access to VA computer systems are subject to a Background Investigation and shall receive a favorable adjudication from the VA Security and Investigations Center (SIC) (07C). The level of background security investigation shall be in accordance with VA Directive 0710 dated September 10, 2004 and is available at: http://www.va.gov/pubs/asp/edsdirec.asp (VA Handbook 0710, Appendix A, Table 1-3).

24.1 Obtain appropriate Background Investigation forms shall be provided upon Contract award, and shall completed and returned to the VA Security and Investigations Center (07C) within thirty (30) business days for processing. Contractors shall be notified by 07C when the Background Investigation has been completed and adjudicated. These requirements are also applicable to all Sub-Contractor personnel requiring the same access.

24.2 If a Background Investigation is not completed prior to the start date of the Contract, the employee shall work on the Contract while the security clearance is being processed, but the Contractor shall be responsible for the actions of those individuals they provide to perform work for the VA. If damage arises from work performed by Contractor personnel, under the auspices of the Contract, the Contractor shall be responsible for resources necessary to remedy the incident.

24.3 The investigative history for Contractor personnel working under this Contract shall be maintained in the databases of either the Office of Personnel Management (OPM) or the Defense Industrial Security Clearance Organization (DISCO). Should the Contractor use a Contractor other than OPM or Defense Security Service (DSS) to conduct investigations, the investigative company shall be certified by OPM/DSS to conduct Contractor investigations.

25. Background Investigations: The position sensitivity impact for this effort has been designated as minimal Risk and the level of Background Investigation is NACI at a cost of $392.00. Price is subject to change in accordance with OPM.

26. Contractor Responsibilities: The Contractor shall:

26.1 Bear the expense of obtaining Background Investigations. Please refer to the OPM website for further guidance at http://www.opm.gov/investigations/background-investigations.

26.2 Reimburse the VA within thirty (30) business days, if the investigation is conducted by the Office of Personnel Management (OPM) through the VA.

26.2.1 Background Investigations from investigating agencies other than OPM are permitted if the agencies possess an OPM and Defense Security Service certification.

26.2.2 The Contractor Cage Code number shall be provided to the Security and Investigations Center (07C), which shall confirm the information and advise the CO whether access to the computer systems can be authorized.

26.3 Prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and can read, write, speak and understand the English language.

26.4 Provide a list of personnel names, Social Security Numbers, addresses to the COR utilizing Attachment C.

26.5 Withdraw personnel form working under the Contract, who, when notified, have an unfavorable determination by the Government. Failure to comply with the Contractor personnel security requirements shall result in termination of the Contract for default.

26.6 Be responsible for the actions of all individuals provided to work for the VA under this Contract. If damages arise from work performed by Contractor provided personnel, under the auspices of this Contract, the Contractor shall be responsible for all resources necessary to remedy the incident.”

27. Government Responsibilities: The VA Security and Investigations Center (07C) shall provide the necessary forms to the Contractor or its employees after receiving a list of names and addresses.

27.1 Upon receipt, the VA Security and Investigations Center (07C) shall review the completed forms for accuracy and forward the forms to OPM to conduct the Background Investigation.

27.2 The VA facility shall pay for investigations conducted by the OPM in advance. In these instances, the Contractor shall reimburse the VA facility within thirty (30) business days.

27.3 The VA Security and Investigations Center (07C) shall notify the CO and Contractor after adjudicating the results of the Background Investigations received from OPM.

27.4 The CO shall ensure that the Contractor provides evidence that investigations have been completed or are in the process of being requested.

28. VA Internet and Intranet Standards: The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites. These documents contain information regarding: VA cookie use policy, privacy statements, Section 508 applicability, posting “Hot Topics”, warning notices and editorial changes.

28.1 Internet/Intranet Services Directive 6102 is posted at:

http://www.va.gov/pubs/directives/Information-Resources-Management-(IRM)/6102d.doc

28.2 Internet/Intranet Services Handbook 6102 is posted at:

http://www.va.gov/pubs/handbooks/Information-Resources-Management-(IRM)/6102h.doc

28.3 Internet/Intranet Services Handbook 6102, Change 1, is posted at: http://www.va.gov/pubs/handbooks/Information-Resources-Management-(IRM)/61021h.doc

29. Invoicing Acceptance: All payments by the Government to the Contractor shall be made in accordance with Far Clause 52.232-34 – Payment by Electronic Funds Transfer – Other Than System for Award Management. All invoices shall be submitted in arrears.

30. Contract Termination: Pursuant to FAR Clause 52.249-2 – Termination for Convenience of the Government (Fixed Price), The Government may terminate performance of work under this contract in whole or, from time to time, in part if the Contracting Officer determines that a termination is in the Government’s interest. The Contracting Officer shall terminate by delivering to the Contractor a Notice of Termination specifying the extent of termination and the effective date. The Contractor shall be paid only for the services rendered up to the point of receiving the termination notice, and then only to the extent that those services meet the requirements of this PWS.

31. Contract Administration: All inquiries and correspondence relative to the administration of the Contract shall be addressed to:

COR: Barry Brooks Telephone Number: (303) 780-4782 E-mail: Barry.Brooks2@va.gov

CO: Erica A Blake Telephone Number: (303) 712-5816 E-mail: Erica.Blake@va.gov

32. Inspection and Acceptance: All reports shall be reviewed and approved by the COR. All reports are due 30 calendar days after the contract award date.

32.1 If a document or part of a document is not translated, COR will contact the vendor to have translated at no cost to the Government or OCC.

33. Quality Assurance: The Contractor shall develop and maintain an effective quality control program in accordance with their approved Management Oversight Plan (MOP) to ensure services are performed in accordance with the PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s Quality Control Program (QCP) is the means to assure that the work complies with the requirement of the Contract. As a minimum, the Contractor shall develop QCP that address the areas identified in the Quality Assurance Surveillance Plan (QASP).

34. Performance Assessment: The Government shall evaluate the Contractor’s performance under this Contract in accordance with the QASP in a separate document. This plan is primarily focused on what the Government shall do to ensure that the Contractor has performed in accordance with the performance standards. The QASP what shall be monitored, how monitoring shall take place, who shall conduct the monitoring, and how monitoring efforts and results shall be documented.

Quality Assurance Surveillance Plan (QASP)

Department of Veteran Affairs Veteran’s Health Administration Office of Community Care AN-98 Home Health Pricing Sole Source Bridge Contract

Contract No: 36C25918C0102

Contract Description: The Department of Veterans (VA), Veteran’s Health Administration (VHA) Office of Community Care (OCC) is looking to establish a contract with a contractor that can receive and price outpatient electronic web portal Home Health (HH) and Purchased Skilled Home Care (PSHC) claims pricing from any VHA facility; utilizing, Medicare (CMS) fee schedules within five seconds. This contract supports the AN-98 regulatory change to 38 CFR 17.56 and affects changes to outpatient healthcare claims for over 10,000 HH and PSHC providers who do not have existing negotiated contracts with VA.

The contractor shall price PSHC claims that contain CMS Health Insurance Prospective Payment System (HIPPS) codes; complying with applicable CMS guidelines for the HIPPS methodology and have the ability to process between five to eight-thousand eligible HH outpatient fee claims each month for 152 Veterans Integrated Service Networks (VISN’s) within 21 regions of the United States (U.S.) and its’ U.S. territories. Claims related to services provided in foreign countries and certain services provided in the state of Alaska have been deemed third party contracts between VA Medical Centers, various providers, and 3rd party administrators under the Choice/Community Care Network and are not subject to the requirements of this contract.

Contractor’s name: Conduent Federal Solutions LLC (Hereafter Referred to as Contractor).

1. PURPOSE: Each Contractor is required to submit this document within 30 calendar days after the Contract award date that outlines how the Contractor plans to provide continued uninterrupted quality of service. This QASP provides a systematic method to evaluate performance for the stated Contract and explains the following:

a. What shall be monitored?

b. How monitoring shall take place?

c. Who shall conduct the monitoring?

d. How monitoring efforts and results shall be documented?

e. Incentives/disincentives.

This QASP does not detail how the…