36C77620R0016_1.docx

Contract Opportunity Presolicitation Notice

PRODUCT SERVICE CODE

SUBJECT

CONTRACTING OFFICE'S

ZIP-CODE

SOLICITATION NUMBER

RESPONSE DATE/TIME/ZONE

ARCHIVE

DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS

SET-ASIDE

NAICS CODE

CONTRACTING OFFICE

ADDRESS

POINT OF CONTACT

(POC Information Automatically Filled from User Profile Unless Entered)

DESCRIPTION

See Attachment

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

GENERAL INFORMATION

PLACE OF PERFORMANCE

* = Required Field Contract Opportunity Presolicitation Notice D399 Health Care Clearing House (HCCH) (#2) Revenue Transactions Processing (RTP) (VA-20-00066700) 63129 36C77620R0016 11-03-2020 10:00

EASTERN TIME, NEW YORK, USA

N 518210 Department of Veteran Affairs

PCAC-ST. LOUIS

4401-D Meramec Bottom Rd Saint Louis MO 63129 Contract Specialist John Schiffhauer john.schiffhauer@va.gov

(314) 894-6656 x65111

USA

http://WWW.Va.Gov http://WWW.Va.Gov http://WWW.Va.Gov http://WWW.Va.Gov

THIS IS A PRESOLICITATION NOTICE ONLY

The Department of Veterans Affairs (VA), Program Contracting Activity Central intends to issue a Request for Proposal (RFP) for Healthcare Clearing House (HCCH) Revenue Transaction Support Services via Solicitation Number 36C77620R0016. The solicitation will be issued as a competitive, full and open solicitation for a firm fixed price, single award, Indefinite Delivery, Indefinite Quantity (IDIQ) contract with a Maximum Ceiling of $20,000,000 with an ordering period of a 1- year base period with 4 option periods.

The Government intends to issue a solicitation on or about November 19, 2020. The required services will be procured in accordance with FAR Part 12, Acquisition of Commercial Items and FAR Part 15, Contract by Negotiation, and FAR Part 16.5, Indefinite – Delivery Contracts .

All future information regarding this acquisition, including the solicitation and any amendments will be distributed solely through the beta.sam website (https://beta.sam.gov/ ). Copies of the solicitation document and its related documents, as appropriate, will be posted at this website. Interested parties are responsible for monitoring the beta.sam website to assure that they have the most up-to-date information regarding this acquisition. Communications with anyone other than the VHA Contracting Office POC listed in this announcement are inappropriate and are not authorized during this procurement.

THIS IS NOT A FORMAL REQUEST FOR PROPOSALS UNDER FAR PART 15 OR AN INVITATION FOR BIDS UNDER FAR PART 14. IF PARTIES CHOOSE TO RESPOND, ANY COST ASSOCIATED WITH THE PREPARATION AND SUBMISSION OF DATA OR ANY OTHER COSTS INCURRED IN RESPONSE TO THIS ANNOUNCEMENT ARE THE SOLE RESPONSIBILITY OF THE RESPONDENT AND WILL NOT BE REIMBURSED BY THE GOVERNMENT.

NAICS Code 518210, Size Standard $25 million.

The Veteran’s Health Administration (VHA) Office of Community Care (OCC), Revenue Operations (RO), eBusiness Solutions Office

Work Statement for

Health Care Clearing House II (HCCH II)

HIPAA Insurance Identification and Verification

October 22, 2020 Revision 12

PERFORMANCE WORK STATEMENT

Revenue Transactions Processing

1. Scope: The Veteran’s Health Administration (VHA) Office of Community Care (OCC), Revenue Operations (RO), eBusiness Solutions Office is looking to establish a Contract with a Health Care Clearing House (HCCH) to continue to increase transaction connectivity and further decrease processing time for VHA revenue operations. The VHA OCC, as a proponent of administrative simplification, currently exchanges transactions from health care entities to third (3rd) party carriers. The Contractor shall provide support for all of VHA’s current electronic transactions across the United States and its territories. The Contractor shall assist the VHA in continuing its mission to implement electronic transactions and to support printing of standard claim forms in certain situations where electronic transmission is not feasible. As such, VHA is required to comply with the Health Insurance Portability and Accountability (HIPPA) Act of 1996 Transaction and Code Set (TCS) regulations.

The Contractor shall work with the Program Office (PO) and Contracting Officer Representative (COR) to provide connectivity for incoming and outgoing electronic transactions. At no time shall the Contractor direct, change, or engage in the formulation of VHA policy. The VHA is solely responsible to review the Contractor’s recommendations and to make decisions concerning the formulation of policy

2. Background: As a Health Care Provider, VHA has initiated a number of projects to increase the number of transactions that are completed electronically in order to comply with legislation and to facilitate administrative simplification. The VHA currently utilizes a Contractor to transmit the majority of its incoming and outgoing electronic transactions to and from the national Payer community. VHA routes these transactions through the Department of Veterans Affairs (VA) Financial Services Center (FSC) or other datacenters as specified by the VA prior to transfer to or from the HCCH. Various transaction formats are utilized, such as HIPAA Healthcare Claim (X12N- 5010 837) and National Council for Prescription Drug Program (NCPDP) transactions. VHA transactions are completed as batch and real-time transfers. The Contractor provides reports to VHA on transaction activity for reconciliation, auditing and billing purposes.

3. Tasks: The Contractor shall:

***Note: All tasks and deliverables that mention, outline or utilize the word(s) “payer” or “payers” throughout the entire PWS shall include, but are not limited to participating and non-participating payers, authorized agents and/or representatives. ***

3.1. Activation Plan: The Contractor will provide an Activation Transition Plan, to include proposed areas and tasks to cover during the Phase-In, and how many days they would anticipate would be required to complete the transition period activities (not to exceed 30 days).

3.1.1. Deliverable: Activation Transition Plan (Deliver per the instructions listed in Section 4)

3.2. Support VHA current and future electronic transaction volumes by providing access to Payers with whom VHA currently conducts electronic healthcare revenue transactions.

3.2.1. Task: Process transactions at the estimated annual volumes listed in Attachment G in the PWS.

3.2.2. Task: Process current and future transactions throughout the duration of the Contract.

3.2.3. Task: Invoice monthly and enumerate processed transactions by type and category

3.3. Establish Reconciliation and Production Failure Protocols in coordination with VA/VHA:

3.3.1. Task: Establish protocols in case of production failure.

3.3.2. Task: Provide mutually defined metrics.

3.3.3. Task: Recommend content, frequency and formats for reconciliation reports.

3.3.4. Task: Provide machine readable 837 reports for disbursement.

3.3.5. Task: Provide timely production failure notifications based on a mutually agreed priority system.

3.3.6. Task: Notify the VHA when 100% of all transactions are not processed within twenty-four (24) hours.

3.3.7. Deliverable: Develop or provide reconciliation reports. (Deliver per the instructions listed in Section 4)

3.3.8. Deliverable: Provide production failure protocol notifications to include root cause analysis, corrective action plans and future mitigation initiatives to prevent reoccurrence of failures to AITC, FSC and the Office of Community Care (OCC) within 2 hours of such failure. (Deliver per the instructions listed in Section 4)

3.3.9. Deliverable: Provide a Production Communication Plan for VA/VHA concurrence; including service and severity levels for production levels within thirty (30) business days of Contract award. (Deliver per the instructions listed in Section 4)

3.4. Coordination of System Changes:

3.4.1. Task: Notify VA/VHA’s appropriate personnel/project team or transaction team 60 days in advance of any changes to the vendor systems, applications, network, security, processes, procedures, and any other item that would impact the services provided by this contract.

3.4.2. Task: Coordinate with VA/VHA necessary testing to validate changes will not have a negative impact contractor’s service to VA/VHA.

3.4.3. Task: Obtain VA/VHA project team concurrence from all potentially affected project teams before implementing changes that may impact contractor’s services to VA/VHA.

3.4.4. Task: Provide testing results of changes made to VHA systems, within thirty (30) days of implementation date.

3.4.5. Task: Provide the VHA with transaction results, thirty (30) business days prior to the planned implementation date.

3.4.6. Task: Provide a testing environment to accommodate future versions of HIPPA and other legislative mandated transaction sets.

3.4.7. Task: Provide VHA with test-bed ability to send and receive future mandated transactions.

3.4.8. Task: Provide testing environment within thirty (30) business days of industry notification changes.

3.4.9. Deliverable: Submit notification of changes that impact assessments, thirty (30) business days prior to the planned implementation date. (Deliver per the instructions listed in Section 4)

3.5. Operational Support.

3.5.1. Deliverable: Provide the following dedicated functional area resources: Operational Support, Health Care Analysis Support, Business Analysis Support and Technical Development. Ensure pricing for these services are included as part of their transaction charge. (Deliver per the instructions listed in Section 4)

3.5.2. Deliverable: Ensure the following operation support services are provided (Deliver per the instructions listed in Section 4):

3.5.2.1. Dedicated operational support staff contact(s) that shall provide technical support for day-to-day operational activities for all transactions.

3.5.2.2. Technical support from 8:00 AM to 5:00 PM, Monday through Friday, with the exception of Federal Government holidays, covering Eastern, Central, Mountain and Pacific Time Zones. Provide a Central Point of Contact for support after regular work hours with the ability to address any production processing issues or problems or elevate to appropriate higher tier support personnel.

3.5.2.3. A copy of a schedule that allows unattended operations for the transmission and receipt of the data/transactions. The Offeror shall obtain VHA approval of the operations schedule and any subsequent changes to the schedule.

3.5.2.4. Monitor and document inbound and outbound data exchanges to identify exceptions in timing and content.

3.5.2.5. Provide on-line problem and transaction submission/response tracking systems within thirty (30) business days of Contract award.

3.5.2.6. Provide information for enhancement and systems changes at least twenty (20) business days prior to deployment.

3.5.2.7. Maintenance of ongoing Payer connections as necessary to support uninterrupted data exchange.

3.5.2.8. Hardware and software maintenance as necessary to support ongoing delivery of consistent services with minimal interruption(s).

3.5.2.9. Regular backups as necessary to support timely recovery for failed equipment and/or problem research.

3.5.2.10. A secure environment that prevents access from unauthorized physical or electronic sources, and which meets all applicable federal regulations, legislations, or laws.

3.5.2.11. Transaction processes to include reformatting, routing, encrypting and other data management processes as may be necessary to help ensure proper application of data.

3.5.2.12. Maintenance of production environment where all internal processes occur.

3.5.2.13. Monitor Payer communications and industry developments to determine changes that are applicable to the scope of these services.

3.5.2.14. Contractor agrees to utilize only contractors, subcontractors, or agents who are physically located within the jurisdiction subject to the laws of the United States. Contractor will ensure that it does not use or disclose PHI received from Department of Veterans Affairs in any way that will remove the PHI from such jurisdiction.

3.5.2.15. Provide a Help Desk service to support 3rd Party payers using the contractor clearinghouse services for VA transactions.

3.6. Health Care Transaction Services:

3.6.1. Task: Provide and support comprehensive version control for all mandated industry standards, specifically the capability to up or down code transactions to accommodate VHA industry compliant transactions regardless of Payer compliance status.

3.6.2. Task: Provide testing or certification mechanisms for validation of current batch (B) and real time (RT) transactions in the current HIPAA X12 and NCPDP versions within thirty (30) business days of award date.

3.6.3. Deliverable: Receive, process, and transmit health care transactions in HIPAA X12 and NCPDP formats, VHA approved formats, or any formats specifically acceptable for electronically-enabled Payers and agreed upon by VHA and the contractor. (Deliver per the instructions listed in Section 4)

3.6.4. Deliverable: Support and process, at a minimum, the following batch and real-time transactions and relevant code sets. (Deliver per the instructions listed in Section 4)

3.6.4.1.1. Batch Transaction: Primary, Secondary and Tertiary Professional Healthcare Claim (837) Health Care Claims (Institutional, Professional, and Dental).

3.6.4.1.2. Batch Transaction: Medicare Equivalent Remittance Advice – 835eMRA.

3.6.4.1.3. Batch Transaction: File Acknowledgements – 997 and 999.

3.6.4.1.4. Batch Transaction: Claim acknowledgement – 277CA, 277 RFAI.

3.6.4.1.5. Batch Transaction: Interchange Acknowledgements – TA1.

3.6.4.1.6. Batch Transaction: VA Proprietary file formats.

3.6.4.1.7. Real-Time Transaction: HIPAA 835/837 and 270/271 Healthcare Eligibility Inquiry and Response

3.6.4.1.8. Real-time Transaction: NCPDP Pharmacy Transactions B1, B2, B3, and E1.

3.6.4.1.9. Real-time Transaction: 278’s.

3.6.5. Deliverable: Send and receive electronic acknowledgements for X12 Interchange envelopes and standard conformance for HIPAA X12 transactions to and from VHA or its submitters. (Deliver per the instructions listed in Section 4)

3.6.6. Deliverable: Provide an acknowledgement transaction upon receipt of HIPAA mandated transactions (999). (Deliver per the instructions listed in Section 4)

3.7. Access to Payers.

3.7.1. Task: Provide connectivity to Payers

3.7.2. Task: Provide processing and transmission of transactions VHA currently employs with Payers.

3.7.3. Task: Establish a mechanism to keep the VHA's and contractor’s Payer list synchronized.

3.7.4. Task: Provide the VHA with a master list of Payer and associated identification numbers within thirty (30) business days of award.

3.7.5. Task: Maintain electronic Payer’s identifiers (ID) for all VHA connected Payers accessed.

3.7.6. Task: Ensure to add identifiers to transactions submitted by VHA where the Payer ID has been omitted.

3.7.7. Deliverable: Return Payer ID’s electronically for incorporation into Veterans Health Information Systems and Technology Architecture (VISTA) or other Electronic Health Record (EHR) applications designated by VA/VHA. (Deliver per the instructions listed in Section 4)

3.7.8. Deliverable: Provide an electronic format for uploading transactions into VISTA or other EHR applications designated by VA/VHA. (Deliver per the instructions listed in Section 4)

3.7.9. Deliverable: Maintain and provide upon request an accurate master list of Payers with their associated identification numbers, including Payers Tax Identification Numbers (TIN’s) available to VHA through either direct connection or internet. (Deliver per the instructions listed in Section 4)

3.7.10. Deliverable: Maintain the Payer dictionary, website, companion guide, and any other site used for communication about requirements/specifications within three (3) business days of any change. (Deliver per the instructions listed in Section 4)

3.8. Additional Access to Additional Payers.

3.8.1. Task: Provide connectivity to Payers currently without connection in an effort to increase number of Payers with electronic processing capability.

3.8.2. Task: Submit VA Medicare equivalent Claims to the Medicare Administrative Contractor (MAC):

3.8.3. Task: Submit VHA Medicare equivalent claims through the MAC vendor responsible for the JH & DME Medicare Administrative Contract segments, in order to receive an Explanation of Benefit (EOB) 835 file herein referred to as electronic Medicare-Equivalent Remittance Advice (eMRA).

3.8.4. Task: Submit VHA Medicare equivalent claims to the MAC and receive MRA's from Medicare with legacy Payer identifiers. Medicare, due to its relationship with VHA as a Government entity, requires that VHA continue to submit legacy Payer without NPI’s on Medicare claims.

3.8.5. Deliverable: Provide a project plan for the establishment of connectivity, processing and transmission of electronic transactions to and from these Payers upon notification of intent from the Payer. (Deliver per the instructions listed in Section 4)

3.8.6. Deliverable: Provide completed sample transaction to document correct processing of eMRA (non-payment) without NPI’s. (Deliver per the instructions listed in Section 4)

3.9. Implement Medicare-equivalent Remittance Advice (MRA).

3.9.1. Task: Implement the use of MRA data within secondary 837 transactions for additional non-primary Payers within a mutually agreed upon timeframe.

3.9.2. Task: Monitor secondary connection, identify and establish new connections and provide itemize report.

3.9.3. Deliverable: Present a project management plan within fifteen (15) business days of start of Contract that details how the secondary connection will be accomplished. (Deliver per the instructions listed in Section 4)

3.10. Print Facsimile Medicare EOB’s (eMRA).

3.10.1. Task: Extract data from Medicare 837’s submitted by VHA for the purpose of printing facsimile Medicare EOB’s to be mailed with paper secondary claims.

3.10.2. Task: Ensure all data required to print EOB’s is contained in the industry standard Professional Healthcare Claim Standard (837-5010), this requires the addition of data fields to VHA proprietary inbound maps in order to successfully print Medicare EOB’s.

3.10.3. Task: Create a mechanism to collect additional data fields required for printing of eMRA EOB’s.

3.11. Provide Paper Claims to Non-Electronic Carriers.

3.11.1. Task: Submit claims via paper media to the Payer through the postal carrier for those Payers not accepting electronic submission of health care claims.

3.11.2. Task: Ensure claim formats to be printed follow NUCC CMS 1500, NUBC UB-04 claim form standards including any pharmacy charges and drug details reported in the LIN/CTP segments, when the pharmacy claim is received in the 837P/837I.

3.11.3. Task: Print additional data on paper claims not contained in the 837.

3.11.4. Task: Ensure that Provider Social Security Numbers are not printed.

3.11.5. Task: Monitor and maintain a list of non-electronic Payers and actively pursue connectivity.

3.12. Monitor All Claims.

3.12.1. Task: Add minor claim rejection edits as needed and were applicable.

3.12.2. Task: Register facilities where rejections are due to the establishment of a new VHA facility or Community Based Outpatient Clinics (CBOC).

3.12.3. Deliverable: Provide electronic eBilling claim rejection reports. (Deliver per the instructions listed in Section 4)

3.12.4. Deliverable: Monitor and report back to VHA all 837 claim rejections. (Deliver per the instructions listed in Section 4)

3.13. Facilitate Payer Enrollment and Registration.

3.13.1. Task: Facilitate and coordinate enrollment with Payers, for all transactions.

3.13.2. Task: Completion of appropriate authorization forms and letters as required by Payer specific guidelines within a mutually agreed upon timeframe.

3.13.3. Task: Provide an updated list as new Payers are added.

3.13.4. Task: Support VHA Claims. Provide dedicated support to VHA for claims including payer relations and rejections/denials.

3.13.5. Task: Support Real Time Authorization Transactions.

3.13.6. Task: Provide ongoing support to ensure payers and utilization management organizations are supporting the use of the HIPAA X12 278 transaction. This includes establishing new payer and UMO connectivity, facilitating relationship building between HCCH, payer and VA, and resolution of issues with payers related to 278 processing.

3.13.7. Deliverable: Provide VHA access to online access to electronic claims submissions and reports. Online access should include the ability to review claim submissions by batch, date of submission or date of service, payer and /or facility and the ability to search for individual claims by date of service, date submitted, payer, facility, patient name, subscriber ID or claim number. Tool should provide the claim status of accepted or rejected with the specific rejection message(s) and provide the ability to view the information and data submitted on each claim. (Deliver per the instructions listed in Section 4)

3.14. Support Pharmacy Claims.

3.14.1. Task: Support the Pharmacy team by granting them access to the pharmacy transition database to look at individual transaction data.

3.14.2. Task: Provide access instructions to the pharmacy team and maintain a list of everyone who has received access.

3.14.3. Task: Provide Payer sheets that detail the NCDPD fields required for electronic pharmacy transactions for each Payer within 5 business days.

3.14.4. Deliverable: Submit Payer sheets within 5 business days to the project lead and the Financial Services Center (FSC) in machine readable code format for our Pharmacy Benefits Managers (PBM) and Payers. (Deliver per the instructions listed in Section 4)

4. Deliverables Specific to this Order:

Chart for the Deliverables Specific to this Order

3.1.1

Activation Transition Plan

3.3.7, 3.3.8 and 3.3.9

Establish Reconciliation & Production Failure Protocols

eInsurance, ePharmacy) at the point of failure.

3.4.9

Coordination of System Changes

ePayments, eInsurance, ePharmacy) when system change is planned

3.5.1 and 3.5.2

Operational Support

ePharmacy)

3.6.3, 3.6.4, 3.6.5 and 3.6.6

Health Care Transaction Services

eInsurance, ePharmacy)

3.7.7, 3.7.8, 3.7.9 and 3.7.10

Access to Payers

eInsurance,

3.8.56 and 3.8.67

Additional Access to Additional Payers

3.9.3

Implement Medicare-equivalent Remittance Advice (MRA).

3.12.3 and 3.12.4

Monitor Claims

Ninety-nine-point nine percent (99.9%) monthly accuracy based on VA/VHA requirements

eInsurance, ePharmacy)

3.13.7

Facilitate Enrollment and Registration

PWS 7.13

eInsurance, ePharmacy)

3.14.4

Support Pharmacy Claims

5. Governance and Key General Requirements:

The Prime Contractor and all sub-contractor(s) shall:

5.1. Be a fully “Accredited Healthcare Network” (HNAP-EHN) by the Electronic Healthcare Network Accreditation Commission (EHNAC) (www.ehnac.org) at the time of proposal submission; and maintain accreditation for the duration of the Contract. Further discussion is provided in Attachment A.

5.1.1.1. Alternately to 5.1 above, currently hold a VA Authority to Operate (ATO), at time of proposal submission and maintain VA Authority to Operate (ATO) for the duration of the Contract.

5.2. Be certified by the Council for Affordable and Quality Healthcare (CAQH) (https://www.caqh.org/core/operating-rules), as a CORE Phase II Certified trading partner for both batch and real-time HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 and 835/837 at the time of Contract Award and/or Contract Effective date whichever comes first; and maintain certification for the duration of the Contract. Further discussion is provided in Attachment A. Work towards future Committee of Operating Rules and Information Exchange and any other future phase certifications required by law within a mutually specified timeframe and or by the implantation date specified by law.

5.3. Be certified by the Council for Affordable and Quality Healthcare (CAQH) (https://www.caqh.org/core/operating-rules), as a CORE Phase III Certified trading partner for both batch and real-time HIPAA ERA and EFT transactions at the time of Contract Award and/or Contract Effective date whichever comes first; and maintain certification for the duration of the Contract. Further discussion is provided in Attachment A. Work towards future Committee of Operating Rules and Information Exchange and any other future phase certifications required by law within a mutually specified timeframe and or by the implantation date specified by law.

5.4. Work towards future Committee of Operating Rules and Information Exchange (CORE Phase IV) and other future phase certifications within a mutually specified timeframe.

5.5. Indicate their existing connectivity to Payers and provide a list of targeted Payers they are working with for future connectivity. Upon request of the COR, provide any other relevant report(s) on an as needed basis within five (5) business days unless otherwise negotiated with COR.

5.6. Provide VHA technical points of contact, as well as back-ups, for the coordination of activities associated with the transition, development, implementation and sustainment (production) phases.

5.7. Provide transaction transmission and processing service at a mutually agreed upon level which will include at a minimum; data transmission, timeliness, accuracy and system availability metrics.

5.8. Ensure connectivity between VHA and the Contractor will be a site-to-site Virtual Private Network (VPN) or other connectivity technology that meets VA security requirements for transmission of healthcare EDI transactions. Ensure data is encrypted to FIPPS IFPS 140.2 standards prior to entry into the VPN Tunnel if/when VPN is used.

5.9. Work with the Financial Services Center (FSC) and Austin Information Technology Center (AITC) or other datacenters as specified by the VA on connectivity requirements.

5.10. Attach Payer appendices to the Solicitation response.

5.11. Contractor shall support any new industry standards and transaction types by the compliance date specified in Regulations or other controlling documents or legislation.

5.12. Meet all HIPAA and Patient Protection and Affordable Care Act (PPACA) standards for HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271and will not impose non-standard transaction options for standard transactions.

5.13. Understand that an “on-line” eligibility and enrollment check performed via a web site is not a compliant HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271and is not considered a HIPAA transaction and is thus non-compliant for this effort and will not be considered.

5.14. Contractor shall support any new industry standards and transaction types by the compliance date specified in Regulations or other controlling documents or legislation.

5.15. When PII/PHI data is transferred from VA/VHA to the Health Care Clearing House (HCCH), it immediately becomes HCCH data, and the HCCH is responsible for obeying all applicable Federal Information Security Management Act (FISMA) and HIPAA rules and regulations. As a covered entity under HIPAA, HCCHs are bound by and must comply with all HIPAA requirements, including requisite Security and Health Information Technology for Economic and Clinical Health Act (HITECH) reporting requirements.

5.16. The services outlined in the PWS are considered essential to the revenue operations cycle process. Should the contractor not be able to process transactions for any reason as outlined in the PWS; contractor shall provide a backup means of processing transactions until they can resolve any connectivity issue(s).

5.17. To support continued operations, the contractor should have data reporting in place to ensure transaction volume, errors, and data is available to research transaction issues. Attachment A provides references to material VA and the Contractor utilize for operational support and transaction monitoring.

5.18. The term “processed” shall mean “Only transactions that have made it to the contractor claim processing system (exclude those that were received but somehow failed to go thru validation and following steps; exclude dups, retransmissions, and other previously described)”

5.19. An Interconnection Security Agreement (ISA)/Memorandum of Understanding (MOU) (ISA/MOU) and Business Associate Agreement (BAA) are required and contractor agrees to work with the necessary VA staff to complete these documents upon contract award and support the approval process for the ISA – MOU.

5.20. Transaction volume projections do not consider changes in Veteran demographics, impact of the economy or impact of new and/or removal of legislative initiatives or mandates imposed on VHA.

5.21. The Contractor should support VHA efforts to inform Payers of non-compliant transactions and/or data content received in HIPAA Health Care Eligibility/Benefit Inquiry and Response 270/271 835 and 837 transactions and assist VHA in ensuring Payers become compliant.

5.22. Coordinate with VA/VHA any changes to system, applications, network, security, privacy, procedure, policies, or any other item that may impact the services provided as indicated by this PWS. At least a thirty (30) day notification prior to any change shall be provided to VA/VHA and VA/VHA must concur before the change is implemented.

5.23. Cooperate and participate as necessary in FSC/VHA’s Disaster Recovery planning and testing when necessary to ensure failover operations can be maintained in the event of localized disaster affecting transaction services.

5.24. VA shall be charged only once for each successful transaction (i.e. Not charged for any transaction that times out, fails validation, rejects during processing, or are duplicates).

5.25. VA shall be charged only once for each successful HIPAA Health Care Eligibility/Benefit Inquiry 270, 271, 835, and 837 transaction (i.e. not charged for any transaction that times out, fails validation, rejects during processing, or are duplicates due to re-submission).

5.26. VA shall NOT be charged separately for any HIPAA Health Care Eligibility/Benefit Response 270, 271, 835 or 837 transaction as they are considered answers to a successful submission of a HIPAA Health Care Eligibility/Benefit Inquiry 270, 835, or 837 transaction.

5.27. VA shall be charged only once for each successful transaction (i.e. Not charged for any transaction that times out, fails validation, rejects during processing, or are duplicates).

6. Section 508 Compliance: In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board), pursuant to Section 508(2) (A) of the Rehabilitation Act Amendments of 1998, established Information Technology accessibility standards for the Federal Government.

6.1. Section 508(a)(1) requires that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows individuals with disabilities who are Federal employees to have access to and use of information and data that is comparable to the access to and use of the information and data by Federal employees who are not individuals with disabilities; and individuals with disabilities who are members of the public seeking information or services from a Federal department or agency to have access to and use of information and data that is comparable to the access to and use of the information and data by such members of the public who are not individuals with disabilities.

6.2. The Contractor shall comply with the following technical standards:

6.3. 1194.21 - Software Applications and Operating Systems

6.4. 1194.22 - Web Based Intranet and Internet Information and Applications

6.5. 1194.23 - Telecommunication Products

6.6. 1194.24 - Video and Multimedia Products

6.7. 1194.25 - Self Contained Closed products

6.8. 1194.26 - Desktop and Portable Computers

6.9. 1194.31 - Functional Performance Criteria

6.10. 1194.41 - Information, Documentation and Support

6.11. To validate conformance to the above standards the COR shall complete the VA’s Section 508 Determination and Findings Document.

6.12. The VA’s Section 508 Program Office has developed a Conformance Validation Statement (CVS).

6.13. The CVS shall be completed by the responsible requiring/procurement official as part of their market research to validate the conformance of the EIT project ((See Section ten (10) in the Section 508 Determination and Findings Document)).

6.14. If at any time the responsible requiring/procurement official finds that an exception shall apply, the Contractor shall complete and have the Section 508 EIT Exceptions Certification Document signed by the VA Section 508 Coordinator. Once the EIT is determined to meet all applicable Section 508 standards, the EIT is validated by the VA’s Section 508 PO in the Department’s Section 508 Testing and Training Center using the information provided by the CVS.

6.15. In the case the VA decides to purchase an application, product or service that cannot be validated for Section 508 prior to purchase, the Contractor agrees to accept all costs for ensuring conformance working with the VA Section 508 Program Office (PO). For future releases or upgrades all steps using the CVS are required and upon validation a signed approval shall be given to the VA Point of Contact (POC) from the VA Section 508 Coordinator.

6.16. Section 508 information is available at http://www.section508.gov.

6.17. The VA Directive and Handbook 6221, Accessible Electronic and Information Technology are posted at: VA Handbook 6221: http://www.va.gov/vapubs/viewPublication.asp?Pub_ID=435&FType=2

7. General Security Requirements: The Contractor shall:

7.1. Not divulge or disclose information received and/or discussed regarding data considered proprietary to other Contractors collaborating on or with this effort.

7.2. Be required to complete mandated VA privacy and security training.

7.3. Be required to negotiate agreements with commercial system Contractor’s relating to non-disclosure of Contractor-proprietary information.

7.4. If the Contractor uses copyright or otherwise licensed software in any deliverable under this order, the Contractor shall secure unlimited use rights for the Government.

7.5. Forward all software licenses on to the Government within thirty (30) business days after completion of the tasks.

7.6. Limit access to the minimum number of employees necessary to perform tasks that are considered sensitive or proprietary in nature.

7.7. Contact the COR, if the Contractor is uncertain of the sensitivity of any information obtained.

7.8. Indoctrinate all personnel employed by the Contractor and any Sub-Contractors involved on their roles and responsibilities for proper handling and nondisclosure of sensitive Government or proprietary information.

7.9. Not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information.

7.10. Comply with VA and VHA Security requirements.

7.11. Currently, the Contractor does not have access to each site's VistA or other EHR/RCM applications designated by VA/VHA system. VA executes appropriate internal code to gather patient names and demographic information which is then transmitted to the Contractor via customized HIPAA transaction. The Contractor shall respond to inquiries with found insurance information via customized HIPAA transaction.

8. Information System Hosting, Operation, Maintenance or Use: Government-owned (facility or equipment) Contractor-operated systems, third-party or business partner networks require memorandums of understanding and interconnection agreements (ISA-MOU) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

9. Contract Award Meeting: The Contractor shall not commence performance on the tasks described in the PWS until the CO has conducted a kickoff meeting or has advised the Contractor that a kick-off meeting has been waived. The Government shall not reimburse the Contractor for any expenses associated with preparing for or executing a kick-off meeting.

10. Changes to the PWS: Any changes to this PWS shall be authorized and approved only through written correspondence from the CO. A copy of each change shall be kept in a project folder along with any other products of the project. Costs incurred by the Contractor, through the actions of parties other than the CO, shall be borne by the Contractor alone.

11. Security and Privacy - Information and Records: The Contractor shall:

11.1. Return all information and records provided to Contractor by the VA, in whatever medium, as well as all information and documents, including drafts, emails, back-up copies, hand-written notes and copies that contain such information and records gathered or created by Contractor (collectively referred to as “VA information”) in the performance of this Contract, regardless of storage media, are the exclusive property of the VA. The Contractor shall not retain any property interest in these materials and shall not use them for any purpose other than performance of this Contract.

11.2. Provide, upon completion or termination of the Contract, all copies of any VA information that it used during work it performed of the contract or certify that it any/all information it obtained has destroyed. Where immediate return or destruction of the information is not practicable, the Contractor shall return and/or destroy the information within thirty (30) business days of completion or termination of the Contract. All provisions of this Contract concerning the security and protection of VA information that is the subject to this Contract shall continue to apply to the VA information for as long as the Contractor retains it, regardless of whether the Contract has been completed or terminated.

11.3. Do Not Destroy, any VA information received from the VA gathered and /or created in the performance of or prior to termination or completion of this contract without prior written approval by the VA .

11.4. Receive, gather, store, backup, maintain, use, disclose and/or dispose of VA information only in accordance with the terms of the contract and any applicable federal, VA, confidentiality, security laws, regulations or policies.

11.5. Not make copies of VA information except as necessary to perform duties required of the contract or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

11.6. Provide access only to VA information to employees, Sub-Contractors, and affiliates to:

11.7. The extent necessary to perform the services specified of the contract

11.8. Perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the contract.

11.9. Individuals who first satisfy the same conditions, requirements and restrictions that are comparable VA employees shall meet to have access to the same VA information.

11.10. Restrictions include the same level of Background Investigations, where applicable.

11.11. Store, transport or transmit VA information only in an encrypted form, using an encryption application that meets the requirements of Federal Information Processing Standards (FIPS) 140-2 or is approved for use by the VA.

11.12. Only use or disclose, except for uses and disclosures of VA information authorized by this Contract for performance of the Contract in response to an order of a court of competent jurisdiction, or with VA’s prior written authorization. The Contractor shall refer all requests for, demands for production of, or inquiries about, VA information to the VA for response.

11.13. Include the statement, “Contractor shall not release information protected by either 38 USC 5705 or 7332 in response to a court order and shall immediately refer such court orders to VA for response,” if VA information subject to the Task Order includes information protected by 38 USC 7332 or 5705.

11.14. Promptly notify the VA, prior to any disclosure pursuant to a court order, of a court order upon its receipt by the Contractor.

11.15. Notify the COR by phone and provide the VA a copy of the court order by fax or e-mail within one (1) business day.

11.16. If the Contractor cannot notify the VA before being compelled to produce the information under court order, the Contractor shall notify the VA of the disclosure as soon as practical and provide a copy of the court order, a description of the records provided pursuant to the court order, and to whom the Contractor provided the records to under the court order.

11.17. The notice shall include the following information to the extent that the Contractor knows it, if it does not show on the face of the court order: the records disclosed pursuant to the order, to whom, where, when, and for what purpose, and any other information that the Contractor reasonably believes is relevant to the disclosure.

11.18. If the VA determines that it is appropriate to seek retrieval of information released pursuant to a court order before Contractor notified the VA of the court order, Contractor shall assist the VA in attempting to retrieve VA information involved.

11.19. Inform the VA, by the most expeditious method available to Contractor, of any incident of suspected or actual access to, or disclosure, disposition, alteration or destruction of, VA information not authorized under this Contract (“incident”) within one (1) hour of learning of the incident.

11.20. An incident includes the transmission, storage or access of VA information by Contractor or Sub-Contractor employees in violation of applicable VA confidentiality and security requirements.

11.21. To the extent known by the Contractor, the Contractor’s notice to the VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information was placed at risk or compromised), and any other information that the Contractor considers relevant.

11.22. Simultaneously report the incident to the appropriate law enforcement entities or jurisdiction. The Contractor, its employees, and its Sub-Contractors and their employees shall cooperate with the VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violations associated with any incident.

11.23. Cooperate with the VA in any civil litigation to recover VA information, to obtain monetary or other compensation from a third-party for damages arising from any incident, or to obtain injunctive relief against any third-party arising from, or related to, the incident.

11.24. In addition to notifying the COR, the VA shall provide the Contractor with the name, title, telephone number, fax number and email address of the VA official to whom the Contractor shall provide all notices required by this Task Order.

11.25. The VA has the right during normal business hours to inspect the Contractor’s facility, information technology systems and storage and transmission equipment, and software utilized to perform the Contract to ensure that the Contractor is providing for the security of VA data and computer systems in accordance with the terms of this Contract.

11.26. Receive, gather, store, backup, maintain, use, disclose and/or dispose of VA information only in compliance with all applicable FIPS and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST) concerning VA information that is the subject of this Contract. If NIST issues or updates an applicable FIPS or SP after execution of this Contract, the parties agree to negotiate in good faith to implement the FIPS or SP in this Contract.

11.27. Provide appropriate administrative, technical, and physical safeguards to ensure the confidentiality and security of the Veteran’s data and to prevent unauthorized use or access to it.

11.28. Sensitive VA information shall not be transmitted by remote access unless VA approved protection mechanisms are used.

11.29. All encryption modules used to protect VA data shall be validated by NIST to meet the current version of FIPS 140 (See http://csrc.nist.gov/cryptval/140-1/1401val.htm for a complete list of validated cryptographic modules).

11.30. Only approved encryption solutions using validated modules shall be used when protecting data during transmission.

11.31. Additional security controls are required to guard VA sensitive information stored on computers used outside VA facilities.

11.32. All VA data shall be stored in an encrypted partition on the hard drive and shall be encrypted with FIPS 140 validated software.

11.33. The application shall be capable of key recovery and a copy of the encryption keys shall be stored in multiple secure locations.

11.34. The Contractor agrees that the data shall not be physically moved or transmitted in any way from the site without first being encrypted and obtaining prior written approval from the VA data owner.

11.35. A determination by VA that the Contractor has violated any of the information confidentiality and security provisions of this Contract, including a violation of any applicable FIPS or SP, shall be a basis for VA to terminate the Contract for cause.

11.36. If anyone performing this Contract, including employees of Sub-Contractors, accesses VA computer systems or data in the performance of the Contract, the VA shall monitor and record all such access activity.

11.37. If VA monitoring reveals any information of suspected or potential criminal law violations; the VA shall refer the matter to the appropriate law enforcement authorities for investigation.

11.38. Inform its employees and other individuals performing any part of this Contract that VA shall monitor their actions in accessing or attempting to access VA computer systems and the possible consequences to them for improper access, whether successful or not.

11.39. Ensure that any Sub-Contractors or others acting on behalf of or for the Contractor in performing any part of this Contract inform their employees, associates or others acting on their behalf that VA shall monitor their access activities. Execution of this Contract, Sub- Contractor agreement that constitutes consent to VA monitoring applies.

11.40. Ensure that all individuals who shall access VA data or systems in performing the Contract are appropriately trained in the applicable VA confidentiality and security requirements. The Contractor shall document those who have completed the VA training. The Contractor shall contact the COR regarding access to the required VA training.

11.41. Mitigate, to the extent practicable, any harmful effect on individuals whose VA information was accessed or disclosed in an incident.

11.42. Require Sub-Contractors, agents, affiliates or others to whom Contractor provides access…