TeleRadiology PWS draft.docx

Billings Area Performance Work Statement (PWS) for Non-Personal Services

Tele-Radiology Services

Table of Contents

Section

Page

General Introduction The IHS has a requirement for Tele-Radiology interpretation services for Indian Health Service facilities at Billings area Service Units.

The services include interpretation of Radiology (DR) images including, but not limited to Cat Scan, Ultrasound, General X-ray, and Mammography.

All Billings Area Service Unit Locations: Crow Hospital, Pryor Health Station, Lodge Grass Health Center, Northern Cheyenne Health Center, Fort Belknap Hospital, Hays Health Center, Poplar Health Center, Wolf Point Health Center, Blackfeet Hospital, Heart Butte Health Station, and Little Shell Health Center, provide medical services Monday through Friday on an ambulatory basis. Additionally, three Service Units; Crow Hospital Fort Belknap Hospital, and Blackfeet Hospital provide inpatient and emergency medical services, 24 hours a day, 7 days a week plus Northern Cheyenne Health Center is a 24/7 urgent care facility.

The purpose of this contract is for the interpretation of digital (or digitized) radiology studies. The Contractor shall furnish the necessary personnel, supplies, materials, and equipment {The Contractor shall interface with Government furnished Image Archive and PACS (Picture Archiving and Communication System) communications platform(s) to perform this contract.

The Contractor shall provide routine and emergency interpretation of Radiology (DR) images through Tele-Radiology. The Contractor’s performance will be evaluated in accordance with the standards set forth in the Performance-Based Matrix, Section 16.

Applicable Documents The Joint Commission http://www.jointcommission.org Centers for Medicare and Medicaid Services (CMS) Standards. http://www.cms.gov Health Insurance Portability and Accountability Act (HIPAA) of 1996. http://www.ihs.gov/AdminMngrResources/HIPAA/index.cfm?module=elec_reading_room Privacy Act of 1974. http://www.ihs.gov/AdminMngrResources/HIPAA/index.cfm?module=elec_reading_room Computer Security Act of 1987. https://www.congress.gov/bill/100th-congress/house-bill/145 IHS Information Technology and Records Security and Safeguard Policies. http://www.ihs.gov/generalweb/helpcenter/webmaster/standards/information%20system.htm IHS Computer Security Directives. http://www.ihs.gov/cio/securityawareness/index.cfm IHS Director’s initiatives. http://www.ihs.gov DICOM. http://medical.nema/org/ American Cardiology of Radiology. http://www.acr.org/s_acr/index.asp HHS Information Security Program Policy. http://www.hhs.gov/read/irmpolicy/121504.html HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook, dated February 1, 2005. http://www.knownet.hhs.gov/acquisition/pssh.pdf HHS HSPD-12 Policy Document, v. 2.0. http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf

Definitions Blinded Over-Readings: The second interpretation of an imaging study during the peer review process, which is used to confirm accuracy.

Contracting Officer (CO): A Government employee authorized and warranted to issue contracts, and to make subsequent modification(s). The CO has full authority to make determinations on all changes and disputes regarding the contract.

Contracting Officer’s Representative (COR): A Government employee who assists the ordering/issuing activity contracting officer in the administration of task orders issued under the contract. The COR is primarily responsible for the day-to-day program management of ordering activity’s task orders. Ordering activity may have different designators for this category (e.g., GTR – Government Technical Representative, COTR – Contracting Officer’s Technical Representative, or PO - Project Officer).

Contractor: The individual awarded a legal binding contract to provide Tele-Radiology and interpretation services.

Credentialing: The process of verifying information about providers/physicians to ensure legitimacy and experience from the time they receive their degree until they apply at your facility. Credentialing is an activity that may be broken into three distinct phases:

Data gathering, verification, storage, dissemination and recommendation to the CMO Analysis of collected information and development of a recommendation (CMO to the Medical Staff) Decision-making based upon recommendations (governing body) DICOM: Diagnostic Imaging Communication in Medicine.

Digital mammography: Digital mammography image.

Federal Acquisition Regulation (FAR): The FAR is the primary regulation for use by all Federal Executive agencies in their acquisition of supplies and services with appropriated funds.

Health Center: A facility physically separated from a hospital, with a full range of ambulatory services including at least primary care physicians, nursing, laboratory, and x-ray which are available at least 40 hours a week for outpatient care.

HL7 format: Health Level Seven is one of several American National Standards Institute. “Level Seven” refers to the highest level of the International Standards Organization’s (ISO) communications model for Open Systems Interconnection (OSI) – the application level. The application level addresses definition of the data to be exchanged, the timing of the interchange, and the communication of certain errors to the application. The seventh level supports such functions as security checks, participant identification, availability checks, exchange mechanism negotiations and, most importantly, data exchange structuring.

Hospital Representative: An employee designated (by the Contracting Officer) to be the primary contact at a facility. The Hospital Representative is authorized to contact the Contractor regarding problems and/or issues involving the day-to-day operations of the facility. This person does not have the authority to modify or make changes to the contract. This right is reserved solely for the Contracting Officer.

Ordering Activity: An authorized user of IHS that may issue a task order to obtain required services under this contract.

Ordering Activity Contracting Officer: A Government employee of the IHS, who is authorized and warranted to issue task orders and make subsequent task order modification(s) under this contract. The Ordering Activity CO has the authority to make initial determinations on all matters of dispute regarding task orders.

PACS: Picture Archiving and Communication System Past Performance Information: Relevant information regarding a contractor’s actions under previously awarded contracts. This includes the contractor’s record of conformance to specifications and to standards of good workmanship; the contractor’s record of containing and forecasting costs on any previously performed cost reimbursable contracts; the contractor’s adherence to contract schedules, including the administrative aspect of performance; the contractor’s history for reasonable and cooperative behavior and commitment to customer satisfaction; and generally, the contractor’s business-like concern for the interest of the customer.

Peer Review: Quality assurance conducted by the Contractor to ensure accurate interpretations are performed by radiologists.

Performance-based Services Contracting (PBSC): Contracts which structure all aspects of an acquisition around the purpose of the work to be performed with the contract requirements set forth in clear, specific, and objective terms with measurable outcome as opposed to either the manner by the work is to be performed or broad and imprecise statement of work.

Quality Assurance Surveillance Plan (QASP): A written document prepared and used by the government for Quality Assurance surveillance of the contractor’s performance.

Referring Facility Physician: An IHS medical professional who orders the radiographic and medical images or his/her designee.

Routine/Standard Interpretations of Radiographic/Medical Images: Interpretations of standard radiographic and other medical images (i.e., Ultrasound, MRI, mammography) of a non-emergent nature. Written interpretations required within 24 hrs.

Service Unit: The local administrative unit of IHS.

Stat (includes emergency and or critical) Interpretations of Radiographic/Medical Images: Interpretations of radiographic and other medical images done as stat or on emergency basis. Telephonic interpretations from the referring facility physician or designee are required within 20 minutes of image submission, with the written interpretation to follow.

Task Order: An order issued in accordance with the terms of the contract that details an ordering activity’s specific requirements. An ordering activity written order to obtain services, at a minimum will include the following where applicable: description of services, skill categories, hours, price, period of performance, contract number, and the ordering activities task order number.

Tele-Radiology: The technology used to transmit digital medical images on a network.

Turnaround Time: The maximum allowable time to receive an interpretation from the Contractor once the Contractor’s radiologist has received the medical images.

Written: defined as either electronic or telefax or transcribed transmission.

Scope of Work Routine and Emergency Study Interpretation All radiology study interpretations are to be performed by licensed; Board-certified/eligible radiologists.

The Contractor shall provide interpretations on a routine and emergency basis. Final interpretations for studies sent as routine are to be returned to the sending IHS facility within 24 hours of study receipt.

The Contractor may provide preliminary interpretations (so-called “wet readings”) for radiology studies sent after-hours, as long as final interpretations are still returned as outlined above.

“Critical” Results The Contractor shall immediately notify, within 20 mins., the sending site clinician via the telephone concerning any results where the interpretation may be deemed critical to patient care. The final written interpretation will be sent within 24 hours of the study receipt.

This includes significant abnormal findings on routine and emergency studies that may impact a patient’s care or treatment. The Contractor shall also immediately notify the sending site clinician via the telephone concerning any and all discrepancies between preliminary interpretations and final interpretations (should the Contractor provide preliminary interpretations for after-hour emergency studies).

Radiologist Availability for Telephone Consultation Contractor radiologists shall be available 24 hours/day and 7 days/week for telephone consultation so that ordering clinicians from IHS facilities may discuss radiology examinations and interpretations with radiologists, as needed.

Estimated Workload The following totals are estimated for radiology study interpretations. This estimate is not a representation to an offer or contractor that the estimated quantity will be required or ordered. Multiple films for standard radiographic exam procedures will be forwarded to the Contractor for interpretation. Workload may vary depending upon the number of IHS facilities utilization of the service, see Appendix A.

The estimated workload identified in Appendix A is an estimate of the radiology study workload by type and IHS Area. While these numbers should not be understood as definitive, they represent a reasonable guide to workload for the base period of the contract. The Contractor should have sufficient radiologist staffing to receive increased workload. Ideal pricing by the Contractor for study interpretation will consider the potential for workload increases and stipulate reductions in cost per interpretation per study type based on such workload increases.

Reporting Requirements The Contractor shall provide interpretation reports in HL7 format for all IHS facilities. All contractor reports must be compatible with the HL7 software package used by the Indian Health Service (the VA HL7 software package). Reports shall also be available via secure facsimile or secure internet/server-based interpretation service, for facilities unable to receive study interpretations in HL 7 format (because of temporary difficulty in doing so).

Final interpretations are preferred. Should the Contractor provide preliminary (“wet”) interpretations for critical results and or stat or emergency studies, both the preliminary and the final interpretations must be provided to the requesting SU withing 24 hours. For facilities whose information systems are unable to receive both the preliminary and final interpretations in electronic format (i.e., two reports cannot be electronically accepted for a single radiology study accession number), the contactor shall provide the final interpretation in electronic format and the preliminary interpretation via facsimile or secure internet/server-based interpretation service.

Billing The Contractor shall provide information concerning Contractor radiologists such that billing for radiology interpretation services can be successfully conducted by the sending IHS facilities. This information must include, but is not limited to, radiologist NPI and other Medicare/Medicaid billing identification numbers and identifiers. The Contractor shall work with the IHS facilities to facilitate billing for services by IHS facilities. At the time of award billing addresses will be determined for each facility.

Quality Control The Contractor shall perform quarterly Quality Control peer review on interpretations from electronic images specific to each facility location covered under this contract according to the requirements of the Billings Area Medical Staff peer review procedure. This Quality Control (QC) peer view shall occur as part of the Contractor’s The Joint Commission-Compliance Quality Control program. Discordant interpretations must be graded as to their clinical significance (agree, disagree-insignificant, disagree-significant).

In addition, a log quantifying discrepancy rates between preliminary vs. final interpretations must be maintained and reported as part of the quarterly quality control report. This log should likewise assess discordant interpretations as to their clinical significance (agree, disagree-insignificant, disagree-significant).

The Contractor must also provide a mechanism for independent review of studies identified by either the IHS sending facilities and or the Contractor as inaccurate or of concern; this information must include all adverse events that result from the telemedicine services provided by the distant site physician or practitioner to the hospital’s patients and all complaints the hospital has received about the distant-site physician or practitioner. BAIHS reserves the right to request a more focused peer review.

Quarterly reports, via either hard copy or electronic mail, should be forwarded to the COR and the COR will forward to the BAIHS Centralized Credentialing Office. Quarterly reports will be submitted 3 months, 6 months, 9 months and 12 months after the start of the contract. The contractor must submit the quarterly report within 10 working days from the beginning of each marked quarter to the BAIHS Credentialing Specialist. These reports shall express peer review discordance rates and any additional information that is pertinent to the Contractor’s performance of quality assurance for the Tele-Radiology services provided.

Quarterly discordant interpretation rates greater than 3% for “disagree-significant” category discordant interpretations require that the Contractor submit to the IHS a detailed plan for quality improvement, to the COR Persistent discordant rates greater than 3% for “disagree-significant” category may lead to discontinuation of the contract.

Communication/ Network Infrastructure/Equipment needed The Contractor shall interface with Government furnished Image Archive and PACS (Picture Archiving and Communication System) communications platform(s) at participating IHS facility sites. The IHS facilities utilize the DICOM format to transmit images to the Contractor. The Contractor must utilize Image Storage, Tele-Radiology PACS Reading System and Reporting System that are compliant and compatible with industry standards as required or recommended by the American College of Radiology (ACR), HIPAA and the Food and Drug Administration (FDA). The Contractor must specify an acceptable compression ratio for a given study before the contract is awarded. The Contractor shall be capable of receiving a 14x17 high resolution (20MB) radiology study within one (1) minute of study transmission (once the study has been successfully sent to the Contractor from the sending IHS facility). Computer monitors utilized by the Contractor for purposes of radiology study interpretation must be calibrated in a timely fashion consistent with proper quality control procedures at the reading site. This calibration shall be in compliance with ACR and FDA recommendations for monitor calibration. The Contractor must provide the IHS with documentation of equipment quality control policies and certifications, upon request.

Customer Service The Contractor shall identify a lead point-of-contact for questions and issues related to clinical service delivery. The Contractor shall also identify a customer service representative to assist IHS staff with billing and/or administrative questions during regular business hours 8:00 A.M. to 5:00 P.M. Monday through Friday (Mountain Time). The Contractor shall maintain a toll-free telephone number or equivalent telephone service 24 hours per day with an answering service. A list of POCs for the IHS Billings Area Service Units is provided in Appendix B.

Deliverables: Roles and Responsibilities The contractor shall provide a monthly report of service volume of all modalities and over-read activities within 5 working days of the first of the month These reports shall be provided to the COR.

The Contracting Officers Representative reserves the right to call for additional reports on an as needed basis.

Key Personnel Changes: All changes that affect the contract must be communicated to the COR and SU contact, within 48 hours of the change.

The contractor must submit additions to staffing to the BAIHS Centralized Credentialing Office PRIOR to the radiologist reading, who will then notify the contractor once the radiologist has been privileged to perform radiology services. The contractor must also submit deletions from staffing to the BAIHS Centralized Credentialing Office, as soon as possible.

Contractor shall provide semi-annually calibration of equipment compliance with the DICOM part 14 standards.

The contractor shall have the capability to receive and send study report information in an HL7 format.

Credentialing and Privileging: The contractor must submit a list of radiologists(s) credentialed and privileged to provide services under this contract along with their respective documentation of credentialing and privileging approval to the BAIHS Centralized Credentialing Office. Once the radiologist has been approved by BAIHS, the BAIHS Centralized Credentialing Office will notify the contractor the radiologist has approved to begin providing radiology services as outlined in this contract. The contractor is responsible for providing the BAIHS Credentialing Specialist with updated information regarding the status of each radiologist(s) credentialing and privileging expiration dates and renewal status. Contractor must fill out, sign and return the Distant Site Hospital Provider Credentialing and Privileging Agreement, see Appendix E. The Billings Area reserves the right to request the contractor to remove providers from the contract when the Billings Area deems, they do not meet quality standards.

Training The Contractor shall provide training and support to participating IHS facilities for any secure internet/server-based platform or software used to transmit work orders and Tele-Radiology images from IHS facilities to Contractor and interpretations from Contractor back to IHS facilities, within 10 working days of the contract award date.

In addition, the Contractor shall provide, upon request, as needed training and support based on the needs of the IHS facility, for example, when staff turnover occurs. Training and support shall be provided within 5 working days of the request.

Also, the Contractor shall make an initial site visit to each facility participating under this contract within 45 calendar days of the service start date.

A written report shall be submitted to the SU and the COR reflecting the visits 5 work days after the due dates.

Security The Contractor shall obtain completed IHS ISSA Security Clearance prior to the start of this contract. This clearance will establish that the Contractor has provided sufficient local telecommunication network firewalls and procedures to ensure patient confidentiality and security consistent with HIPAA (Health Insurance Portability and Accountability Act of 1996) regulations, FIPS, and ACR (American College of Radiology) Guidelines.

Interconnection Security Agreement Contractor shall provide and complete an ISA with the IHS, prior to the performance of any actions related to the contract.

Business Associate Agreement (BAA) The Contractor shall complete an approved copy of a BAA to IHS, prior to performance of any actions related to the contract. See Appendix D.

Patient data security plan The Contractor shall describe the security plan for patient data. This includes location of physical servers and reading centers in support of contractor services. The plan should include any encrypted wireless systems used by reading providers. All wireless systems must be FIPS-140 compliant.

Encryption protocols Contractor will provide the ability to comply with IPsec VPN standards for encrypting communications. All communications between participating facilities and contractor that are transmitted outside the IHS Wide Area Network must be encrypted.

Section 508 Compliance Contractor shall conform to Federal 508 requirements which address accessibility for personnel with disabilities. Contractor shall procure a waiver if Section 508 applicability does not exist or relates to the contract. Please refer to http://www.section508.gov for more information.

Government Furnished Property All digital medical imaging files provided to the Contractor for interpretation shall remain the property of the government. Contractor shall not publish and/or share outside Contractor’s organization any IHS digital or analog image or imaging study report without the express written consent of the sending IHS facility. Any publication or sharing outside of Contractor’s organization of any digital or analog images or imaging study reports undertaken with the express written consent of the sending IHS facility must be done in a manner allowed by HIPAA and all other IHS rules and regulations.

Joint Use by the Government and the Contractor: All digital images will be provided to the Contractor for interpretation service only. As clinically indicated, sending IHS facilities will forward available copies of prior radiology studies requested by the Contractor in order to assure comparison interpretations. Contractor shall securely retain digital images and x-ray films in a HIPAA-compliant manner consistent with best practices for future clinical questions that may occur from the sending IHS facilities.

Contractor Furnished Property Contractor shall provide DICOM compatible formatted equipment. Shall provide all material, supplies, and maintenance necessary to provide the interpretation service described herein.

Work Orders shall be received and Interpretive Reports returned to IHS facilities electronically via HL7 format for all participating facilities capable of transmitting study information/receiving study reports in HL7 format.

Contractor Qualifications and Relevant Experience Requirements Contractor shall possess a minimum of 1 year experience in the practice of Tele-Radiology. References shall be made available upon request.

All radiologists providing interpretations under this contract shall be English-speaking.

License: All radiologist(s) shall possess a current, valid unrestricted license in a state, the District of Columbia, the Commonwealth of Puerto Rico, or a Territory of the United States, throughout the term of this contract.

Board Eligibility: All radiologists shall be Board Eligible or Certified by the American College of Radiology (ACR) throughout the term of this contract.

All radiologists shall be eligible to participate in the Medicare or Medicaid programs.

Credentialing and Privileging: The contractor shall be accredited by The Joint Commission. Each radiologist must be currently credentialed and privileged by the contractor, which shall meet or exceed the privileging and credentialing standards of The Joint Commission. The radiologist shall render contracted services within the scope of each radiologist’s respective privileges.

All radiologists shall meet the “Qualifications and Responsibilities of Personnel” in the American College of Radiology Technical Specification for Tele-Radiology Section III, A, Physician.

Appendix A: Estimated Workload

Appendix A- Estimated Annual Workload

Appendix B: Points of Contact Blackfeet Service Unit: Dawn Austin Crow Service Unit: James Reed Fort Belknap: Bettejo Snider Fort Peck: Dana Matejovsky Little Shell: Stacey Thomas Northern Cheyenne: Torrey Darkenwald

Appendix D: BUSINESS ASSOCIATE AGREEMENT See attachment A2 Appendix E: Credentialing Telemedicine Status: Patient care services provided by telemedicine LP’s to exchange information from one site to another via electronic communication through a telemedicine link. These telemedicine LP’s are required to be credentialed and privileged for relevant services at the site where the patient is located, called the Originating Site (OS). The distant site (DS) is the entity through which a distant site telemedicine practitioner (DS LP) is credentialed and privileged to provide telemedicine services. IHS preferred method of credentialing DS LP(s) is Credentialing by Proxy (CBP), but DS LP providing in-person or onsite services must be fully credentialed and privileged using the traditional credentialing process.

DS shall provide OS with Schedule 1 roster, a list identifying each telemedicine LP and the scope of privileges granted by DS to such DS LP.

DS will provide OS with each DS LP delineation of privileges and a copy of their approval letter.

DS will also provide OS a list of state licenses(s) for each DS LP.

DS shall provide OS a CBP Intake Form for each DS LP. This form will enable the OS to enroll the DS LP as a Continuous Query in the NPDB and in current credentialing software.

DS shall provide OS an IHS signed release from each DS LP.

DS will provide OS with written evidence of accreditation.

OS will perform and retain queries of the NPDB, OIG, and state licensure.

OS shall also ensure that the privileges granted to each DS LP at the OS site do not exceed the privileges granted to the LP by the DS.

Each DS LP listed on the approved Schedule 1 roster shall be entered and maintained in the current credentialing software.

It is anticipated that the Schedule 1 roster may change from time-to-time. In that event the following procedures shall apply:

DS shall provide OS with a revised Schedule 1 indicating the name of any new DS LP(s) that have had their credentials verified by the DS and accompanying delineation of privileges, approval letters, CBP Intake Form and list of state licensure. If at any time there is a change in the scope of a DS LP’s privileges or if a DS LP loses privileges at DS, DS shall notify OS of such change and shall thereafter provide OS with updated documentation delineating the current scope of such DS LP’s privileges. If DS has removed an LP from the Schedule 1 roster anticipated to provide Contracted Services going forward or if a DS LP loses privileges at DS, DS will provide OS with a revised Schedule 1 indicating that such telemedicine LP has been removed from the Schedule 1 roster providing Contracted Services to OS.

For subsequent Schedule 1 Roster processing to Governing Body only documentation and verifications are required for DS LP(s) added to the Schedule 1.

Any time DS LP(s) are removed or added, a new Schedule 1 roster needs to be submitted by DS and approved by the OS Governing Body, both the DS and OS sign and date the roster.

SECURITY CLEARANCE

A security pre-clearance must be performed for any employees referred to IHS through this contract.

Fingerprints must be completed and adjudicated prior to services being performed under this contract.

No contract award shall be made to any vendor or provider listed on the OIG Exclusion List http://exclusions.oig.hhs.gov throughout the duration of the contract. It shall be the responsibility of the contractor to notify the acquisition official if there is a change in provider.

Performance of this contract will require routine access by employees of the Contractor or its subcontractors to facilities or systems controlled by the Indian Health Service (I.H.S.). Before starting work requiring routine access to I.H.S. facilities or systems each person must complete a FBI National Criminal History Check (Fingerprint Check) adjudicated by an I.H.S. employee using the Office of Personnel Management Personnel Investigations Processing System. Contractors shall allow five business days for I.H.S. processing of fingerprints taken electronically at an I.H.S. site and thirty business days for non-electronic processing of fingerprints using FBI Form FD-258. A list of I.H.S. sites with electronic fingerprint capability is available from the Contracting Officer. In addition, no Contractor or subcontractor employee shall be permitted to perform work under this contract if listed on the HHS Office of Inspector General List of Excluded Individuals/Entities (LEIE), http://exclusions.oig.hhs.gov. As soon as practicable prior to the start of work, the performance of the work the Contractor shall provide to the Contracting Officer the names of all individuals to be used in performance of work for screening against the LEIE. During the performance, the Contractor shall provide the Contracting Officer the names of any additional or substitute employees for screening before they begin work. The Contractor is responsible for conducting security preclearance investigations in sufficient depth to ensure that each Contractor or subcontractor employee referred to IHS is not on the LEIE and can obtain a favorable fingerprint clearance. Each security preclearance shall be conducted sufficiently in advance of the start of performance to avoid delays caused by denial of access. As this is intended to be a Fixed Price contract, denial of access due to security clearance findings shall not be a basis for excusable delay or an increase to the contract amount.

Government will pay for the cost to process the contractor’s suitability clearances. However, multiple investigations for the same position may, at the Contracting Officers discretion, lead to reduction(s) in the contract price of no more than the cost of the extra investigation(s).

Employees that DO NOT have access to LMS, contractors, volunteers, or IHS employees with IPA’s or MOA’s to tribal organizations please, click here IHS Sexual Abuse Prevention website. When the contractors have completed and passed the training, please have them send a copy of the last page of the training with Name, Date, and Time to their Supervisor, COR, and Head of Billings Area Office Security Clearance.

“Contractor Personnel will arrive on a Business Day ONLY to complete all Orientation and Background procedures, as necessary. The Clinical Director or Designee will ensure all Orientation and Background procedures have been completed and an email will be sent to the Contracting department to state as such. The Contractor Personnel will NOT see patients until Background/Fingerprints have been cleared.”

“The standards of medical practice and duties of the Contractor through its Contracting Personnel shall be determined pursuant to the bylaws of the Service Unit. The regulations of the hospital, applicable provisions of law, other rules and regulations of any and all governmental authorities relating to licensure and regulation of physicians and hospitals must be followed. Also, the standards and recommendations of Centers for Medicare and Medicaid Services (CMS) or the Accreditation Organization must be adhered to. The Contract Contracting Personnel shall be required to participate in a quality improvement program, which is consistent with current requirements for ongoing monitoring and evaluation of the quality and appropriateness of care.”

This contract/order will entail the following position sensitivity level(s): Level 5: Public Trust - Moderate Risk.

INTERCONNECTION SECURITY AGREEMENT (ISA)

Before an entity to the IHS connects to any IHS System, an ISA must be in place and appropriate security controls must be implemented or configured.

All of the staff members are off-site and do not require physical or network access. Any staff member that comes on-site needs to be accompanied by a cleared IHS staff member at all times.

HANDLING OF DATA

The Contractor agrees to the extent that it receives or is given access to data necessary for the performance of contract which contains restrictive markings, the Contractor shall treat the data in accordance with such markings unless otherwise specifically authorized in writing by the Contracting Officer.

SECURITY OF DATA

The Contractor shall comply with any security requirements established by HHS to ensure proper and confidential handling of data and information. The Contractor shall refer to “HHS Cybersecurity Program.”, which is HHS’ Information Security Program Policy, dated June 2010.

The contractor shall become familiar with the HHS Departmental Information Security Policies which may be found at http://www.hhs.gov/ocio/policy/2007-0002.html. “HHS Cybersecurity Program” develops policies, procedures, and guidance to serve as a foundation for HHS' information security program. These documents implement relevant Federal laws, regulations, standards, and guidelines that provide a basis for the information security program at the Department. The contractor must become familiar with ‘HHS Cybersecurity Program” guidelines as presented at http://www.hhs.gov/ocio/policy/index.html#Security.

Data obtained for this contract shall not be used to create databases or any other product not intended for use specifically in this project. All data containing personal identifiers shall be handled in accordance with the Privacy Act of 1974 (Public Law 93-579). No data is to be released to anyone without the specific approval of the COR and the Contracting Officer.

HHS-CONTROLLED FACILITIES AND INFORMATION SYSTEMS SECURITY

To perform the work specified herein, Contractor personnel are expected to have routine (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data or information, whether in an HHS controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

To gain routine physical access to an HHS facility, logical access to an HHS-controlled information system, and/or access to sensitive data or information, the Contractor and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; Office of Management and Budget memorandum (M-05-24); and Federal Information Processing Standards Publication (FIPS PUB) Number 201; and with the personal identity verification and investigation procedures contained in the following documents:

HHS Information Security Program Policy. http://www.hhs.gov/read/irmpolicy/121504.html HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook, dated February 1, 2005. http://www.knownet.hhs.gov/acquisition/pssh.pdf HHS HSPD-12 Policy Document, v. 2.0. http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf List of Attachments and Exhibits A1: Part 8-Chapter 12 Information Technology Security A2: Business Associate Agreement A3: Business Partner Interconnection Security Agreement A4: Distant Site Telemedicine Entity Credentialing and Privileging Agreement A:5 Internal Use Software

A:6 Indemnification and Governing Law 21 A:7 HHSAR FAR Clauses 2 Performance Based-Matrix Surveillance will include periodic inspections and audits by IHS contracting staff. Payment of contracted price for satisfactory service. Contract may be terminated for Contractor failure to meet indicators and/or Contractor failure to develop a performance improvement plan to address performance difficulties.

Timeliness

Customer Service

Reporting Requirements

Training

Credentialing and Privileging

Security/ISSO Clearances

Government and Contractor Furnished Property

Qualifications and Accreditation 100% compliance with section 4.

100% compliance with section 4.

100% compliance with section 4. 100% of all Clearance forms to be delivered prior to the start of any contract services.

100% compliance with section 6.