Description of Agreement REVISED 01252022.pdf

Attachment A

Blanket Purchase Agreement (BPA) Vaccine Injury Compensation Program

(VICP)

Countermeasures Injury Compensation Program (CICP)

Medical Expert Witness Medical Case Reviewers

Revised 1/25/2022

I. Background

The Health Resources and Services Administration (HRSA) National Vaccine Injury Compensation Program (VICP) has two Federal programs that provide compensation to people found to be injured by certain vaccines or countermeasures;

1. The VICP is a no-fault alternative to the traditional legal system for resolving vaccine injury petitions. Authorizing Legislation – Public Health Service Act, Title XXI, Subtitle 2 Parts A and D, Sections 2110-19 and 2131-31.

To compensate those found to be injured by childhood vaccines, congress enacted the National Childhood Vaccine Injury Act of 1986 (Public Law 99-660) October 1, 1988.

Several amendments to this law expanded the VICP’s coverage to include new categories of vaccines that previously were not covered by the VICP: vaccines recommended by the CDC for routine administration to pregnant women (but not for routine administration in children) and subject to a federal excise tax. See Section 3093(c) (1) of P.L. 114-255. To find out more about the vaccine injury program visit the website at;

https://www.hrsa.gov/vaccine-compensation/index.html

HRSA has been delegated the authority to administer Parts A and D of Subtitle 2. An individual must file a petition (also called claims) with the U.S. Court of Federal Claims. In accordance with program authority, consistent with the delegation, the HRSA, HSB, VICP Program:

• Receives petitions requesting compensation for vaccine injuries or deaths served against the Secretary of HHS (the Secretary) which are filed with the court;

• Arranges for medical review of each petition and supporting documentation by healthcare professionals which special expertise in pediatrics and adult medicine, and develops preliminary recommendations that are provided to the Department of Justice (DOJ), which DOJ incorporates in the DOJ Rule 4(b) report that is submitted to the Court regarding the eligibility of petitioners for compensation.

https://www.hrsa.gov/vaccine-compensation/index.html

2. The Countermeasures Injury Compensation Program (CICP) provides compensation to eligible individuals for serious physical injuries or death directly caused by the administration or use of pandemic, epidemic, or security countermeasures identified in declarations issued by the Secretary of the U.S. Department of Health and Human Services (HHS) pursuant to section 319F-3(b) of the PHS Act (42 US.C 247d-6d).

Since 2010, the CICP has provided compensation for serious injuries that occur as the result of the administration or use of certain countermeasures. Compensation may include unreimbursed medical expenses (expenses that health insurance did not cover), lost employment income, and the survivor death benefit. To find out more about the CICP program visit the website at https://www.hrsa.gov/cicp.

The CICP Administrative Implementation, Final Rule (FR) allows the CICP to evaluate and process requests for benefits filed by individuals who experienced serious physical injuries as a direct result of the administration or use of covered countermeasures identified by the HHS Secretary in declarations issued under the Public Readiness and Emergency Preparedness or, PREP Act.

• Receives all medical records from each health care provider and generally all of the medical records from one year before the administration or use of the covered countermeasure to the present time.

• Is the payer of last resort and only covers expenses or provides benefits that other third-party payers, such as health insurance, the Department of Veterans Affairs, or Workers’ Compensation programs have no obligation to pay.

Depending on the type of petition filed, such as injuries, disabilities, illnesses, conditions, and deaths resulting from vaccines, would determine the medical specialists required for medical case review of petition and documents. HRSA contracts with medical experts and reviewers to perform these tasks.

The Medical Expert serves in reviewing medical case files (petition, medical records affidavits, and depositions provided by the Petitioner) for assessment of merit, liability, damages and standard of care deviations. Although, the medical expert panel is limited to actively practicing board- certified physicians willing to testify to support an unbiased opinion. The Medical Case Reviewer serves as in reviewing medical case files (petition, medical records affidavits, and depositions provided by the Petitioner) for assessment of merit, liability, damages and standard of care deviations.

II. Purpose / General Description http://www.hrsa.gov/cicp

The purpose of this requirement is to establish a BPA to acquire medical-expert services and medical reviewer/case managers for the National Vaccine Injury Compensation Program (VICP) and Countermeasures Injury Compensation Program (CICP) efforts in the litigation process in defense of the petitions and filed against the HHS Secretary.

III. Period of Performance / Place of Performance

The period of performance shall be for five (5) years (exact dates to be entered at time of award). The work shall be performed at the contractor’s facility. Travel may be required to attend court hearings at specified locations within the continental United States.

IV. Tasks

Task 1: VICP/CICP Medical Expert Witness:

The contractor shall:

a. Obtain and review the case file, which includes the petition, medical records, affidavits, depositions, exhibits, and other relevant documentation.

b. Consult, when applicable, on the case with the assigned VICP or CICP Medical Officer (MO) and the Department of Justice (DOJ) attorney.

c. Notify the MO and DOJ attorney of the need for any additional or missing medical records or exhibits.

d. Provide a written draft report to the MO and DOJ attorney by the due date provided in the Case Review Guidance Memo sent with the case file. The report shall:

• Identify the essential medical points in question.

• Identify any inconsistencies in the petitioner's theory of causation.

• Provide an analysis of the petitioner's theory of causation and include whether or not the theory is considered scientifically valid and medically reasonable.

• Provide the expert's opinion.

e. Provide a written final report to the MO and DOJ attorney by the due date provided in the Case Review Guidance Memo. The final report shall include copies of all pertinent reference materials utilized for the report.

f. Provide a written response to all interrogatories received from the MO or DOJ attorney originating from the U.S. Court of Federal Claims (the Court), including copies of pertinent reference materials utilized for the response, by the due date provided by the MO or DOJ attorney.

g. Provide testimony to the Court as required, either in person, through teleconference, video conference or in writing. Participate in any preparation in advance of testifying before the Court.

h. When requested by the VICP or CICP, provide assistance in evaluating issues or questions regarding selected vaccines, countermeasures, or medical conditions, including reported serious adverse events or issues related to vaccine safety.

i. When requested by VICP, DOJ, or the Court, conduct in-person physical examination of the petitioner.

j. Comply with all requirements provided in the Case Review Guidance Memo regarding document security, including protection of Personal Health Information (PHI) and Personally Identifiable Information (PII).

k. Return, shred, or destroy all records, as directed by the VICP, within 30 days of notification of case adjudication or closure. The contractor shall manage and maintain Federal records, including electronic records, resulting from this BPA in accordance with all applicable records management laws and regulations, including the Federal Records Act (44 U.S.C. Chapters 21, 29, 31, 33); 36 CFR § 1236.20.

l. Regardless of format, all digital content or communications materials produced as a deliverable under this BPA must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided persons without disabilities. Remediation of any materials that do not comply with the applicable requirements as set forth below, shall be the responsibility of the vendor. HHS guidance regarding accessibility of documents can be found at http://www.hhs.gov/web/section-508/making-files-accessible/index.html.

m. Travel In the event that in-person testimony is required by the U.S. Court of Federal

Claims. Travel and per diem expenses shall be reimbursed in accordance with Federal Travel Regulations. If travel is required it will be noted within a BPA Call.

n. Invoicing shall be done once work is completed on a case.

Task 2: VICP/CICP Medical Case Reviewer:

http://www.hhs.gov/web/section-508/making-files-accessible/index.html http://www.hhs.gov/web/section-508/making-files-accessible/index.html

The contractor shall:

b. Obtain and review the case file, which includes the petition, medical records, affidavits, depositions, exhibits, and other relevant documentation for determining;

1. Adequacy of available information, likelihood of vaccine causation based on medical principles, knowledge of the literature and

2. An understanding of associated disease and conditions

c. Consult on the case with the assigned VICP Team Lead, medical expert, when applicable, Office of General Counsel (OGC) Attorney and/or the Department of Justice (DOJ) attorney.

d. Notify the Team Lead and DOJ attorney of the need for any additional or missing medical records or exhibits.

e. Provide an initial written draft report to the Team Lead and DOJ attorney by the due date provided in the Case Review Guidance Memo sent with case file. The report shall;

1. Identify the essential points in question

2. Provide determination of eligibility for compensation based on the Countermeasure

Injury Table in Statute

3. Provide determination of preponderance of evidence to support a “factor unrelated” or alternate cause and make recommendations in medical reports

4. Obtain outside medical consultation and interpretation in context of Statute in specific case review and provide the expert’s opinion.

f. Consult with the Team Lead and DOJ attorney in preparation of reports for legal proceedings by the due date provided in the Case Review Guidance Memo. The final report stall include copies of all pertinent reference materials utilized for the report.

g. Participate in-group panel discussions on case findings in order to reach consensus on proceedings of case.

h. Records Management Training: The contractor shall complete the HRSA Records Management training before performing work under this BPA and thereafter completing annual training refresher course during the life of the BPA.

https://humancapital.learning.hhs.gov/courses/2020recordsmanagement/01_index.html

Task 3: Verification of Contact Information:

The contractor shall complete and update contact information and submit for program file records to ensure up-to-date contact information is accurate. See Agreement - Attachment A for Verification of Contact Information Form.

Task 4: Non-Disclosure:

Performance of this requirement may require the contractor to access and use data and information proprietary to a Federal Government which is of such a nature that its dissemination or use, other than in performance of this requirement, would be adverse to the interests of the Federal Government and/or others.

Contractors shall not divulge or release data or information developed or obtained in performance of this requirement, until made public by the Federal Government, except as authorized by appropriate Federal Government personnel or upon written approval of the Contracting Officer (CO). The contractor shall not use, disclose, or reproduce proprietary information or data that bears a restrictive legend, other than as required in the performance of this requirement. Nothing herein shall preclude the use of any data independently acquired by the contractor without such limitations or prohibit an agreement at no cost to the Federal Government between the contractor and the data owner which provides for greater rights to the contractor. Contractors performing work under this requirement shall submit a signed non- disclosure agreement (Agreement - Attachment B).

Task 5: Confidentiality and Maintenance of Records:

Protection of Personally Identifiable Information (PII)

The contractor shall comply with the Privacy Act clause within the BPA, HHSAR 352.224-70.

The Health Resources and Services Administration (HRSA) and its Bureaus/Offices are committed to protecting privacy. As a result, emails containing personally identifiable information (PII) should be sent and received in a secure manner.

PII sent and received internally among HRSA employees (including contractors) must be sent and received in a secure and confidential manner (for example, using encryption to protect data and/or attachments). Encryption helps to ensure that the data is not comprised during transmission. To aid in this effort, we recommend the following options to transmit PII in a secure manner; SecureZip. SecureZip ensure that sensitive data kept in file, folder, or email format is protected while the data is in transit or at rest. It combines ZIP compression and encryption to deliver more secure method of transmitting PII via email. If you do not have SecureZip, please contact the HRSA Helpdesk to request a copy of the software to be installed on your computer.

Secure Email File Transfer (SEFT), National Institutes of Health (NIH) Secure Email and File Transfer Service is a service that allows HRSA users to send and receive emails securely on a secure socket layer (SSL)/encrypted connection. Use of this service will help protect the data from loss and compromise during transmission. The link to use SEFT is https://secureemail.nih.gov. You may need to register with NIH in order to use SEFT.

Task 6: Standard for Encryption:

The Contractor (and/or any subcontractor) shall:

1. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

2. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

3. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR prior to the EPLC Design Readiness Review (DRR).

4. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the BPA.

Task 7: Privacy Act:

It has been determined that this BPA is subject to the Privacy Act of 1974, because this BPA provides for the design, development, or operation of a system of records on individuals.

The System of Records Notice (SORN) that is applicable to this BPA is: 09-15-0056, National Vaccine Injury Compensation Program.

https://secureemail.nih.gov/ https://secureemail.nih.gov/ https://secureemail.nih.gov/

Task 8: Incident Response:

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor), the Contractor (and/or any subcontractor) shall:

1. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this BPA so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send notifications to affected individuals following specific instructions from the HHS Privacy Incident Response Team (PIRT).

3. Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Security Operations Center (SOC), COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, BPA information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. Not include any sensitive information in the subject or body of any reporting e-mail; and

c. Encrypt sensitive information in attachments to email, media, etc.

4. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, HHS, and HRSA incident response policies when handling PII breaches.

5. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

V. Schedule of Deliverables

Regardless of format, all digital content or communications materials produced as a deliverable under this BPA must conform to the applicable standards of Section 508 of the Rehabilitation Act to allow federal employees and members of the public with disabilities access to information that is comparable to information provided to persons without disabilities. Remediation of any materials that do not comply with these requirements shall be the responsibility of the vendor.

Regardless of format, all digital content or communications materials produced as a deliverable under this contract, must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. Remediation of any materials that do not comply with the applicable requirements as set forth below, shall be the responsibility of the vendor.

HHS guidance regarding accessibility of documents can be found at https://www.hhs.gov/web/section-508/accessibility-checklists/index.html.

https://www.hhs.gov/web/section-508/accessibility-checklists/index.html

VICP and CICP Medical Expert Witness Deliverables

Task Deliverables Format Completion Date

1d

Draft report to the MO and DOJ attorney.

Microsoft Word or other as directed by

VICP

By the due date provided in the Case Review Guidance Memo sent with the case file.

1e Final report to the MO and DOJ attorney.

Microsoft Word or other as directed by

VICP

By the due date provided in the Case Review Guidance Memo.

1f Written interrogatories received from the MO or DOJ attorney originating from the U.S. Court of Federal Claims (the Court).

Microsoft Word or other as directed by

VICP

By the due date provided by the MO or DOJ attorney.

1k Return, shred, or destroy all records, as directed by the

VICP

Microsoft Word or other as directed by

VICP

Within 30 days of notification of case adjudication or closure.

1n Submit invoices Invoice Form - Microsoft Word or

PDF or as directed by VICP

Upon completion of each Case.

Task 3

Submit Verification of Contact Information Form

Microsoft Word

Upon award of BPA and if changes occur during the duration of the

BPA

Task 4

Non-Disclosure Agreement

PDF

Upon BPA Call Order award

Task 5

Maintenance of records Electronic

Anytime records will be transferred.

Task 6

Standard for Encryption Electronic transferred

Task 7

Privacy Act Electronic

Anytime records will be transferred

Task 8

Incident Report Electronic Per concurrence of incident

VICP/CICP Medical Case Reviewer Deliverables

Task Deliverables Format Completion Date

2d

Draft report to the Team Lead, medical expert (if needed) and DOJ attorney.

Microsoft Word or other as directed by VICP

By the due date provided in the Case Review Guidance Memo sent with the case file.

2e Final report to Team Lead and DOJ attorney

Microsoft Word or other as directed by VICP

By the due date provided in the Case Review Guidance Memo sent with the case file.

2f Participate in-group panel discussions on case findings in order to reach consensus on proceedings of case.

Conference call

Weekly/ or as defined in the Case Review Guidance Memo sent with the case file. Needs to be defined by each award

Task 3

Submit Verification of Contact Information Form

Microsoft Word

Upon award of BPA and if changes occur during the duration of the BPA

Task 4

Non-Disclosure Agreement

PDF

Upon BPA Call Order award

Task 5

Maintenance of records Electronic transferred.

Task 6

Standard for Encryption Electronic

Task 7

Privacy Act Electronic

Task 8

Incident Report Electronic Per concurrence of incident

All deliverable reports are to list the following at the top of the first page:

• BPA number.

• Deliverable item number.

• Deliverable item delivery due date.

• Date of submission.

• All deliverable items are to be separate physical submissions.

• All deliverable items are subject to the review and concurrence of the COR.