PWS_-_Graphics_Illustrator_-_Final.pdf

PERFORMANCE WORK STATEMENT

GRAPHICS ILLUSTRATION SUPPORT

Air Force Surgeon General

27 August 2015

ACQUISITION SENSITIVE

TABLE OF CONTENTS

PERFORMANCE WORK STATEMENT

17 August 2015

1. DESCRIPTION OF SERVICES

1.1 Background

1.2 Scope

2. SPECIFIC REQUIREMENTS

2.5 DELIVERABLES

3.1.5 a

3.1.5 b

3.1.5 c

2.5.1 Monthly Status Report (MSR)

2.5.2 Quality Control Plan (QCP)

2.6 SERVICE SUMMARY

3. GENERAL REQUIREMENTS

3.1 Contractor General Support

3.2 Government Furnished Property/Information (GFP/GFI)

3.3 Security Procedures

3.4 Travel

3.5 Place of Performance and Hours of Operation

3.6 Privacy of Information

3.7 Nonpersonal Services

3.8 Period of Performance

APPENDIX A: ACRONYMS, ABBREVIATIONS AND GLOSSARY OF TERMS

APPENDIX B: APPLICABLE PUBLICATIONS

APPENDIX C: BUSINESS ASSOCIATE AGREEMENT

APPENDIX D: AF/SG ORGANIZATIONAL CONFLICT OF INTEREST

APPENDIX E: HQ USAF/SG NON-DISCLOSURE AGREEMENT

1. DESCRIPTION OF SERVICES

1.1. Background

The Air Force/Surgeon General (AF/SG) plans, programs and provides Air Force (AF) medical expeditionary capabilities to support the national security strategy. It defines and executes health care policy for 44,000 personnel at 75 Medical Treatment Facilities (MTFs). The AF/SG ensures a cost-effective, patient-centered and prevention-based health care continuum for 2.6M beneficiaries worldwide. It builds strategic partnerships with Department of Defense (DoD) Health Affairs, Veterans Administration, federal agencies, academia and allied medical services.

1.2. Scope

AF/SG has a need for nonpersonal services to support and improve agency policy development, decision-making, administration, and project management and administration, and to improve the effectiveness of managerial processes and procedures.

The primary purpose of this requirement is to design, lay-out and execute a wide range of illustrative/graphic artwork to organizational customers in support of presentations, displays, briefings, printed materials and other related projects using common art media, as well as computer-generated graphics and videography software/equipment.

2. SPECIFIC REQUIREMENTS

The Contractor shall provide the personnel and expertise to support the Air Force Medical Service (AFMS) requirements. The Contractor shall complete the following tasks.

2.1. Design, Lay Out and Prepare a Variety of Artwork. The Contractor shall:

2.1.1. Provide graphics support for medical and non-medical projects from beginning of assignment and follow through to completion on all aspects.

2.1.2. Create preliminary sketches, mockups or models for production to ensure accuracy and achieved objective for various informational and operational projects. Final documents will be at an agreeded upon date between the Contractor and the Government PM.

2.1.3. Employ visual elements and principles of composition including style, balance, contrast, tone, color, dominance and sub-ordinance.

2.1.4. Ensure accurate subject matter portrayal for informational and operational projects. All documents will be due at a date specified by the Government Program Manager (PM).

2.1.5. Propose and plan a work method to Government Program Manager (PM), Quality Assurance Evaluator (QAE) or management, select suitable color scheme, typestyle and type sizes, and recommend ideal subject matter depiction considering objective, deadline and reproduction method.

2.1.6. Assist the Government with researching reference sources and consult with subject-matter experts to assure that illustrations are accurate presentations of the objects used to communicate themes.

2.1.7. Compose and complete a variety of general and technical artwork in full color, monochromatic, or black and white. The work requires imaginative and creative ideas, sometimes without the benefit of precedent.

2.1.8. Organize, update and manage electronic library of videos, sound clips, photos, images and clip-art for use in generating medical and non-medical artwork. Files that are not placed on the AFMS Knowledge Exchange will be maintained in an electornic format and provided to the Government PM.

2.2. Advise and Provide Project Management Support to Government PM and AF SG staff [to include the AF/SG, their Commanders’ Action Group, and other headquarters staff members as deemed appropriate by the Government PM.]:

2.2.1. Meet and coordinate with project officers, subject matter experts and senior AFMS personnel to plan illustration projects. Advise on specific services, capabilities, processes and suitable equipment to use in terms of compatibility, improvability, availability of photographic images and reproduction processes available. Advise project officers on the capabilities of these processes and various art media. Identify advantages and disadvantages for various types of materials to be used.

2.2.2. Complete rough ideas, conceive theme and prepare preliminary layout for presentation to customer. Recommend format, color medium and method of reproduction considering the customer’s specifications. The Contractor shall discuss all requirements with the customers and recommend the development of the project based on personal experience and training.

2.3. Create Original Artwork Utilizing Computer Graphics Software:

2.3.1. Develop visual graphics using state-of-the-art software programs such as Corel Draw and all Adobe Creative Suite CS5 software and create, analyze, interpret, coordinate, accomplish, and produce computer-generated and/or conventional graphics and multi-media products utilizing computer hardware, software and peripherals. All software will be provided by the Government PM and shall remain the property of the Government. All documents (AFMS Public Affairs requests, SG deliverables, etc.) will be due at a date specified by the Government PM.

2.3.2. Compile and depict data using various media, drawing instruments, and electronic equipment.

2.3.3. Operate electronic, interactive, graphic design equipment and desktop publisher software (for purpose such as the creation of brochures or retirement pamplets) in performance of illustrating duties.

2.4. Research and Recommend Equipment, Materials and Software to Meet Current and Future Production Needs:

2.4.1 Provide recommendations for future acquisition of new equipment or upgrades by researching new technologies and cost effective methods to meet changing requirements or customer needs.

2.5. QUALIFICATIONS

2.5.1. Bachelor’s degree in Visual Communication and/or Multimedia, Graphics Design, Applied Graphic Studies, Applied Graphic Technology, Multimedia Graphics or Graphic Art.

2.5.2. Four (4) years’ experience in the fields listed in 2.5.1.

2.5.3. Ability to communicate effectively, both orally and in writing.

2.5.4. Knowledge of the principles and methods of visual and written communication.

2.5.5. Knowledge of graphic reproduction processes, art production, photography, printing, illustration, multimedia techniques and computer graphics hardware/software capabilities.

2.5.6. Knowledge of web programming languages.

2.5.7. Skill in video shooting, video editing, photography, and multimedia storytelling.

2.5.8. Ability to analyze the characteristics and needs of stakeholders and determine the most effective digital communications strategies to reach those audiences.

2.5.9. Ability to work with a variety of software, hardware, and traditional are media used to create graphics including Adobe Photoshop, Adobe Illustrator, Adobe InDesign, and Adobe Acrobat Professional.

2.5. DELIVERABLES

Deliverables associated with this Performance Work Statement (PWS) are specified below. All deliverables shall be submitted in a draft format mutually agreed upon by the Contractor and the Government. If the calendar day falls on the weekend, Government observed holiday, or the facility is closed, then the deliverable shall be due the next business day.

DELIVERABLE PWS

PARAGRAPH

DELIVERY DATE

Create preliminary sketches, mockups or models for production

2.1.2. Final documents will be at an agreeded upon date

between the Contractor and the Government PM

Develop visual 2.3. All documents will be due at a date specified by the graphics using state-of-the-art software programs such as Corel Draw and all Adobe Creative Suite CS5 software, as provided by Government PM government PM

Monthly Status Report

2.5.1. The 10th business day of every month electronically

Quality Control Plan 2.5.2. Due with Contractor’s proposal

Business Associate Agreement

3.1.5. a Due within five (5) business days of contract award

Non-Disclosure Agreement

3.1.5. b Due within five (5) business days after contract award and on first day of reporting for replacement personnel

Organizational Conflict of Interest

3.1.5. c Due within five (5) business days after contract award is signed

Trip Reports 3.4.4. Due within five (5) business days after trip completion

2.5.1. Monthly Status Report (MSR)

The Contractor shall submit MSRs to the COR no later than the 10th business day of every month reflecting the support provided in the previous month. The MSR shall include the following information:

• A brief task description of the area(s) of focus being worked

• A brief narrative review of work accomplished during the reporting period or significant events

• Problem areas with proposed corrective actions

• Proposed staff changes

• Progress report with contract execution trends

• Schedule of activities planned and estimated date/time of completion

2.5.2. Quality Control Plan (QCP).

The Contractor shall develop and maintain a QCP to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor shall submit a QCP with their proposal. The COR will provide a written notice of acceptance to the Contractor five (5) business days after receipt. The Contractor is responsible for contract management.

2.6. SERVICE SUMMARY

The Government will use the following standards to determine Contractor performance and will compare Contractor performance to the the performance thresholds listed below

Performance Objectives

PWS Performance Threshold Surveillance Method

Provide graphics support for medical and non-medical projects

2.1.1. Source documents shall have no more

than 3 errors per product/ document/ project and no more than 1 rework per quarter

100% Customer Inspection

Create preliminary sketches, mockups or models for production

2.1.2. Source documents shall have no more

than 3 errors per product/ document/ project and no more than 1 rework per quarter

100% Customer Inspection

Employ visual elements and principles of composition including style, balance, contrast, tone, color, dominance and sub-ordinance

2.1.3. Source documents shall have no more

than 3 errors per product/ document/ project and no more than 1 rework per quarter

100% Customer Inspection

Use state-of-the-art computerized electronic graphics imaging systems to produce acceptable graphics

2.3.1. Source documents shall have no more

than 3 errors per product/ document/ project and no more than 1 rework per quarter

100% Customer Inspection

Monthly Status Report

2.5.1. No more than one missed suspense in

a six month period.

100% inspection

Quality Control Plan 2.5.2. Maintain currency and accuracy 95% of the time

100% inspection

Provide preliminary sketches, mockups or models for production

2.1. All documents will be due at a date

specified by the government PM

100% inspection

3. GENERAL REQUIREMENTS

3.1. Contractor General Support.

3.1.1. Continuation of Services. The Contractor shall ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that impact to the Government is minimal and position vacancies do not exceed 30 business days.

3.1.2. Vacancies. In instances where the Contractor projects vacancies exceeding five (5) business days, the Contractor shall notify the Contracting Officer (CO) and Contracting Officer’s Representative (COR) at the five (5) day mark.

The Contractor shall provide follow-up documentation within 72 hours after notification, stating the date/time the position will be vacant, the reason for the vacant position, the anticipated replacement date of personnel, and what management corrective action will be taken to ensure contract mission completion. The Contractor shall not invoice for any positions that are vacant and the Government will not pay for any positions that are vacant. The COR will review the new hire resume; the Contractor shall document personnel absences and send the information to the COR. Vacancies will be measured in number of business days.

3.1.3. Professionalism. The CO may request that any Contractor whose conduct, in the opinion of the CO, interferes with proper order or professionalism at the installation where services are performed, be removed from such installation and the Contractor shall comply with such request.

The Contractor shall present a neat, well-groomed appearance: neat, clean, business attire clothing shall be worn. The Contractor shall be required to observe all base and facility parking, safety and traffic regulations that apply to all facility employees.

3.1.4. Common Access Card (CAC). Each Contractor employee shall have their CAC in his/her possession at all times while working on any Government installation and shall surrender the CAC at the end of his/her employment under this contract, or when the CAC expires, or when demanded by authorized Government officials, whichever occurs first. The loss of any pass and identification items shall be reported as soon thereafter as possible to the issuing activity and the COR.

3.1.5. Treatment of Sensitive Information. Contractor personnel shall not release any personal or medical/patient information to include patient personal health information during the course of this contract. Treatment of sensitive information shall in accordance with the following:

a. Business Associate Agreement. The Contractor shall sign and comply with the requirements in Appendix A due to the COR within five (5) business days of contract award.

b. Non-Disclosure Agreement (NDA). The Contractor shall provide the COR with signed NDAs for each Contractor personnel (Appendix B) within five (5) business days of reporting for the first day of work.

c. Organizational Conflict of Interest: (OCI). The Contractor shall provide to the COR within five (5) business days after contract award a signed OCI (Appendix C) addressing the activities of all Contract personnel. Contractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information (e.g. cost or pricing information). Contractor personnel may receive budget information or analyses, specification or work statements, etc. or perform evaluation services that may create current or subsequent OCIs as defined in Federal Acquisition Regulation (FAR), Subpart 9.5. The Contractor shall notify the CO immediately when such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid

OCI or mitigate. The Contractor’s mitigation plan shall be determined to be acceptable solely at the discretion of the CO. In the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary. This may include prohibiting the Contractor from participation in subsequent contracted requirements that are affected by the OCI.

d. DoD Directives and Instructions Compliance. The Contractor shall comply with the latest versions of DoD Directive (DoDD) 8570.1M, Information Assurance Workforce Improvement Program; DoD Instruction (DoDI) 8500.01, Cybersecurity; DoDD 5400.11, DoD Privacy Program; and DoDI 5200.2-R, DoD Personnel Security Program.

e. Other Applicable Regulations. Other Military Health System (MHS) and Air Force Medical Support Agency (AFMSA) regulations and other Federal and State laws regarding the treatment of sensitive information, as listed in Appendex B, may also be applicable.

3.1.6. Contractor Identification. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, Contractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. The Contractor shall follow any other applicable workplace policies.

3.1.7. Section 508 Compliance. The Contractor shall support the Government in its compliance with Section 508 throughout the development and implementation of the work to be performed. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S. Code 794d), and implemented by 36 Code of Federal Regulations (CFR) 1194, requires that when Federal agencies develop, procure, maintain, or use electronic IT, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency. For additional Section 508 information, the Contractor should review the following websites:

http://www.section508.gov http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources

3.2. Government Furnished Property/Information (GFP/GFI).

The Contractor shall ensure accurate control and accountability of all GFP/GFI in accordance with the Government property clauses incorporated into the basic contract. The following GFP/GFI will be provided to the Contractor, on-site.

3.2.1. Documents, Data Rights, and Intellectual Property. The Government will furnish or make available to the Contractor any documentation/material deemed necessary to accomplish requirements of this contract. Documents include access to databases, reference materials, and most unclassified AF policy documents. The Government will retain ownership of all data entered, processed, or generated by the Contractor in the performance of the tasks set forth in the Performance Work Statement (PWS). Provisions of FAR 52.227-11, Patent Rights—Ownership by the Contractor (2007) will be applied to the contract. The full text of the clause may be accessed electronically at http://farsite.hill.af.mil/.

3.2.2. Local Area Network (LAN). Contractors with a valid National Agency Check with Inquiries (NACI) verified through the Joint Personnel Adjudication System (JPAS) roster of validation from the Contractor’s security manager shall be provided access to the AFMS’s unclassified computer network and its inherent capabilities including, but not limited to: internet access, electronic mail, file and print services, and dial-in network access. The Contractor shall be aware of and abide with all Government regulations concerning the authorized use of the Government’s computer network. Government regulations will be address upon inprocessing and made available throughout course of employment.

3.2.3. Workspace. The Government will provide the Contractor working on site: office work space, desk, chair, filing cabinet, laptop and docking station, monitor, software, a CAC, telephone, access to LAN printers, scanners, fax machines, and miscellaneous office supplies.

The Government will provide other workspace amenities for individuals with disabilities in accordance with Section 508 laws. The Government will not be liable for any injury to the Contractor’s personnel or damage to the Contractor's property unless such injury or damage is due to negligence on the part of the Government and is recoverable under the Federal Torts Claims Act, or pursuant to other Federal statutory authority.

3.3. Security Procedures

Minimum facility and personnel clearance level required under this contract is Unclassified (UNCLAS). However, the CO must be kept abreast of issues dealing with the security clearances and/or certifications. No foreign national candidates shall be utilized within the scope of this contract without prior approval of the Government. In addition to the below and due to the nature of the work that the Contractor will likely be exposed to, the Contractor shall sign and comply with Appendices C and D prior to commencing work in support of this PWS.

3.3.1. Security Provisions. The Contractor shall fully adhere with the provisions of the referenced publications by having each of their on-site employees submit the appropriate forms and maintain a favorable suitability determination to continue performing under this contract.

Within 14 business days after the Period of Performance (POP) start date, the Contractor shall submit on-site employees’ names, and contract numbers, required/prospective start dates, and telephone contact numbers to the Service Contract Manager and the Unit Security Manager identified in the contract. See Appendix E for a list of referenced publications.

3.3.2. SF-85 (Public Trust). The Contractor shall ensure that the Contractor’s personnel assigned to staff this requirement complete the SF-85 in the Electronic Questionnaires for Investigations Processing (e-QIP) after the Unit Security Manager contacts the Contractor’s personnel to establish an account in e-QIP Direct.

3.3.3. Joint Personnel Adjudication System (JPAS) Verification. A favorable report, verified through JPAS, is needed as a condition of support at Defense Health Headquarters

(DHHQ) in support of this PWS. The Contractor shall understand that, while the unit Commander may allow contracted personnel temporary or interim access to Government systems in non-sensitive positions pending the outcome of the NACI (usually through a 90-day waiver), contracted personnel will be immediately removed from the position if the NACI returns with unfavorable or denied adjudication.

3.3.4. Security Education. The Contractor shall be required to complete the security education training per DoD 5200.1-R, Information Security Program Regulation; Air Force Instruction (AFI) 16-1404, Air Force Information Security Program; and AFI 31-601, Industrial Security Program Management. All training is mandatory, to include initial, refresher, quarterly, annual, security and awareness training. Mandatory training also includes Anti-terrorism Awareness training and Operational Security (OPSEC) training. OPSEC training will also address specific security criteria for protecting critical information and OPSEC indicators within the Contractor's duties.

3.4. Travel.

The Government requires the Contractor to travel in order to meet the requirements in this PWS.

The Government expects to authorize the Contractor to travel an average of five (5) times in the year in the Continental United States. The Government estimates that each trip will average four

(4) weekdays in duration, two (2) of which are travel days.

3.4.1. Travel Guidance. Contractor travel shall be in accordance with the Joint Travel Regulations (JTR): https://www.defensetravel.dod.mil/Docs/perdiem/JTR.pdf).

3.4.2. Travel Pre-Approval. The Contractor shall obtain written (emailed) authorization for travel from the COR prior to arranging travel logistics: all passenger transportation, lodging, and subsistence. The Contractor shall email the following information to the COR when seeking approval for travel: destination, dates, purpose, and the estimated cost of the trip broken down by airfare, lodging, meals and incidental expenses, car rental (if approved by the COR), taxi/parking, and other miscellaneous costs.

3.4.3. Travel Reimbursement. The Contractor shall invoice the Government for travel reimbursements in accordance with the FAR 31.205-46. The Contractor shall notify the Government when invoiced travel expenditures are 75% of awarded travel funds. The Contractor shall travel using the lowest cost mode of transportation commensurate with the mission requirements. Reimbursement will not exceed cost incurred by Contractor. In addition, reimbursement will not exceed the travel contract line item number (CLIN) dollar amount on the contract.

3.4.4. Trip Report. The Contractor shall submit Trip Reports (TRs) within five (5) business days after travel completion. TR contents shall include:

• Supporting documents for each traveler: airline ticket/receipt, hotel invoice, car rental, gas, parking, tolls, etc.

• Inclusive Dates of Travel

• Destination

• Purpose

• Individuals Contacted

• Brief Synopsis

• Issues & Challenges

• Recommendations

• Signature Block

3.5. Place of Performance and Hours of Operation.

The Contractor shall comply with established security procedures for entering the installation and its facilities to include any special security procedures that may be established for entry to restricted, mission essential, or vulnerable areas. The Contractor shall adhere to all announced guidance when the installation alters its security condition.

3.5.1. Primary Place of Performance. The work to be performed under this contract shall be performed at the DHHQ, Falls Church, VA. The Contractor shall on occasion be required to attend briefings or training at Bolling AFB, Fort Detrick, the Pentagon, or other locations within the National Capital Region area. DHHQ is a smoke-free facility.

Defense Health Headquarters 7700 Arlington Blvd.

Falls Church, VA 22042

3.5.2. Work Hours. Normal business hours at the primary place of performance is eight (8) hours at the primary place of performance between the hours of 7:00am to 6:30pm, Monday through Friday. The Government reserves the right to change hours of operation or restrict Contractor’s access.

3.5.3. Scheduled Government Holidays. Government holidays (non-workday weekdays) are New Year’s Day; Dr. Martin Luther King, Jr. Birthday; Presidents’ Day; Memorial Day;

Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day; and Christmas Day.

3.5.4. Facility Closures. The Government will notify the Contractor of anticipated closure of the facility, (i.e., training, holidays, administrative leave granted to the entire staff, or other closure including down days) five (5) business days in advance or as soon as possible. A down day is a day that USAF leadership designates as a minimal manning/liberal leave day. In the event of unplanned closure of the facility due to natural disasters, military emergency, or severe weather, the Government will notify the Contractor in the same manner as the Government notifies Washington D.C. area civilian personnel. In the event of emergencies, base or facility closures, or other reason the Contractor’s Government site workspaces are not available to Contractor personnel, the Contractor must have a plan (submitted as part of the Contractor’s proposal) to fulfill the PWS requirements from an off-site location. The Contractor shall submit updates to this plan if changes occur.

3.6. Privacy of Information.

The Contractor shall not release any personnel or medical/patient information to include patient content with personal health information. The Contractor shall comply with information privacy guidance in Appendix D.

3.6.1. Privacy Act of 1974. The Privacy Act of 1974 (5 U.S.C. § 552a), which includes Public Law 100-503, DoDD 5400.11, and DoD 5400.11-R and must be treated as FOR OFFICIAL USE

ONLY.

3.6.2. Need to Know. Contractor shall provide patient information only to authorized Government employees, Government Contractors, and Subcontractors having a need-to-know such information in the performance of their duties for this contract.

3.7. Nonpersonal Services.

The Government will neither supervise the Contractor nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules, for the Contractor. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. The Contractor shall immediately notify the CO if any Government action(s) constitute or have a perception of being personal services. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the Contractor shall be the sole responsibility of the Government.

3.8. Period of Performance.

The period of performance on this contract shall be one (1) base year and four (4) option years to begin on or around 1 October 2015 through 30 September 2020.

3.9. Telework

An alternate duy location is authorized for this PWS. The Contractor telework policy and procedures should be closely aligned to that of the Government to ensure continuity and timeliness in completing tasks. The Contractor shall agree to a telework schedule with the Government PM. The Government shall have final approval of the telework schedule.

Contractor shall propose an alternate work location of either his/her home or Contractor’s office.

Telework is authorized in the event of unplanned closure of the facility due to natural disasters, military emergency, or severe weather.

APPENDIX A: ACRONYMS, ABBREVIATIONS AND GLOSSARY OF TERMS

AF Air Force AFI Air Force Instruction AFMS Air Force Medical Service AFMSA Air Force Medical Support Agency AFSO21 Air Force Smart Operations 21st Century BAA Business Associate Agreement CAC Common Access Card CFR Code of Federal Regulations CO Contracting Officer COR Contracting Officer’s Representative CONUS Continental United States CPI Continuous Process Improvement DHA Defense Health Agency DHHQ Defense Health Headquarters DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction e-QUIP Electronic Questionnaires for Investigations Processing FAR Federal Acquisition Regulation FTC Federal Trade Commission GFI Government Furnished Information HHS U.S. Department of Health and Human Services GFP Government Furnished Property HIPAA Health Insurance Portability and Accountability Act IT Information Technology JPAS Joint Personnel Adjudication System LAN Local Area Network LSS Lean Six Sigma MSR Monthly Status Report MTF Medical Treatment Facility NDA Non-Disclosure Agreement NoPP Notice of Privacy Practices OCI Organizational Conflict of Interest PHI Protected Health Information PM Program Manager PWS Performance Work Statement QAE Quality Assurance Evaluator OCI Organizational Conflict of Interest

QCP Quality Control Plan SG Surgeon General US CERT US Computer Emergency Readiness Team

APPENDIX B: APPLICABLE PUBLICATIONS

Publications and forms are available electronically through the internet. Publications and forms applicable to this PWS are coded as mandatory. The Contractor shall comply with mandatory publications and forms to the extent specified in this PWS. The Contractor shall be responsible for all updates, supplements, and amendments to mandatory documents through the life of this contract. Publications applicable to the PWS include, but are not limited to, those listed below.

The Contractor is obligated to follow all applicable publications. These publications are available online and are maintained by the Government. Supplements or amendments to listed publications from any organizational level may be issued during the life of the contract.

DoD Directives.

DoD Directives can be found at http://www.dtic.mil/whs/directives/index.html. Consult this site for the latest change. Regulations are followed by a “-R” (e.g., DoD 6025.18-R) and can be located on the website by clicking on “Publications” instead of “Directives.”

Air Force Instructions/Manuals.

The Air Force’s E-Publishing website is at http://www.e-publishing.af.mil. Consult this site for the latest change.

http://www.dtic.mil/whs/directives/index.html http://www.e-publishing.af.mil/

APPENDIX C: BUSINESS ASSOCIATE AGREEMENT

Introduction

In accordance with 45 CFR 164.502(e) (2), 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18- R, DoD Health Information Privacy Regulation, January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below).

The parties are a DoD MHS component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances and in reference to this BAA, shall mean [INSERT NAME OF

BUSINESS ASSOCIATE].

Agreement means this BAA together with the documents or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean Headquarters Air Force, Office of the Surgeon General, Medical Plans and Programs Directorate.

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD MHS. These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45

CFR 164.402.

HIPAA Rules means collectively the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act or HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of this Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e) (1) (ii) and 164.308(b) (2) respectively and corresponding DoD HIPAA Issuances, as applicable the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or as directed by the Covered Entity to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524 and corresponding DoD HIPAA Issuances.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526 and corresponding DoD HIPAA Issuances.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528 and corresponding DoD HIPAA Issuances.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of the HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s).

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate.

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in this Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose, and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in this Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in this Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in this Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s healthcare operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions.

(a) The Covered Entity shall notify the Business Associate of any limitation(s) in the notice of privacy practices of the Covered Entity under 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by 45 CFR

164.522 and the corresponding DoD HIPAA Issuances, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity.

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response.

(a) In general.

(1) In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall report the breach to the Covered Entity in accordance with Section VII, assess the breach incident, take mitigation actions as applicable, and notify affected individuals, as directed by the Covered Entity.

(2) The Business Associate shall coordinate all investigation actions with the Covered Entity and at a minimum, follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

(3) The Business Associate shall, at no cost to the government, bear any costs associated with a breach of PII/PHI that the Business Associate has caused or is otherwise responsible for addressing.

(b) Government Reporting Provisions

(1) If the Covered Entity determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the Covered Entity, regardless of where the breach occurs. If the Covered Entity determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office.

(2) This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business Associate shall implement these breach response requirements immediately upon the Business Associate’s discovery of a possible breach.

(3) The following provisions of Part V set forth the Business Associate’s Privacy Act and HIPAA breach response requirements for all breaches, including but not limited to HHS breaches.

(i) The Business Associate shall report the breach within one hour of discovery to the US Computer Emergency Readiness Team (US CERT) and within 24 hours of discovery, to the Covered Entity and to other parties as deemed appropriate by the Covered Entity. The Business Associate is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer or other agent of the Business Associate.

(ii) The Business Associate shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report/. Before submission to US-CERT, the Business Associate shall save a copy of the on-line report. After submission, the Business Associate shall record the US- CERT Reporting Number. Although only limited information about the breach may be available as of the one (1) hour deadline for submission, the Business Associate shall submit the US- CERT report by the deadline. The Business Associate shall e-mail updated information as it is obtained, following the instructions at http://www.us-cert.gov/pgp/email.html. The Business Associate shall provide a copy of the initial or updated US-CERT report to the Installation Privacy Act Officer, MTF HIPAA Privacy Officer, and the Contracting Officer (if applicable), if requested. Business Associate questions about US-CERT reporting shall be directed to the Installation Privacy Act Officer or MTF HIPAA Privacy Officer, not the US-CERT office.

(iii) The Business Associate shall comply with the Breach Timeline and Notification Flow Chart processes attached to this Agreement, to include the timelines established for completing the DD Form 2959 and the HIPAA Privacy Incident Report.

(4) If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances. The Business Associate shall inform the Covered Entity as soon as possible if it believes that “single event” breach response is appropriate the Covered Entity will determine how the Business Associate shall proceed and if appropriate, consolidate separately reported breaches for purposes of Business Associate report updates, beneficiary notification and mitigation.

(i) When a Breach Report Form initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the Business Associate shall submit a revised form or forms, stating the updated status and previous report date(s) and showing any revisions or additions in red text. Examples of updated information the Business Associate shall report include, but are not limited to: confirmation on the exact data elements involved, the root cause of the incident and any mitigation actions to include, sanctions, training, incident containment, and follow-up. The Business Associate shall submit these report updates within three (3) business days after the new information becomes available. Prompt reporting of updates is required to allow the Covered Entity to make timely final determinations on any subsequent notifications or reports. The Business Associate shall provide updates to the same parties as required for the initial Breach Reporting Form. The Business Associate is responsible for reporting all information needed by the Covered Entity to make timely and accurate determinations on reports to HHS as required by the HHS Breach Rule and reports to the Defense Privacy and Civil Liberties Office as required by DoD Privacy Act Issuances.

(ii) In the event the Business Associate is uncertain on how to apply the above requirements, the Business Associate shall consult with the Covered Entity and the Contracting Officer when determinations on applying the above requirements are needed.

(c) Individual Notification Provisions

(i) If the Covered Entity determines that individual notification is required, the Business Associate shall provide written notification to individuals affected by the breach as soon as possible, but no later than 10 working days after the breach is discovered and the identities of the individuals are ascertained. The 10 day period begins when the Business Associate is able to determine the identities (including addresses) of the individuals whose records were impacted.

(ii) The Business Associate’s proposed notification to be issued to the affected individuals shall be submitted to the parties to which reports are submitted under paragraph VII for their review and for approval by the Contracting Officer, in consultation with the Covered Entity.