Atch D - Statement of Work (SOW).pdf

Statement of Work

Teleradiology Services 3 April 2025

A. INTRODUCTION:

Fort Duchesne Health Center is an ambulatory health care center which provides comprehensive health services primarily to Native American /Alaska Natives and other eligible beneficiaries within the Uintah Basin area. Fort Duchesne Health Center is remotely located approximately 160 miles south-east of Salt Lake City, Utah and serves as the primary health facility for the Paiute, Shoshone, and Ute tribes.

B. SCOPE OF WORK:

I. Contractor shall provide:

A.) The Contractor shall perform off-site teleradiology for Fort Duchesne Health Center which is located at 6932 E. 1400 S. Fort Duchesne, UT 84026.

B.) Hours of Operation are Monday through Friday from 8:00 AM to 5:00 PM.

C.) Teleradiology interpretation service for Direct X-Ray (DX) exams. Most studies will be designated “routine.”

D.) Contacting the IHS ordering provider or clinical director in the absence of the ordering provider immediately in the event that the interpretation of a study suggests a significant health risk to the patient.

E.) Be available during the Hours of Operation for questions from providers concerning the Contractor’s study interpretations. Contractor will define the method for contacting the Radiologist.

F.) Providing teleradiology reception capability compatible with Indian Health Services (IHS) Resource and Patient Management System (RPMS) and the Department of Veteran Affairs (VA) VistA Imaging system.

G.) Providing all transcription services, reports will be transmitted to U & O via fax or virtual fax and/or facility technicians will be able to view, copy/paste final reports directly from REAL Radiology’s PACS (OnePACS), as HIPAA compliant cloud-based platform.

• There will be an option to convert to an HL7 interface should it become evident that the benefits would outweigh the costs, but initially U&O will utilize the Gateway system to retrieve reports.

H.) PC required for the gateway application is optioned to be purchased/supplied by IHS, or provided by REAL Radiology at a cost as noted in Bid Schedule (allowing the IHS location to retain the equipment upon termination of the contract).

I.) Provide a point of contact for network and technical issues during the Hours of Operation.

J.) Provide a point of contact for interpretation/clinical issues during the Hours of Operation.

II. Reports:

A.) Provide a final written interpretation on all routine studies within 8 hours after receipt of the study. Interpretations on studies received within <24hrs remaining in the business week (Monday -Friday, excluding holidays) will be provided on the first business day of the following week.

B.) Provide a final written interpretation on all emergent studies within one hour of receipt of the study.

C.) Protocol for Critical Results Reporting:

The contractor will call the report to the requesting provider of a radiology exam within 30 minutes after receiving the examination that can have a critical impact on the patients care (critical results). Results will be communicated to the ordering provider.

D.) The REAL Radiology Gateway Application will be the primary method for the reporting and completion of an exam. However, in the event of a downtime, the contactor shall exercise the Protocol for Critical Results Reporting for all examinations.

III. Quality Management and Qualifications :

Contractor shall provide:

A.) The contractor will have in place a daily proactive monitoring system to ensure that contract interpretation benchmarks are met.

B.) Contractor will have a designated coordinator for technical and medical staff issues.

C.) Contractor shall have a designated primary technical consultant for computer, network and software issues relative to this contract.

D.) Contractor will develop or shall demonstrate a Quality Assurance (QA) program to monitor performance and submit quarterly reports to Contracting Officer Representative (COR).

E.) The contractor must provide all applicable criteria for credentialed and privileged attending physicians who will be providing these services.

F.) Contractor will enter into a "Distant Site Telemedicine Entity Credentialing and Privileging Agreement" with Fort Duchesne Health Center.

G.) The contractor must be Joint Commission accredited.

H.) The contractor shall provide, if necessary, a completed credentials file which shall include documentation of:

i.) Radiology residency training ii.) Board certification radiology iii.) Medical school training iv.) Tort claims history and liability coverage v.) Expe1ience appropriate to the scope of service vi.) Licensure (active unrestricted U.S. medical license)

D. PRICE/COST:

The Contractor shall be compensated at the agreed contract amount based on invoices submitted and only for services in direct performance of this contract.

The Contractor does not allow for annual or sick leave or other fringe benefits.

Per mandate by the U. S. Department of Treasury and effective July 1996, payments by Electronic Funds Transfer System (EFTS) will be made to the Contractors designated financial institute.

The Federal Government DOES NOT WITHHOLD taxes from the Contractor, any Local, State or Federal taxes. It is the Contractor's sole-responsibility to pay their own taxes and other personal obligations that they may have.

E. PERIOD OF PERFORMANCE:

Contract performance shall commence on date of award and four (4) option years. Extension of the contract shall not be executed unless by written notification.

F. SITE LOCATION:

Fort Duchesne PHS Indian Health Center Radiology Department P.O. Box 160 Fort Duchesne, Utah 84026 ATTN: Barbara Stavropoulos Phone: 435-725-6865

G. INFORMATION TECHNOLOGY AND INFORMATION SECURITY REQUIREMENTS:

The Indian Health Service (IHS) is responsible for maintaining an information security program that provides protection for information collected or maintained by or on behalf of the Agency; and information systems used or operated by the Agency or by a contractor of the Agency or other organization on behalf of the Agency.

1.) Phoenix Area Office Department of Information Resource Management (IRM) must review, approve, and verify the Contractor connectivity functionality. The Contractor will be responsible for establishing and maintaining computer network connectivity with Fort Duchesne Health Center as well as associated costs, including configuring their system for connectivity. Minimum specifications require a "business class" high-speed internet connection such as Symmetric Digital Subscriber Line (SDSL) or a dedicated Tl to the Contractor and/or Internet Service Provider (ISP).

2.) Contractor is required to make the appropriate arrangements with all hardware and software vendors for proper licensing of their products for Contractor computer systems.

3.) REAL Radiology has the ability to provide HL7 interface, however U&O volumes may not warrant the expense to IHS/Taxpayers. U&O technicians, care providers and patients will utilize REAL Radiology’s Gateway Application which provides a 99.999% uptime record, is HIPAA compliant and provides a streamlined study/report sharing capability for patients and referring physicians.

However, U&O will have the option to purchase the HL7 interface should they decide that the benefits outweigh the costs after using the Gateway. This option will remain for the life of the contract or until exercised.

4.) The Contractor must maintain a system that is reliable and functional to prevent any disruption in the delivery of services. The Contractor and/or sub-contractor must always maintain data transmission security.

5.) Contractor and/or sub-contractor must notify the Phoenix Area Office IRM Department or the Fort Duchesne Radiology Department radiology staff immediately of any equipment malfunctions that would impact the ability to provide reports.

6.) Contractor must handle data containing patient-specific identifiers in such a way as to prevent disclosure to unauthorized parties. This includes transmission of data as well as storage of the data by the Contractor shall comply with all applicable data security laws and guidelines, as well as HIPAA and Joint Commission or equivalent provisions. The Contractor and/or sub-contractor will provide care and attention to patient data. All patients must feel assured of their privacy and personal dignity in accordance with applicable laws, rules, and regulations. All patient information remains the sole property of the U.S. Government and may not be used for any purpose other than those stipulated in this contact. Fort Duchesne Health Center will be the primary custodian of the patient information (including both the image data and the report) for all purposes related to Fort Duchesne Health Center and Government records retention requirements. Upon request, the Contractor will provide Fort Duchesne Health Center with access to information pertaining to the way in which the Contractor maintains Fort Duchesne Health Center patient data and the steps taken on an ongoing basis to assure the privacy and security thereof. This includes, but is not limited to, information regarding computer network architecture, configuration of firewall(s), routers, and other pieces of networking equipment, information about installed security software, and audits of patches for known security vulnerabilities. The Contractor must ensure the installation of all relevant security-related Operating System patches, approved anti-virus software, and all updates on all computer systems that access Fort Duchesne Health Center data.

7.) Contractor and/or sub-contractor(s) computer systems or networks that transmit, store or process Fort Duchesne Health Center protected healthcare information must implement the appropriate security controls to protect that data from unauthorized access, disclosure, modification, or loss.

Contractor and/or sub-contractor computer systems shall have virus protection installed and maintained with current updates. The Contractor and/or sub-contractor must install and maintain all operating systems and software applications, configured and maintained at the current release and security update/patch. Contractor and/or sub-contractor will, after award, demonstrate, create, implement, and document a backup plan with a periodic testing schedule.

8.) All Contractor and/or sub-contractor personnel who process, store, or transmit on Contractor and/or sub-contractor or Fort Duchesne Health Center computer systems shall be assigned unique user identifications (IDs) and passwords. Contractor and/or sub-contractor personnel shall be responsible for all activity performed with their user IDs. Contractor and/or sub-contractor personnel must not share or allow anyone to use their IDs, to include associates, friends, family members, or others.

These IDs are for the exclusive use of each Contractor and/or sub-contractor only and must remain secure at all times. Contractor and/or sub-contractor personnel are forbidden from perfo1ming any activity with user IDs belonging to other individuals. The Contractor and/or sub-contractor shall notify the Contracting Officer Representative and/or Fort Duchesne Health Center Information Security Officer immediately when their personnel no longer require access to the computer systems.

9.) All Contractor and/or sub-contractor personnel who process, transmit or access Fort Duchesne Health Center computer systems or networks shall be required to sign and submit a copy to the Contracting Officer the Indian Health Service of Rules of Behavior Agreement. A signature on this statement indicates the user understands and agrees to adhere to Indian Health Service policies, standards, procedures, and guidelines.

10.) Whenever a computer connection is established between the Fort Duchesne Health Center and the Contractor's and/or sub-contractor's computer system located outside the official Indian Health Service network or facility, and whenever the connections transmit, this information shall be encrypted using Indian Health Service approved standard algorithms and implementations.

11.) The Contractor and/or sub-contractor shall report any infom1ation security violations or attempted violations or any unanticipated threats, disclosures or hazards to Fort Duchesne Health Center Radiology Department or Phoenix Area IRM Department immediately.

12.) Indian Health Service reserves the right to audit and review Contractor and/or sub-contractor personnel security, information security, and privacy controls to determine their adequacy in regards to Federal or State regulations and laws, and Indian Health Service policy, standards, procedures and guidelines. This includes, but is not limited to inspecting the Contractor's and/or sub-contractor's facility, installations, operations, documentation, records and databases.

H. CONTRACTOR AND/OR SUBCONTRACTOR REMOTE ACCESS

REQUIREMENTS:

The Contractor and/or subcontractor will use remote access to connect to the Fort Duchesne Health Center computer systems or network(s) in the performance of the Contract. Indian Health Service has stringent policies and procedures covering remote access. Therefore, the Contractor and/or subcontractor must follow the responsibilities outlined below:

1.) Al l remote connections to the Indian Health Service network shall be through the Information Technology Access Control (ITAC) office. Office Cyber Security (OCS) authorized configurations and access points. Contractor and/or subcontractors will access, through the internet or other networks using Indian Health Service remote access Virtual Private Network (VPN) Service and software.

2.) Indian Health Service shall provide secure and reliable remote access to systems, applications, and info1mation on the Fort Duchesne Health Center network to the Contractor and/or subcontractor.

3.) All Contractor and/or subcontractor personnel requesting remote access shall be required to sign an Indian Health Services VPN Rules of Behavior. The Contractor and/or subcontractor shall be responsible to ensure their personnel follow the terms of the agreement. On award, the Contractor must complete an Interconnect Security Agreement (TSA).

4.) The Contractor and/or subcontractor shall adhere to the remote access requirements, and ensure proper and appropriate configuration of each system and that security mechanism and monitoring devices are up to date with best practices and technical standards.

I. IT SECURITY-INFORMATION SYSTEMS SECURITY AWARENESS (ISSA)

TRAINING:

Information Systems Security Awareness (ISSA) is mandatory annual security awareness training for all IHS system users and fulfills Federal mandates and regulations. IHS develops the modules in line with National Institute of Standards and Technology (NIST) guidelines on info1mation security awareness and information security trainings.

The ISSA modules fulfill an IHS user's annual requirements for the following:

1.) Acknowledgement and acceptance of the IHS Rules of Behavior 2.) Privacy training 3.) Protecting sensitive information and the Health Insurance Po1tability and Accountability Act

(HIPAA) & the Health Information Technology for Economic and Clinical Health Act

(HITECH)

4.) Physical and information security 5.) Appropriate email use 6.) Protecting mobile devices and portable media 7.) Social engineering awareness 8.) Incident response and learning from past incidents

You can take the training or learn more at the ISSA website.

All IHS information system users must take annual security and privacy training in order to fulfill federal mandates and regulations. In addition, all new users must successfully complete this course within 24 hours off receiving access unless the user has read the IHS Quick Guide to Information Security, in which case they will have 30 days to complete the training. Failure to complete training requirements will result in the loss of information systems access.

J. INCIDENT RESPONSE PROCEDURES:

To meet federal requirements and provide IHS with centralized incident reporting and response services, IHS established the IHS Incident Response Team (IRT) to coordinate IHS- wide cyber security information sharing, analysis, and response activities. The IHS IRT provides a centralized resource for collecting, analyzing, and disseminating information technology security incident-related information.

If you witness an IHS suspicious event or a potential incident, IMMEDIATELY do the following:

1. Contact - via email, phone or in person - your site manager or local ISSO. Be prepared to provide the date, time, location, and any other information you feel may be useful.

2. If you do not reach your site manager or local ISSO, contact your Area ISSO.

3. If you do not reach the Area ISSO, contact the IRS IRT using the information at the bottom of this page.

4. Do not discuss any suspicious activity with others to minimize impact on a possible investigation .

5. If the potential incident involves an information system:

a) STOP using the information system. Wait for further instructions from your ISSO or the

IRT.

b) LOCK the system (e.g., Ctrl+Alt+Delete ' Lock Computer).

c) Do NOT tum it off, logout, or otherwise change anything.

d) Impossible, prevent others from physically accessing the system.

K. QUALITY CONTROL:

1.) The Contractor shall provide services under the te1ms and of this contract with staff capable of providing proper and adequate services and workmanship.

2.) The Contractor shall be responsible for monitoring and evaluating the safety, quality and appropriateness of services provided and shall maintain the quality control program.

L. METHOD OF PAYMENT AND INVOICE SUBMISSION:

1.) Payment shall be made in ARREARS per month;

2.) Electronic Funds Transfer (EFT) shall be utilized as method for processing payment;

3.) Upon receipt of the Contractor’s properly prepared invoice, the COR is responsible for certifying the invoice for acceptance of service;

4.) Improperly prepared invoices will be returned to the Contractor resulting in delayed payment.

5.) Invoices shall be prepared and submitted electronically and in accordance with rates and terms as stated in the contract.

6.) Invoices should be submitted electronically through the US Treasury via IPP platform:

If you require assistance registering or IPP account access, please contact the IPP Helpdesk at

(866) 973-3131 (M-F 8AM to 6PM ET), or IPPCustomerSupport@fiscal.treasury.gov

Payments in Full/ No Billing IHS Beneficiaries: The Contractor shall accept payment for services rendered under this contract as payment in full. IHS beneficiaries shall not under any circumstances be charged nor shall their insurance companies including Medicare be charged for services rendered by the Contractor under this contract, even if IHS does not pay for those services. The Contractor shall not bill, charge, collect a deposit from, seek compensation, remuneration, or reimbursement from, or have any recourse against, any person or entity other than the IHS for services provided pursuant to this contract. It shall be considered fraudulent for the Contractor to bill other third parties for services rendered under this contract. This provision shall survive the termination or ending of the contract.

Invoice Requirements and Supporting Documentation: Supporting documentation and invoices must be submitted no later than the 30th workday of the month after services have been provided. Changes or corrections shall be submitted by separate invoice. In addition to information required for submission of a “proper” invoice in accordance with FAR 52.212-4 (g) all invoices must include:

1.) Purchase Order Number/Contract Number 2.) Period of performance or Shipment Information 3.) Charges for services or products identified by LINE ITEM NUMBER in the description.

4.) Description, quantity, unit of price and extended total per line item; total amount of invoice.

5.) Contractors contact information (name, title, phone number of point of contact in event of defective of invoice).

M. DESIGNATED CONTRACTING OFFICERS REPRESENTATIVE (COR):

James Kee, Supply Specialist, is hereby designated as the POC/COR for this service. His phone number is 435-725-6836. The POC/COR’s responsibilities will be to coordinate with the contractor the technical aspects of this service and the review of performance hereunder.

N. CONTRACTING OFFICERS REPRESENTATIVE (COR):

1.) The Contracting Officer shall designate the COR representing the Government for the purpose of this contract in writing. Such designation will set forth the duties specifically delegated in regard to the performance of this contract. A copy of the designation will be provided to the contractor.

2.) The major responsibility of the COR is to ensure Contractor accountability, monitor contract performance, and assist the Contractor in the resolution of program problems encountered during the performance of this contract.

3.) The COR shall be responsible for:

a) Monitoring the Contractor’s technical progress, including the surveillance and assignment of performance and recommending to the contracting Officer changes in requirements;

b) Interpreting Statement of Work;

c) Performing technical evaluation as required;

d) Performing technical inspection and acceptance required by the contract;

e) Assisting the contractor in the resolution of technical problems encountered during performance.

The COR’s responsibilities will be to coordinate with the contractor the technical aspects of this service and the review of performance hereunder. The COR does not have the authority to change or alter the order amount, terms and conditions.

O. CONTRACTING OFFICER:

The Contracting Officer is the only person with authority to act as the agent of the Government under this contract. Only the Contracting Officer has authority to: (1) Direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule;

(4) authorize reimbursement to the contractor for any costs incurred during the performance of this contract; or (5) otherwise changes any Terms and Conditions of this contract. The Government my unilaterally change it’s COR designation.

P. POINT OF CONTACT (CLINICAL):

Dr. Dwight Humpherys, Telephone: 435-725-6853

Email: dwight. humpherys@ihs.gov Fort Duchesne PHS Indian Health Center P.O. Box 160 Fort Duchesne, Utah 84026

Q. DEPARTMENT OF LABOR:

No contractor or subcontractor holding a service contract for any dollar amount shall pay any of its employees working on the contract less than the minimum wage specified in section 6(a)(1) of the Fair Labor Standards Act (29 U.S.C. 206).

The Department of Labor, Wage and Hour Division has issued a Wage Determination for laborers to be employed under this purchase order. Wage Determination applicable shall be based on the location/s of contractor’s employees. This is pursuant to Federal Acquisition Regulation (FAR) 22.1108-2.

In addition, to paying employees appropriate hourly wages the contractor is responsible for fringe benefits applicable to all classes of service employees engaged in purchase order performance. Fringe benefits are not included in the hourly wages.

R. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA):

The Contractor shall adhere to the Provisions of Public Law 104-191, HIPAA of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). Medical records of IHS patients are Federal records and are subject to some or all of the following laws: the Privacy Act. 5 U.S.C. 552a; the Freedom of Information Act. 5 U.S.C. 552; the Drug Abuse Prevention. Treatment. and Rehabilitation Act. 21 U.S.C. 1101. the Comprehensive Alcohol Abuse and Alcoholism Prevention.

Treatment and Rehabilitation Act. 42 U.S.C. 4541. the Health Insurance Portability and Accountability Act of 1996.42 U.S.C. 1301. Fort Duchesne Health Center's Confidentiality of Certain Medical Records.

38 U.S.C. 7332; Confidential Nature of Claims. 38 U.S.C. 5701; Medical Quality Assurance Records

Confidentiality. 38 U.S.C. 5705. and Federal regulations promulgated to implement those acts. 38 U.S.C. 5705 (Confidentiality of Healthcare Quality Assurance Review Records), 38 U.S.C. 7332 (Confidentiality of certain medical records), as well as 45 C.F.R. Parts 160,162 and 164 (Health Insurance Portability and Accountability Act) should be followed.

S. MEDICAL RECORDS:

Patient medical records are confidential and are protected by the Privacy Act of 1974, 5 U.S.C. 552a.

Any breach of confidentiality and/or unauthorized release of information is subject to monetary penalty.

Any individual making unauthorized disclosures may be criminally liable for violations of the Act.

END OF STATEMENT OF WORK