Attachment 1 - PWS.pdf

09 Feb 26

CUI

PERFORMANCE WORK STATEMENT

FOR

MEDICAL COUNTER – CHEMICAL,

BIOLOGICAL, RADIOLOGICAL, AND

NUCLEAR SUPPORT

Version 4

9 Feb 26

HQ AETC/SG COMMAND SURGEON

TABLE OF CONTENTS

1. INTRODUCTION

2. GENERAL INFORMATION

3. DESCRIPTION OF SERVICES

4. HOURS OF OPERATION

5. CONTRACTOR EMPLOYEES

6. SERVICE SUMMARY

7. QUALITY CONTROL PLAN

8. GOVERNMENT PROPERTY/SERVICES

9. ORGANIZATIONAL CONFLICT OF INTEREST

10. HIPAA BUSINESS ASSOCIATE AGREEMENT (BAA)

PERFORMANCE WORK STATEMENT

FOR

MEDICAL COUNTER – CHEMICAL, BIOLOGICAL, RADIOLOGICAL & NUCLEAR (MC-

CBRN) SUPPORT

1. INTRODUCTION. The AETC Medical Readiness Division (AETC/SGX) has the responsibility to provide oversight and compliance of policy, guidance, and technical support for the MC-CBRN program as it relates to medical emergency management in accordance with DAFI 41-106, Medical Readiness Program Management and AF Tactics, Techniques, and Procedures

(AFTTP 3-42.32).

1.1. Scope. This is a performance based, non-personal advisory and assistance (A&AS) services requirement in support of the MC-CBRN program within AETC/SG in accordance with established program goals and objectives for medical emergency management.

1.2. Workload. Workload estimate anticipated for one Full Time Medical Emergency Manager.

2. GENERAL INFORMATION. The purpose of this contract is to provide MC-CBRN program oversight at HQ AETC/SGX.

2.1. Annual Training Requirements. Contract employees shall complete all mandatory and annual training required in accordance with (IAW) DoD, Air Force Instructions, and regulatory agencies (TJC, Health Insurance Portability and Accountability Act (HIPAA), Air Force Computer Security Policy, and AF Safety Policy). They shall complete all additional training as dictated by the work-center specific to the duties.

Table 1 – Contractor Training Training Delivery Frequency HIPAA & Privacy Act Training

Web-based Annual

DoD Cyber Awareness Challenge

Web-based Annual

DoD Controlled Unclassified Information Training

Web-based Annual

Derivative Classification Web-based Annual Environmental Management Systems (EMS) General Awareness Training

Web-based One-Time

Operations Security (OPSEC) Awareness Training

Web-based One-Time

Federal Emergency Management Agency

Web-based One-Time

Independent Study (IS) Course 100.c, Introduction to the Incident Command System Federal Emergency Management Agency IS- 200.c, Basic Incident Command System for Initial Response

Web-based One-Time

Federal Emergency Management Agency IS- 700.b, An Introduction of the National Incident Management System

Web-based One-Time

Federal Emergency Management Agency IS- 800.c, National Response Framework an Introduction

Web-based One-Time

Defense Medical Readiness Training Institute Public Health Emergency Management Course

In-person One-Time

3. DESCRIPTION OF SERVICES: Comprehensive MC-CBRN programmatic support as MAJCOM Emergency Manager which includes but is not limited to:

3.1. Coordinating with AFMEDCOM and ACC for MC-CBRN program requirements, issues, and consultative support.

3.2. Support day-to-day activities of the MC-CBRN program and serve as reach back support to installation MEMs.

3.3. Reviewing unit Medical Contingency Response Plans (MCRPs), prior to publication to validate medical response capabilities and verify compliance with AF directives.

3.4. Collecting and evaluating MC-CBRN guidance change requests from subordinate units.

3.5. Maintaining situational awareness of subordinate Federal Coordinating Center capabilities by reviewing annual self-assessment checklists and exercise after action reports.

3.6. Coordinating support for Federal Coordinating Center staff assistance visits and National Disaster Medical System (NDMS) bed availability reporting, as scheduled or requested.

3.7. Assist with the preparation and execution of Home Station Medical Response (HSMR) annual budget for PEC 28036F.

3.8. Attend and act as subject matter expert for AETC/SGX on the Home Station Medical Response Working Group (formerly Medical Preparedness and Response Working Group) to develop strategies, policies, and tactics, techniques, and procedures.

3.9. Provide home station medical response training support to installation MEMs.

3.10. Provide guidance on HSMR inventory to meet current mission requirements and project future sustainability needs.

3.11. Monitoring and assisting with medical exercise development, execution, and improvement planning.

3.12. Facilitate Public Health Emergency Management nominations.

3.13. Minimum Qualifications. Contractor employee performing tasks related to these services shall meet the following minimum requirements:

3.13.1. At least 3 years of experience in the emergency management medical field.

3.13.2. DoD Experience or similar senior-level expertise in strategic planning, social marketing, program development and evaluation.

3.13.3. Experience in the functional knowledge of workflow analysis, business process reengineering and A&AS.

3.13.4. Experience in accomplishing multi-tasks (work, organize, and time management) projects simultaneously.

3.13.5. Experience in current software programs: Microsoft Office to include Project, and Internet search browsers/tools.

3.13.6. Experience in medical CBRN response, the National Incident Management System (NIMS), Hospital Incident Command System, and Homeland Security Exercise and Evaluation Program.

3.13.7. Complete and maintain the following Federal Emergency Management Agency Independent Study (IS) Courses within, and provide certificate of completion to the Contracting Officer Representative(COR), the past five years: IS-100.c, Introduction to the Incident Command System; IS-200.c, Basic Incident Command System for Initial Response; IS-700.b, An Introduction of the National Incident Management System and IS-800.c, National Response Framework an Introduction.

3.14. English Language Requirement. The applicant shall be able to read, speak, understand, and write English well enough to effectively communicate with staff and customers.

4. HOURS OF OPERATION

Normal Hours of Operation, the contractor shall perform the services required under this contract Monday - Friday, 0730-1630, excluding Federal holidays and other designated non-duty days.

However, if flextime or a compressed work schedule is in effect, work hours shall correspond with Government personnel duty hours. In the event that an occasional special project may occur, the contractor shall be required to work beyond the normal duty hours stated herein if required by the COR. If that should occur, the COR may alter the work schedule to accommodate the additional hours needed to accomplish the project.

4.1. If flextime or a compressed work schedule is in effect, contractor work hours shall correspond with Government personnel duty hours. Occasional change of work hours may be required to accommodate extraordinary requirements. Extended or compressed schedules that are mutually beneficial and do not exceed 80 work hours in the span of two weeks shall be coordinated through the COR. Government furnished resources shall be available during the hours of duty.

4.2. Place of Performance. The work under this contract shall be performed at HQ Air Education and Training Command, JBSA- Randolph, Texas. The contractor shall on occasion be required to attend training, briefings, mission events, and site visits within the San Antonio area, AETC base locations, and HQ AFMEDCOM.

4.3. Telework is situational based on the current AETC guidance and HPCON levels. Duties may be performed via telework by mutual agreement between AETC/SGX and the candidate, in accordance with AF and AETC telework policies. The government reserves the right to authorize situational telework on a case-by-case basis. Examples include but are not limited to the following: 1) an employee has a short-term need for uninterrupted time to complete work on a complex project or report. 2) an employee is recovering from illness or an injury and is temporarily unable to report to the traditional office physically. 3) an employee receives word of inclement weather and notifies her/his supervisor that s/he would like to opt for unscheduled telework that day.

4.4. Federal Holidays. The Contractor shall not be required to work any of the following federal holidays:

New Year’s Day - 1 January Martin Luther King Day - 3rd Monday in January President’s day (observed) - 3rd Monday in February Memorial Day - last Monday in May Juneteenth Day - 19 June Independence Day - 4 July Labor Day - 1st Monday in September Columbus Day - 2nd Monday in October Veteran’s Day - 11 November Thanksgiving Day - 4th Thursday in November Christmas Day - 25 December

4.5. Facility Closures. The Government will notify the Contractor of anticipated closure of the facility, (e.g., training, holidays, administrative leave granted to the entire staff, or other closure including down days) five business days in advance or as soon as possible. A down day is a day that the United States Air Force (USAF) leadership designates as a minimal manning/liberal leave day. The employee may take leave following their company’s policies or work from an alternate location. In the event of unplanned closure of the facility due to natural disasters, military emergencies or severe weather, the Government will notify the Contractor in the same manner as the Government notifies its civilian personnel.

4.6. Contract Manager. The Contractor shall provide a contract manager and an alternate who shall be responsible for the performance of the work. These individuals shall have full authority to act for the contractor on all contract matters relating to the daily operation of this contract and shall be designated, in writing, to the CO and COR. The alternate contract manager shall act for the contract manager when the manager is absent. The contract manager and alternate contract manager shall have experience in management and supervision.

4.6.1. The contract manager or alternate shall be available within 2 hours to meet on the installation or by telecom with the COR and/or with other government personnel designated by the CO during normal duty hours to discuss issues or concerns.

4.7. Communication. Contractor personnel shall always maintain open and professional communication with government personnel. Complaints validated by the COR shall be reported in writing to the CO and the contractor for action. Failure of the contractor to take corrective action on validated complaints raised by the COR and the CO will be considered a failure to perform.

5. CONTRACTOR EMPLOYEES.

5.1. The contractor shall not employ persons for work on this contract if such employees are identified to the contractor by the COR as a potential threat to the health, safety, security, general well-being or operational mission of the installation and its population.

5.2. The contractor is cautioned that Military Reservists and National Guard members may be subject to recall to active duty. The sudden absence of this personnel could adversely affect the contractor’s ability to perform; however, their absence at any time shall not constitute an excuse for nonperformance under this contract.

5.3. Appearance. Contractor personnel shall present a neat well-groomed appearance. Contractor personnel shall report for duty in a professional manner, in appropriate attire and having complied with socially acceptable standards of personal hygiene. Expected dress is business casual or business attire.

5.4. Conflict of Interest. The contractor shall not employ any person who is an employee of the U.S. Government if employing that person would create a conflict of interest, violate DoD 5500.7R Joint Ethics Regulation Chapter 5, or violate any other Air Force regulation, instruction, or policy. The contractor shall not employ any person who is an employee of the Department of the Air Force, either military or civilian, unless such a person seeks and receives approval in accordance with the Department of Defense (DoD) Directive 5500.7 and Air Force policy. If prior military, personnel shall have been discharged under honorable conditions with no administrative actions taken against them.

5.5. The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoDM 8140.03, Cyberspace Workforce Qualification and Management Program. The Contractor shall meet the applicable information assurance certification requirements, including:

5.5.1. DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoDM 8140.03; and

5.5.2. Appropriate operating system certification for information assurance technical positions as required by DoDM 8140.03.

5.5.3. Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems to perform information assurance functions.

5.5.4. In the event there is an error in any DAFIs, DoDIs etc., in this PWS, the latest version found at http://www.e-publishing.af.mil/ or https://www.esd.whs.mil/dd/dod-issuances/ shall apply.

5.6. Security Requirements. Obtaining and Retrieving Identification Media. As prescribed by the DAFFARS 5352.242-9000, Contractor access to Air Force installations, the contractor shall comply with the following requirements:

a. The contractor shall obtain base identification, and vehicle passes for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract.

b. No later than three days prior to start of contract work, the contractor shall submit a written request on company letterhead (or e-mail correspondence) to the COR (with copy to contract administrator) listing the following: project title, project number, contract number, location of work site, contract start and stop dates, work schedule, and names of contractor employees needing access to the base, including full legal name, date of birth, sex, race, SSAN, state issued I.D. Card/Driver License number, and name of sub-contractor if not employed directly by contractor (Government will provide template to be used in submitting visitor pass request). The authorized program manager will endorse the request and forward it to the issuing base pass and registration office or security forces for processing. Contractors will present government (state or federal) issued ID, and INS Form 9 (I9), before being issued a pass to enter the installation. A Wants and Warrants check is conducted for every person before a pass is issued. Personnel employed by the contractor shall get a pass for their privately owned vehicles at the installation Visitor Reception Center, with proof of the following:

(1) Liability Insurance http://www.e-publishing.af.mil/ http://www.esd.whs.mil/dd/dod-issuances/

(2) Current License Plates

(3) Current State Inspection Sticker (If required)

(4) Valid State Driver License

(5) A phone number for sponsor on base

c. Vehicles owned by the contractor with the company name permanently printed on them are not required to obtain a pass as long as a current work order is presented at the time of entry. However, current liability insurance, state inspection sticker, and registration is required.

The person driving the vehicle shall have a valid operator license for the type of vehicle.

d. The contractor is responsible for ensuring employees report to the installation Visitor Reception Center, to present their Form I-9 (Employment Eligibility Verification).

e. Upon completion or termination of the contract or expiration of the identification passes, the contractor shall ensure that all base identification passes issued to contractor employees are returned to the issuing office. If a contractor employee has been terminated, the pass will need to be retrieved and returned to Security Forces so that employee does not have base access. If the pass is not retrieved, then SF will need to be notified so base access is not allowed. Upon completion of the contract return all issued installation access passes to the issuing authority.

f. Failure to comply with these requirements may result in withholding of final payment.

5.7. Pass and Identification. The Host Unit shall ensure the following pass and identification items required for contract performance are obtained for employees and non-government owned vehicles:

a. Installation Access Pass (IAP) (DBIDS), Visitor/Vehicle Pass (DoDM 5200.08, Volume 3, DoD Physical Security Program: Access to DoD Installations), used for contracts for less than one year to include one-day visits (i.e. warranty work).

b. Installation Access Card (IAC) (DBIDS), Civilian Identification Card (DoDM 5200.08, Volume 3, DoD Physical Security Program: Access to DoD Installations), used for contracts for more than one year or more which do not require access to controlled areas or government computer systems.

c. DoD Common Access Card (CAC), (DAFI 36-3026), used for contracts for more than one year and requirement exists for access to the government computer systems and software. CAC applications are accomplished by Trusted Agents via the Trusted Agent Sponsorship System (TASS).

5.8. Suitability Investigations.

a. Security Clearance Requirements. The Contractor shall possess an active facility security clearance Tier 3 (T3), Secret, prior to award and prior to performing work on a classified Government contract. The Contractor assumes costs and conducts investigations for a Secret facility security clearance. Contractor shall have an active T3 Facility Clearance at the time of proposal. The Government will not pay for nor sponsor any Contractor’s attempt to obtain a Facility Clearance.

b. Security Requirements for Contractor Personnel Requiring Access to Classified Information. Contractor personnel shall require view access to and be involved in discussions concerning classified information. A contractor’s “Facility Clearance” is required IAW DoD 5220.22-M Incorporating Change 2_May 18, 2016, National Industrial Security Program Operating Manual. The Contractor shall possess an active facility security clearance Tier 3 (T3), Secret, prior to award and prior to performing work on a classified Government contract. The

c. A DoD Contract Security Classification Specifications T3 is required. The Contractors shall attend meetings and briefings related to CBRN and MC-CBRN that are classified Secret. For Contractors to provide comprehensive support, they need to stay current and aware of events and information located in classified documents.

d. Contractor personnel requiring a T3 Clearance shall be able to work in an environment applicable to classified and unclassified DoD information systems. These Contractor employees shall have view access only to the Secret Internet Protocol Router Network (SIPRNET) and shall access and analyze For Official Use Only (FOUO) and OPSEC required to execute the responsibilities of this position. These Contractor employees shall have access and analyze to the SIPRNET, NATO (North Atlantic Treaty Organization), FOUO, Communications Security (COMSEC), Restricted Data, Formerly Restricted Data, and OPSEC required to execute the responsibilities of this position. This designator is based on the potential for an individual assigned to this position to adversely impact DoD missions or functions. The position categories on this contract include Limited Privileged and Non-Privileged, as defined in DoDM 5200.2 Procedures for the DoD Personnel Security Program (PSP). Investigative requirements for each category vary.

5.8.1. Listing of Employees. The contractor shall maintain a current listing of employees. The list shall include employee's name, social security number, and date of investigation if service work involves unescorted entry to Air Force restricted or other sensitive areas designated by the installation commander. The list shall be validated and signed by the company supervisor and provided to the contracting officer prior to the contract start date. Updated listings shall be provided when an employee's status or information changes.

5.8.2. Freedom of Information Act Program (FOIA). The contractor shall comply with DoD Manual 5400.07_AFMAN33-302, DoD Freedom of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding for Controlled Unclassified Information (CUI) material.

The contractor shall comply with DAFI 33-332, Privacy and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013. The contractor shall remove or destroy official records only in accordance with DAFI 33-322, Records Management and Information Governance Program.

5.8.3. Reporting Requirements. The contractor shall comply with DAFI 71-101, Volume- 1, Criminal Investigations, and Volume-4 Counterintelligence. Contractor personnel shall report to an appropriate authority, any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

5.8.4. Entry Procedures to Controlled/Restricted Areas. Contractor personnel requiring unescorted entry to areas designated as controlled or restricted areas by the installation commander shall comply with installation’s access requirements and will possess, as a minimum, a favorable suitability determination. These requirements are contained in DAFI 31-101, Integrated Defense for installation access procedures and AFMAN 16-1405, for suitability determinations.

The contractor shall comply and implement local base procedures for entry to Air Force controlled areas.

5.8.5. Additional Security Requirements. In accordance with DoDM 5200.01, Information Security Program and AFMAN 16-1404, the contractor shall comply with AFSSI 7700, Emission Security (EMSEC) Program; applicable AFKAGs, DAFIs, and AFSSIs for Communication Security (COMSEC); and DAFI 10-701, Operations Security (OPSEC) Instructions. The contractor will comply with DoD Standard 22/Force Protection Condition Measures, DoD Standard 25/Level I-AT Awareness Training, and associated tasking contained in DoDI O-2000.16 Vol 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards. Level I AT Awareness training is available for contractor personnel and can be requested by calling the local installation AT Office.

5.8.6. Physical Security. Areas controlled by contractor employees shall comply with base Operations Plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and local search/identification requirements. The contractor shall safeguard all government property, including controlled forms, provided for contractor use. At the close of each work period, government training equipment, ground aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured. During increased FPCONs, contractors may have limited access to the installation and should expect entrance delays.

5.8.7. Key Control. The contractor shall establish and implement key control procedures in the Quality Control Plan to ensure keys issued to the contractor by the government are properly safeguarded and not used by unauthorized personnel. The contractor shall not duplicate keys issued by the government. Lost keys shall be reported immediately to the contracting officer. The government replaces lost keys or performs re-keying. The total cost of lost keys, re-keying or lock replacement shall be deducted from the monthly payment due the contractor. The contractor shall ensure its employees do not allow government issued keys to be used by personnel other than current authorized contractor employees. Contractor employees shall not use keys to open work areas for personnel other than contractor employees engaged in performance of their duties, unless authorized by the government functional area chief.

5.8.8. Lock Combinations. The contractor shall establish procedures in local Security Instructions ensuring lock combinations are not revealed to unauthorized persons and ensure the procedures are implemented.

5.9. Traffic Laws. The contractor and their employees shall comply with base traffic regulations.

5.10. Weapons, Firearms, and Ammunition. Contractor personnel are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on any Air Force base/DOD installation.

6. SERVICE SUMMARY

6.1. The contract service requirements are summarized in performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimally acceptable levels of service required for each requirement. The SS provides information on contract requirements, the expected level of contractor performance and the expected method of government surveillance and confirmation of services provided. These thresholds are critical to mission success. Procedures as set forth in the Federal Acquisition Regulation (FAR) 52.212-4 (a), Contract Terms and Conditions - Commercial Items, Inspection/Acceptance, will be used to remedy all deficiencies. The absence of any contract requirements from the SS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the contract. The Government has the right to inspect all services required in the contract. The contractor’s performance will be monitored and documented on the monthly surveillance checklist by the Government and reported annually in CPARS (Contractor Performance Assessment Reporting). Performance standards shall include the contractor’s ability to comply with the criteria listed in the Services Summary categories and the overall performance.

Table 2 Service Summary

Performance Objective PWS Paragraph

Performance Threshold

Method of Surveillance

1. Review and provide guidance on

Medical Emergency Management Policy and Tactics, Techniques and Procedures.

3.2.

3.3.

3.4.

3.8.

3.10.

90% (monthly) Periodic/Valid customer complaint

2. Monitor FCC capabilities and coordinate support.

3.5.

3.6.

90% (bi-annually)

Periodic/Valid customer complaint

3. Assist in preparation and execution MAJCOM Program Element Code (PEC) 28036F budget requirements.

3.7.

Excellent –

Submitted on time with no errors and no complaints received in a one (1) month period.

Very Good –

Submitted on time with one (1) error or less and no more than one (1) complaint received in a one

(1) month period.

Satisfactory - Submitted on time with no more than two (2) technical errors per page and no more than three

(3) complaints received in a one (1) month period.

Marginal – Submitted on time with no more than three (3) technical errors per page and no more than four (4) complaints received in a one (1) month period.

Unsatisfactory – Submitted late or with more than three

(3) technical errors per page, not submitted at all, or receiving more than four (4) complaints in a one

(1) month period.

100% Inspection

4. Provide HSMR training support and oversight to installation MEMs.

3.9.

3.11.

3.12.

90% (monthly)

Periodic/Valid customer complaint

6.2. Contractor Travel: Contractor personnel may be required to travel throughout the Continental United States (CONUS) to support flying training, mission requirements, labor efforts, attend meetings, conferences, and training. Most travel is projected to begin and end on weekdays (Monday–Friday) but occasional travel during a holiday or weekend may be required. In some cases, travel may exceed the standard 8-hour workday. All travel requires Government pre-approval/authorization in writing and notification to the Contracting Officer Representative (COR).

Contractor Reimbursement for Employee Travel Expenses for Temporary Duty (TDY). The contractor shall conduct travel in support of mission requirements as directed by the COR.

Table 3 Projected Travel

Event Projected Travel Destination Duration (# of Days) HSMR Working Group Meeting

Semi-Annually Falls Church, VA 5

Global Medical Readiness Workshop

Annually Location to be determined

Installation HSMR Program Support

Bi-Monthly Locations to be determined

FCC Exercise Annually Location to be determined

6.2.1. Travel within the local area or place of performance to attend meetings, conferences, seminars or perform work shall be considered a cost of doing business and shall not be separately reimbursed as a travel expense. Local area travel is defined as within an 80-kilometer radius of the primary place of performance. Any travel, outside the primary place of performance, in support of this PWS which incurs reimbursable charges against the Government, shall require a Travel Authorization Request (TAR) and an approved Letter of Identification (LOI). The contractor shall initiate and sign the TAR, obtain the contract on-site PM coordination and then submit the TAR to the COR. The TAR shall be in writing and contain at a minimum the name of the traveler, date timeline, location, clearance level and issuing authority, and estimated cost. The COR will create the LOI, verify available funding and obtain the COs approval/signature on the LOI. The TDY approval process shall allow a minimum lead time IAW Table 2. No travel shall be conducted in support of this contract, regardless of distance, without a fully coordinated and pre-approved TAR and LOI signed by the CO.

6.2.2. The contractor shall be responsible for obtaining all passenger transportation, lodging and subsistence required in performance of the contract. Allowable travel costs are described in FAR 31.205-46, Travel Costs. The contractor shall be reimbursed IAW FAR 31.205-46. The reimbursement shall be at actual costs incurred but shall not exceed the approved amount of the LOI. If the travel arrangements cause additional costs, which exceed those previously negotiated, written approval by the CO is required prior to undertaking such travel. The contractor shall travel using the lowest cost mode transportation commensurate with the mission requirements. The Government will reimburse the contractor for travel on a cost reimbursable basis; no profit or fee will be paid.

Table 4 Travel Notification Timeframes

Duration of TDY in Days Minimum Lead Time Notification 1-5 business days 3 business days 6-15 business days 5 business days More than 16 business days 10 business days

6.2.3. The contractor shall be paid per diem allowance each day an employee is required to stay overnight away from his/her normal duty station, while on official temporary duty status.

6.2.4. Meals and Incidental Expenses (M&IE) will be reimbursed at the published M&IE rate for the dates and locations of travel.

6.2.5. When commercial air travel or car rental is authorized, the contractor shall utilize coach, tourist, or similar accommodations.

6.2.6. When Government quarters are available and approved, the contractor shall use them.

6.2.7. In cases where the TDY purpose requires the Government and the contractor to travel to the same location and the Government provides transportation on a Government Owned Vehicle (GOV), the contractor cannot opt to drive on their own and charge the Government for mileage.

6.2.8. Payment shall be made directly to the contractor on a cost reimbursable basis, upon submission of proper invoices and supporting documentation to the COR. Invoices for reimbursable travel shall be submitted as soon as possible, but within 15 business day from the end of the travel period.

6.2.9. Trip Reports. The contractor shall post trip reports within 5 business days of the conclusion of travel. Trip Reports shall contain such information as the dates, locations, purpose and travelers involved in any travel taken in the performance of this contract. The trip report shall identify any issues or risks revealed that may have an impact on the systems and/or programs germane to this contract plus any action item that shall be accomplished by any party in order to accomplish the goals of this contract.

6.3. Alternate Place of Performance: If performance is required at a location other than the principal place of performance, i.e., other Government locations worldwide on a temporary basis, travel shall be IAW guidelines contained in this PWS. If the circumstances require remote support services, the contractor shall obtain prior written approval from the COR and CO.

7. QUALITY CONTROL PLAN

7.1. General Guidance. Only the COR or the designated alternate COR has the authority to inspect, accept, or reject all deliverables.

7.2. Quality Assurance. The government is responsible for evaluating the contractor's performance. For those tasks listed on the Service Summary (SS), the COR shall follow the methods of surveillance specified in the Quality Assurance Surveillance Plan (QASP). The COR shall record all surveillance observations. COR surveillance of tasks not listed in the SS or by methods other than those listed in the SDS may occur during the performance period of this contract on an as-needed basis.

7.3. Quality Meetings. The CO may require the contractor to meet with the CO, contract administrator (CA), COR, and other government personnel as deemed necessary. The contractor may request a meeting with the CO when he or she believes such a meeting is necessary.

7.4. The COR shall record written minutes of any such meetings. A copy of the minutes shall be sent to all attendees via e-mail for their review. A copy of all recorded minutes shall be provided to the contractor, and a copy shall be placed in the official contract file for record keeping purposes. In the event the contractor does not concur with any portion of the minutes, exceptions to the minutes shall be provided, in writing, to the CO within 10 working days following receipt of the minutes. The final resolution to exceptions taken by the contractor resides with the CO.

7.5. Contractor’s Quality Control Plan (QCP): The contractor shall provide and maintain a current QCP, which shall ensure the requirements of the contract are provided as specified. One copy of the QCP shall be provided to the CO as part of the technical proposal. The QCP shall be considered acceptable unless the CO notifies the contractor before award.

8. GOVERNMENT PROPERTY/SERVICES.

8.1. Government Facilities. The Government shall furnish or make available facilities within the MTF that the contractor is assigned to. Government facilities have been inspected for compliance with Occupational Safety and Health Act (OSHA) and environmental regulations. The facilities are provided “as-is” and the government does not represent the condition, quality, or completeness of the property. However, no hazards have been identified which would prevent normal use of the facilities or for which workarounds were required. The fact that no such conditions have been identified does not warrant or guarantee that no possible hazard exists, or that workaround procedures will not be necessary or that the facilities as furnished will be adequate to meet the responsibilities of the contractor.

8.2. The Government will provide workspace, office furniture, computer resources, telephones, office supplies, test data, and tools necessary to perform the task. The contractor shall have access to Government regulations, technical manuals, and life cycle/program files.

8.3. Telephone Service. The Government will provide telephone service in office, not to include a cellular phone. Use of a government-supplied telephone is provided solely for official use government business and shall not be used to transact personal business by contractor personnel.

8.4. Refuse Collection. The Government will provide established refuse collection service at pre-established pickup locations. It is the responsibility of contractor personnel to transfer refuse from their work area to the predetermined pickup locations.

8.5. Custodial Services. The Government will provide established restroom cleaning services at pre-established intervals. The contractor is required to maintain their work area(s) in a clean, neat and professional manner conducive with the type of work being performed.

8.6. Utilities. The Government will furnish electricity, water and sewage services as necessary for accomplishment of work in accordance with this contract. The contractor shall adhere to all base level utility conservation practices or requirements. The contractor shall be responsible for operating under conditions that prevent waste of utilities.

8.7. Security, Fire and Medical Services. The Government will provide police and fire protection. In the event of a medical emergency, base ambulance services for transporting an injured employee to a local hospital is available on a cost reimbursement basis.

8.8. Electronic Mail Service/Local Area Network (LAN) Connectivity. The Government will provide electronic mail and LAN capability to facilitate communications with government personnel and the ability to retrieve required information. The existing government computers and hardware may be used by the contractor.

8.9. Base Distribution. The contractor shall use the Base Information Transfer System (BITS) for mail services for official mail only.

8.10. Contractor Furnished Items and Services. Except for those items or services specifically stated in this PWS to be government-furnished, the contractor shall furnish everything required to perform this contract in accordance with all of its terms and conditions. It is the contractor’s responsibility to ensure contractor personnel are familiar with and understand the contents of this PWS as well as the company’s handbooks/handouts, etc. prior to beginning work.

8.11. The services and spaces provided to the contractor are for official use only. Each individual contractor employee shall be required to sign hand receipts for all Information Technology Equipment (ITE) that they exclusively use, e.g. all equipment on their desktop. This includes laptops for travel/out of office use. The contractor shall not be required to sign for multiple-user ITE, such as network equipment, network printers, scanners and servers.

9. ORGANIZATIONAL CONFLICT OF INTEREST

9.1. The Contractor shall be cognizant of FAR 9.5, Organizational and Consultant Conflicts of Interest, and FAR 3.101-1, Improper Business Practices and Personal Conflicts of Interest, Standards of Conduct.

9.2. The contractor, as part of this contract, may have access to the financial plan, programmed amounts, and the program objective memorandum (POM) for future requirements. The contractor agrees to protect all proprietary information, refrain from using the information for any other purpose other than for which it was furnished and is precluded from providing the services of the requirements that they have access to.

9.3. In order for the government to prevent conflicting roles which might bias the contractor’s judgment or objectivity, and prevent unfair competitive advantage to the contractor, the parties to this contract agree that the contractor and its parent companies, subsidiaries, affiliates, if any, is precluded from providing the services of these requirements that they have access to.

9.4. The contractor, at his discretion, may provide information having a direct bearing upon these restrictions to the Contracting Officer for consideration. Final authority for approvals rests with the Contracting Officer.

9.5. Government business shall be conducted in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none.

Transactions relating to the expenditure of public funds require the highest degree of public trust and impeccable standard of conduct. The general rule is to avoid strictly any conflict of interest or even the appearance of a conflict of interest in Government-contractor relationships.

10. HIPAA BUSINESS ASSOCIATE AGREEMENT (BAA)

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18- R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates shall be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the Contractor.

Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean AETC/SG.

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD

5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and/or HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards and comply with the DoD HIPAA

Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with all Information Assurance provisions of this Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, and corresponding DoD HIPAA Issuances, as applicable, the Business Associate shall ensure that all subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524 and corresponding DoD HIPAA Issuances.

(f) The Business Associate shall make all amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526, and corresponding DoD HIPAA Issuances.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528 and corresponding DoD HIPAA Issuances.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of the HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in this Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the

HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in this Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in this Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in this Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall notify the Business Associate of any limitation(s) in the notice of privacy practices of the Covered Entity under 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business…