Attachment A - PWS NTP Physician Services.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) National Teleradiology Program (NTP)

Teleradiology Physician Services

Date: TBD PWS Version Number: 0

CONTENTS

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 CONTRACT TYPE

4.2 PERFORMANCE PERIOD

4.3 PLACE OF PERFORMANCE

4.4 VA HOURS OF OPERATION

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 SERVICE MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 DIRECT PATIENT CARE – TELERADIOLOGY

5.1.3 CONTRACTOR RESPONSIBILITIES

5.1.4 CONTINUITY OF SERVICES UNDER CONTRACT

5.1.5 CONTRACTOR RESPONSIBILITIES

5.1.6 MEDICAL RECORDS

5.1.7 SYSTEM REQUIREMENTS

5.1.8 GOVERNMENT RESPONSIBILITIES

5.1.9 REPORTING REQUIREMENTS

5.1.10 QUALITY CONTROL

5.1.11 SECURITY AND PRIVACY REQUIREMENTS

6.0 VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

LANGUAGE FOR INCLUSION INTO CONTRACTS, AS APPROPRIATE

1. GENERAL

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

3. VA INFORMATION CUSTODIAL LANGUAGE

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE 34

6. SECURITY INCIDENT INVESTIGATION

7. LIQUIDATED DAMAGES FOR DATA BREACH

8. SECURITY CONTROLS COMPLIANCE TESTING

9. TRAINING

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) is to provide benefits and services to Veterans of the United States, their caregivers, and/or beneficiaries. The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), National Teleradiology Program (NTP) provides high-quality, effective, and efficient solutions to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective and timely manner.

The NTP provides teleradiology services to more than 130 VHA facilities across the United States. Due to recent staffing losses and a national shortage of radiologists, NTP has been unable to recruit enough new radiologists to meet current workload demands.

NTP is seeking a contract for teleradiology services to meet and support workload demands.

2.0 APPLICABLE DOCUMENTS

Policy/Directives/Handbooks. The Contractor shall be subject to the following policies, including any subsequent updates during the period of performance. These policies may be accessed electronically via the following: VA Publications VHA Publications

1. VA Directive 1663: Health Care Resources (HCR) Contracting – Buying Title 38 U.S.C. 8153

2. VHA Directive 1003.04: VHA Patient Advocacy

3. VHA Directive 1065: Productivity and Staffing Guidance for Specialty Provider

Group Practice

4. VHA Directive 1084: Teleradiology Services

5. VHA Directive 1088(1): Communicating Test Results to Providers and Patients

6. VHA Directive 1100.18: Reporting and Responding to State Licensing Boards

7. VHA Directive 1100.20: Credentialing of Health Care Providers

8. VHA Directive 1100.21: Privileging

9. VHA Directive 1605.01: Privacy and Release of Information

10. VHA Directive 1907.01: VHA Health Information Management and Health Records

11. VHA Directive 1916(1): VHA Teleradiology Programs, dated June 10, 2021.

12. VHA Handbook 1100.17: National Practitioner Data Bank (NPDB) Reports

13. Privacy Act of 1974 (5 U.S.C. 552a) as amended:

http://www.justice.gov/oip/foia_updates/Vol_XVII_4/page2.htm

14. 42 Code of Federal Regulations (CFR) Part 482 Conditions of Participation

Hospitals:https://www.ecfr.gov/cgi-bin/text-idx?node=pt42.5.482&rgn=div5

15. The VA Radiology Services follow the standards and guidelines set forth by the American College of Radiology (ACR) https://gravitas.acr.org/ppts?_gl=1*hstxx2*_gcl_au*MzM1MTE1NjY5LjE3NTk https://www.va.gov/vapubs/ https://www.va.gov/vhapublications/index.cfm http://www.justice.gov/oip/foia_updates/Vol_XVII_4/page2.htm https://www.ecfr.gov/cgi-bin/text-idx?node=pt42.5.482&rgn=div5 https://gravitas.acr.org/ppts?_gl=1*hstxx2*_gcl_au*MzM1MTE1NjY5LjE3NTk0MzUzNzc.*_ga*NzQ3ODczNTAyLjE2OTkzOTA5MjM.*_ga_K9XZBF7MXP*czE3NjUzOTU0MjMkbzU0JGcwJHQxNzY1Mzk1NDI1JGo1OCRsMCRoMA

0MzUzNzc.*_ga*NzQ3ODczNTAyLjE2OTkzOTA5MjM.*_ga_K9XZBF7MXP* czE3NjUzOTU0MjMkbzU0JGcwJHQxNzY1Mzk1NDI1JGo1OCRsMCRoMA.

16. “Federal Information Security Modernization Act of 2014”

17. Federal Information Processing Standards (FIPS) Publication 140-3, “Security

Requirements for Cryptographic Modules”, March 22, 2019

18. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

19. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

20. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

21. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

22. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

23. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and

Information Technology Act of 2006, as amended, Title IX, Information Security Matters

24. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

25. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1631&FType=2

26. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1631&FType=2

27. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

28. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” as amended

29. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

30. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”, as amended

31. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

32. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

33. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

34. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

35. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

36. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

37. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

38. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix https://gravitas.acr.org/ppts?_gl=1*hstxx2*_gcl_au*MzM1MTE1NjY5LjE3NTk0MzUzNzc.*_ga*NzQ3ODczNTAyLjE2OTkzOTA5MjM.*_ga_K9XZBF7MXP*czE3NjUzOTU0MjMkbzU0JGcwJHQxNzY1Mzk1NDI1JGo1OCRsMCRoMA https://gravitas.acr.org/ppts?_gl=1*hstxx2*_gcl_au*MzM1MTE1NjY5LjE3NTk0MzUzNzc.*_ga*NzQ3ODczNTAyLjE2OTkzOTA5MjM.*_ga_K9XZBF7MXP*czE3NjUzOTU0MjMkbzU0JGcwJHQxNzY1Mzk1NDI1JGo1OCRsMCRoMA https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1631&FType=2 https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1631&FType=2

C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

39. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

40. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

41. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

42. OIT Process Asset Library (PAL), OIT Process Asset Library.

43. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

44. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014

45. VA Directive 6510, “VA Identity, Credential and Access Management,” September

3, 2024

46. VA Handbook 6510, “VA Identity, Credential and Access Management,” September

27, 2024

47. VA Directive and Handbook 6513, “Secure External Connections,” October 12,

48. VA Directive 6300, “Records and Information Management,” September 21, 2018

49. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

50. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December

51. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

52. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

53. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

54. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

55. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

56. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

57. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

58. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

59. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

60. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

61. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

62. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx https://www.idmanagement.gov/arch/#:%7E:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

63. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

64. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

65. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

66. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

67. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L.

110–140), December 19, 2007

68. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

69. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

70. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

71. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

72. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

73. “Veteran Focused Integration Process (VIP) Guide 4.0,”

March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

74. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. “Product Line Management Transformation Playbook” version 3.1, August

2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

76. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

77. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

78. Social Security Number (SSN) Fraud Prevention Act of 2017

79. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

80. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

81. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,”

May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-…

82. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

83. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

84. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

85. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

86. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation

Capabilities Related to Cybersecurity Incidents,” August 27, 2021

87. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

88. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation

Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems

89. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

90. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01:

Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

91. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

92. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

3.0 SCOPE OF WORK

The National Teleradiology Program requires teleradiology services to support Veterans Affairs (VA) facilities nationwide in the interpretation of imaging exams. VA Radiology Services follow the standards and guidelines set forth by the American College of Radiology (ACR). A Contractor providing teleradiology services shall provide services that meet or exceed the American College of Radiology Guidelines https://www.acr.org/Clinical-Resources/Clinical-Tools-and-Reference/Practice- Parameters-and-Technical-Standards.

For the purpose of this contract, teleradiology is defined as the electronic transmission of radiological images from VHA Picture Archive and Communication System (PACS) and HL7 orders/reports to the Contractor for imaging exam interpretation and subsequent transmission of the imaging report back to the source facility’s electronic medical record.

The Contractor shall provide teleradiology services in the following functional areas, as defined in PWS Section 5.0 below, which establishes all general requirements for the services performed under this contract. To ensure integration across the program, the Contractor shall coordinate with all stakeholders in the performance of orders placed against this contract.

The Contractor shall provide Board Certified or Board Eligible Radiology Physician Services in accordance with the specifications contained herein. The Contractor shall provide teleradiology services and support services consistent with Joint Commission, that meet or exceed VA and American College of Radiology Guidelines as defined further in this document.

Specifically, The Contractor shall furnish routine and STAT specialty and subspecialty interpretations of diagnostic imaging exams. In addition to providing final interpretations for approximately 138,000 examinations, it is expected The Contractor will develop a workflow to ensure the exams are interpreted within the turnaround times specified in section 5.1.5 of the contract. Based on the complexity and size of the facilities served by NTP, and the scope of the work performed, a dedicated pool of Board Certified or Board Eligible radiologists will be required for this contract. The Contractor shall have an https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.acr.org/Clinical-Resources/Clinical-Tools-and-Reference/Practice-Parameters-and-Technical-Standards https://www.acr.org/Clinical-Resources/Clinical-Tools-and-Reference/Practice-Parameters-and-Technical-Standards existing or be eligible to obtain a national Memorandum of Understanding (MOU)/Interconnection Security Agreement (ISA) between themselves and the VHA to allow for providing teleradiology services that conform to all VA security requirements.

To ensure continuous maintenance of the network and the ability to transmit images from the NTP to The Contractor, it is necessary to have 24/7/365 support from The Contractor’s Information Technology (IT) Service. In addition, The Contractor shall provide ongoing professional practice evaluations (OPPE) for all staff that meet the VA requirements of 100 exams per radiologist per year. All services must include assigned points of contact for all administrative, billing, technical, and quality functions.

The Contractor shall be responsible for providing interpretations of imaging examinations, including computed tomography/angiography scans (CT/CTA), digital x-ray (digital plain film), ultrasound (US), including vascular ultrasound (Doppler/Duplex) exams, and magnetic resonance imaging/angiography (MRI/MRA) exams.

The Contractor shall identify a single point of contact as the representative and program lead for all work done under this contract.

4.0 PERFORMANCE DETAILS

4.1 CONTRACT TYPE

Indefinite Delivery / Indefinite Quantity (IDIQ) period of performance is anticipated to be five (5) years from the date of award.

4.2 PERFORMANCE PERIOD

The Period of Performance (POP) is anticipated to be five (5) years from the date of award, inclusive of a 12-month base year plus four (4) 12-month option years.

4.3 PLACE OF PERFORMANCE

The place of performance under this PWS shall primarily be performed at Contractor facilities within and outside the continental United States (CONUS / non-foreign

OCONUS).

4.4 VA HOURS OF OPERATION

Business Hours: Coverage is 24 hours a day, 7 days a week, 52 weeks a year, including all Federal holidays.

Federal holidays set by law (USC Title 5 Section 6103) that VA follows are outlined here: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

5.1 SERVICE MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the base contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include a communications plan to demonstrate how the Contractor will coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. In the CPMP, the Contractor shall also detail how coordination with other contractors supporting NTP will be managed.

The baseline CPMP shall be delivered within 30 business days after award and updated monthly thereafter. Additional Contractor Project Management requirements will be defined at the individual TO level

Deliverable:

A. Contractor Project Management Plan

5.1.2 DIRECT PATIENT CARE – TELERADIOLOGY

Scope of care – The Contract physician(s) shall be responsible for providing, including, but not limited to: Physicians provided in satisfaction of this contract shall be required to perform their assigned duties with regard to all admitted patients, outpatients, and eligible beneficiaries regardless of underlying disease process or physical condition of such patients or beneficiaries.

The contract shall provide physicians who shall: The Contractor shall provide Board Certified or Board Eligible Radiologists to perform final teleradiology interpretation services. Examination images from VHA will be transmitted to The Contractor using the Digital Imaging and Communications in Medicine (DICOM) protocol and the Federal Information Processing Standard (FIPS) compliant encryption via site to site Virtual Private Network (VPN) tunnel. Upon receipt of the captured image(s) and patient information from VHA, The Contractor shall provide an interpretation of the exam. The workflow will be provided in writing once the contract is awarded.

The Contract physician(s) shall dictate all interpreted studies and reports will be transmitted electronically to VA’s electronic health record (EHR) (VistA/Oracle Health).

The Contract Radiologists will have control of the reporting process from dictation to report sign-off/electronic signature/approval. Report quality/content will follow ACR standards of report structure and communication of results. The Contract Radiologist(s) will immediately notify VA clinicians of critical findings in accordance with American College of Radiology (ACR) standards, VHA and the NTP "alert notification" Quality Assurance policies, and in a manner appropriate to the clinical urgency of the case.

If a serious medical condition is identified during the interpretation, the report shall be immediately called in telephonically to the requesting VA Provider.

All STAT exams, when properly identified, will be performed and the results communicated within 60 minutes of receipt of images. All STAT exams must be identified at or prior to receipt of the images by The Contractor.

Final routine examination interpretation and official signature will be electronically uploaded into the VA VISTA or Oracle Health EHR within 72 hours of the image being transmitted to the reading site.

Mechanisms must be in place to provide notification of test results for patients receiving care in accordance with VHA Directive 1088, Communicating Test Results to Providers and Patients.

Deliverable:

The Contractor shall be expected to perform on a per procedure basis annually beginning with the initial estimated quantity listed below with an expectation that the estimated quantity will increase +/- 5% yearly. VA will not need to guarantee any minimum image volume.

Schedule of Supplies/Services (Reads/Studies) Estimated Quantity Digital X-Rays (Plain Films) 71,000 Computed Tomography (CT Scans) 51,000 Magnetic Resonance Imaging (MRI Scans) 5,000 Ultrasound Scan (US Scans) 11,000

5.1.3 CONTRACTOR RESPONSIBILITIES

The Contractor shall provide staff for the services required according to the following:

1. License: The Contracted physician(s) assigned by The Contractor to perform the services covered by this contract shall have a current, full, and unrestricted license to practice medicine in any State, Territory, or Commonwealth of the United States, or in the District of Columbia.

a. All licenses held by the radiologist working on this contract shall be full and unrestricted licenses. Contract physicians who have current, full, and unrestricted licenses in one or more states, but who have, or ever had, a license restricted, suspended, revoked, voluntarily revoked, voluntarily surrendered, pending action, or denied upon application for cause in accordance with 38 USC 7402(f) will not be considered for this service contract.

2. Board Certification: All contract physician(s) shall be Board Certified or

Board Eligible. All continuing education courses required for maintaining certification must be up to date at all times. Documentation verifying current certification shall be provided by The Contractor to the VA COR on an annual basis for each year of contract performance.

3. Credentialing and Privileging: Credentialing and privileging shall be done in accordance with the provisions of VHA Directive 1084, VHA Directive 1100.20, and VHA Directive 1100.21 referenced above in section 2.0, APPLICABLE DOCUMENTS. The Contractor is responsible for ensuring that proposed physician(s) possess the requisite credentials enabling the granting of privileges.

a. No services shall be provided by any contract physician(s) prior to obtaining approval by the Facility Medical Executive Board and Medical Center Director.

b. If a contract physician(s) is not credentialed and privileged or has credentials/privileges suspended or revoked, The Contractor shall furnish an acceptable substitute without any additional cost to the government.

c. Contract licensed independent practitioners must be credentialed and privileged on behalf of the NTP through the VA Palo Alto Health Care System Medical Staff Office in accordance with Credentialing and Privileging Directives 1100.20 and 1100.21 and VHA Directive 1084.

d. In general, the credentialing process should be started at least 60-90 days in advance of estimated entry on duty. The time required for this process may be expedited when patient care needs are urgent.

e. The VA’s Medical Staff Office, COR, or Human Resources

Management Service will provide an instruction packet containing forms and a detailed listing of required documentation, including curriculum vitae, current references, signed release of information from the candidate, and statement that the candidate does not have any physical or mental health condition that would adversely affect his/her ability to carry out the assigned duties, and additional credentialing forms.

f. The Contractor’s personnel/or candidate will also be required to make an application through the VetPro internet-based process. The candidate will need to be enrolled in VetPro by the Credentialing Coordinator at the VA or by the Human Resources Management Service designee. The website address is:

https://fcp.vetpro.org/Admin/Login/Index

g. It is The Contractor’s responsibility to contact COR to request a package and instructions.

h. The Contractor must furnish a copy of its policy and procedures for credentialing and privileging to the Contracting Officer and COR for review to ensure these meet the VA’s requirements for establishment of competence through these mechanisms.

4. Technical Proficiency: Contract physician(s) shall be technically proficient in the skills necessary to fulfill the government’s requirements, including the ability to speak, understand, read, and write English fluently. The Contractor shall provide documents upon request of the CO/COR to verify current and ongoing competency, skills, certification, and/or licensure related to the provision of care, treatment, and/or services performed. The Contractor shall provide verifiable evidence of all educational and training experiences, including any gaps in educational history for all contract physician(s) and contract physician(s) shall be responsible for abiding by the Facility's Medical Staff ByLaws, rules, and regulations that govern medical staff behavior.

5. Continuing Medical Education (CME) Requirements: The Contractor shall provide the COR copies of current CMEs as required by Facility Bylaws or as requested by NTP. Contract physician(s) registered or certified by national/medical associations shall continue to meet the minimum standards for CME to remain current. The Contractor shall report CME hours to the credentials office for tracking. These documents are required for both privileging and re-privileging. Failure to provide shall result in loss of privileges for contract physician(s).

6. Training (VA MANDATORY): The Contractor shall meet all VA educational requirements and mandatory course requirements defined herein; all training must be completed by the contract physician(s) as required by the VA. In particular, The Contractor will ensure continuous compliance of all providers for the following training, which is required to maintain access to VA information systems:

Training Frequency Annual Hours

VA Privacy and Information Security Awareness and

Once per year Learning Hours: 1.0 https://fcp.vetpro.org/Admin/Login/Index

Rules of Behavior (TMS Course 10176

Privacy and HIPAA Focused Training (TMS course 10203)

Once per year Learning Hours: 1.0

7. National Provider Identifier (NPI): NPI is a standard, unique 10-digit numeric identifier required by HIPAA. The Veterans Health Administration must use NPIs in all HIPAA-standard electronic transactions for individual (health care practitioners) and organizational entities (medical facilities). The Contractor shall have or obtain appropriate NPI and if pertinent, the Taxonomy Code confirmation notice issued by the Centers for Medicare and Medicaid Services (CMS) National Plan and Provider Enumeration System (NPPES) be provided to the Contracting Officer with the proposal.

8. Conflict of Interest: The Contractor and all contract physician(s) are responsible for identifying and communicating to the CO and COR conflicts of interest at the time of proposal and during the entirety of contract performance. At the time of proposal, the Contractor shall provide a statement which describes, in a concise manner, all relevant facts concerning any past, present, or currently planned interest (financial, contractual, organizational, or otherwise) or actual or potential organizational conflicts of interest relating to the services to be provided. The Contractor shall also provide statements containing the same information for any identified consultants or subcontractors who shall provide services. The Contractor must also provide relevant facts that show how it’s organizational and/or management system or other actions would avoid or mitigate any actual or potential organizational conflicts of interest. These statements shall be in response to the VAAR provision 852.209-70 Organizational Conflicts of Interest.

9. Citizenship related Requirements:

a. The Contractor certifies that The Contractor shall comply with any and all legal provisions contained in the Immigration and Nationality Act of 1952, As Amended; its related laws and regulations that are enforced by Homeland Security, Immigration and Customs Enforcement and the U.S Department of Labor as these may relate to non-immigrant foreign nationals working under contract or subcontract for the Contractor while providing services to Department of Veterans Affairs patient referrals;

b. While performing services for the Department of Veterans Affairs, the Contractor shall not knowingly employ, contract or subcontract with an illegal alien; foreign national non-immigrant who is in violation their status, as a result of their failure to maintain or comply with the terms and conditions of their admission into the United States. Additionally, The Contractor is required to comply with all “E-Verify” requirements consistent with “Executive Order 12989” and any related pertinent Amendments, as well as applicable Federal Acquisition Regulations.

c. If The Contractor fails to comply with any requirements outlined in the preceding paragraphs or its Agency regulations, the Department of Veterans Affairs may, at its discretion, require that the foreign national who failed to maintain their legal status in the United States or otherwise failed to comply with the requirements of the laws administered by Homeland Security, Immigration and Customs Enforcement and the U.S Department of Labor, shall be prohibited from working at The Contractor’s place of business that services Department of Veterans Affairs patient referrals; or other place where The Contractor provides services to veterans who have been referred by the Department of Veterans Affairs; and shall form the basis for termination of this contract for breach.

d. This certification concerns a matter within the jurisdiction of an agency of the United States and the making of a false, fictitious, or fraudulent certification may render the maker subject to prosecution under 18 U.S.C. 1001.

e. The Contractor agrees to obtain a similar certification from its subcontractors. The certification shall be made as part of the offerors response to the RFP using the subject attachment in Section D of the solicitation document.

10. Annual Office of Inspector General (OIG) Statement:

a. In accordance with HIPAA and the Balanced Budget Act (BBA) of 1977, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) has established a list of parties and entities excluded from Federal health care programs. Specifically, the listed parties and entities may not receive Federal Health Care program payments due to fraud and/or abuse of the Medicare and Medicaid programs.

b. Therefore, Contractor shall review the HHS OIG List of Excluded Individuals/Entities on the HHS OIG web site at http://oig.hhs.gov/exclusions/index.asp to ensure that the proposed contract physician(s) are not listed. Contractor should note that any excluded individual or entity that submits a claim for reimbursement to a Federal health care program, or causes such a claim to be submitted, may be subject to a Civil Monetary Penalty (CMP) for each http://oig.hhs.gov/exclusions/index.asp item or service furnished during a period that the person was excluded and may also be subject to treble damages for the amount claimed for each item or service. CMP’s may also be imposed against The Contractor that employ or enter into contracts with excluded individuals to provide items or services to Federal program beneficiaries.

c. By submitting their proposal, The Contractor certifies that the HHS

OIG List of Excluded Individuals/Entities has been reviewed and that The Contractors are and/or firm is not listed as of the date the offer/bid was signed.

11. Clinical/Professional Direction: The qualifications of Contractor personnel are subject to review by VA Medical Facility Chief of Staff (COS) or his/her clinical designee and approval by the Medical Facility Director as provided in VHA Directive 1100.20, VHA Directive 1100.21, and VHA Directive 1084.

Clinical/Professional direction of all clinical personnel covered by this contract for quality purposes will be provided by the Facility Chief of Staff and/or the Executive Director of NTP, or their designee.

12. Non-Personal Healthcare Services: The parties agree that The Contractor and all contract physician(s) shall not be considered VA employees for any purpose.

13. Indemnification: The Contractor shall be liable for, and shall indemnify and hold harmless the Government against, all actions or claims for loss of or damage to property or the injury or death of persons, arising out of or resulting from the fault, negligence, or act or omission of The Contractor, its agents, or employees.

14. Prohibition Against Self-Referral: The Contractor’s physicians are prohibited from referring VA patients to The Contractor’s or their own practice(s).

15. Inherent Government Functions: Contractor and Contract physician(s) shall not perform inherently governmental functions. This includes, but is not limited to, determination of agency policy, determination of Federal program priorities for budget requests, direction and control of government employees (outside a clinical context), selection or non-selection of individuals for Federal Government employment including the interviewing of individuals for employment, approval of position descriptions and performance standards for Federal employees, approving any contractual documents, approval of Federal licensing actions and inspections, and/or determination of budget policy, guidance, and strategy.

16. No Employee status: The Contractor shall be responsible for protecting The

Contract physician(s) furnishing services. To carry out this responsibility, The Contractor shall provide or certify that the following is provided for all their staff providing services under the resultant contract:

a. Workers’ compensation

b. Professional liability insurance

c. Health examinations

d. Income tax withholding, and Social Security payments.

17. Tort Liability: The Federal Tort Claims Act does not cover Contractor or contract physician(s). When a Contractor or contract physician(s) has been identified as a provider in a tort claim, The Contractor shall be responsible for notifying their legal counsel and/or insurance carrier. The Contractor must ensure that all contract physicians are covered by professional liability insurance that covers the health care services they provide to VA. Any settlement or judgment arising from a Contractor’s (or contract physician(s)) action or non-action shall be the responsibility of The Contractor and/or insurance carrier.

18. Contingency Plan: Because continuity of care is an essential part of NTP services, The Contractor shall have a contingency plan in place to be utilized if Contract service physician(s) leave(s) Contractor’s employment or is unable to continue performance in accordance with the terms and conditions of the resulting contract.

19. Substitution of Personnel: During the first ninety (90) calendar days of performance, The Contractor shall make NO substitutions of assigned personnel unless the substitution is necessitated by illness, death or termination of employment. The Contractor shall notify the CO, in writing, within 7 calendar day (s) after the occurrence of any of these events and provide the information required below. After 90 days, The Contractor shall submit the information required below to the CO at least 20 business days in advance of the effective date to approve or disapprove the proposed substitution.

a. New personnel shall not commence work until all necessary security requirements have been fulfilled and resumes provided and accepted. The COR and the Contracting Officer will evaluate such requests and promptly notify The Contractor of approval or disapproval in writing.

b. The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the CO. Proposed substitutes shall have equal to or better qualifications to those of the persons being replaced.

c. For temporary substitutions where the key person shall not be reporting to work for three consecutive workdays or more, The Contractor shall provide a qualified replacement for the key person.

The substitute shall have comparable qualifications to the key person.

Any period exceeding two weeks will require the procedure as stated above.

5.1.4 CONTINUITY OF SERVICES UNDER CONTRACT

The Contractor must provide continuity of services during the performance of this contract.

1. The Contractor is responsible for providing qualified personnel to read images.

The VA must be informed at least 48 hours in advance if there will be a significant change in The Contractor’s ability to perform to allow for planning of service coverage and workload distribution. Requirements will be provided to NTP and maintained by the Contractor.

2. The Contractor shall maintain open and professional communication with members of the VA NTP staff. The Contractor shall provide up-to-date points of contact to facilitate communication on clinical, technical and administrative issues. Clinical staff will be available by phone and/or pager 24/7. The Contractor will provide a schedule of radiologists with telephone numbers for consultation by VA technologists and referring physicians.

3. The Contractor shall provide a single phone number with a list of individuals who could be contacted to immediately resolve any difficulties experienced during the hours of teleradiology services and STAT studies after hours. The COR will ensure up-to-date rosters of staff are provided to The Contractor.

4. Tele-Communications

a. The Contractor will secure and maintain the site to site VPN between The Contractor’s facility and the VA at the Contractor’s expense...

b. The Contractor shall make provisions for the proper maintenance and functioning of all imaging, teleradiology and associated equipment, facilities and fixtures as may reasonably be required by Contract Physicians to perform services hereunder.

5. Integration with VHA PACS and EMR’s

a. The Contractor will be responsible to configure and maintain all required DICOM services needed to support ingestion of VHA images from VHA PACS. Data will be exported in the format native to the source PACS and

VHA will not be responsible to provide any data normalization as part of the export process.

b. The Contractor shall be responsible for HL7 testing and integration to the VA’s EMR. These include VistA HL7 v2.3, VistA v2.4 and Oracle Health Federal Electronic Health Record (FEHR). The contractor shall be responsible for ongoing HL7 testing, validation and integration as VA moved from VistA to FEHR. Integration changes will be required as sites update their VistA links from v2.3 to v2.4. The Contractor shall be responsible for interface/integration changes within their teleradiology PACS to align with VA’s HL7 specifications.

5.1.5 CONTRACTOR RESPONSIBILITIES

1. Clinical Personnel Required: The Contractor shall provide contract physician(s) who are competent, qualified per this performance work statement, and adequately trained to perform assigned duties.

2. Management and Supervision: The Contractor shall be responsible for their own supervision of day-to-day operations and services provided under this contract by the Contractor’s staff.

a. The NTP will provide the Contractor policies, procedures, and processes necessary to allow cooperative functioning between The Contractor and NTP. Updates and refreshers will provide The Contractor upon request and when policy procedures or processes change.

b. The Contractor shall complete background investigations to ensure that employees do not have a record of criminal offenses or substantiated incidents of patient abuse.

3. Standards of Care: The contract physician(s)’ care shall cover the range of

Radiology services as would be provided in a state-of-the-art civilian medical facility, and the standard of care shall be of a quality, meeting or exceeding current recognized national standards as established by:

a. The American College of Radiology Guidelines:

https://www.acr.org/Clinical-Resources/Clinical-Tools-and- Reference/Practice-Parameters-and-Technical-Standards

b. ACR Practice Parameter for Communication of Diagnostic Imaging Findings: https://gravitas.acr.org/PPTS/GetDocumentView?docId=74

4. VA Standards: The Contractor shall provide timely interpretations on all previously listed modalities, including digital x-ray (digital plain films), Computed Tomography/Angiography (CT/CTA), Magnetic Resonance Imaging/Angiography (MRI/MRA), and Ultrasound (US). Turnaround times are defined by the exam https://www.acr.org/Clinical-Resources/Clinical-Tools-and-Reference/Practice-Parameters-and-Technical-Standards https://www.acr.org/Clinical-Resources/Clinical-Tools-and-Reference/Practice-Parameters-and-Technical-Standards https://gravitas.acr.org/PPTS/GetDocumentView?docId=74 type and begin at the time of transmission of the case from NTP to The Contractor for interpretation. Turnaround times are based on the nature of the exam and the required response time by The Contractor.

a. STAT exam turnaround time: Read within 60 minutes.

b. Routine exam turnaround time: Read within 72 hours.

5. The professional standards of Joint Commission :

https://www.jointcommission.org/en-us/standards

6. The standards of the American Hospital Association (AHA):

https://www.aha.org/type/ahahret-guides and; the requirements as contained in this PWS.

5.1.6 MEDICAL RECORDS

1. Authorities: Contractor’s physician(s) providing healthcare services to VA patients shall be considered as part of the Department Healthcare Activity and shall comply with the 5 U.S.C.552a (Privacy Act), 38 U.S.C. 5701 (Confidentiality of claimants records), 5 U.S.C. 552 (FOIA), 38 U.S.C. 5705 (Confidentiality of Medical Quality Assurance Records) 38 U.S.C. 7332 (Confidentiality of certain medical records), Title 5 U.S.C. § 522a (Records Maintained on Individuals) as well as 45 C.F.R. Parts 160, 162, and 164 (HIPAA).

2. HIPAA: This contract and its requirements meet exception in 45 CFR 164.502(e), and do not require a BAA in order for Covered Entity to disclose Protected Health Information to: a health care provider for treatment of VA patients. Based on this exception, a BAA is not required for this contract.

a. Health records generated by this contract or provided to the Contractor by the VA are covered by the VA Privacy Act system of records entitled ‘Patient Medical Records-VA’ (24VA10A7).

b. Contractor generated VA Patient records are the property of the VA and shall not be accessed, released, transferred, or destroyed except in accordance with applicable laws and regulations.

c. Contractor shall ensure that all records pertaining to medical care and services provided to VA patients are captured in the VA electronic health record system as required by VA policy.

3. Disclosure: Contractor’s physician(s) may have access to patient medical records for the purpose of providing medical care and services to VA patients and performing services under the contract. VA authorizes The Contractor to discuss patient health information for coordination of care with community health care providers in compliance with VA regulations, HIPAA and VHA Directive 1605.01, Privacy and Release of Information. The VA will provide The Contractor with a https://www.jointcommission.org/en-us/standards https://www.aha.org/type/ahahret-guides copy of VHA Directive 1907.01, Health Information Management and Health Records and VHA Directive 1605.1, Privacy and Release of Information. The penalties and liabilities for the unauthorized disclosure of VA patient information mandated by the statutes and regulations mentioned above, apply to The Contractor.

4. Professional Standards for Documenting Care: Care shall be appropriately documented in medical records in accordance with standard commercial practice and guidelines established by VHA Directive 1907.01 Health Information Management and Health Records:

https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=9235 and all guidelines provided by NTP.

a. All image interpretations will either meet or exceed established NTP standards of timeliness, accuracy, content and signature. Only VHA-approved abbreviations will be used for documentation of the patient health record. All imaging exam interpretations shall meet or exceed established standards of timeliness, accuracy, content, and signature.

Only medical abbreviations from Joint Commission’s National Patient Safety Goals, current edition, will be used for documentation of the patient health record.

b. Interpretations shall include the following information:

i. Patient’s full name, SSN, date of birth, clinical history, exam case number (accession number), date of interpretation, requesting physician, exam type, interpretation, and signature of contract radiologist providing interpretation.

5. Release of Information: The VA shall maintain control of releasing any copies of patient health information or health records and will follow policies and standards as defined but not limited to Privacy Act requirements. Contractor will not release or disclose copies of records and will refer to all such requests to the Release of Information Department to NTP.

6. Management for Medical Records: National Archives and Records Administration record disposition requirements are found in RCS 10-1 Chapter 6, 6000 series.

7. MEDICAL RECORDS/COMPUTERIZED RECORD…