Attachment A - Statement of Objectives -- Quality Control Reagents.docx

STATEMENT OF OBJECTIVES

Quality Controls for Chemistry Testing Department of Pathology and Area Laboratory Services (DPALS) Brooke Army Medical Center (BAMC)

PR 2091976

1. GENERAL REQUIREMENT:

The Department of Pathology and Laboratory Services at Brooke Army Medical Center, JBSA - Fort Sam Houston, Texas has a requirement for quality controls to allow for specific chemistry testing requirements as outlined in the workload data table (Table 1).

2. SCOPE

The Contractor shall provide quality control products for use in support of the Core Chemistry and Reference Laboratories’ mission at Brooke Army Medical Center (BAMC), Joint Base San Antonio, TX 78234.

The Contractor shall provide quality control (QC) products for testing Clinical Chemistry and Immunochemistry testing to include QC appropriate for specific analytes and instrumentation, sequestered Lot numbers commensurate with expiration of product, consumables (dropper caps), computerized Quality Assurance Program including Monthly Evaluation Summary Report Print-outs, on-going Support for IT and QC trouble-shooting, Training, and services necessary to meet the immunochemistry mission of Brooke Army Medical Center, JBSA, Fort Sam Houston, TX. All supplies and equipment outlined in this Statement of Objectives (SOO) must be supplied and serviced through a single Contractor (to whom the contract is awarded). All costs integrated into this contract must be included in cost of QC kits. All testing materials must be FDA-approved.

3. ORDERING PERIOD:

The Government will order items on an as needed basis and shall only pay for the actual number of controls ordered, received, and accepted by the Government. The quantities listed in the workload data table represent anticipated volumes for the period of performance listed; however, quantities could increase and/or decrease during certain periods and/or months.

The inspection and acceptance for all deliverables rendered under this contract will be by the appointed Ordering Officer. The performance by the contractor technician, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance, and review for acceptance by the designated ordering officer representative. Other evaluation factors will be monitored that are not quantified by numerical measurements.

4. QUALITY CONTROL (QC) AND QUALITY ASSURANCE (QA)

4.1. The Contractor shall provide a Quality Control (QC) Plan that contains, as a minimum, the items listed in Table 1 to the Contracting Officer (KO) and Contracting Officer Representative (COR)/DPALS POC for acceptance not later than 21 calendar days AFTER the start of the contract. The Contracting Officer will notify the Contractor of acceptance or required modifications to the plan. The Contractor shall make appropriate modifications and obtain acceptance of the plan by the Contracting Officer.

4.2. The QC Plan shall include:

4.3. A description of the inspection system to cover all incidental support and maintenance services listed on the Performance Requirements Summary (PRS). Description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title and organizational placement of the inspectors. Additionally, control procedures for any Government provided keys or lock combinations shall be included.

4.4. A description of the methods to be used for identifying and preventing equipment failure and/or defects.

4.5. A description of the records to be kept to document inspections and corrective or preventive actions taken. NOTE: The records of inspections shall be kept and made available to the Government throughout the contract performance period and for the period after contract completion until final settlement of any claims, if any, under this contract.

4.6. Quality Assurance (QA). For those tasks listed on the PRS, the Contracting Officer Representative (COR)/DPALS POC Ordering Officer will follow the methods of surveillance specified in this contract. Government personnel will record surveillance observations, as needed, and provide to the Contractor. The receipt of the observation does not necessarily constitute concurrence with the observation, only acknowledgment that the Contractor has been made aware of the defective performance. Government surveillance may include additional observations/tasks not listed in the PRS. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the Contracting Officer as a result of surveillance will be according to the terms of this contract.

4.7. Equipment Troubleshooting. When the Government performs troubleshooting with the Contractor, the Contractor shall replace all reagents, calibrators, controls, and any other materials used at no additional cost to the Government IAW Paragraphs 10.3. and 10.5. (below).

4.8. Meetings:

4.8.1. The Contracting Officer may require the Contractor to meet with the Contracting Officer and/or Ordering Officer, as deemed necessary.

4.8.2. The Contractor may request a meeting with the Contracting Officer, when the Contractor believes such a meeting is necessary. If required, written minutes of any such meetings shall be recorded in the contract and signed by the Contractor and the Contracting Officer. If the Contractor does not concur with any portion of the minutes, such non-concurrence shall be provided in writing to the Contracting Officer within 10 calendar days following receipt of the minutes.

4.9. During the installation and validation of the equipment and tests to be performed, the Contractor will coordinate scheduled meetings with technical experts of the Laboratory to discuss milestones and to provide updates on completion date. Following the completion of the installation of the new equipment and validation of the tests to be performed, the Contractor will meet with technical experts from the Laboratory at times mutually agreeable to discuss areas of interest to the Laboratory or hospital staff. When the validation of the equipment and tests are to be performed, the Contractor shall provide all reagents, calibrators, controls and any other materials used at no

4.10. additional cost to the Government. The contractor will provide analyzed data to laboratory supervisor for approval. If the validations are not found to be adequate, the Contractor will be responsible for repeating studies in a timely manner in order for the laboratory to meet go live deadlines.

4.11. The Contractor shall provide at no additional cost to the Government the ability to request visits that are educational in nature from medical and/or scientific advisors/specialists to discuss with the Laboratory and/or hospital staff areas of interest, to include but not limited to, new tests of interest, application of current tests in specific specialty areas (e.g., Cardiology, Endocrinology, Nephrology, etc.), etc.

5. HOURS OF OPERATION

The Chemistry and Reference Labs are in operation 24 hours a day, 7 days a week. Normal business hours for administrative personnel are Monday through Friday between the hours of 0700 – 1600 CST. The Contractor shall coordinate maintenance scheduled with Ordering Officer (OO) and appointed on duty staff in absence of OO no less than 48 hours.

6. CONTRACTOR PERSONNEL

6.1. All Contractor personnel must adhere to all required reporting procedures for BAMC prior to reporting to the laboratory for work, etc (if required). Current procedures will be available through the COR or ACOR.

6.2. Contractor employees shall present a neat appearance and be easily recognized as Contractor employees. Contractor personnel shall either wear a distinguishable uniform or badge on the exterior of their clothing while performing any service at any Government facility.

6.3. Contract employees must adhere to security standards set forth in Section 16 Cybersecurity.

7. GOVERNMENT-FURNISHED FACILITIES, EQUIPMENT, MATERIAL, AND SERVICES.

7.1. The Government will provide, without additional cost to the Contractor, the facilities, equipment, materials, and services listed below:

7.2. FACILITIES. The Government will furnish the facilities for set-up and operation of the Contractor equipment analyzers required in support the SOW. The Contractor shall not alter the facilities without written approval of the Contracting Officer. The Contractor shall return the facilities to the Government in the same condition as received, fair wear and tear and approved modifications excepted.

7.3. EQUIPMENT. No equipment will be provided.

7.4. MATERIALS. No materials will be provided.

7.5. SERVICES. The Government will provide the following services at no cost to the Contractor:

7.6. The Government will provide the normal range of facility utilities (e.g. electricity, water, heating, refuse collection, etc.) and other utilities necessary for the full functionality of the equipment/instrumentation.

7.7. Security: Police and Fire Protection, as is provided other personnel.

8. CONTRACTOR FURNISHED PROPERTY

8.1. General. Except for those Government-furnished items and services specified in Section 6, the Contractor shall furnish all items, under this contract. All such items supplied by the Contractor shall conform to the applicable Safety and Health Standards as indicated in the current code of federal Regulations, Title 29, Chapter XVII, and paragraph 1910, Occupational Safety Health Act of 1970.

8.2. Transportation. Transportation in support of any equipment and incidental support and maintenance services is the responsibility of the Contractor. The Government will not provide transportation.

8.3. Nametags. The Contractor shall furnish a nametag for each contract employee. The nametag will contain the name of the company and the employee. DOCUMENTS/RECORDS.

8.4. The Contractor shall maintain all records necessary to comply with regulatory requirements and Food and Drug Administration (FDA) standards. The Contractor shall be responsible for creating, maintaining, and disposing of only those Government required records that are specifically cited in this SOW or required by the provisions of a mandatory directive listed, Applicable Publications and Forms. If requested by the Government, the Contractor shall provide the original record or a reproducible copy of any such record within 5 working days of receipt of the request.

8.5. The Contractor must provide paper and electronic copies of material safety data sheets (SDSs) for each reagent item delivered under this contract (as appropriate). The Contractor must provide paper and electronic copies of target or assayed values for each lot of control shipped. The Contractor must provide end of month reports via hard copy paper with electronic copies available online. End of month reports are at minimum to include Peer evaluation and BAMC specific internal Peer evaluation.

9. INSTRUMENTATION (Middleware only)

9.1. Each vendor must provide software system equipped to offer continuous, random statistical analysis using common statistical control rules. System must provide data management/editing software for QC results that is compatible with DoD requirements. Manufacturer software with full editing tools and storage of previously performed QC required either server supported or via web.

9.2. Software must have an interface that is compatible to the government system. Software connectivity with 3rd Party vendor instrumentation via middleware (i.e. Data Innovations) required. Bidirectional communication between Laboratory Information System (LIS) and/or middleware and instrument manufacturer software required.

9.3. Software and/or consulting services must be provided for the advisement of appropriate Westgard rules for each assay and analytic line. May be included annually or bi-annually to be used at discretion of BAMC.

9.4. Software must accommodate at minimum 10 concurrent users and Thin Clients for access from multiple locations at same time. Installment by vendor required.

9.5. The products must not require remote communication to outside sources to be functional.

9.6. The products shall provide users with reliable test results that are critical for patient care. These products (must) be capable of performing in low, medium, and high volume work periods to produce results that are accurate and precise throughout the manufacturer’s stated linearity/analytic measurement range.

9.7. All analyzer/data management system displays and supporting literature shall be in the English language.

9.8. QC must be compatible with current middleware system.

9.9. QC must have reasonable shelf life (≥ 12 months) and open vial stability (≥ 7 days) at 2- 8°C.

9.10. QC must be available in at least 2 levels (high and low) which span the analytical measuring range of the instrument in liquid ready-to-use form predominately.

9.11. QC for volatile analytes (ethanol and ammonia) must be within the normal reference range (Level 1 specifically).

10. REAGENTS AND SUPPLIES

10.1. The Contractor shall provide an estimate of the yearly quantities of QC pack required to perform the number of analytes being tested on specific instruments for each site.

10.2. The Contractor shall provide quality control materials sufficient to run every 24 hours and to be used as needed for trouble shooting, etc.

10.3. The Contractor shall ensure that requirements for routine quality control runs (as defined by the Laboratory QA program) and for troubleshooting of out-of-control assays be considered when calculating the yearly requirements.

10.4. The Contractor shall estimate the volume of user-replaceable maintenance items that will be required to support dispensing of QC product (e.g. dropper caps), and any analyzer specific tools/supplies necessary to perform operator-level daily/periodic instrument maintenance, at minimum QC performance once per 24 hours.

10.5. The Contractor shall sequester the required quality control materials (specific lot numbers) and ensure that no more than one (1) lot change for QC product occurs per contract year. QC product shall (must) be stable enough to maintain a single control run per 24 hours of testing.

10.6. All QC materials provided must be FDA approved for use in the systems stated in Section 9. All reagents/reagent packs shall be provided as follows:

10.7. Be marked with the required storage temperature.

10.8. Be maintained at the proper storage temperature during transportation from the Contractor’s storage facility to the Government acceptance site and be delivered on time at the appropriate storage temperature.

10.9. The Contractor shall provide the reagents/reagents packs, calibrators/standards, quality control materials, user- replaceable maintenance items, and analyzer specific tools/supplies as indicating based on volumes and utilization.

10.10. The Contractor must include access to peer-group quality assurance programs (including hard copy print outs of monthly evaluation summaries) and all training at no additional cost. Peer group data to be provided across all BAMC Labs and within Manufacturer performance.

11. INFORMATION MANAGEMENT.

11.1. The software system shall (must) be capable of interfacing with the military hospital computer system. The Contractor shall (must) have a driver compatible for interfacing with MHS Genesis directly or via 3rd party middleware (i.e. Data Innovations). The interface between MHS Genesis and/or middleware shall (must) be bi-directional.

11.2. The Data Management system shall have a comprehensive, fully-integrated Quality Control (QC) software module that stores and evaluates quality control results. Results can be viewed in a variety of formats including Levy-Jennings charts allowing for daily and monthly statistical analysis. The application shall validate QC results by checking them against user selected rules and automatically alert the operator when a rule violation has occurred. System shall allow for automated transfer of quality control results from instrumentation to Quality Assurance Program without user intervention.

11.3. The QC software shall have a large capacity to store graphics and results and quality control files with statistics - all available to user.

11.4. The QC software shall provide the capability to write user defined Westgard QC Rules. In addition it shall integrate with the result manager/middleware for auto-verification of results, allow viewing and maintaining of QC data across multiple levels and lots for connected analyzers, provide a mechanism to maintain an action log of comments from QC review, provide real-time access to QC charts, graphs (Levy-Jennings) and provide the ability to add comments, and eliminate data point(s) from statistics. The QC software shall (must) include the ability to apply Westgard quality control result decision rules in real-time and rule recommendations, with the ability of the user to individually select the rules to be applied.

11.5. Data Management system shall (must) have a user friendly "Windows Based" interface that shall include a data management system for operational control of the QC program

11.6. The software shall provide up to 10 concurrent users data management and status monitoring. The software monitors the lot number expiration date of on-board control materials.

11.7. The software allows archiving, status, calculation of statistics and long-term QC result storage.

11.8. The software shall provide proactive monitoring of key instrument parameters to allow for predictive diagnostics.

11.9. The Contractor shall provide and install a Thin Client-type data management system that allows for review and operation software system of the quality control program from multiple locations.

11.10. The Thin Client shall provide a dynamic display sample status, allow for dynamic/real- time review and management of the quality control program, review of on-instrument useful life of the reagents/reagent packs, and management of patient results instrument. In addition, the status of automation components and communications shall be able to be monitored from a single remote interface.

11.11. The Contractor will provide a license for connection to a middleware solution and full IT support as defined below at no addition cost to the Government throughout the life of the contract, to include the installation of servers required to operate systems (i.e. SQL server installation).

12. SPECIFIC TASKS

12.1. Within 10 working days after contract award, Contractor shall coordinate and conduct a post award site visit for the purpose of coordinating schedule sequestered lot numbers (with 1 year change-over).

12.2. The Contractor must provide a specific identifier for placing orders directly from reserve and periodic updates of quantity in reserve.

12.3. During the initial implementation, a primary, dedicated technical representative must be assigned and available on site throughout the entire implementation period and go-live.

13. DELIVERY AND INSTALLATION

13.1. All products must be delivered to the appropriate location indicated below within 30 calendar days after contract award. The products shall (must) be delivered to the location as indicated below and be in alignment with section requirements. Information Management setup and on-site training, shall (must) be completed by Contractor personnel to ensure that equipment is fully operational. During the initial implementation, a dedicated technical representative must be available on site throughout the entire software implementation period. Substitutions must be coordinated with the COR.

13.2. Brooke Army Medical Center Department of Pathology and Area Laboratory Services - Core Laboratory 3551 Roger Brooke Drive Fort Sam Houston, TX 78234

13.3. Exact installation locations at the primary locations shall be coordinated by the Contractor with the point of contacts listed below. A memorandum on Contractor’s letter head will also be provided to the individual below at the time of installation that includes all serial numbers, names, costs and any additional information identified for each piece of equipment.

13.4. The Point of Contact (POC) for all deliveries: NCOIC, Core Laboratory Department of Pathology

13.5. Brooke Army Medical Center Tel: (210) 916-9062/3386/3625

13.6. Deliveries of required items shall be as called in by the COR/DPALS POC. The Contractor will provide, upon shipment, an electronic tracking mechanism whereby the Government is able to identify the shipping status of any equipment, reagents, or materials. Large items (e.g., 20L and above), must be shipped in a split order to arrive 2 weeks apart.

13.7. Orders shall arrive on the date agreed upon and if the scheduled date is a Federal Holiday (listed above), the delivery will be scheduled for the day following the Federal Holiday.

13.8. Any supplies that are placed on back order shall be clearly identified on the shipping documents and shall be delivered in a timely manner, not to exceed ten (10) working days. Should Contractor fail to make delivery whereas such failure causes customer to purchase in the open market at a higher cost, then Contractor shall provide reimbursement to customer for the difference between contract costs and excess costs occasioned by such open market purchase(s) shall be limited to one week’s supply based upon historical usage within the ordering customer facility, after which, if contractor is still unable to supply, the customer may again go to the open market for another two week’s supply based upon historical usage for which Contractor shall provide reimbursement. Reimbursement shall be made within thirty (30) days of receipt by Contractor of documentation from the customer. If, after that period, Contractor is not able to supply, then First Choice shall have just cause for terminating this contract with thirty (30) days’ notice.

13.9. Emergency orders shall be delivered within 24 hours after the order is placed and be of the same lot number of products currently in use for the assay(s) for which supplies are being requested. Contractor will notify the Government via email and telephonic message when an order is not available or capable to be shipped within these timelines. Contractor shall provide means for ensuring orders processed accurately for specific account numbers assigned to BAMC sites.

13.10. For all orders, standing or emergency, the Contractor shall notify via email the designated points of contact that orders have shipped and provide a tracking number.

13.11. Preservation and packing - Preservation and packing shall be performed in accordance with the best commercial practice and in such a manner to afford adequate protection against any damage during shipment from source to destination. All packaging and shipping information shall be clearly marked as to contents on both the shipping documents and the shipping container/box. All deliveries will be made Tuesday through Thursday, to exclude Federal Holidays.

13.12. QC Validations will be conducted entirely by the section with support from vendor in accordance with QC protocols established by the Department of Pathology’s Quality Management Program (these protocols are in concordance with applicable standards as described by the Clinical Laboratory Standards Institute (CLSI) and/or required by the College of American Pathologists (CAP)). Additional guidelines may be required, depending on regulatory requirements.

13.13. QC Validation will include but not be limited to establishment of initial control ranges using control materials, as designated by the DPALS POC. QC Validation product to be provided at no additional cost to the Government. Validation to include no less than 20 runs per instrument system per site.

13.14. All data collected for method validations will be provided to the government in a manner appropriate for review. Statistical analysis of all QC validations will be reviewed and approved in accordance with CAP guidelines prior to reporting of patient results.

13.15. QC materials used in the QC validation will be provided by the Contractor at no additional cost to the Government. These materials will not be used in the analysis of QC for patient care. When new tests or new Generations of reagents are available/added, the Contractor will provide necessary QC product to start validation studies.

13.16. The Contractor shall provide print and electronic copies of all safety data sheets (SDS) for each item delivered under this contract that is considered to be HAZARDOUS MATERIAL by the United States. The shall contain information on the hazards associated with each specific chemical or material. The SDS shall be printed in the English language and shall contain, as a minimum, identification of:

13.16.1. The hazardous material

13.16.2. The specific hazard

13.16.3. The required practices for the safe use of the product

13.16.4. First aid procedures

13.16.5. What to do in the event of a spill or other mishap or accident.

13.16.6. The Contractor shall provide the reagents and shall coordinate exact quantities and shipment schedule with the COR prior to shipment IAW Section 13 Deliveries and Installation.

14. SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

14.1. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the Contractors shall (must):

14.2. Notify the MTF HIPAA Security Manager.

14.3. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

15. SERVICE

Contractor shall provide technical support telephone service 24 hours per day, 365 days per year to assist operators in IT problems related to the use of Unity Real Time software.

16. CYBERSECURITY

Must be ATO/RMF compliant in accordance with DoDI 8510.01. (End of Statement of Objectives)

Table 1: Estimated Workload Data

EXHIBIT 1

Defense Health Agency (DHA) Cyber Logistics Cybersecurity/Risk Management Framework (RMF) Requirements\ Information Requirements (Revised 10/27/2020)

1. General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA) The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action: The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers shall be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA) If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de‐identified data) The Contractor shall consult with the DHA Privacy Office to determine if the Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor shall gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

· DSA for De‐Identified Data

· DSA for PHI

· DSA for PII Without PHI

· DUA for Limited Data Set DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (Applies if contract requirements may include human subject research) This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235- 7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

7. Privacy Act and HIPAA Training The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate. The Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

8. HIPAA Business Associate Provisions

8.1 Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Ru es and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at, https://www.health.mil/Military-Health- Topics/Privacy-and-Civil- Liberties/Privacy-Contract- Language/HIPAA-Compliant- Business-Associate-Agreement-for-the-MHS. b.i. and (3)b.ii

9. Breach Response This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference

9.1 Definitions Related to Breach response

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non‐cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

9.1.3 A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident shall initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors: • How the event was discovered; • Did the information stay within the covered entity’s control; • Was the information actually accessed/viewed; and • Ability to ensure containment (e.g., recovered, destroyed, or deleted). •

· How the event was discovered;

· Did the information stay within the covered entity’s control;

· Was the information actually accessed/viewed; and

· Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4. A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re‐classify the incident as a non‐breach incident.

9.1.5 A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states: Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI. HHS breach excludes: Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule. covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule. A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information. Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors: The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re- identification; The unauthorized person who used the PHI or to whom the disclosure was made; Whether the ed; and The extent to which the risk to the PHI has been mitigated.

9.1.6 A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality),then a non‐breach cybersecurity incident has occurred.

9.2 General

9.2.1 The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

9.2.2 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non‐breach, confirmed vs. possible, cyber vs. noncyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24‐hour deadline.. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

9.2.4 In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States‐ Computer Emergency Readiness Team (US‐CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below. The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirement.

9.2.5 Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery. The time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours) under paragraph 9.3.2. If a cybersecurity incident is involved, the contractor’s deadline for US‐CERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the contractor to complete the breach response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall report directly to US‐CERT and the DHA Privacy Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

9.2.6 Contractors shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome. Investigations identifying unauthorized disclosures shall be logged for HIPAA and Privacy Act disclosure accounting purposes, whether or not individual notification is required under the HIPAA Breach Rule.

9.2.7 Contractors, when acting as HIPAA‐covered entities, and not as business associates, are not subject to the breach response requirements herein. However, such contractors are subject to both the HIPAA Breach Rule (applicable to them in their capacity as covered entities) and DoD cybersecurity requirements (applicable to them in their capacity as DoD contractors).

9.3 Reporting Provisions

9.3.1 Immediately upon discovery of a possible or confirmed breach or cybersecurity incident, the contractor shall initiate an investigation. If the incident involves electronic PII/PHI, and if the investigation finds a confirmed breach or cybersecurity incident, the contractor shall report it, within 1 hour of confirmation, to the US‐CERT Incident Reporting System at https://forms.us‐ cert.gov/report/, as required by the Department of Homeland Security (DHS).

Note: DHS no longer requires US-CERT reporting of non-cyber breaches or unconfirmed electronic breaches. However, DHS permits US-CERT reporting of unconfirmed cyber- related incidents on a voluntary basis.