Attachment D 1 PWS Medical Claims Processing Support.pdf

Performance Work Statement Medical Claims Processing Support

For the

Department of Veterans Affairs

Financial Healthcare Service

2/24/2022

Version 1.1 ii PWS - Medical Claims Processing Support

Table of Contents

1. BACKGROUND

2. SCOPE OF WORK

3. APPLICABLE DOCUMENTS

4. PERFORMANCE DETAILS

4.1. Period of Performance

4.2. Hours of Operations

4.3. Place of Performance

4.4. Continuity Of Operations Plan (COOP)

4.5. Training

4.6. Travel

4.7. Government Furnished Information, Equipment, or Office Space

4.8. Kick-Off Meeting

4.9. Transition Planning

4.10. Contractor Personnel Requirements

4.10.1. Key Personnel

4.10.2. Personnel

4.11. Personnel Roster

5. SPECIFIC PERFORMANCE REQUIREMENTS

5.1. Medical Claims Processing

5.2. Operational Medical Claims Help Desk

6. POSITION/TASK RISK DESIGNATION LEVEL(S) AND CONTRACTOR SECURITY AND PRIVACY

REQUIREMENTS

6.1. Security and Privacy Requirements

6.2. Personnel Security Requirements

6.3. Contractor Personnel Security Requirements

7. DOCUMENTATION

7.1. Data Rights

7.2. Deliverables

8. PERFORMANCE MEASURES

9. CYBER AND INFORMATION SECURITY REQUIREMENTS FOR VA IT SERVICES:

iii PWS - Medical Claims Processing Support

10. PHYSICAL SECURITY AND SAFETY REQUIREMENTS

11. CONFIDENTIALITY AND NON-DISCLOSURE

12. VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

12.1. General

12.2. Access to VA Information and VA Information Systems

12.3. VA Information Custodial Language

12.4. Information System Hosting, Operation, Maintenance, Or Use

12.5. Security Incident Investigation

12.6. Liquidated Damages For Data Breach

12.7. Security Controls Compliance Testing

12.8. Training

12.9. Contractor Personnel Security

13. NARA RECORDS MANAGEMENT LANGUAGE FOR CONTRACTS

1 PWS - Medical Claims Processing Support

1. BACKGROUND

The Department of Veterans Affairs (VA) Financial Services Center (FSC) is a Franchise Fund under the Government Management Reform Act, P.L. 103-356. Consequently, the FSC receives no federally appropriated funding and thus is required to market its services to customers. As such, FSC provides financial services to the Department as well as to other government agencies (OGAs).

FSC processes medical claims in support of their customers. Vendors providing medical services and care to individuals send claims to the FSC for adjudication in accordance with appropriate fee schedules based on customer program requirements. The FSC is responsible for processing the associated medical claims submitted by the medical providers in accordance with the Prompt Payment Act and customer program requirements and reimbursing medical care providers on behalf of customers. Current FSC customers include, but are not limited to, 21 Veteran Integrated Service Networks (VISNs) throughout the United States (US), Department of Health and Human Services, dialysis medical claims (Medicare), and compensation claims resulting from Veterans’ exposure to contaminated water at Marine Corps Base Camp Lejeune.

2. SCOPE OF WORK

The Contractor shall provide technical and professional medical claims processing services in support of the FSC and its customers. FSC already has a claims processing system in place;

therefore, the Contractor providing a claims processing system is not a requirement of this project. The Contractor shall assist in the management of, as well as, process a large volume of medical claims efficiently and in the prescribed timeframes. The Contractor shall process up to 20,000claims daily. The difference in the number of claims processed daily is based on current rates. For purposes of processing the medical claims, all data shall be electronic. Additionally, the Contractor shall respond to 1,000 written and oral payment inquiries daily and 30,000 written and oral payment inquiries monthly.

In addition to claims processing, a small percentage of Contractor personnel shall be required to provide operational Help Desk Support (i.e., respond to telephonic and email inquiries. This is not an Information Technology Help Desk). (See Section 5.2, Operational Medical Claims Help Desk)

The Contractor shall provide all resources necessary to accomplish the requirements described in this Performance Work Statement (PWS). The Contractor shall follow all applicable privacy laws, including but not limited to the Health Insurance Portability and Accountability Act of 1996 (HIPAA; Pub.L. 104–191, 110 Stat. 1936, enacted August 21, 1996), in the performance of this requirement.

2 PWS - Medical Claims Processing Support

This will be a Requirements contract. The base contract shall include hours for a program manager, administrative assistant, medical claims processor lead, and medical claims processors. For each labor category, the annual contract ceiling shall not exceed the following:

Table 1. Contract Ceiling by Labor Category Labor Category Contract Ceiling

Program Manager 1,920 hours

Administrative Assistant 1,920 hours

Medical Claims Processor Lead 48,000 hours

Medical Claims Processor 480,000 hours

Medical Claims Processor Lead – Adhoc Labor Hours for Overtime

2,500 hours

Medical Claims Processor– Adhoc Labor Hours for Overtime

17,500 hours

Contractor support for this requirement may increase and/or decrease throughout the performance period based on the following variables:

1. Manual review of all claims; the complexity depends on the type of claim being reviewed.

2. Introduction of software to automate most of the review process; if the Government utilizes a new software system training will be provided on the new system.

3. Combination of a manual and software automation review process.

However, any potential increases and/or decreases in support will be subject to contract modifications.

3. APPLICABLE DOCUMENTS

The following documents shall be used in the performance of the tasks in this Performance Work Statement:

1. International Classification of Diseases, Ninth Revision (ICD-9)

2. International Classification of Diseases, Tenth Revision (ICD-10)

3. Health Insurance Portability and Accountability Act of 1996 (HIPAA; Pub.L. 104-191, 11O Stat. 1936, enacted August 21, 1996)

4. Diagnostic and procedural coding for all Health Care Financing Administration-1500

(HCFA-1500)

3 PWS - Medical Claims Processing Support

5. Department of Veterans Affairs Alternative Workplace Arrangement (Telework) Policy (VA Handbook 5011, Part II, Chapter 4)

6. 44 U.S.C. § 3541,“Federal Information Security Management Act (FISMA) of 2002”

7. Title 38 U.S.C. §5705, confidentiality of medical quality assurance records

8. Title 38 U.S.C. §7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus

9. Title 38 U.S.C. §5725, Contracts for data processing or maintenance

10. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

11. 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”).

12. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

13. VA Handbook 6500.2, “Management of Data Breaches Involving Sensitive Personal Information (SPI)”, January 6, 2012

14. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

15. VA Directive 6300, Records and Information Management, February 26, 2009

16. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, October 1, 2013

17. VA Directive and Handbook 0710, Personnel Suitability and Security Program

18. Department of Veterans Affairs 0710 Handbook, “Personnel Security Suitability Program,”

19. VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules,

20. VA Handbook 6500.1, Electronic Media Sanitization

21. Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS PUB 140-2)

4. PERFORMANCE DETAILS

4.1. Period of Performance

The period of performance shall be for one 12-month base period and two optional 12-month periods, to be determined by the award date.

The Contractor shall provide services during the hours of operation (paragraph 4.2 below), except for the following federal holidays set by law (USC Title 5 Section 6103). This list of holidays relates to Government duty days and is not intended to supplement or otherwise alter the provisions of any Wage Determination regarding applicable paid holidays.

4 PWS - Medical Claims Processing Support

There are eleven Federal holidays set by law (USC Title 5 Section 6103) that VA follows: New Year’s Day, Martin Luther King Day, President’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, and Christmas.

Under current definitions, five are set by date:

New Year's Day January 1st Juneteenth June 19th Independence Day July 4th Veterans Day November 11th Christmas Day December 25th

If any of the above falls on a weekend, then the Government will notify the Contractor of the day the holiday will be observed.

4.2. Hours of Operations

It is anticipated there shall be claims backlogs, or surges in the request by FSC customers to process medical claims. It shall be incumbent upon the contractor to provide support to alleviate and accommodate these backlogs and surges. Examples of methods to alleviate these surges include but are not limited to part time, night shift, adhoc or weekend hours.

The Contractor shall provide medical claims processing services Monday through Friday, except Federal Holidays, from 6:00 AM to 6:00 PM Central Time (core hours), except Federal Holidays.

The Contracting Officer’s Representative (COR) will provide notification to the Contractor with 48 hours’ notice if there is a need for additional coverage required to meet FSC customer need to meet backlogs and/or surges. In anticipation of the backlog and surges in medical claims processing while maintaining continuity of services a Not to Exceed (NTE) Contract Line Item Number (CLIN) has been included. The aforementioned CLIN has been estimated based on historical backlogs/surges.

4.3. Place of Performance

Contractor personnel shall work at an alternate work location approved by both the Contractor’s Program Manager and the COR.

4.4. Continuity Of Operations Plan (COOP)

Should the Government implement its Continuity of Operations Plan (COOP), the COR will notify the Contractor Program Manager of any changes to the working conditions.

4.5. Training

All Contractor personnel shall successfully complete Government held training for a period not to exceed three months. Training includes orientation and familiarization with VA systems and standard operating processes, and on the job training. Training timeframes may be less than

5 PWS - Medical Claims Processing Support three months depending on individual contract personnel training success. Only Contractor personnel who have successfully completed training will be acceptable to begin work.

The Contractor shall complete all mandatory training courses virtually on the, the VA Talent Management System (TMS) and successful completion will be tracked therein. Specific courses include:

• VA 10176 - Info Security Rules of Behavior

• VA 10203 - Privacy & HIPAA

• VA 3812493 - Annual Government Ethics Training

• VA 8872 - Prevention of Workplace Harassment/No FEAR

• VA 1367006 - Telework Training For Employees

4.6. Travel

Travel is not authorized for this effort.

4.7. Government Furnished Information, Equipment, or Office

Space The Government will provide all procedural guides, reference materials, and equipment to perform job functions relative to the tasks identified in this PWS.

VA shall provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use of a VA approved method to connect external equipment/systems to VA’s network. Citrix Access Gateway (CAG) is the current and only VA approved method for remote access users when using or manipulating VA information for official VA Business. VA permits CAG remote access through approved Personally Owned Equipment (POE) and Other Equipment (OE) provided the equipment meets all applicable 6500 Handbook requirements for POE/OE. All the security controls required for Government furnished equipment (GFE) must be utilized in approved POE or OE. The Contractor shall provide proof to the COR for review and approval that their POE or OE meets the VA Handbook 6500 requirements and VA Handbook 6500.6 Appendix C, herein incorporated as Addendum B, before use. CAG authorized users shall not be permitted to copy, print or save any VA information accessed via CAG at any time. VA prohibits remote access to VA’s network from non-North Atlantic Treaty Organization (NATO) countries. The exceptions to this are countries where VA has approved operations established (e.g. Philippines and South Korea). Exceptions are determined by the COR in coordination with the Information Security Officer (ISO) and Privacy Officer (PO).

This remote access may provide access to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, ProPath, Primavera, and Remedy, including appropriate seat management and user licenses, depending upon the level of access granted. The Contractor shall not transmit, store or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6

6 PWS - Medical Claims Processing Support dated March 12, 2010. All VA sensitive information shall be protected at all times in accordance with VA Handbook 6500, local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/Local Area Networks (LANs) accessed while performing the tasks detailed in this PWS. The Contractor shall ensure all work is performed in countries deemed not to pose a significant security risk. For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into easy reference) refer to Sections 9 - Cyber and Information Security Requirements for VA IT through Section 12 - VA Information And Information System Security/Privacy Language.

If Government Furnished Equipment (GFE) is provided, the Contractor shall provide and maintain an inventory list of GFE. The following is of equipment that may be provided:

• Laptop w/card reader

• Laptop Case

• Additional Monitor(s)

• Docking Station

• Keyboard

• Mouse

• Lock set cable

• Head set

4.8. Kick-Off Meeting

The Government shall conduct a kick-off meeting within seven (7) calendar days after award with the Contractor Team. The Government Team will include the COR, CO and Program Manager. The Contractor shall brief the Transition In Plan (including a staffing plan), Training Plan to include syllabus and Quality Assurance Plan using the guidance contained in the Quality Assurance Surveillance Plan (QASP) at this meeting. The Contractor shall provide briefing material no later than two (2) working days prior to the kick-off meeting. The kick-off meeting will be held via teleconference.

4.9. Transition Planning

If the incumbent Contractor is already providing the service under a previous contract, a Transition In Plan is not required.

The Contractor shall provide a plan for transitioning out to either the Government or subsequent Contractor at the end of the Period of Performance. In the Transition Out Plan, the Contractor shall address how the Contractor intends to maintain a level of services required to meet performance metrics individually, or in coordination with the subsequent provider. The Contractor shall provide the plan no later than 90 days before the end of the period of performance.

7 PWS - Medical Claims Processing Support

4.10. Contractor Personnel Requirements

4.10.1. Key Personnel

The Contractor shall assign lead personnel to supervise performance of the work in this PWS with the goals to meet performance measures. The Key Personnel are the Program Manager and Medical Claim Processor Lead. Key Personnel are essential for successful Contractor accomplishment of the work to be performed. Key personnel are those persons whose resumes are submitted with the proposal. The Contractor shall not remove, divert, or replace any Key Personnel without written approval of the Contracting Officer (CO) and COR.

Requests to substitute Key Personnel shall be provided to the CO and the COR for approval no later than thirty (30) calendar days prior to making any change. The request shall be in writing and shall provide a detailed explanation of the circumstances necessitating the proposed substitution of key personnel. The Contractor shall submit a complete resume for the proposed substitute Key Personnel, and any other information requested by the CO to approve or disapprove the proposed substitution. The CO will evaluate such requests and notify the Contractor of approval or disapproval thereof in writing.

4.10.1.1. Program Manager or Equivalent

The Program Manager/Equivalent (PM) shall provide the supervision needed for all Contractor personnel to perform the scope of work accurately, efficiently and within established time frames to attain the required performance metrics in this PWS. The PM or Equiv shall be the primary interface with the Government. The PM shall ensure this contract is sufficiently staffed and there is no lapse in services.

This position requires the following experience level(s):

• Minimum of ten years of experience supervising personnel, of which a minimum of six years experience is supervising personnel on processing medical claims and vouchers using numerous database applications in accordance with medical claims coding regulations and guidelines

• Possess a thorough understanding of Current Procedural Terminology (CPT), Healthcare Common Procedure Coding System (HCPCS) and International Classification of Diseases, Ninth Revision, Clinical Modification (ICD-9-CM) and Tenth Revision Clinical Modification (ICD-10-CM) standards

• Possess in-depth subject matter knowledge and judgement to direct the performance of the personnel

• Possess proven capability and experience to supervise a team of the size needed to perform the scope and accuracy of work and to attain the required performance metrics in the PWS

• Possess knowledge and expertise in the use of Microsoft Office Products such as Word, Excel, and Project

8 PWS - Medical Claims Processing Support

• Possess an in-depth understanding of billing and follow up regulations as it relates to Medicare

• Possess an in-depth understanding of electronic claims editing and submission capabilities including Medicare and NEIC on-line claims processing and query system

• Have demonstrated success supervising a team focused on meeting organizational goals, objectives, and strong customer service skills

4.10.1.2. Medical Claims Processor Lead or Equivalent

The Medical Claims Processor Lead/Equivalent (MCP Lead) shall perform the same functions as the other MCPs in addition to supervising the team’s workload.

Typical duties include assisting in a variety of administrative matters; maintaining a wide variety of medical or other records; verifying medical claims and vouchers for accuracy and completeness; handling and adjusting on-line and phone inquiries and/or complaints

This position requires the following experience level(s):

• Must possess a high school diploma

• Minimum of three years experience processing medical claims and vouchers

• Possess subject matter knowledge and judgement to independently complete assignments consisting of numerous steps that vary in nature and sequence

• Ability to utilize alternative methods and refer problems not solvable by adapting or interpreting substantive guides, manuals, or procedures

• Capable of training personnel on FSC systems if needed

• Possess a thorough understanding of Current Procedural Terminology (CPT), Healthcare Common Procedure Coding System (HCPCS) and International Classification of Diseases, Ninth Revision, Clinical Modification (ICD-9-CM) and Tenth Revision Clinical Modification (ICD-10-CM) standards

• Possess a working knowledge of Microsoft Office, Access, and Excel

• Possess an in-depth understanding of billing and follow up regulations as it relates to Medicare

• Possess an in-depth understanding of electronic claims editing and submission capabilities including Medicare and NEIC on-line claims processing and query system

• Have demonstrated success working in a team environment focused on meeting organizational goals, objectives, and strong customer service skills

4.10.2. Personnel

The Contractor shall provide the personnel needed to satisfy the services performed under this contract. The Contractor shall provide personnel that meet all qualifications. Any substitutes or replacements by the Contractor shall have qualifications that meet the requirements herein.

The following positions are applicable to this requirement:

9 PWS - Medical Claims Processing Support

4.10.2.1. Medical Claims Processor or Equivalent

The Medical Claims Processor or Equivalent (MCP) uses some subject matter knowledge and judgement to complete assignments consisting of numerous steps that vary in nature and sequence. The MCP shall select from alternative methods and refer problems not solvable by adapting or interpreting substantive guides, manuals, or procedures. Typical duties include assisting in a variety of administrative matters; maintaining a wide variety of medical or other records verifying medical claims and vouchers for accuracy and completeness in accordance with VA policy, Medicare regulations and medical claims coding regulations and guidelines;

handling and adjusting on-line and phone inquiries and/or complaints.

This position requires the following experience level(s):

• Must possess a high school diploma

• Minimum of two years experience as a medical claims processor, a medical field, or a field using medical coding standards.

• Possess a working knowledge of Microsoft Office Suite

• Possess a familiarity with CPT, HCPCS and ICD-9-CM & ICD-10-CM standards.

• Possess an understanding of billing and follow up regulations as it relates to Medicare

• Possess an understanding of electronic claims editing and submission capabilities including Medicare and NEIC on-line claims processing and query system

4.10.2.2. Administrative Personnel or Equivalent

The Administrative Personnel or Equivalent performs a variety of moderately complex general support duties under general supervision. The Supervisor normally provides general instructions and work priorities. Completed work may be reviewed by Supervisor for accuracy.

Typical duties include processing the day to day clerical activities, record keeping, gathering data and assisting in preparing reports of a particular function or area. Acting as a liaison with staff members and disseminating information. Coordinating the scheduling of activities and maintaining inventory logs.

This position requires the following experience level(s):

• Must possess a high school diploma

• Possess a working knowledge of Microsoft Office Suite

4.11. Personnel Roster

The Contractor shall provide an initial personnel roster within 15 days of contract award that lists all personnel, their title (PM, MCP Lead, MCP or Equiv), and the CLIN they are supporting.

The Contractor shall update the roster monthly; not later than the 10th calendar day of the month for subsequent rosters. Updates are not required if no changes occur.

10 PWS - Medical Claims Processing Support

5. SPECIFIC PERFORMANCE REQUIREMENTS

The Contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS.

5.1. Medical Claims Processing

The Contractor shall process up to 20,000 claims daily which are submitted by FSC customers.

The Contractor shall use the FSC medical claims processing system which incorporates an Internet authorization application, document processing functionality, optical character recognition (OCR) scanning capability, Plexis Claims Manager (PCM) claims processing software, Electronic Claims Adjudication Management System (eCAMS), and VA Purchase Care System functionality.

The Contractor shall process claims that are submitted individually or multiple claims submitted concurrently (bulk claims). The Contractor shall maintain an average hourly rate for processing a standard medical claim per the designated section as indicated by the table below. The target volume is the estimated number of claims for the Contractor to process.

Table 2. Rate Per Hour (RPH) Target Medical Claims Processor (MCP) Per Section

Claim Type RPH Target Per

MCP

Target Volume of Claims Processed Annually

Dialysis National Contract 10 200,000 Camp Lejeune Family Member Program 10 40,000

Other Government Agency (OGA) 13 230,000 Patient-Centered Community Care

(PC3) 13 80,000

eCAMS (see below) 625,000 End-to-End Claims Processing 15 Pricing only 30

Total 1,175,000

In addition, the Contractor shall:

1. Input medical claims data into the FSC medical claims processing system using either PCM/eCAMS application or VA Purchase Care System. The Contractor shall manually enter any claims which do not scan correctly using OCR.

2. Examine vouchers, invoices, claims and other payment requests for various types of medical services for authorized patients for completeness, accuracy (including mathematical errors, missing, or incorrect data) and compliance with laws and regulations.

Review claims for appropriate diagnostic and procedural coding for all Health Care

11 PWS - Medical Claims Processing Support

Financing Administration-1500 (HCFA-1500), Uniform Bill 92 (UB92) and other claim forms.

Ensure compliance with Current Procedural Terminology (CPT), Healthcare Common Procedure Coding System (HCPCS) and International Classification of Diseases, Ninth Revision, Clinical Modification (ICD-9-CM) and Tenth Revision Clinical Modification (ICD-10- CM) medical claims coding regulations and guidelines, and Medicare billing standards.

3. Provide comments to include recommended claims dispositions: acceptance and payment; or rejection due to the need for corrections by the claimant.

4. For accepted claims, process all necessary payment transactions through to the U.S.

Treasury.

5. Forward rejected claims to claimants with recommendations for corrections.

6. Analyze and audit any overpayments or underpayments of claims. Draft letters to claimants informing them of their obligation to provide payments for underpayments or reimburse overpayments for government signature. Inform the Government of payments that have not been resolved within a reasonable period not to exceed two weeks. Follow up as needed until payments are resolved.

5.2. Operational Medical Claims Help Desk

In addition to claims processing, Contractor personnel shall be required to provide Help Desk Support for medical claims processing. This shall not be an Information Technology Help Desk.

The following duties include:

1. The Contractor shall respond to approximately 5,000 written and oral inquiries monthly that are received from FSC customers by phone or via e-mail. Considering there are 20 working days in the average month, the Contractor shall respond to approximately 250 written and oral inquiries daily from FSC customers received by phone, via the FSC web site, or via email.

2. The Contractor shall use PCM and other appropriate systems to research customer inquiries. The Contractor shall take information from these locations or systems, interpret laws, policies and procedures, and analyze information. The Contractor shall interpret that information to provide a response that is accurate and easily understood by the customer.

3. The Contractor shall determine when requests must be forwarded to their supervisor or elevated to a Government lead for resolution. For issues that require elevation to the Government, the Contractor shall provide clear and concise documentation of the customer’s help desk request and identify or provide the information found during research.

12 PWS - Medical Claims Processing Support

6. POSITION/TASK RISK DESIGNATION LEVEL(S) AND

CONTRACTOR SECURITY AND PRIVACY REQUIREMENTS

6.1. Security and Privacy Requirements

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the solicitation.

6.2. Personnel Security Requirements

The position sensitivity and the level of background investigation required for each Contractor personnel are commensurate with the required level of access for the tasks defined in this PWS.

As indicated in the table below, the Contractor shall deem all tasks in this PWS as Position Sensitivity “Moderate” (also referred to as Tier 2 or Moderate Background Investigation (MBI)).

Table 3. Background Investigation and Task Risk Designation Levels Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Security Suitability Program,” Appendix A)

Low / Tier 1

National Agency Check with Written Inquiries (NACI) A NACI is conducted by the United States Office of Personnel Management (OPM) and covers a five-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the United States Department of Defense (DOD) Defense Central Investigations Index (DCII), Federal Bureau of Investigation (FBI) name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate / Tier 2

Tier 2 / MBI. A Tier 2/MBI is conducted by OPM and covers a five-year period.

It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

6.3. Contractor Personnel Security Requirements

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate background investigation, and are able to read, write, speak and understand the English language.

13 PWS - Medical Claims Processing Support

2. The Contractor shall bear the expense of obtaining background investigations.

3. Within five business days after award, the Contractor shall provide an initial personnel roster of Contractor and Subcontractor personnel to the COR to begin their background investigations.

The roster shall contain each Contractor personnel’s Full Name, Date of Birth, Place of Birth, email address and individual background investigation level requirement (to support Section 6.2, Personnel Security Requirements). The Contractor shall submit full Social Security Numbers either within the Personnel Roster or under separate cover to the COR. The Contractor shall notify the COR of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc.

throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Personnel Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service. The final roster shall be provided 30 days before the Period of Performance (PoP) start date.

4. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

5. For a Low Risk designation, the following forms are required to be completed: 1. OF-306 and

2. Department of Veterans Affairs Memorandum – Electronic Fingerprints. These initial documents should be submitted to the COR within five business days after award; final documents shall be submitted no later than 30 days before the PoP start date.

6. The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the OPM’s Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

7. The Contractor personnel shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC.

These documents shall be submitted to the COR within three business days of receipt of the e- QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor personnel should notify the COR within three business days that documents were signed via eQIP).

8. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. If damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

9. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) fingerprint results, 14 PWS - Medical Claims Processing Support training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the

OPM.

10. The Contractor, when notified of an unfavorably adjudicated background investigation for Contractor personnel as determined by the Government, shall withdraw the personnel from consideration in working under the contract.

11. Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

12. Identity Credential Holders shall follow all HSPD-12 policies and procedures, as well as, use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

7. DOCUMENTATION

7.1. Data Rights

All information reviewed, acquired and documents developed during this contract shall belong to VA. The Government shall retain all rights and privileges, including those of patent and copy, to all Government furnished data. The Contractor shall neither retain nor reproduce for private or commercial use any data or other materials furnished under this contract. The Contractor agrees not to assert any rights at common law or in equity or establish any claim to statutory copyright in such data. These rights are not exclusive and are in addition to any other rights and remedies to which the Government is otherwise entitled elsewhere in the contract.

7.2. Deliverables

The Contractor shall provide the documentation identified in Table 3 below. The Contractor shall deliver the documents in electronic (e.g., searchable PDF and source application format such as Microsoft Office Word or Excel) and/or hard copy (e.g., bound or notebook, etc.)

formats as specified below.

Table 4. Deliverables Description PWS Reference Delivery Notes Deliver To

GFE Inventory List 4.7 Initial submittal no later than (NLT) twenty-one (21) Calendar Days (CDs)

CO, COR

Electronic Format

15 PWS - Medical Claims Processing Support

Description PWS Reference Delivery Notes Deliver To after receipt of GFE.

Provide monthly updates on the 10th CD of the month, if changes occur.

Transition In Plan 4.9 Draft provided seven

(7) days after award.

May be presented at kickoff meeting

CO, COR

Electronic Format

Transition Out Plan 4.9 NLT 90 calendar days prior to contract completion, or within 30 days of notification by the Contracting Officer.

CO, COR

Electronic Format

Personnel Roster 4.11, 6.3 Initial submittal NLT five (5) business days after contract award; in the event this initial list isn’t comprehensive a final roster shall be provided 30 days before the PoP start date. Updates shall be submitted on the 10th calendar of the month, if changes occur

CO, COR

Electronic Format

8. PERFORMANCE MEASURES

The Government will evaluate Contractor performance and deliverables against the following criteria to determine interim and final acceptance of the services provided:

Table 5. Performance Measures

OBJECTIVES PERFORMANCE STANDARDS METHOD OF

ASSESSMENT

GFE Inventory List (if applicable)

Initial submittal (NLT) twenty-one (21) Calendar Days (CDs) after receipt of GFE.

The list contains accurate, up-to-date

COR Surveillance

16 PWS - Medical Claims Processing Support

OBJECTIVES PERFORMANCE STANDARDS METHOD OF

ASSESSMENT

information. Updates are submitted on the 10th of the month as changes occur.

Kickoff Meeting Briefing Materials

Materials succinctly summarize the staffing plan and quality assurance planning (using the QASP as guidance).

The briefing shall clearly demonstrate that the Contractor is ready to do work, as determined by the Government.

COR Surveillance

Transition In Plan The Plan describes the Contractor’s approach to provide sufficient staff to attain performance metrics without any degradation of services throughout the period of performance; and shall Include a contingency plan for replacing staff as vacancies occur. The plan will include a schedule for in-processing, orientation, and training on FSC systems.

The plan shall clearly demonstrate that the

Contractor is ready to do work, as determined by the Government.

CO/COR

Acceptance

Transition Out Plan The Plan addresses how the Contractor intends to maintain a level of services required to meet performance metrics individually, or in coordination with the subsequent provider.

The plan shall clearly demonstrate that work will be transitioned with minimal degradation to medical claims services.

CO/COR

Acceptance

Personnel Roster Initial submittal is received NLT fifteen working days of contract award in order to commence Contractor personnel in-processing at FSC; in the event this initial list isn’t comprehensive a final roster shall be provided 30 days before the PoP start date.

The roster contains accurate, up-to-date information.

Updates are submitted on the 10th of the month as changes occur.

COR Surveillance

17 PWS - Medical Claims Processing Support

OBJECTIVES PERFORMANCE STANDARDS METHOD OF

ASSESSMENT

Dialysis National Contract Individual

Target Rates

10 Per Hour COR Surveillance

Camp Lejeune Family Member

Program Individual Target Rates

10 Per Hour COR Surveillance

Other Government Agency (OGA)

Individual Target Rates

13 Per Hour COR Surveillance

PC3 Individual Target Rates

13 Per Hour COR Surveillance eCAMS End-to-End Claims Processing Individual Target

Rates

15 Per Hour COR Surveillance eCAMS Pricing only Individual Target Rates

30 Per Hour COR Surveillance

9. CYBER AND INFORMATION SECURITY REQUIREMENTS

FOR VA IT SERVICES:

The Contractor shall ensure adequate LAN/Internet, data, information, and system security using VA Handbook 6500 as guidance with VA standard operating procedures and standards as set forth within the PWS, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible.

The Contractor shall follow all applicable VA policies and procedures governing information security.

Contractor supplied equipment, personal computers of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA;

Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus

18 PWS - Medical Claims Processing Support and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The CO, COR, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance

The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp which is enforced at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

10. PHYSICAL SECURITY AND SAFETY REQUIREMENTS

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

The Contractor and its personnel shall wear visible identification at all times while personnel are on the premises.

VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

Smoking is prohibited inside/outside any building other than the designated smoking areas.

The possession of weapons is prohibited.

The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

11. CONFIDENTIALITY AND NON-DISCLOSURE

The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations. The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability

19 PWS - Medical Claims Processing Support and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, following contract award the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA Contracting Officer will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA Contracting Officer for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities.

Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this contract and its subparts and appendices.

4. The Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA Contracting Officer.

5. Contractor shall train all its employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. The Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

20 PWS - Medical Claims Processing Support

7. The Contractor shall adhere to the following:

(1) The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

(2) Controlled access to system and security software and documentation.

(3) Recording, monitoring, and control of passwords and privileges.

(4) All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

(5) VA, as well as, any Contractor (or Subcontractor) systems used to support the PWS herein, shall provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

(6) Contractor PM and VA PM shall be informed within 24 hours of any employee termination.

(7) Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

(8) The Contractor does not require access to classified data.

12. VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

12.1. General

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

12.2. Access to VA Information and VA Information Systems

1. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their personnel, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

2. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or personnel who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

3. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the

21 PWS - Medical Claims Processing Support classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS).