CCA Draft PWS October 2025.doc

DRAFT Performance Work Statement Title: Comprehensive Cost Avoidance, Coordination of Benefits, and Recovery Program Anticipate Period of performance of this contract is: July 29, 2026, to July 28, 2031 Anticipated Base Period: July 29, 2026, to July 28, 2027 Anticipated Option Period One: July 29, 2027, to July 28, 2028 Anticipated Option Period Two: July 29, 2028, to July 28, 2029 Anticipiated Option Period Three: July 29, 2029, to July 28, 2030 Anticipated Option Period Four: July 29, 2030, to July 28, 2031

SECTION 1 – BACKGROUND

On January 2, 2011, the President signed into law the James Zadroga 9/11 Health and Compensation Act of 2010 (Zadroga Act). The Act established within the Department of Health and Human Services a program to be known as the World Trade Center (WTC) Health Program. The WTC Health Program provides medical monitoring, screening, and treatment for responders and survivors of the 9/11 terrorist attacks. The statute authorizing these services directs the WTC Health Program to recover monies from workers’ compensation (WC) insurers for medical treatment (including pharmaceuticals) when the responder or survivor who is treated by WTC Health Program is also eligible for workers’ compensation benefits. The New York State (NYS) Workers’ Compensation Board (WCB) has established a Health Insurance Matching Program (HIMP) that permits health plans, such as the WTC Health Program, to identify individuals who are eligible for workers’ compensation benefits and to seek reimbursement from workers’ compensation insurers for treatment-related costs paid by the health plan.

The overarching aim of this contract is to improve efficiency and control health care costs by establishing a comprehensive cost avoidance, coordination of benefit and recovery program from pre- to post-payment processes.

SUBSECTION A – DEFINITIONS

Clinical Centers of Excellence (CCE): CCEs are the NY metropolitan area-based medical facilities that, in accordance with the Act, operate under individual contractual relationships with NIOSH to provide medical monitoring examinations, diagnosis, and treatment services for eligible persons in the NY metropolitan area. Members are each assigned a CCE which is responsible for coordinating their care under the WTC Health Program.

National Program Administrator (NPA): The NPA is a designated entity responsible for providing services to WTC Health Program Responders and Survivors residing outside the New York Metropolitan Area (NYMA), as mandated by the Zadroga Act (42 USC 300mm-4). The NPA's objectives include delivering monitoring and treatment benefits, conducting outreach and retention activities for eligible individuals, offering counseling for WTC-related health conditions and associated benefits, providing assistance with applications for various insurance and social service programs, ensuring access to translation and interpretive services for non-English proficient participants, and collecting and reporting data in compliance with the Zadroga Act. The NPA is tasked with identifying Survivor and Responder members and tailoring care to meet the specific needs and benefits associated with each membership category.

Near-Real Time: Near-Real time is defined as 25 seconds (achieved 99% of the time) when insurance inquiries take place through the proposed User Interface (UI). Near real-time batch solutions for insurance identification (containing up to 10,000 records) are returned by the end of the following business day when submitted by 12 PM ET.

Other Health Insurance (OHI): Private or public health insurance a Member has in addition to the coverage available through the Program, to include group health, government, or workers’ compensation insurance. The Program is a limited health care benefit program that provides monitoring and treatment for Certified WTC-Related Health Conditions and Certified Health Conditions Medically Associated with a WTC-Related Health Condition only. By law, Members are required to maintain Minimum Essential Coverage as defined by the Affordable Care Act (ACA), absent a limited exception as outlined in the ACA. Members must report their OHI to their CCE/NPA and the TPA; treatment claims for non-work-related health conditions must first be billed to their OHI before being billed to the Program.

Primary Health Insurance: The first payer for medical claims, covering eligible healthcare costs before any secondary insurance or additional coverage is applied.

Third Party Administrator (TPA): The TPA contractor provides administrative support for the Program in the areas of medical benefits and member services, including, but not limited to, member enrollment, health condition certification, affiliated provider credentialing and enrollment, claims processing, and coordination of benefits. The TPA contractor also maintains a call center and mailroom to respond to inquiries from potential enrollees, members, and providers.

Timely Filing Limit (TFL): establishes deadlines for submitting internal and external claims to ensure efficient tracking of healthcare expenditures. External claims without COB must be submitted within 15 months, while those with COB have an 18-month limit. Internal claims require 95% submission within 90 days and 100% within 180 days for claims without COB, and 18 months for those with COB. The CCE must review 90% of external claims within five business days and 100% within ten business days, resolving all pending claims within 30 business days.

SECTION 2 – PURPOSE

The World Trade Center (WTC) Health Program intends to improve efficiency and control health care costs. The purpose is to establish a comprehensive cost avoidance, coordination of benefit, and recovery program by implementing a comprehensive cost avoidance and recovery platform from pre- to post-payment processes. This shall facilitate the ability of the WTC health Program to improve efficiency and control health care costs without compromising quality of care.

This requirement includes the deployment of a robust and near real-time primary insurance identification system and database, validation and facilitation of the Coordination of Benefit (COB), recovery of incorrectly or inappropriately paid claims from OHI participation in New York State (NYS) Workers’ Compensation Board (WCB)’s Health Insurance Matching Program (HIMP) to identify individuals who are eligible for WC benefits and to seek reimbursement from WC’s insurers, identification of deceased members, and providing performance metrics, quality assurance and payment integrity services.

The five primary objectives are:

1) Identify primary health insurance and maintain database;

2) Validate and facilitate COB;

3) Recoup incorrectly or inappropriately paid claims from OHI and NYS WCB’s insurers through HIMP

4) Identify deceased members.

5) Provide quality assurance payment integrity services

The contractor must have at least 3 years of experience in providing financial services to a federal health care program with comprehensive, scalable platforms and agile methodologies for pre- to post- payment of medical and pharmacy benefits claims.

General Period and Place of Performance The contractor work shall take place at the contractor’s facility (100%) offsite. At least four trips are anticipated, including the kick off meeting. Trips may be to travel to meetings in the Washington Metro area, Cincinnati, Atlanta, or New York City. The contract will consist of one base year of 12 months with four 12-month options performing services and one 12-month option to process pre-existing claims and outstanding recoveries.

Parties the Project Involves

The contractor shall coordinate with WTC Health Program on all tasks within the PWS. The contractor will be required to coordinate with other WTC Health Program stakeholders, such as the HPS, NYS WC Board and CCEs, which are deemed necessary and appropriate by the Program.

Performance Objectives

Task 1 & 2: Identify Primary Health Insurance and Coordinate Benefits

1. Identification of OHI information provided via a quarterly batch file submission, shall be returned within thirty (30) calendar days with matched and verified policies 95% of the time.

Task 3: Recoup incorrectly or inappropriately paid claims from OHI and NYS WCB HIMP

1. Matching with NYS Workers’ Compensation Board occurs at least 2 times a year.

2. WTC Health Program member with claims and an identified established NYS Workers’ Compensation case, will be reviewed and evaluated within 30 days of receipt.

3. Lockbox reconciliation for both Workers’ Compensation and OHI treatment recoveries will occur monthly.

Task 4: Identify Deceased Members (Optional)

1. Deceased member identification will take place on a quarterly basis.

Task 5: Provide quality assurance payment integrity services (Optional)

1. The FWA platform shall have a 95% service availability Monday-Friday from 8AM ET-8PM ET.

2. The contractor shall review requested medical records within 60 calendar days of a complete record 95% of the time.

3. The contractor shall maintain 95% quality, measured monthly by the contractor, utilizing a random, statistically valid sample. Random is defined as every unit within the population had an equal probability of being selected.

Deliverables:

All agreed upon deliverable reports will be complete, accurate and delivered to the WTC Health Program with a 95% monthly accuracy. The contractor shall notify the WTC Health Program if an extension is needed.

Invoices accurately reflect the performed work and corrections are made with a 95% monthly accuracy.

Operating Constraints

If the WTC Health Program chooses to utilize their own data formats for any services, the contractor will have the opportunity to provide input and approval.

The WTC Health Program will not provide SSN or Medicare beneficiary identification (MBI) as part of the member demographic information. The contractor must be able to perform all tasks without that information from the WTC Health Program.

All file format change requests from the WTC Program will be provided at least 30 days in advance.

SECTION 3 – SCOPE OF WORK

The WTC Health Program is looking to establish an off-site comprehensive cost avoidance, coordination of benefit and recovery program. This will include identifying, verifying, and communicating OHI information on a quarterly basis, recovering incorrectly or inappropriately paid claims, participating in NYS WCB HIMP to identify individuals who are eligible for WC benefits and to seek reimbursement from WC’s insurers, and identifying deceased members. This will also include quality assurance payment integrity services, utilizing clinical claims review and a fraud, waste and abuse platform.

The WTC Health Program will provide the contractor with membership eligibility, claim (pre- and post- pay) and provider information in order to identify primary health insurance coverage, using advanced algorithms to match through electronic methodologies and provide that information back to the program and designated stakeholders prior to claim adjudication. The contractor shall also perform recovery work on any WTC Health Program paid claims, through the identification and billing of primary health insurance and through the NYS WC HIMP recovery process. The contractor shall also provide clinical claim review on paid claims to ensure accuracy and provide a platform to support the identification and investigation of any potential fraud, waste and abuse through data analytics and case tracking.

The contractor is responsible for recovery efforts, including receiving the recovered funds and transferring collections, accounting for the contractor’s contingency fee, back to the WTC Health Program.

The contractor shall provide standard metrics, monitor the accuracy and timeliness of deliverables and provide cost control recommendations and administrative cost reduction solutions.

The WTC Health program will provide introductions and coordination activities during implementation and operation to ensure the proper WTC Health Program stakeholders are engaged.

SECTION 4 – TASKS TO BE PERFORMED

Task 1. Identify primary health insurance and maintain database

1.1 Deploy a robust primary health insurance verification solution that will identify, verify, or reverify OHI policies held by all WTC Health Program members who are eligible for coordination of benefits (i.e., Survivors). The solution is required to leverage automated data matches against a robust insurance database, not otherwise available to the WTC Health Program, to identify OHI coverage. The contractor shall utilize advanced matching algorithms to support insurance identification in the absence of having the member’s social security number.

1.2 After receipt of the eligibility file from WTCHP, the contractor shall format, match, verify and/or reverify the entire eligible population and deliver newly discovered or recently updated/termed policies back to the WTCHP within 30 calendar days.

Task 2. Validate and facilitate COB

2.1 Validate primary health insurance information and Explanation of Benefits (EOBs). Validation methods should include verification of identified insurance information discovered within the carrier sourced database through 270/271 transactions, electronic eligibility websites, and/or phone call verifications.

2.2. Facilitate COB and medical benefits claims adjudication process by coordinating with the, TPA and other contractors. The contractor will intake pre-pay claim file submission, including member demographic information, from the HPS contractor for OHI identification and validation for each date of service provided. The contractor will provide a response indicating the OHI coverage information through the quarterly batch process.

2.3. Provide COB information to WTC Health Program claim adjudicator for pre-payment adjudication within WTC Health Program’s TFLs and protocols. The contractor shall provide OHI coverage based on claim dates of service for proper claim adjudication in a quarterly batch basis.

2.4. Reconcile member records and COB database for pre- and post-payment claims analytics.

Implementation, testing and operational requirements for Task 2 are summarized in the chart below:

· Contractor will establish file transmission processes and procedures with the HPS (and other contractors).

· Contractor will complete gate review prior to transitioning to operations

· Contractor will process pre-payment submissions for OHI identification and verification and return response files

Task 3. Recoup incorrectly or inappropriately paid claims from OHI and NYS WCB HIMP

3.1. Expedite recovery and negotiation for maximum payment possible and dispute resolution options. The contractor must have established working relationships with both workers and non-workers’ compensation payers. Processes, such as electronic billing platforms, shall be used to expedite and maximize recoveries. Practices, such as accounts receivable management, shall be implemented to ensure proper payment reconciliation and processes.

3.2. Recoup maximum possible amount from incorrectly or inappropriately paid treatment claims from OHI. The contractor shall identify the appropriate payer and bill identified paid claims on the WTC Health Program’s behalf. The contractor shall implement electronic billing platforms, complete timely follow up on open claims and workable, denied claims. The contractor shall validate recovered payment amounts from OHI are paid accurately. OHI for treatment claims shall be billed on a monthly basis.

3.3.Recoup maximum possible amount from incorrectly or inappropriately paid claims from NYS WCB’s insurers through HIMP. The contractor shall establish the NYS WC HIMP agreement and submit WTC Health Program membership data for matching at least 2 times per contract year. The contractor shall review WTC Health Program paid claims monthly for causality and follow NYS procedures for HIMP mailings to the appropriate workers’ compensation carrier. The contractor is responsible for performing case management and follow up to ensure timely recoupments. The contractor shall adhere to NYS WC HIMP arbitration rules to ensure WC carriers are responsive in a timely manner.

3.4. Reconcile payment and recoupment for reporting and deposit to WTC Health Program’s account. The contractor shall establish processes and procedures to validate payment receipt and accounting of each paid claim. The contractor shall manage a lockbox account on behalf of the WTC Health Program for incoming payer recoveries and provide monthly reporting and wire transfer of funds to the WTC Health Program. The contractor will have the first right to recovery in situations where other WTC Health Program stakeholders might be pursuing recoveries in conjunction.

Implementation, testing and operational requirements for Task 3 are summarized in the chart below:

· Contractor will establish lockboxes on behalf of the WTC Health Program.

· Contractor will resume receiving member, provider and claims files for Workers’ Compensation and OHI recovery activities

· Contractor will associate claims to WC cases based on causality.

· Contractor will match members against insurance database who have paid claims to identify other payer.

· Contractor will recover from appropriate WC payer or other payer and reconcile recoveries.

· Contractor will provide a monthly status report reporting on the prior month’s activity

Task 4: Identify deceased members (Optional)

4.1. Identify deceased members without SSN in various sources such as the Death Master File (DMF) and other databases. The contractor shall establish electronic matching procedures against a robust database, to identify additional demographic information, such as SSN, on WTC Health Program members. Obtaining additional demographics is required to accurately identify deceased members using the DMF. This processes shall take place on a quarterly basis. Implementation will include mapping the membership data file to perform data matches against the insurance database and the DMF.

4.2. Reconcile and provide deceased members’ database to the WTC Health Program. The contractor shall work with the WTC Health Program to validate identified deceased members through an approved program method. This could include letter communication to the member and/or provider to validate the identified information. At a minimum of a quarterly basis the contractor should supply results of the DMF match off process to the WTC Health Program.

Implementation, testing and operational requirements for Task 4 are summarized in the chart below:

· Contractor will test deliverable acceptance with WTC Health Program

· Contractor will establish a validation procedure with the WTC Program

· Complete gate review prior to transitioning to operations

· Contractor will continue processes to identify deceased members and validation procedures on a quarterly basis.

Task 5: Provide quality assurance payment integrity services (Optional)

5.1. Provide performance metrics, quality assurance and surveillance plan (QASP), review claims, COB information, death records, recoupment records and other databases for errors and potential FWA, and create claim-level breakdowns of improper billing issues for compliance verification and overpayment protection. The contractor shall report on their rate of recovery for both workers’ and non-workers’ compensation payers. The contractor shall report on the volume of OHI coverage segments identified, the types of coverage reported, and the carriers identified. The contractor shall report on the volume of claims billed to OHI, the total amount recovered and the count of carriers from which recoveries are received. Contractor should report on open, pending and recovered cases or claims associated with program integrity reviews.

5.2 Conduct clinical claims review by clinicians to identify improper coding, location, service and reimbursement taking into consideration that other payers may have already paid their portion of the claim which could prevent codes or other elements of the claims from being changed to meet Program standards. Review clinicians shall include nurses, coders, pharmacists and physicians, when appropriate. The contractor shall provide an overview of the edit selections the program could implement in order to identify the highest potential claims for overpayment, while minimizing provider abrasion. Once established and on a monthly basis, the contractor shall provide a selection file of claims for the WTC Health Program’s approval prior to generating medical record requests to the providers, conduct reviews, and recover overpayments. The contractor will be responsible to pay the provider medical record fees.

5.3 Provide solutions for cost control and administrative cost reduction. The contractor shall provide continuous feedback on where the WTC Health Program can focus efforts through enhanced processes for both pre-payment and post-payment cost reductions for cost avoidance, clinical claim review and recovery efforts. These solutions will be documented as part of the annual report deliverable.

5.4 Provide FWA platform with ease of access, interface and report. The contractor shall make available a system that supports the identification of fraud, waste and abuse with integrated investigative case management functionality. The system shall have the ability to track leads, manage case investigations and create reports. The contractor shall provide data analysts to support the identification of FWA issues and case targets and investigators to perform case investigations. Reports and findings will be produced as it relates to both the data analysis and investigations and will be provided to the WTC Health Program. The contractor shall also provide training to the WTC Health Program on how to use the platform to enable the WTC Health Program personnel to use the various data exploration functions, perform or follow case investigations, and produces reports.

Implementation, testing and operational requirements for Task 5 are summarized in the chart below:

· Contractor will consult the WTC Health Program on edits and solutions appropriate for the WTC Health Program prior to full implementation.

· Contractor will review and approve data file layouts

· Contractor will provide the WTC Program with system access and onboard data

· Contractor will create WTC Health Program queries and review provider mailing limitations

· Contractor will review analytics plan with WTC Health Program.

· Contractor will review the investigative workflow and customizations with WTC Health Program.

· Contractor will establish a lockbox for recoveries on behalf of the WTC Health Program

· Contractor will test deliverable acceptance with WTC Health Program

· Complete gate review prior to transitioning to operations

· The contractor will ensure models are continuously updated to ensure continuous improvement.

· The contractor will request medical records, as needed, to ensure timely review and minimize provider abrasion.

· Provide on-site training for use of the FWA platform.

6.0 Key Personnel

6.1. Program Director

The Program Director shall be the managerial focal point for program level communications between the WTC Health Program and the contractor. The Program Director is responsible for the oversight of the contract requirements as well as the overall operations. The Program Director should be the main day-to-day main point of contact on the contract. The tasks shall include, but are not limited to:

· Maintain program communications with the WTC Health Program Management and WTC Health Program CO and COR.

· Possess at least 10 years Coordination of Benefits (COB) & Recovery experience and experience managing similar Federal programs.

· Effective lines of communication with internal staff and external stakeholders.

· Contract requirements are met including quality, timeliness and business relations.

· An adequate quality assurance program and process are in place and strictly adhered to for all tasks.

· Monthly reports are submitted timely and accurately.

· Timely and quality submission of deliverables and ad hoc requests.

· Maintain superior business relations with WTC Health Program and WTC Health Program stakeholders.

6.2 Systems Security Officer

The Senior Security Analyst shall be the focal point for program level security related information and procedures between WTC Health Program and the WTC Health Program contractor. The Senior Security Analyst shall establish a framework for program security activity. The tasks shall include, but are not limited to:

· Maintain program security protocols and reviews of security incidents occurring and pass all information through to the WTC Health Program Management and WTC Health Program CO and COR.

· This position requires a minimum of 6 years of experience in information security, network security and security tools.

· Analyzes and defines security requirements for computer and network-based systems.

· Designs, develops, engineers, and implements solutions to specified security requirements.

· Performs risk analysis, which also includes risk assessments.

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

Government furnished materials will not be provided under this contract.

SECTION 6 – PERIOD OF PERFORMANCE

One base year of 12 months with four 12-month options performing services and one 12-month option to process pre-existing claims and outstanding recoveries.

SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

When a timeframe for completion is specified (for example, “within 45 days”), “days” refers to calendar days unless otherwise stated. If the deadline calculated in this way falls on a weekend or a federally recognized holiday, the contractor may comply with the deadline on the next business day, unless otherwise stated.

The plan should describe how risks are assessed and managed at all stages of operation from the implementation and throughout operationalized phase. Tests should be conducted during the initial implementation phases and corrected accordingly. The offeror shall describe approaches to address failed tests or less than optimal results.

Subcontracting Plan

Request for Consent to Subcontract per FAR 44.2 In accordance with FAR 44.2, submit a request for consent to subcontract to the CO and COR for prior approval before entering into a new subcontract. Submit as applicable.

· Pre-pay OHI identification

· Workers’ Compensation Recovery

· OHI recovery (Direct Bill)

· Deceased member Identification (included quarterly)

Payment Integrity Services; Clinical Claims Review and FWA efforts

Contractor will be provided with security welcome packet that we provide to those that need to go through the Security Assessment and Authorization (SA&A) process to be authorized has other timelines as far as specific items in the package. Contractor may be subjected to additional report upon authorization.

Data Exchange/Integration with Program and other Program Contractors

The Contractor is one of many Program contractors responsible for collecting, using, and maintaining integrity of Program data. The Contractor shall establish and maintain bidirectional exchange of information with the Program and other Program contractors as needed to fulfill the requirements of this contract and ensure all relevant entities and their systems have accurate and consistent information to properly support member benefit administration and inquiry resolution.

Incoming and outgoing data and/or record/document exchanges may occur daily, weekly, monthly, or on an ad hoc basis. All data exchanges shall be made through a secure connection with appropriate Data Use Agreements (DUA) and Interconnection Security Agreements (ISA), and shall leverage standardized data models and queries, where possible. Throughout the period of performance, the content, cadence, and number of data exchanges may shift depending on the Program’s data storage and governance modernization efforts. The Contractor shall coordinate with the Program to adapt information exchange and integration policies and capabilities accordingly.

The Contractor shall implement an approach for data exchanges that include data crosswalking, technical requirements documentation, and validations to integrate the Contractor’s systems with the Program and/or other Program contractors. Testing to confirm successful, accurate, and HIPAA-compliant data and record/document transmission amongst all parties shall play a critical role in assessing Contractor readiness.

Comprehensive Data Extract

The Contractor shall transfer all Program data and information, as defined in TGD 028 (Attachment 00X), to the Program at the end of Handover (end of month 12) and each option year, at the termination of the contract, and at any other time as requested by the Program. Program data and information include:

1. All records (including paper records) pertaining to Program members in the Contractor’s systems

2. Up-to-date Data Dictionary

3. Complete data schema

4. Data flow diagrams of all data exchanges with external entities that the Contractor participates in, describing the flow of data, the different data being transferred, and directionality

5. Medical records, data, and reference tables

6. WTC-specific data, configurations, process documents, and specifications

7. Documentation relating to software and interfaces

8. Reports and all scripts, templates, and data objects used to create the reports; business needs statement showing who requested the report and who signed off on final format and delivery

9. Copies of all outgoing communication generated on behalf of the Program (templates are acceptable) and any scripts or automation needed to generate the results of the template. This could also include database objects

The Contractor shall be able to extract specific datasets and documentation on a more frequent basis, as requested.

For purposes of this requirement, “documentation” means all operations, technical, and user manuals used in conjunction with the software, services, and deliverables, in whole or in part, that the Program determines are necessary to view and extract application data in a proper format. The Contractor shall make available the documentation and all Program data in non-proprietary formats, and such file specifications and documentation as may be necessary for interpretation of these files.

This Program data shall be provided in a HIPAA-compliant manner, according to the schedule approved by the Program, and in a media and format approved by the Program. All relevant data and information must be received and verified by the Program.

Continuity of Operations

The Contractor shall make best efforts to ensure continuity of operations and minimize disruptions to care throughout the period of performance, including during and following local, state, national, or global public health emergencies and natural or man-made disasters. During a disaster or public health emergency, the Program may administer temporary and waivers to medical and pharmacy benefits to ensure continuity of care. The NPA Contractor shall comply with all changes and waivers that may be administered by the Program during these times.

The Contractor shall implement data security safeguards while maintaining operation of all systems, data availability and exchange, and organizational support of the Program. The Contractor shall monitor systems and provide timely notification to the Program of any issues affecting delivery of services (individuals or groups); access to data and files (e.g., medical records), particularly if access issues result in disruption to care; or system uptime and accessibility. Where service delivery is impacted, the Contractor shall collaborate with the Program to implement alternative solutions and communicate associated direction to members to continue care through the Program.

The Contractor shall be prepared to manage temporary system unavailability and establish a communication method that shall be used to ensure minimal process disruption if/when the Continuity of Operations Plan (documented in the Operations Plan) is activated.

Notification of System Maintenance

The Contractor shall provide a System Maintenance Notification to the Program at least two weeks in advance of any scheduled system maintenance. The notification shall include the system(s) affected, changes that will occur, and the date/time changes will be in effect. To the maximum extent practicable, the Contractor shall schedule system maintenance windows during weekends or non-peak hours to minimize disruption of services. The Contractor shall schedule system maintenance outside standard business hours.

In cases where an issue is detected, the Program recognizes that the Contractor may need to perform unscheduled, responsive system maintenance. In such cases, the Contractor shall notify the Program via email within one hour of the issue being detected.

Notification of System Outages

The Contractor shall notify the Program within one hour of identification of any unplanned system outage that impacts Member Service Center functions and within one hour of system restoration.

When any system experiences unscheduled downtime for more than one cumulative hour in any given 24-hour period, the Program may request that the Contractor conduct a Root Cause Analysis. The Contractor shall complete such analysis and provide its findings and planned corrective actions to the COR within 10 business days of the request. The Contractor shall provide the COR with a schedule to resolve any identified issues and/or implement safeguards to prevent future issues within two business days of completion of the Root Cause Analysis.

Transition-Out

If and once exercised, the Contractor shall move from Sustainment to Transition-Out. The Government may exercise Transition-Out at any time, provided that the Government gives the Contractor a preliminary written notice of its intent to do so no less than 60 days prior to the start of Transition-Out. During Transition-Out, which will run concurrently with the successor contractor’s transition-in, the Contractor shall transfer duties and responsibilities to a Program-appointed designee, whether a government entity, another contractor, or a combination of both.

The Contractor shall collaborate with the Program, other Program contractors, and the successor contractor(s), if applicable, to ensure a successful Transition-Out is completed in the required timeframe while maintaining the expected level of performance as defined by the PWS and QASP. The Contractor shall cooperate fully with the Program and the successor contractor during the Transition-Out period, to facilitate an orderly transfer of Program functions and operations to the successor contractor. The Contractor shall ensure continuity of services during this period of transition, while prioritizing minimal disruption of services to members receiving care and providers delivering care.

The Contractor shall submit a Transition-Out Plan 30 calendar days after the Transition-Out Contract Line Item Number (CLIN) is exercised, detailing all activities necessary for the Contractor to provide Program data and information to the successor contractor, maintain operational standards, and completing all Transition-Out tasks successfully within a risk management framework. The Contractor shall implement the plan and make revisions as needed throughout the Transition-Out period to document changes and lessons learned. The Contractor shall incorporate additional feedback provided by the Program and collaborate with the successor contractor to ensure alignment of the Contractor’s Transition-Out Plan with the successor’s Transition-In Plan.

During the Transition-Out period, the Contractor shall:

1. Maintain continuity of operations through Transition-Out;

2. Provide current and accurate program and system management documentation (e.g., interface library, data dictionaries, data schema), no later than 14 calendar days after the Transition-Out Option is exercised;

3. Provide a current, validated inventory of all Government-owned assets used by the Contractor over the life of the contract along with full support in the reconciliation of the inventory as needed;

4. Proactively manage transition activities and milestones within a formal schedule to ensure alignment with the Transition-Out Plan and the successor’s Transition-In Plan (if applicable), and convene regular meetings to provide regular updates to the Program;

5. Attend and participate in meetings to transfer information, processes, and data; mitigate transition risks and issues; and report status of transition tasks;

6. Communicate final dates of usage of current systems and processes, in accordance with the successor's transition-in, and assist in communicating transition details to NPA members, as required by the Program;

7. Adapt to reductions in operational volume as appropriate;

8. Upon completion of the transfer of all Program data to the Program and/or successor contractor(s), execute all required “system decommissioning” tasks, including destruction of all non-public or other protected data from Contractor-owned systems, and certify execution.

The Contractor shall coordinate with the Program and any successor(s) to minimize the quantity of risks associated with services that have been initiated but have not been fully resolved, including member certification requests, clinic transfers, and open member issues. The Contractor shall ensure that these services are tracked and communicated to relevant stakeholders and facilitate the handoff of these services to the successor contractor, in accordance with the Transition-Out Master Schedule (TOMS). The Contractor shall ensure all handoffs are completed by SHCD of the successor contractor, unless otherwise agreed upon between the Program, the Contractor, and the successor contractor.

The Contractor shall also work with the WTC Health Program Information Security Officer (ISO) and COR to transfer all Program records, data, and other information (including process and policy guidance materials) to the Program and/or successor contractor(s) within 14 calendar days of each Transition-Out CLIN exercise, with updates provided in accordance with the approved schedule. The data transfer shall be performed in a manner and format that enables the Program and/or the successor contractor(s) to map all data from the Contractor’s system(s) to the replacement system(s) of the Government or a successor contractor. This includes all data and data-related documentation as well as:

1. Functional business process flows, including operational manuals, documentation of all processes to accomplish work on behalf of the Program, and sample data files;

2. Operational information including correspondence, documentation of ongoing or outstanding issues, operations support documentation, and operational information regarding subcontractors to the successor contractor.

Regulatory Compliance

HIPAA Compliance and Business Associate Agreement

As further explained below, the Contractor is a Business Associate of the WTC Health Program; the WTC Health Program is a healthcare component of a hybrid entity, HHS, under HIPAA and functions as a Covered Entity. To the extent that the Business Associate performs functions or activities on behalf of, or provides certain services to, the Covered Entity where the Business Associate creates, receives, maintains, or transmits “protected health information” (PHI), the following HIPAA provisions apply: the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104–191; 42 USC 1320d); the Health Information Technology for Economic and Clinical Health (HITECH) Act (Pub. L. 111-5; 42 USC 300jj et seq.); the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (45 CFR pts. 160, 162, and 164); and HHS HIPAA policies.

For purposes of this contract, “Business Associate” shall mean the Contractor; “Covered Entity” shall mean the WTC Health Program and any other NIOSH, CDC, or HHS components to the extent that they assist in administering the WTC Health Program and where PHI is involved. These terms are used as defined in 45 CFR 160.103.

For any potential HIPAA incident that should occur involving the Business Associate, the Contractor shall submit an initial notification to the WTC Health Program’s HIPAA Privacy Officer within one hour of discovery, followed by a HIPAA Incident Report within three business days, utilizing the Incident Report Form provided upon award. As the Covered Entity, the WTC Health Program is responsible for determining the risk level of each incident and for determining in which cases a breach notification shall occur. Notification to the Program’s HIPAA Privacy Officer shall be provided prior to the WTC Health Program learning of the incident from outside sources (HHS Office for Civil Rights, Organizational Press Release, Letter sent to WTC Health Program member, etc.). Notification to the Program shall be transmitted securely and shall include the date and nature of the incident (including the identification of each WTC Health Program member whose information was implicated in the incident and the extent of the information breached) and actions being taken by the Contractor as a result of the breach.

The Business Associate Agreement (BAA) provides the detailed legal obligations and requirements of the Business Associate and the Covered Entity and will be incorporated into this contract. The template can be found in Attachment 026.

At all times throughout the duration of this contract and until the Business Associate fulfills its obligations under this contract and the BAA, the Business Associate is subject to and shall comply with all applicable HIPAA provisions regarding business associates, as well as any updates to those provisions.

The parties acknowledge that the Business Associate is directly liable under HIPAA for the following violations:

· Impermissible uses and disclosures of PHI;

· Failure to provide breach notification to the Covered Entity;

· Failure to provide access to a copy of electronic PHI to either the Covered Entity, the individual, or the individual’s designee, as specified in the BAA;

· Failure to disclose PHI where required by the Secretary of HHS to investigate or determine the Business Associate’s compliance with HIPAA;

· Failure to provide an accounting of disclosures; and

· Failure to comply with the requirements of the Security Rule.

Furthermore, the Contractor shall provide the detailed process of how it will meet the obligations of HIPAA in the Operations Manual.

Records Management The Contractor shall develop, implement, and administer a comprehensive records management program that complies with all applicable records management laws and regulations, including the Federal Records Act, NARA records policies, CDC and NIOSH agency-specific records policies, and those policies associated with the safeguarding of records covered by HIPAA and the Privacy Act. To the extent that any records are not scheduled by the above, the Contractor shall consider the records permanent and retain the records for the full period of performance. All records shall be returned to the Program at the conclusion or termination of the Contract, whichever occurs first. Records returned to the Program shall be hand carried, mailed, emailed, or securely transmitted electronically (such as through a security-compliant USB device, file transfer process, or other agreed-upon medium).

The Contractor shall maintain all records created for Program use, created in the course of performing the contract, and/or delivered to or under the legal control of the Program in accordance with federal law. The Contractor shall digitize temporary and permanent paper records, designate the digitized version as the recordkeeping copy, and destroy the original source record after digitizing the records and validating digitization activities against NARA-established provisions, as listed in 36 CFR 1224, 1225, and 1236. Digitization resources can be found at https://www.archives.gov/records-mgmt/policy/digitization. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

The Contractor shall prevent alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage, or alienation of federal records is subject to the fines and penalties imposed by 18 USC 2071. The Contractor must immediately report any unlawful or accidental removal, defacing, alteration, or destruction of records.

The Contractor shall obtain the CO’s approval prior to engaging in any contractual relationship (subcontractor) in support of this contract requiring the disclosure of information, documentary material, and/or records generated under or relating to contracts.