DRAFT Performance Work Statement

Credentials Verification Organization (CVO) for Non-Community Care Network (CCN) Providers

1.0 BACKGROUND

The U.S. Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Office of Integrated Veteran Care (IVC), requires services to credential and monitor community care providers that furnish hospital care, medical services, or extended care services to Veterans under VA’s Veteran Community Care Program (VCCP). VCCP encompasses different programs including the Community Care Network (CCN) and Veterans Care Agreements (VCA).

A primary goal of VA’s community care program is patient safety for all Veterans served by VA. To achieve this goal, VA must ensure community care providers are medically qualitied and competent to provide care prior to referring Veterans for community care from such providers. The credentials verification and monitoring services identified in this Performance Work Statement (PWS) directly support and facilitate VA’s efforts to assess and monitor the medical qualifications and competence of community care providers who furnish hospital care, medical services, or extended care services to Veterans pursuant to Veterans Care Agreements (VCA) entered into by VA under the authority set forth by 38 U.S.C. § 1703A and 38 CFR § 18.4100-4135 or other contracts or agreements entered into and administered by VA. These providers are referred to in the PWS as “community care providers”.

This contract shall provide comprehensive credentialing support by obtaining required Primary Source Verification (PSV), conducting peer‑level reviews of credentialing information and provider appeals, and continuously monitoring credentialed community care providers to ensure they maintain all qualifications needed to furnish care to Veterans under VA’s VCCP.

2.0 CONTRACT TYPE

This is a firm-fixed price (FFP), single award indefinite-delivery indefinite-quantity (IDIQ) contract. Orders will be placed as the Government need is identified and funding is available.

3.0 SCOPE OF SERVICES

The Credentials Verification Organization (CVO) shall provide comprehensive credentialing support services for Non-Community Care Providers, including end-to-end program management, oversight, and reporting to ensure effective governance, operational transparency, and regulatory compliance. Services include maintaining and operating a secure online database of provider demographic, professional, and credentialing information; performing complete Credentials Verification Organization (CVO) activities such as application intake, primary source verification, credential file preparation, and re-credentialing; and supporting the operation of the Credentialing Committee through case preparation, meeting facilitation, and documentation of decisions. The CVO shall conduct ongoing monitoring of provider licensure, certifications, sanctions, and other risk indicators, ensuring timely identification and escalation of adverse findings. Additionally, the CVO shall deliver training and communications to providers, staff, and stakeholders to promote process understanding, system use, and compliance with credentialing requirements. All services shall be performed in accordance with applicable regulatory, accreditation, and organizational standards.

4.0 GENERAL REQUIREMENTS

1. The Contractor shall be certified or accredited for its credential verification services by a nationally recognized certifying or accrediting organization (e.g., the National Committee for Quality Assurance (NCQA) or the Utilization Review Accreditation Commission (URAC) at the time of submission of the solicitation response and throughout the life of the contract.

2. The Contractor shall follow applicable accreditation standards (NCQA and/or URAC) as the base requirement for PSV processes. Entities without credentialing standards or accreditation requirements (such as home healthcare providers) may require supplemental credentialing standards as defined by VA.

3. The Contractor shall maintain documentation of all accreditation, certification, credentialing, and licensing for its accredited components or programs and providers performing services under this contract. The Contractor shall provide a copy of its accreditation documentation in accordance with the Schedule of Deliverables. The Contractor shall notify VA if its accreditation is put on probation, suspended, or revoked within three (3) business days of the adverse action along with a corrective action plan (CAP).

4. The Government anticipates an initial 30-day calendar day implementation phase for set-up, access configuration.

5.0 REPORTING

The Contractor shall provide monthly reporting from the previous calendar month (excluding the initial 30-day implementation phase) to the Contracting Officer Representative (COR) by the 10th of each month (or next business day, if the 10th falls on a weekend or holiday) along with the corresponding invoice. The Contractor shall use the VA- approved template for the monthly reporting which includes the following topics:

1. Any outages of the online database under Task 1 during the preceding month, including the length of time of the outage

2. Itemized list of new providers with the date of request by VA and date of initial contact/attempt to contact by the Contractor

3. Itemized list and total number of providers for which the Contractor performed credentials verification services under 9.1.2 during the preceding month, and their graded risk assessment results (e.g., A-Fs), with annotation of whether the credentialing services were for initial or re-credentialing

4. Itemized list of returned providers with documented contact attempts, including dates and modalities for communication

5. Summary of efforts monitoring all providers for sanctions and disciplinary actions during the preceding month, with an itemized listing of all providers flagged and the specific reason(s) for being flagged

6. Credentialing review board status.

6.0 PERIOD OF PERFORMANCE

The Period of Performance (PoP) shall consist of a 12-month base period, with four (4) 12-month option periods. The overall PoP shall not exceed 60 months.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

7.0 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

8.0 TRAVEL

Travel is not required or reimbursable for performance of the PWS.

9.0 TASK STATEMENT

The work performed under this PWS is for the purposes of completing credentialing only, this contract is not for consultation or program management and is not specific to the terms of the VA contracts for which the providers are being credentialed. The work performed under this PWS is guided by the VA (see Section 11.0), and orders are specific to the tasks assigned by VA. Services are aligned with the process of obtaining information, completion of PSV, and assessment of the CVO Review Board to allow VA to make a full assessment of a provider’s credentials. The Contractor shall perform the following tasks:

9.1 TASK 1: PROGRAM MANAGEMENT & REPORTING

9.1.1 Accreditation

Upon proposal submission, the Contractor shall submit to the Government all accreditation credentials for verification. VA reserves the right to perform random reviews of the accreditation, certification, credentialing, privileging/competency measures, and licensing files for the accredited programs and providers.

The Contractor shall follow applicable accreditation standards (NCQA and/or URAC) as the base requirement for Primary Source Verification (PSV) processes. Entities/Providers without credentialing standards or accreditation requirements (such as home health providers) are required to provide the following minimum documentation:

a. Proof of identity by obtaining a U.S. or U.S. State government-issued photo identification or I-9 documentation

b. Proof of completion of required and relevant education and training (e.g., transcripts, certificates, etc.), as applicable (unskilled home health is excluded)

c. An active, unrestricted license in the State(s) in which the service is performed, if applicable. Some States may not require a network provider to be licensed for particular services provided within the State, in which case this requirement is waived for providers of those services providing care within that State (individual homemaker services and unskilled home health staff are excluded).

d. Current National Provider Identifier (NPI) number

e. Tax identification number (TIN)

f. Active professional liability insurance in an amount in accordance with the laws of the State in which the care is provided. The Contractor shall ensure that their network providers provide proof of insurance, through a certification of insurance, for each State in which they practice.

g. Relevant work history related to their scope of practice (minimum of last 10 years)

h. Criminal background disclosure

i. Minimum of three (3) professional references

j. Confirmation that the network provider does not have history indicating that they violated the requirements of a medical license of the network provider that resulted in the loss or voluntary surrender in lieu of such medical license in any State. Any provider that has a history of license violations resulting in the loss or voluntary surrender of such medical license in any State is ineligible to provide care under this contract

Deliverables:

9.1.1 Annual attestation of accreditation

9.1.2 Monthly Status Report

The Monthly Status Report shall include, at a minimum:

1. Any outages of the online database under Task 2 during the preceding month, including the length of time of the outage

2. Itemized list of new providers with the date of request by VA and date of initial contact/attempt to contact by the Contractor

3. Itemized list of providers for which the Contractor performed credentials verification services under Task 3 during the preceding month, their graded risk assessment results (e.g., A-F, or 1-5s), with annotation of whether the credentialing services were for initial or re-credentialing

4. Itemized list of providers whose re-credentialing will be required within the next 120 days from the first of the month being reported, including information regarding whether the provider has engaged in the re-credentialing process in the past 30 calendar days from the time of the report

5. Itemized list of providers whose PSV documentation will expire within the next 120 days from the first of the month being reported, including information regarding whether the provider has furnished updated or renewed documentation

6. Itemized list of returned providers with documented contact attempts - including dates and modalities for communication – in alignment with the monthly report

7. Summary of efforts monitoring all providers for sanctions and disciplinary actions during the preceding month (as described in Task 5) with an itemized listing of all providers flagged and the specific reason(s) for being flagged

8. CVO Credentialing Committee recommendation for approval or denial for each provider reviewed as detailed in Task 3

9. Final Medical Executive Committee (MEC) recommendation for approval or denial for each provider reviewed, including notes or documentation from the MEC review.

Deliverable

· 9.1.2 Monthly Status Report

9.2 TASK 2: ONLINE DATABASE OF PROVIDER DEMOGRAPHIC, PROFESSIONAL, AND CREDENTIALS DATA

9.2.1 Online Database Capabilities

The Contractor shall maintain an online, profile-based database that enables providers to self‑report demographic and professional information and supports VA credentialing activities. The Contractor shall submit documentation of their online database capabilities in their proposal submission. The database shall allow VA personnel and VA‑identified providers to access and update information as needed, while ensuring all user access and password issues are resolved in a timely manner within 3-5 business days. Issues that are outside the Contractor’s control shall be documented and reported to VA within 3 business days of determining the issue is outside the Contractor's control.

The database shall have the following capabilities:

a. An online demographic and credentials database compliant with nationally recognized accreditation standards (e.g., NCQA, URAC). The database shall have self-reporting capability that allows providers to enter required data and VA to obtain provider information from this database.

b. Database licenses for up to 50 VA personnel.

c. All provider demographic and credentials data within the database shall be exportable in PSV and Excel files, with the functionality to export multiple providers in the same PSV and Excel files at once.

d. This database shall be able to ingest and process data from IP addresses associated with all States and U. S. territories. IP-based access controls, firewalls, or security configurations shall be implemented in a manner that does not prevent the completion of credentialing, re-credentialing and NPDB enrollment activities.

e. Ability for VA personnel to access the database to view provider data, request provider data changes (such as deactivations) and track the status of the provider’s credentialing process.

f. Provide a filterable MEC queue with search capabilities, allowing users to filter and search by provider name, National Provider Identifier (NPI), facility, risk level, risk score, date submitted, and keywords within files (such as “malpractice,” “sanction,” or “appeal”), and to bulk export providers by risk category into Excel with sortable fields preserved.

Deliverable:

· Documentation of Online Database Capabilities

9.3 TASK 3: CREDENTIALS VERIFICATION ORGANIZATION (CVO) SERVICES

9.3.1 Credentialing Verification

The Contractor shall develop processes and materials necessary to provide VA with credentials verification services that will inform and facilitate VA’s credentialing process for all community care providers. The credentials verification services consist of contacting providers to obtain information necessary to initiate the credentialing process, collecting and verification of the information identified in section 9.3.3, below, and providing VA with a risk assessment and analysis of providers’ qualifications based on the application of the VA-determined criteria to the Contractor’s review of collected and verified information. VA reserves the right to issue additional specifications to the VA-determined criteria based on policy, legislative, or regulatory changes without a modification to the contract. The Contractor shall use primary source verification as a standard practice, and all documentation supporting the verification and risk assessment shall be made available to VA for review within the provider credentialing file. Upon proposal, the Contractor shall provide the criteria that will be used to verify provider information and conduct a risk assessment of each provider for VA’s approval. The Contractor shall develop a process and materials based on those criteria upon approval from VA.

Deliverable:

· 9.3.1 Credentialing Verification Services Plan

9.3.2 Credentialing Application

The Contractor shall develop a credentialing application form to gather all required information from providers. When applicable, application forms will follow accreditation standards and industry practice for gathering and content. For providers outside of accreditation standards, VA’s one-time approval of the content within the application form is required. Additionally, to follow VHA regulations, application forms may require information above industry standards dependent upon the specialty and category of services offered. In any instance of uncertainty, a final determination of the more stringent standard will be made by VA. If such additions are required, the VA will inform the CVO, and all application forms shall be in compliance with VA provided guidance. All application forms shall be available in both digital (type to include Word, Excel, etc.) and hard copy format. If this contract and the accrediting organization(s) have different standards, the more stringent standard shall apply. In any instance of uncertainty, a final determination of the more stringent standard will be made by VA.

Deliverable:

· 9.3.2 Credentialing Application Form

9.3.3 Credentialing Intake Process

The Contractor shall conduct initial verification of provider history and license sanctions for all States and U. S. territories and develop a process for receiving provider information dating back no less than 10 years from initial credentialing application submission – from all states and all U.S. territories – for the purpose of contacting providers to initiate the credentialing process. The process shall have two entry points with at least one being electronic. The VA will provide the Contractor with a provider list(s) for which the credentialing process shall be initiated VA will provide the following basic elements to initiate the credentialing process with the contractor.

a. Provider NPI

b. Provider Name

c. Provider Care Site Address

d. Provider Mailing Address (if different than care site address listed)

e. Provider Phone number

f. Provider Email Address

g. If available, Provider Fax Number A provider “return” is defined as a provider which has been submitted by VA to the CVO for credentialing but has been non-responsive to the CVO's minimum of five (5) contact attempts, resulting in the Contractor submitting the provider’s name and the scenario necessitating the return back to VA. Upon submission of the returned provider to VA, all work associated with that provider’s verification package will cease until VA reviews the circumstances and provides further guidance and next steps. In most cases, returned providers may be included in a future provider credentialing submission to complete the credentialing process with updated contact information; however, VA does not guarantee that all provider returns will be resubmitted to the Contractor to complete the credentialing process.

The Contractor shall include all returned providers, including documentation of contact attempts, in the Monthly Report (Section 9.1.2).

Deliverables:

· 9.3.3 Completed credential verification package

9.3.4 Provider Standardized Assessment

The Contractor shall develop a standardized assessment to use for all providers in documenting the results of the credentials verification and risk assessment of the provider, submitted within 30 days of award for VA approval. The standardized assessment shall include, but is not limited to:

· Overall risk assessment of the provider, expressed in terms of a scaled grading system (e.g., A-F, or 1-5)

· Outcome/categorization of selected verification elements, with score for each (list to be approved by VA, could include all elements) and free text comments as needed

· Method, source, verification date, and name and/or initials of primary source verification Deliverable:

· 9.3.4 Provider Standardized Assessment

9.3.5 Frequently Asked Questions (FAQ)

The Contractor shall develop and provide a FAQ sheet in PDF format, updated annually and published on a VA-approved site, for use by providers. The FAQ sheet shall adhere to all applicable VA branding style guides and branding guidelines. The content shall address commonly asked questions on the Contractors credentialing process, including the credentials verification processes implemented by the Contractor, how providers submit an application, and the process for providers to appeal VA’s credentialing determinations. The Contractor shall obtain Government approval of the FAQ sheet prior to any distribution and updates.

Deliverable:

· 9.3.5 FAQ Sheet

9.3.6 Credentialing Package

The Contractor shall use the processes and materials developed to provide credentials verification services for community care providers requested by VA. The Contractor is not responsible for, nor authorized to solicit, investigate or otherwise obtain additional providers names or information beyond those submitted by VA. Upon VA’s request to initiate credentials verification services for a specific provider, the Contractor shall provide all required credentials verification services for that provider, including:

a. Utilize the process developed under Section 3.3 and the application form developed under Section 3.2 to initiate the credentialing process, contact the provider, and obtain all required information.

b. Obtain documentation of and verify the following credentials information (as applicable to the type of provider), using primary source verification (PSV) as a standard practice:

i. Utilize the process developed under section 3.3 and the application form developed under section 3.2 to initiate the credentialing process, contact the provider, and obtain all required information that dates back not less than 10 years from the credentialing application submission date.

ii. Obtain documentation of and verify the following credentials information (as applicable to the type of provider), using only primary source verification (PSV):

iii. License(s) to practice (including all current and past licenses relevant to the scope of practice)

iv. DEA and CDS certificates

v. Education and training

vi. Board certification

vii. Work history (dating back at least 10 years prior to the application submission date)

viii. Malpractice history (NPDB)/Professional Liability claims (dating back at least 10 years prior to the application submission date)

ix. License sanctions (obtained from sources including NPDB)

x. Medicare/Medicaid Sanctions (obtained from sources including NPDB)

xi. Current malpractice coverage to be of a certain minimum value (in accordance with the laws of the state in which the provider practices)

xii. Current attestation and disclosure questions (see section 3.2)

xiii. OIG Sanction Check

xiv. SAM and LEIE sanction check

xv. Medicare participating/enrolled/opt-out check

c. Document the results of the credentials verification, conduct and document the risk assessment as described in Section 9.3.4. The Contractor shall complete and submit an assessment that includes the overall graded risk assessment for the provider, along with a summary of the results from the primary and other sources for the credentials verification, to VA for each application. The Contractor shall save the list in an electronic location accessible to VA and approved by VA OIT.

Deliverables:

· 9.3.6 Credentialing plan summarizing credentialing processes and procedures

· 9.3.6 Provider application forms based on type of provider

· 9.3.6 Approved credentials verification process and standard assessment

9.3.7 Re-Credentialing Package

The Contractor shall provide the services identified in Section 9.3.6 for community care providers that the VA determines require re-credentialing, which shall occur within three (3) years of the providers initial credentialing or in accordance with the accreditation standards set by NCAQ or URAC whichever is applicable. All requirements pertaining to credentialing shall also apply to re-credentialing. The VA will initiate this process in the same manner established under Section 9.3.6.

Deliverables:

· 9.3.7 Completed re-credential verification package

9.4 TASK 4: OPERATION OF CVO CREDENTIALING COMMITTEE

9.4.1 CVO Credentialing Committee

The Contractor shall establish and operate a peer-level CVO Credentialing Committee that meets the standard requirements according to the Contractor’s accrediting body (e.g., NCQA or URAC). This Committee shall conduct enhanced reviews of credentialing information, including marginal findings resulting from the credentials verification process conducted under Task 3, information suggesting that providers may have potentially committed egregious acts, and any information provided in support of provider appeals of VA credentialing determinations. The Committee shall provide assessments and recommendations to the VA. The enhanced reviews and findings will be reported to VA through the Monthly CVO Credentialing Committee Report, as described in section 4.3 below. Upon award, the Contractor shall provide a summary of the CVO Credentialing Committee members, charter, and review process documentation to VA. The Contractor shall notify VA within 14 business days of any significant changes to the structure or makeup of the CVO Credentialing Committee occur during the contract period.

Upon request from VA, the Contractor shall evaluate provider appeals of VA credentialing determinations, including reviewing the relevant credentials verification files and assessments as well as the appeal and any supporting information provided by the provider after the credentialing determination was concluded. For each of the foregoing types of evaluations, the Contractor’s CVO Credentialing Committee shall be responsible for conducting an enhanced review of each provider, including the National Provider Data Bank Continuous Query (NPDB-CQ) report. Additionally, the CVO Credentialing Committee shall provide a written assessment and recommendation to VA for consideration by VA’s Appeals Committee which will be documented in the provider’s credentialing file and included in the Monthly CVO Credentialing Committee Report (as indicated in section 9.4.3). The VA’s Appeals Committee will independently determine whether to credential the provider and whether to grant or deny an appeal, and this determination shall be officially documented in the provider’s credentialing file.

Deliverables:

· 9.4.1 CVO Credentialing Committee Establishment Summary

9.4.2 Delay Notification

Should there be delays to completing provider credentialing within the allotted timeframe due to factors including but not limited to database errors or an incomplete review by the CVO Credentialing Committee (i.e., requesting board certification when not needed), the Contractor shall inform VA of the concern within three (3) business days of the delay and include a projected action plan and timeframe for resolution. Resolution timeframes and action plans for technical issues are subject to VA review and concurrence. Issues caused by Contractor error must be resolved within 5 business days.

Deliverables:

· 9.4.2 Delay Notification

9.4.3 Monthly CVO Credentialing Committee Report

The Contractor shall provide a monthly report of the CVO Credentialing Committee activities and reviews to the COR. The Monthly CVO Credentialing Committee Report shall include:

· CVO Credentialing Committee Meeting Minutes, including attendees, key decision points, and all providers discussed

· An aggregate summary of the total number of provider application files reviewed by the Committee, including the type of review (new/renewal or NPDBCQ findings related) final recommendation for approval or denial

· Average time to complete the review from start of work file submission to CVO Credentialing Committee review Deliverables:

· 9.4.3 Monthly CVO Credentialing Committee Report

9.4.4 Electronic Process Documentation

The Contractor shall establish a VA-approved electronic process to disseminate documents and collect individual summaries of provider file reviews. Documents shall be disseminated to VA points of contact that will be provided to the Contractor at the time of award.

Deliverables:

· 9.4.4 Documentation of Electronic Process

9.5 TASK 5: MONITORING PROVIDERS

9.5.1 NPDB-CQ Enrollment

Upon contract award, the Contractor shall submit a summary plan for the process to enroll all eligible providers under NPDB-CQ within 30 calendar days of award. Once submitted, VA will approve or deny the summary within 30 calendar days of the Contractor’s submission. If the summary plan is denied, the Contractor shall resubmit the summary plan within 30 days of denial.

The Contractor shall establish a VA-approved process to enroll all eligible providers in Continuous Monitoring under The National Provider Data Bank Continuous Query (NPDB-CQ). NPDB-CQ enrollment shall occur prior to the CVO Credentialing Committee recommendation. Additionally, NPDB-CQ enrollment shall occur under the VA’s authorized NPDB administrative account, and the Contractor shall be established as a delegate of VHA to enroll providers and perform required NPDB‑CQ actions in accordance with standard CVO practices.

NPDB-CQ re-enrollment and renewal shall be completed annually and shall be renewed prior to expiration. Any incident where a NPDB-CQ failed to be renewed shall be reported to the COR within three (3) business days of a failed renewal, via written notification (email), including the provider’s identifying information and the reason for the renewal failure. All renewal failures shall be documented in the Monthly CVO Credentialing Committee Report for further review by the MEC.

New and renewed NPDB-CQ shall be included in the Monthly Status Report (Deliverable 9.1.2) and clearly identify the type of enrollment (i.e., new or renewal) and the individual providers being enrolled or renewed. All new NPDB-CQ enrollment shall occur prior to the CVO Credentialing Committee review of the credentialing file.

VA will be responsible for notifying enrolled providers of negative findings, such as sanctions found during monitoring. The Contractor shall notify VA in writing (email) of any negative findings identified during monitoring within three (3) business days of the findings and will include updated findings information in the Monthly CVO Credentialing Committee Report and in the provider’s credentialing file, which shall be accessible to VA in the database.

Deliverables:

· 9.5.1 Summary Plan Process for NPDB-CQ Enrollment

9.6 TASK 6: TRAINING & COMMUNICATIONS

9.6.1 Training Videos

The Contractor shall provide video training recording(s) and materials for VA approval within 10 business days of contract award. Upon receipt of the training materials from the Contractor, the Government will review and provide feedback within 10 business days prior to training VA staff. The Contractor shall provide one video training session for providers at contract award and shall host a separate live, recorded training session for VA staff within 30 business days of award. The VA staff training shall include instruction on overall system usage, including how to access, customize and export information/reports, as well as how to use provider credentialing status tracking within the database. Within 30 business days upon receipt from the Contractor, the Government will review and provide feedback prior to training VA staff. The provider training must be available online via the Contractor’s website or an online video-sharing site (such as YouTube) for future use, and all training and resources/tools shall be 508 compliant. The Contractor shall provide all training videos and associated links directly to the COR, or other Government designated representatives, and shall obtain approval from the appropriate VA Information Security Officer (ISO) and/or Office of Information & Technology (OI&T) to ensure any hosting platform is accessible within the VA network. The Contractor shall not use any platform that is blocked or inaccessible to VA personnel. The Contractor shall provide updated training materials, including all videos, PowerPoints presentations, User Guides, and recordings within five (5) business days of any changes that result in significant process changes for VA or providers. VA may request additional training as needed.

Deliverables:

· 9.6.1 Training Videos (minimum of 2)

· 9.6.1 Live, Recorded Training

9.6.2 User Guides

The Contractor shall develop and maintain comprehensive user guides for the database to ensure consistent and effective use by all authorized users within 10 business days award. User guides shall clearly document system functionality, workflows and data management processes. The Contractor shall provide VA with an updated user guide within five (5) business days of any changes that result in significant process changes for VA or providers.

Deliverables:

· 9.6.2 User Guide(s)

9.6.3 Communications Plan

The contractor shall develop a standardized plan for provider communication cadence. The communication plan shall define the frequency and method of contacts via any modality (e.g., phone, fax, email, etc.) that will be conducted in attempt to obtain provider information or to encourage providers to complete the application for credentialing. If a provider has not completed the Credentialing application within five (5) business days of receipt, the Contractor shall attempt to contact the provider to complete the credentialing application by phone at least once (1) and shall make a minimum of five (5) attempts to contact the provider until the application is complete. If the provider does not respond, the Contractor shall report the provider to the VA as a Return in the Monthly Status Report, and the provider’s Return status shall be recorded in the database for the life of the contract. All documentation of the Contractor’s communication attempts with the provider shall be maintained in the provider’s file in the database. The Contractor shall submit any updates to the communication plan to the COR for review and approval. The COR shall approve all revisions prior to the Contractor implementing any new communication frequencies or methods.

The Contractor will conduct outreach (five attempts, at least one attempt by phone) to providers who meet the following criteria:

1. For providers who have not completed their credentialing application, outreach must begin 90 calendar days after attestation;

2. For providers whose records (license, COI, DEA, board membership or other documentation within the credentialing application) expire within 60 calendar days, outreach must begin 60 calendar days in advance of the expiration;

3. For providers who have been identified for recredentialing and have not completed their credentialing application, outreach must begin at least 30 calendar days after attestation.

Deliverables:

· 9.6.3 Standardized Communications Plan

9.6.4 Communications Templates

The Contractor shall create communication templates for initial credentialing requests, recredentialing, and follow up messages to providers and non-responders. All communications the Contractor intends to send to providers shall be reviewed and approved by VA prior to their first use to ensure appropriate content, language and compliance with 508 requirements. If any approved templates require modification, the Contractor shall make the requested changes within 5 business days of the VA’s initial request. All communications to providers shall follow VA guidelines and utilize the approved templates.

Deliverables:

· 9.6.4 Communications Templates

10.0 DELIVERABLES SCHEDULE

All deliverables provided under this contract shall meet all applicable Section 508 accessibility requirements. VA has unlimited rights, as defined in FAR 52.227-14, to all data and documents delivered to VA, and VA will retain ownership of all such documents after the contract ends.

11.0 PERFORMANCE STANDARDS

The performance standards and acceptable quality levels (AQL) set forth the Quality Assurance Surveillance Plan (QASP) are incorporated by reference into this PWS. The Contractor shall always comply with all performance standards and AQLs set forth in the QASP.

VA will monitor contractor performance in accordance with the performance standards set forth in Attachment A: Quality Assurance Surveillance Plan (QASP).

12.0 GOVERNMENT FURNISHED EQUIPMENT, INFORMATION, AND FACILITIES

The Government will provide all information required for the Contractor to provide reports and data, along with certain provider information necessary to contact providers to initiate credentialing. Business Associate Agreement (BAA) will not be required as protected health Information (PHI) will not be shared from VA to the Contractor. All data the Contractor receives from the providers shall be protected by and the responsibility of the Contractor.

There will be no Government furnished equipment or facilities.

14.0 SECURITY

Direct access to VA information or VA systems is not required for the contractor to fulfill the requirements outlined in the PWS. The VA will legally disclose a copy of the required sensitive Government Furnished Information to the Contractor under the authority of the Privacy Act System of Records “Non-VA Care (Fee) Records-VA”, 23VA10B3 Routine Use 10 ( 80 FR 146, July 30, 2015), Privacy Act System of Records “Patient Medical Records-VA”, 24VA10P2 Routine Use 43 (79 FR 157, August 14, 2014), 38 U.S.C. 5701, HIPAA Privacy Rule provision 45 CFR § 164.506(c) and The Veterans Choice Program Improvement Act, Public Law 115-26 and 38 U.S.C. 7332(b)(2)(H). The data will be sent via FIPS 140-2 encrypted transmission. The contractor will then receive, retain and then own that data copy. When the Contractor submits back to VA the agreed upon information, VA will then own that copy.

The Contractor, duly owning the received data, will then be solely responsible for ensuring the privacy and security protection of the information in accordance with all applicable Federal, state and local laws and provisions afforded sensitive and personally identifiable healthcare information.

The Contractor must be capable of sending and receiving this sensitive data to and from VA using NIST FIPS 140-2 validated encryption. The contractor must fully cooperate and assist in a government-sponsored security controls assessment; including those initiated by the Office of Inspector General. The government may conduct a security control assessment on short notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

15.0 DATA RIGHTS

Government Furnished Information modified, updated, revised or changed in any manner by the Contractor during performance of the contract is technical data as that term is used in FAR 52.227-14, Rights in Data—General (May 2014) and VA shall receive unlimited rights to all such data.

During the period of performance of the contract, VA shall have unlimited access to both Government Furnished Information and any and all technical data produced by the Contractor.

At the conclusion of the contract, the Contractor shall return to VA in a format acceptable to VA all data, including but not limited to, Government Furnished Information and technical data, entered or processed by the Contractor in performance of this contract, to ensure that the Government can use, store, and maintain the data as needed. The technical data generated, stored, and processed by the Contactor pursuant to this Contract may contain Sensitive Information. The CO shall be the sole official authorized to release whether verbally or in writing, any VA Government Furnished Information, technical data or any other written or printed materials pertaining to the VA maintained or provided by the Contractor pursuant to the requirements of the contract.

16.0 DEFINITIONS

This section defines key terms and acronyms used within the Performance Work Statement to promote accuracy and consistency in interpretation.