Dictation and Transcription Software SOW_ (DRAFT).pdf

STATEMENT OF WORK (SOW)

Secure Enterprise Dictation and Transcription Solution (SEDTS)

1. General Information. This is a sole source supply buy. The Government has an ongoing requirement for the purchase of the 3M Secure Enterprise Dictation and Transcription Solution (SEDTS) dictation software, to be delivered at the first five identified sites no later than 30 September 2018. The required software will allow medical professionals the ability to input voice dictation via landline telephones, mobile telephones, (e.g. cell phones, smart phones, etc.) and personal computers (PC). In addition to the purchase of the required software, the government requires installation, training, maintenance, system interfacing and all required licenses for operation of the dictation software.

1.1. Background. The U.S. Army Medical Command (MEDCOM) is seeking to standardize the transcription and dictation software utilized in Department of Defense medical treatment facilities (MTFs). There have been previous purchases for the required software done at the MTF level, however this is the first attempt to deploy an enterprise wide solution.

1.2. Scope of Work. The Contractor shall provide all equipment, materials, personnel, services, software, hardware, software licenses and supplies necessary to deliver the Secure Enterprise Dictation and Transcription Solution

(SEDTS). In addition to the purchase of the required software, the government requires installation, training, maintenance, system interfacing and annual licenses for operation of the dictation software.

1.3. The Contractor shall comply with all applicable laws, rules and regulations, reference Section 6 of this SOW for regulations applicable to this requirement.

1.4. Safety Requirements. The Contractor shall maintain safety and health standards compliant with requirements of the Occupational Safety and Health Administration (OSHA).

1.5. Security Requirement. The Contractor shall be responsible for the security of all Government information.

Failure to safeguard any classified/privileged information that may involve the Contractor or the Contractor’s personnel or to which they may have access to may subject the Contractor and/or the Contractor’s employees to criminal liability under Title 18, Section 793 and 7908 of the United States Code. Provisions of the Privacy Act also apply to all records and reports maintained by the Contractor. All programs and materials developed by the contractor at Government expense during the course of this contract are the property of the Government.

1.5.1. Neither the Contractor nor any of its contract service providers (CSPs) shall disclose or cause to disseminate any information concerning operations of military activities. Such action(s) could result in violation of the contract, termination for cause, and possible legal actions.

1.5.2. All inquiries, comments or complaints arising from any matter observed, experienced, or learned of as a result of or in connection with the performance of this contract, the resolution of which may require the dissemination of official information, shall be directed to the COR and the contracting officer (KO).

1.5.3. The Contractor shall only conduct business with designated Government personnel identified as points of contact (POCs) for this requirement. Names of authorized personnel will be provided within 5 calendar/working days of contract award to the Contractor by the Government COR, in writing, and updated within 5 calendar/working days as identified throughout the contract period.

1.5.4. U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports are maintained by the Contractor, but remain the property of the U.S. Government.

These files/results shall be surrendered to the COR as required by the contract or within five calendar days of contract completion. All materials, reports (original/editable), data (original/editable), and information formulated at

Government expense during the performance of this contract are and remain the sole property of the Government.

1.5.5. The contractor shall not mark work products produced in support of this contract as “Proprietary.” All other formulated tools (i.e. in Microsoft Word, Access, Excel, PowerPoint, Visio or other software formulated files or databases) shall become and remain the property of the U.S. Government and shall have no effect or impact on monies owed to the Contractor by the Government. All data remains the property of the U.S. Government and will be surrendered upon request.

1.5.6. All programs and materials developed at Government expense during the course of this contract are the property of the Government.

1.5.7. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements (CFR clause 52.204-9, Personal Identity Verification of Contract Personnel) as directed by

DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the

Government may require changes in contractor security matters or processes.

1.5.8. Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist

Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative);

or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

1.5.9. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 90 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the

COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website:

http://jko.jten.mil.

1.5.10. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program

(training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR.

This training shall be completed within 90 days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

1.6. Cybersecurity Requirements

1.6.1. The contractor shall appoint a contractor point of contact responsible for the cybersecurity of the contractor device or system throughout the life of the contract, within 7 days of contract award.

1.6.2. The contractor shall provide Subject Matter Experts (SMEs) to support all assessments of the contractor provided products and materials.

1.7 Continuous Risk Management

http://jko.jten.mil/

1.7.1. The contractor shall maintain a duplicate of the original and patches for software supporting the fielded system in a contractor supplied lab environment at contractor location for the life of the contract.

1.7.2. The contractor shall maintain the duplicate system in operational condition with the latest security patches installed.

1.7.3. The contractor shall maintain the authorized security configuration and notify the Government within forty eight (48) hours of any major changes.

1.7.4. The contractor shall ensure the contractor’s system is in compliance with the Department of Defense (DoD)

Information Assurance Vulnerability Management (IAVM) program.

1.7.5. The contractor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools, which will be provided by the Government within 90 days of contract award.

1.7.6. Contractor shall maintain the system and update to comply with updated STIGS as made available by the

Government within three (3) months of notification by the Government.

1.7.7. The contractor shall provide vulnerability scan and Security Content Automation Protocol (SCAP) Universal

Serial Bus.

1.7.8. Contractor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month beginning October 2018.

1.7.9. The contractor shall disclose all vulnerabilities and close all discovered vulnerabilities within three months of discovery. The contractor shall provide a summary of all vulnerabilities discovered and closed to the DoD cybersecurity official no later than the 10th calendar day of each month beginning October 2018.

1.7.10. The contractor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities.

1.7.11. The contractor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

1.7.12. The contractor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

1.7.13. The contractor shall use Government approved methods and procedures for remote access administration of system or device. The Government will provide the approved methods and procedure no later than 90 days after contract award.

1.8. Intrusion Detection and Prevention, Antivirus, and Antimalware

1.8.1. The contractor shall ensure that the contractor device or system is capable of supporting the use of Defense

Information Security Agency (DISA) approved intrusion detection and prevention, antivirus, and antimalware applications. The contractor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support, either fully or partially the operation without performance degradation of the medical system/device within 10 days of request. In cases where the operation of security applications are not technically achievable, the contractor shall provide detailed justification and a Plan of Actions and Milestones

(POA&M) describing steps towards compliance with this requirement.

1.8.2. The contractor shall ensure that the contractor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis, which will be agreed upon by the Contractor and

DoD cybersecurity official after contract award. Scanning shall encompass the entire system (file system, operating system, real-time processes) unless there is a justified exclusion. In cases where scanning of the entire system may negatively affect its operation, the contractor shall provide a detailed list of exclusions with justifications. The list of exclusions with justifications will be reviewed by the DoD cybersecurity official and collaborate a plan of action going forward.

1.9. Licenses

1.9.1. The contractor shall provide all software licenses necessary to operate the equipment and peripherals supplied as a result of this contract. The contractor shall provide content upgrades to all licensed modules, as required for optimal system functionality.

1.9.2. The contractor shall provide permissions to allow use of copyrighted or licensed material for use during contingency and non-contingency operations (e.g. permission to use copyrighted paper templates).

1.10. Travel. The contractor will be required to travel to MTFs throughout the MHS to provide services incidental to the purchase of the dictation solution. Arrangement and payment of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor.

1.11. POLICY FOR REPORTING INCIDENTS OF SEXUAL ASSAULT AND SEXUAL HARRASSMENT

UNDER SEXUAL ASSAULT PREVENTION AND RESPONSE PROGRAM (SHARP).

1.11.1. The contractor shall comply with OTSG/MEDCOM Policy Memo 16-038, Policy for Reporting Incidents of

Sexual Assault and Sexual Harassment under the Sexual Assault Prevention and Response Program (SHARP), 12

Nov 13. The SHARP reporting requirements apply only to knowledge obtained by contractor personnel while performing services under this contract.

1.11.2. The contractor shall require all contract service providers (CSPs) with knowledge of an incident of sexual assault occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours of gaining knowledge) report the incident in writing to the government's COR. This reporting policy also applies to sexual assault incidents involving MEDCOM personnel that occur on the contractor’s owned or leased facility under this contract. All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals, when the incidents occur on a Government facility or a Government leased facility.

1.11.3. The contractor shall require all contract service providers with knowledge of an incident of sexual harassment occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours) report the incident in writing to the government's COR. This reporting policy also applies to sexual harassment incidents involving MEDCOM personnel that occur on the contractor’s owned or leased facility under this contract. All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals, when the incidents occur on a Government facility or a Government leased facility.

1.12. U.S. Federal Holidays. The contractor will not be required to perform services on the holidays listed below.

Any of the holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday:

New Year’s Day January 1st

Martin Luther King’s Birthday 3rd Monday in January

Presidents’ Day 3rd Monday in February

Memorial Day last Monday in May

Independence Day July 4th

Labor Day 1st Monday in September

Columbus Day 2nd Monday in October

Veteran’s Day November 11th

Thanksgiving Day 4th Thursday in November

Christmas December 25th

2. DEFINITIONS AND ACRONYMNS.

2.1. DEFINITIONS.

CONTRACTOR. The term as used in this contract refers to the prime.

CONTRACTING OFFICER. A person with authority to enter into, administer, or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

MEDICAL TREATMENT FACILITY (MTF). A military hospital or clinic to include dental and veterinary clinics.

PHYSICAL SECURITY. Actions that prevent the loss or damage of government property.

SUBCONTRACTOR. One that enters into a subcontract and assumes some of the obligations of the primary

Contractor.

2.2. ACRONYMS.

COTS Commercial Off-The-Shelf

CSP Contract Service Provider

DCAA Defense Contract Audit Agency

DISA Defense Information Security Agency

DoD Department of Defense

FAR Federal Acquisition Regulation

HIPAA Health Insurance Portability and Accountability Act

IT Information Technology

IAVM Information Assurance Vulnerability Management

JTR Joint Travel Regulation

KO Contracting Officer

MEDCOM U.S. Army Medical Command

MHS Military Health System

MTF Medical Treatment Facility

OSHA Occupational Safety Health Administration

POC Point of Contact

RHC Regional Health Command

RMF Risk Management Framework

SME Subject Matter Expert

STIGS Security Technical Implementation Guide

SOW Statement of Work

TMC Troop Medical Clinic

3. GOVERNMENT FURNISHED ITEMS AND RESPONSIBILITIES.

3.1. Government Facilities. The Government will provide a location for the facilitation of user training. In addition, the Government will provide access to toilet facilities, electric power and water, as needed for the contractor to complete the requirements of this contract.

3.2. Government Quality Assurance (QA). The Government will identify a representative(s) to periodically monitor, the contractor’s performance. The Government representative(s) will evaluate the contractor’s work through intermittent on-site inspections. Inspections and tests are for the sole benefit of the Government and do not relieve the contractor of responsibility for providing adequate quality control measures; for damage to or loss off material before acceptance by the Government; constitute or imply acceptance; nor affect the continuing rights of the Government after acceptance of the completed work.

3.3. Government Points of Contact. The Government will provide a list of all pertinent government points of contact and their contact information within 5 days of delivery order issuance.

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES.

http://encyclopedia.thefreedictionary.com/Security+Technical+Implementation+Guide

4.1. The Contractor shall provide qualified personnel, services, materials, equipment, software, hardware, software license(s) and supplies necessary to deliver the latest version of the Secure Enterprise Dictation and Transcription

Solution (SEDTS) solution.

4.6. Installation. The contractor shall provide on-site installation services. The contractor shall install the Secure

Enterprise Dictation and Transcription Solution (SEDTS) on the Government server(s) located within the identified

MTF. The commercial dictation and transcription software solution shall be fully operational and operate seamlessly.

4.7. Onsite User Training. The contractor shall provide on-site user training. The user training shall ensure that all users receiving the training understand how to operate the system, system use(s), maintenance requirements, and service agreements and requirements (estimated minimum of two (2) days). Users include; medical providers, telehealth support personnel, Information Technology (IT) personnel, and medical maintenance personnel approximately 20 personnel per training session.

4.8. Remote Technical Support Services. The contractor shall provide remote technical support twenty four (24) hours a day, seven (7) days a week.

4.9. The contractor shall provide hardware support which will include telephonic, email, and onsite location support

(when necessary) for the dictation and transcription software solution. This includes parts repair, parts replacement when repair not possible, reinstallation of parts repaired and/or parts replaced, testing connectivity and ensuring optimal operating capability.

4.10. The contractor shall provide software support which will include telephonic, email and onsite support as well as remote diagnostic access coordinated with USAMITC and local cybersecurity for connectivity support of installation, launch, and reinstallation when the hardware configuration meets the minimum system requirements for the software. The contractor shall also provide software updates and patches as required for optimal system functionality. Software updates and patches are to be coordinated with USAMITC and local cybersecurity.

4.11. Facilities. None

5. DESCRIPTION OF WORK.

5.1. The contractor shall deliver the a dictation and transcription solutiom in which is Windows 10 compatible with the capability to be upgraded as the government’s infrastructure is upgraded.

5.2. The contractor shall provide on-site installation services. The contractor shall ensure the provided equipment is fully operational in accordance with manufacturer standards and contract terms upon completion of installation.

5.3. The contractor shall provide on-site user (medical personnel, medical support personnel, On-site IT specialist, and on-site medical maintenance personnel) training services.

5.4. The contractor shall provide all licenses required to operate the system for a period of 12 months following the installation of the equipment, with each delivery order.

5.5. The contractor shall provide content upgrades to all licensed modules, when necessary for a period of 12 months following the installation of the equipment.

5.6. The contractor shall perform maintenance on all licensed modules, when necessary for a period of 12 months following the installation of the equipment.

5.7. The contractor shall provide a secure remote connection across all MTFs, both within the Continental United

States and outside of the Continental United States.

5.8. The contractor shall provide a dictation and transcription software platform with the capability to receive an electronic Admissions, Discharge, and Transfer (ADT) demographic data feed from the Military Health System electronic health record (CHCS, Essentris, MHS GENESIS, etc).

5.9. The contractor shall provide an electronic document upload interface with the capability to interface with the electronic health record.

5.10. The contractor shall provide the capability for electronic signature with the DoD Common Access Card

(CAC).

5.11. The contractor shall provide the capability to electronically review and edit the transcribed document which includes the ability for reviewing and editing of back end speech recognition generated notes completed by a transcriptionist.

5.12. The contractor shall perform change management activities during implementation to help with change and expectation management and work collaboratively with the subject matter experts to determine the best solution.

5.13. If the system is inoperable, the repair shall be initiated in no less than 4 hours and worked to completion.

5.14. The contractor shall establish a Business-to-Business (B2B) connection from the Defense Information Systems

Agency (DISA).

5.15. The contractor shall provide dictation and transcription management and reporting tools that allow for detailed analysis of electronically signed documents.

5.16. The contractor shall allow a variety of commercial dictation input devices to function with the bundled dictation and transcription solution.

5.17. The contractor shall provide the capability for individual site data segregation within a centralized hosted environment.

5.18. The contractor shall provide a solution infrastructure that allows an unlimited number of sites to be added without additional hardware purchases after the initial purchase.

5.19. The contractor shall provide a solution infrastructure that allows for resource sharing of transcriptionists in a regionalized manner.

5.20. The contractor shall provide a solution in which accurately transcribe common medical terminology.

6. DELIVERABLES.

6.1.Sexual Assault Reporting. The contractor will immediately (within 24 hours) submit a written report of an incident of sexual assault to the Government contract POC.

6.2. Sexual Harassment Reporting. The contractor will immediately (within 24 hours) submit a written report of an incident of sexual harassment to the Government POC.

7. APPLICABLE REGULATIONS/PUBLICATIONS/STANDARDS/MANUFACTURER REQUIREMENTS.

Compliance with all publications, regulations, operating instructions and standards provided by the Government is required when they pertain to the procedures for materials expediting herein and where the contractor is authorized by the SOW to accomplish the work specified. The contractor is required to acquire and work based on the latest version of the publication. For any area not covered by regulation, publication, etc., the contractor shall abide by industry standards and manufacturer requirements.

7.1. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

7.2. The Federal Information Security Management Act (FISMA)

7.3. The E-Government Act of 2002

7.4. Office of Management and Budget (OMB) publications. The following publications are located at https://www.whitehouse.gov/omb/agency/default

7.4.1. Circular A-130

7.4.2. Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a

Common Identification Standard for Federal Employees and Contractors

7.5. National Institute of Standards and Technology (NIST). The following publications are located at http://www.nist.gov/publication-portal.cfm

7.5.1. NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to

Federal Information Systems

7.5.2. NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

7.6. Federal Information Processing Standards (FIPS). The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm.

7.6.1. FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

7.6.2. FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

7.6.3. FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Contractors

7.7. Department of Defense (DoD). The following publications are located at http://www.dtic.mil/whs/directives/.

7.7.1. DoD Instruction 5200.2, DoD Personnel Security Program (PSP) https://www.whitehouse.gov/omb/agency/default http://www.nist.gov/publication-portal.cfm http://www.dtic.mil/whs/directives/

7.7.2. DoD Instruction 8500.1, Cybersecurity

7.7.3. DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

7.7.4. DoD Instruction 8510.01, Risk Management Framework Process (RMF)

7.7.5. DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

7.7.6. DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care

Programs

7.7.7. DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care

Programs

7.7.8. DoD Directive 5400.11, DoD Privacy Program

7.7.9. DoD Manual 5400.11-R, Department of Defense Privacy Program

7.8. Army Regulation 600-20, Army Command Policy, 20 Sep 2012

7.9. OTSG/MEDCOM Policy Memo 13-062, Policy for Reporting Incidents of Sexual Assault and Sexual

Harassment under the Sexual Assault Prevention and Responses Program (SHARP), 12 Nov 2013

8. ATTACHMENTS/EXHIBIT LIST:

Exhibit A- Exclusion from Participation in Federal Health Care Programs (October 2015)

Exhibit B- Tobacco Free Medical Campus (TFMC)

Exhibit C- Invoicing, Receipt, Acceptance and Property Transfer (iRAPT) – formerly known as WAWF

Exhibit D-

Contractor

Attachment #1 Military Health System Fielding Plan- Initial Sites. The government reserves the right to change primary locations as mission dictates. Location changes will be relayed to the contractor in enough time to allow for training, installation, and implementation.

Exhibit A Exclusion from Participation in Federal Health Care Programs (October 2015)

1. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as

“person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector

General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The

Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at http://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-

Healthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

2. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the

Lists and no such names appear on either of the Lists.

3. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the

Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

4. The Contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of contractor personnel working in the MTF against the Lists, as specified in

OTSG/MEDCOM Policy Memo 15-037. The Government will notify the Contractor in the event any contractor personnel working in the MTF appear on either of the Lists.

5. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the

Contracting Officer, and (b) promptly remove that person from the contract.

6. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

7. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42

USC § 1320a-7a):

a. There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

b. Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person.

8. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health

Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at http://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

http://oig.hhs.gov/fraud/exclusions.asp http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-Healthcare/Program-Integrity/Sanctioned-Providers http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-Healthcare/Program-Integrity/Sanctioned-Providers http://oig.hhs.gov/exclusions/files/sab-05092013.pdf

(End of Exhibit A)

Exhibit B Tobacco Free Medical Campus (TFMC)

In accordance with Army Regulation 600-63, paragraph 7-3, 14 April 2015; Operations Order 15-48 (Army Medical

Command (MEDCOM) Tobacco Free Living – USAMEDCOM), 8 May 2015; and any Operations Order, regulation or other instruction implementing, defining or otherwise addressing the Tobacco Free Medical Campus

(TFMC) on any military installation or DoD-controlled location, Contractor personnel are prohibited from using any tobacco product on or within any TFMC while performing under this contract. TFMCs are established at each installation or DoD-controlled location and include: (1) any property or non-residential building that is operated, maintained or assigned to support medical activities, including but not limited to, hospitals, medical laboratories, outpatient clinics (including medical, dental, and veterinary facilities), or aid stations operating for the primary purpose of delivering medical care and services for DOD eligible beneficiaries and /or meeting the mission of the

Army Medical Command; (2) all other facilities in which medical activities or administration take place, to include

HQ MEDCOM and Defense Health Headquarters; (3) all internal roadways, sidewalks and parking lots; and (4) all sidewalks, parking lots and grounds external but adjacent to the building or related to the migratory corridors surrounding the medical facility. The Contractor shall obtain from the COR any orders, regulations, instructions or other documents implementing, defining or otherwise addressing the TFMC for any given installation or DoD-controlled location where Contractor personnel may perform under this contract and shall instruct Contractor personnel on the TFMC limitations for installations or DoD-controlled locations where they may perform under this contract.

(End of Exhibit B)

Exhibit C: Invoicing, Receipt, Acceptance and Property Transfer (iRAPT) – formerly known as WAWF iRAPT is the authorized method to electronically process contractor request for payment. This application allows

DOD contractors to submit and track Invoices and Receipt/Acceptance documents electronically. Contractor shall

(i) register to use iRAPT at https://wawf.eb.mil and (ii) ensure an electronic business point of contract (POC) is designated in the System for Award Management at https://www.sam.gov within ten (10) calendar days after award of this contract/order.

iRAPT Instructions:

Questions concerning payments should be directed to the Defense Finance and Accounting Service (DFAS) location listed in Block 18a of your purchase order/contract. Please have your purchase order/contract number ready when calling about payments.

You can easily access payment and receipt information using the DFAS web site at http://www.dfas.mil/money/contractor . Your purchase order/contract number or invoice number will be required to inquire status of your payment.

The following codes and information will be required to assure successful flow of iRAPT documents.

https://wawf.eb.mil/ https://www.sam.gov/ http://www.dfas.mil/money/vendor

Foreign Contractors will submit banking information in the Comments Tab of the iRAPT invoice.

TYPE OF DOCUMENT [X the appropriate block]

___ Invoice (Contractor Only)

_X__ Invoice and Receiving Report (COMBO)

___ Invoice as 2-in-1 (Services Only)

___ Receiving Report (Government Only)

CAGE CODE: TBD

ISSUE BY DODAAC: W81K04

ADMIN BY DODAAC: W81K04

INSPECT BY DODAAC: TBD ON DELIVERY ORDER

ACCEPT BY DODAAC: TBD ON DELIVERY ORDER

SHIP TO DODAAC: TBD ON DELIVERY ORDER

PAYMENT OFFICE FISCAL STATION CODE: HQ0490

EMAIL POINTS OF CONTACT LISTING: (Use Group e-mail accounts if applicable)

INSPECTOR Primary: TBD ON DELIVERY ORDER

Alternate: TBD ON DELIVERY ORDER

ACCEPTOR Primary :TBD ON DELIVERY ORDER

RECEIVING OFFICE POC: Primary: TBD ON DELIVERY ORDER

CONTRACT ADMINISTRATOR/ SPECIALIST: TBD ON DELIVERY ORDER

CONTRACTING OFFICER: See Block 31b on SF1449 for email address.

ADDITIONAL CONTACT:

Any modification requests must be in writing and submitted to: ADMIN DODAAC.

(End of Exhibit C) https://wawf.eb.mil/SUM%20RoboHelp%20Web%20Help/Detailed_Document_Information/Scribble550.htm https://wawf.eb.mil/SUM%20RoboHelp%20Web%20Help/Detailed_Document_Information/Scribble560.htm https://wawf.eb.mil/SUM%20RoboHelp%20Web%20Help/Detailed_Document_Information/Scribble570.htm https://wawf.eb.mil/SUM%20RoboHelp%20Web%20Help/Detailed_Document_Information/Scribble620.htm

Exhibit D: Non-Defense Health Agency (Non-DHA) Health Insurance Portability and Accountability Act (HIPAA)

Business Associate Agreement (BAA) (7 July 2014)

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD

Health Information Privacy Regulation,” January 24, 2003, this document serves as a BAA between the signatory parties for purposes of the HIPAA and the “HITECH Act” amendments thereof, as implemented by the HIPAA

Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The

HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health

Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health

Information, and Use.

—Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other

PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act

Issuances as defined herein.

—Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA

Issuances, and in reference to this BAA, shall mean [insert name of Business Associate signatory to this BAA].

—Agreement means this BAA together with the documents and/or other arrangements under which the Business

Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this

BAA.

—Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [insert name of MHS component signatory to this BAA].

—DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the

HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate

(NCRMD).

—DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health

System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

—DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD

5400.11 (2007) and DoD 5400.11-R (2007).

—HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

—HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the

U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E

(Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the

2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-

5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

—Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by the Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business

Associate shall also respond to any security incident of which it becomes aware in accordance with any

Information Assurance provisions of the Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively), as applicable, the Business

Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the

Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR

164.524.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered

Entity’s obligations under 45 CFR 164.526.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45

CFR 164.528.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the

HIPAA Privacy Rule, the Business Associate shall comply with the requirements of HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in the

Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy

Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA

Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA

Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business

Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in the Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in the Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business

Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business

Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in the Agreement, the Business Associate may use PHI to provide Data

Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall provide the Business Associate with the notice of privacy practices that the Covered

Entity produces in accordance with 45 CFR 164.520 and the corresponding provision of the DoD HIPAA

Issuances.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business

Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the

Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act

Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

If the DHA Privacy Office determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the DHA Privacy Office, regardless of whether the breach occurs at DHA or at one of the Service components. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with

DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office. The Business Associate shall contact the Covered Entity for guidance when the incident is not an HHS Breach.

This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response, the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals, and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business Associate shall implement these breach response requirements immediately upon the Business

Associate’s discovery of a possible breach.

(b) Government Reporting Provisions

The Business Associate shall report the breach within one hour of discovery to the Covered Entity and to the US

Computer Emergency Readiness Team (US CERT) -the other parties as deemed appropriate by the Covered Entity.

The Business Associate is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer or other agent of the Business Associate.

The Business Associate shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report/.

Before submission to US-CERT, the Business Associate shall save a copy of the on-line report. After submission, the Business Associate shall record the US-CERT Reporting Number. Although only limited information about the breach may be available as of the one hour deadline for submission, the Business Associate shall submit the US-

CERT report by the deadline. The Business Associate shall e-mail updated information as it is obtained, following the instructions at http://www.us-cert.gov/pgp/email.html. The Business Associate shall provide a copy of the initial or updated US-CERT report to the -Covered Entity and the applicable Service-Level Privacy Office, if requested by either. Business Associate questions about US-CERT reporting shall be directed to the Covered Entity or Service-

Level Privacy Office, not the US- CERT office.

The additional US Army and the US Army Medical Command (MEDCOM) reporting requirements are addressed in the PII Breach Reporting and Notification Policy. The latest version of this policy can be obtained from the

Covered Entity or the MEDCOM Privacy Act/Freedom of Information Act (FOIA) Office at:

http://www.us-cert.gov/pgp/email.html usarmy.jbsa.medcom.list.medcom-foia- users@mail.mil . If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances.