Draft OT PWS.docx

Performance-Based Work Statement for Optimization and Transformation U.S. Navy Bureau of Medicine and Surgery (BUMED) N10D (Medical Readiness)

1. Introduction The Bureau of Medicine and Surgery (BUMED) has a requirement for Information Technology and Communications professional support services to assess, support, and enhance Navy Medicine’s Medical Readiness (N10D) directorate. Navy Medicine is facing significant changes in the upcoming years such as shifts in operations related to the NDAA, sustainment of legacy IT systems, and shifts in operations to support operational forces to ensure optimal readiness for themselves and their family members. With such significant changes occurring, consistent program support will be critical not only to develop and implement process improvement activities, but also to sustain ongoing operations, transition programs where necessary, and implement new initiatives to further the mission throughout the infrastructure network.

2. Background At a high level, N10D’s mission is to “Support the N10D Mission by ensuring the Medical Readiness of every Sailor and Marine by overseeing force health, deployability and suitability screening for assignment, monitoring Family Readiness, guiding the identification of fit and unfit personnel, and providing subject matter expertise on adjudication processes to guarantee that Navy personnel are medically ready for any deployment or assignment.” To accomplish this mission, N10D has several associated objectives but is not limited to:

2.1. Ensure the data and communications information flow for readiness of Sailors and Marines by actively and passively monitoring force health, deployability, and suitability screening for assignment throughout the network

2.2. Monitor and ensure Family Readiness to support mobilization of the force across the enterprise

2.3. Evaluate and update Navy and USMC matters and policy regarding current standards, practices, procedures, and safety issues for associated readiness programs

2.4. Develop policies and processes to guide identification and disposition of unfit Active Duty and Reserve personnel

2.5. Provide subject matter expertise and advisory opinions on medical and administrative adjudication processes for accession or retention in the Department of Navy

2.6. Provide Navy Medicine policy, procedure, guidance, training, and oversight for Educational and Developmental Intervention Services (EDIS).

2.7. N10D serves as the strategic authority for multiple critical programs. The Contractor shall provide policy analysis, data engineering, training development, and administrative support across the following functional portfolios but not limited to:

2.8. N10Ds operations are central to the future requirements of Navy Medicine as it relates to a Medically Ready Force, and will continue to expand through new policies and additional requirements. This ever-changing landscape necessitates additional support to be able to continue current operations and meet the increased need of future operations.

3. Objectives/Scope There are a number of activities that will support and enhance N10D’s data network for day-to-day operations. These support services are needed to ensure that the people, processes, information technology, and policies are adequately supporting the N10D mission. Such support will enhance the ability to deliver appropriate telecommunications and data over to stakeholders and to improve N10D’s ability to automate its data decision support processes to meet Operations, Plans and Readiness’ mission. Updating, consolidating, and generating new policy, and leveraging information technology to streamline workflows through standardized data and network processes, templates, and tools will allow N10D to perform programmatic activities more efficiently and effectively as well as develop a robust training capability will significantly improve knowledge sharing and provide stakeholders the information necessary to perform their duties effectively and efficiently.

The following attributes will provide N10D with the necessary support to meet its intended mission: 1). Practical experience in implementing federal and commercial health care best practices; 2). Experience supporting both the clinical and operational side of Military Medicine with optimizing Information Technology and Communications Infrastructure processes and policies; 3). Knowledge and understanding of Navy Medicine’s challenges as it relates to clinical programs, Medical Readiness, and the implications of the operational transition related to yearly NDAAs; 4). Detailed understanding of Navy Medicine’s strategic intent, functions, and processes to navigate policy development and overall change management activity to support transformational efforts throughout the enterprise; 5). Expertise in developing a capability to track and monitor program performance management that allows leadership to align performance to strategic goals on an ongoing basis.

4. Tasks

4.1. Policy Implementation

4.1.1. The contractor will assist with drafting, modernizing, organizing, and disseminating medical readiness policy, procedural documentation, and stakeholder communications that enable BUMED N10D to implement and maintain enterprise medical readiness guidance.

4.1.2. Provide research and technical writing support to assist the Government in drafting updated medical and physical standards for Navy and Marine Corps accessions and retention.Support development of Disability Evaluation System (DES) and Limited Duty (LIMDU) processes

4.1.3. Support development of IMR and broader FHP guidelines.

4.1.4. Develop family readiness support frameworks, including Educational and Developmental Intervention Services (EDIS).

4.1.5. Develop data governance and protocols for the surveillance and tracking of fleet readiness metrics.

4.1.6. Assist with drafting, revising, formatting, quality-checking, and maintaining medical readiness policy and guidance work products for N10D review and approval.

4.1.7. Drafting Requirements: All drafted policies must align with the directorate’s strategic objectives and higher-level DoW directives. Ensure clear delineation of roles, responsibilities, and standardized procedures for managing specialized care, force health, deployability and suitability screening for assignment, and medical readiness tracking.

4.1.8. Adjudication Facilitate stakeholder reviews, consolidate feedback, and provide technical writing support to adjudicate comments through the formal staffing and clearance process. Coordinate stakeholder inputs for policy actions, document comment resolution, and maintain complete coordination records through action closure.

4.1.9. Gap Analysis: Analyze existing process workflows and policy documents across N10D to identify content gaps, establish common connections, and eliminate unnecessary redundancies.

4.1.10. Enterprise Alignment: Ensure all policies are de-conflicted and aligned to ensure standards are consistent from accession through discharge for Service members and their families, strictly adhering to DoW and DON directives.

4.1.11. Provide strategic and operational support to execute the rollout of new or updated readiness policies across the enterprise.

4.1.12. Implementation Plans: Develop phased implementation plans detailing timelines, milestones, stakeholder impacts, and resource requirements.

4.1.13. Implementation Plans: Develop phased implementation plans detailing timelines, milestones, stakeholder impacts, and resource requirements.

4.1.14. Training & Communication: Draft strategic messaging, executive briefings, and training materials (e.g., FAQs, quick reference guides) to educate Echelon II-IV commands, Medical Treatment Facilities, and line commanders on revised LIMDU, accessions, IMR, deployment health, suitability assessments and EDIS policies.

4.1.15. Develop and refine policy frameworks that govern the surveillance, data collection, and compliance tracking of military readiness programs.

4.1.16. Metrics Integration: Establish policy guidelines for how IMR, LIMDU, deployability, suitability and force health data are tracked, reported, and utilized by leadership for decision-making.

4.1.17. Compliance Auditing: Draft assessment tools and compliance checklists to evaluate adherence to published accessions, retention, deployability, suitability and family readiness policies across the fleet.

4.1.18. Draft & Revise: The contractor will assist with developing and updating instructions, memorandums, notices, Concepts of Operation, and process workflows for programs including but not limited to EDIS, IDES, IMR, deployability and suitability.

4.1.19. Produce stakeholder-facing communications, implementation materials, and distribution plans that explain policy changes, clarify required actions, and promote consistent execution across the enterprise.

4.2. Data and Performance Management Support Services

The contractor shall collate, manage, analyze, visualize, and report medical readiness data using Government-approved and locally available tools, systems, and platforms to improve measurement, reporting consistency, and leadership decision-making.

4.2.1. Compile, organize, and format program-level readiness data from existing, authorized Government systems to generate standardized reports.

4.2.2. Extract, validate, process, analyze, and visualize medical readiness data from approved readiness systems and data sources to generate actionable readiness insights.

4.2.3. Develop and maintain automated data extraction and transformation processes to pull metrics related to deployability and suitability screening for assignment, accession waivers, retention trends, and medical boards.

4.2.4. Produce, update, and maintain recurring and ad hoc reports that enable deployment health, readiness monitoring, performance review, and timely leadership awareness.

4.2.5. Define, refine, and track Key Performance Indicators in coordination with the directorate that measure the health, readiness, and deployability of the force.

4.2.5.1. Metric Formulation: Develop standardized metrics to evaluate program effectiveness, such as:

4.2.5.1.1. Average processing times for Disability Evaluation System (DES) and Limited Duty (LIMDU) phases.

4.2.5.1.2. Compliance and care-delivery timelines within the EDIS program.

4.2.5.1.3. IMR deficiency rates across Navy and Marine Corps units.

4.2.5.1.4. Suitability for assignment for Navy and Marine service members and their families compliance, processing timeline, reconsiderations frequency and results, and non-suitable rates.

4.2.6. Benchmarking: Conduct historical trend analysis and benchmarking to establish baseline performance metrics for accessions, retention, and deployability and suitability screening for assignment surveillance.

4.2.7. Build and maintain a data repository for products, including reporting templates, historical submissions, business rules, data dictionaries, analytic outputs, and supporting documentation.

4.2.8. Implement and maintain automation for recurring data pulls and reports, when technically feasible and authorized.

4.2.9. Analyze data to identify trends, bottlenecks, correlations, performance gaps, and key drivers affecting readiness outcomes, and present findings in usable decision-support formats.

4.2.10. Establish and maintain a performance review framework and reporting cadence for dashboards, recurring reports, and formal readiness outcome discussions.

4.2.10.1. Develop and maintain a data infrastructure framework that describes the ongoing cadence of program, project, and initiative performance reviews and include milestones such as dashboard refreshes and formal performance reviews.

4.2.11. Improve usability, training, and adoption of analytic products.

4.2.12. Establish and enforce strict data quality control measures and governance protocols to ensure the accuracy, completeness, and security of all readiness data.

4.2.12.1. Data Validation: The Contractor shall perform routine audits of EDIS, LIMDU, and IMR data sets to identify anomalies, duplicate records, or systemic input errors, and coordinate with stakeholders for remediation.

4.2.12.2. Privacy & Compliance: The Contractor shall ensure all data management activities strictly adhere to DoW, DoN, and DHA policies regarding the safeguarding of Personally Identifiable Information and Protected Health Information during analytics and reporting processes.

4.2.12.3. Provide administrative and technical analysis to assist the Government in drafting migration plans and decommissioning roadmaps for outdated readiness tracking applications and migrating their functions to DoW-approved cloud infrastructures.

4.3. Force Development

The contractor shall develop, update, organize, publish, disseminate, and maintain standardized and role-based training products that advance N10D’s enterprise medical readiness training needs

4.3.1. Learning Needs Analysis and Strategy Development. Conduct comprehensive analyses to identify knowledge gaps and performance deficiencies across the directorate’s portfolio (e.g., LIMDU, Accessions, EDIS).

4.3.1.1. Evaluate the state of fleet and medical staff knowledge regarding readiness tracking and provide a recommended Instructional Strategy that identifies the most effective delivery methods for the target audience.

4.3.1.2. Curriculum Architecture: Design a cohesive learning roadmap that ensures personnel at all echelons (from administrative staff to senior leadership) receive the appropriate level of information to maintain force readiness compliance.

4.3.2. Development of Learning Solutions and Content Assets. Develop and produce high-quality instructional materials and knowledge-transfer tools tailored to the directorate’s operational requirements.

4.3.2.1. Content Creation: Create instructional content that translates complex readiness policies into digestible learning assets.

4.3.2.2. Technical Integration: Any digital learning solutions developed must be compatible with existing Navy and DoW information systems and enterprise hosting environments to ensure broad accessibility across the fleet.

4.3.3. Performance Support and "Point-of-Need" Resources. Develop performance support tools designed to assist users in real-time during the execution of readiness-related tasks.

4.3.3.1. Reference Materials: The Contractor shall produce and maintain a suite of reference tools—such as process maps, decision-support guides, and technical manuals—that provide immediate assistance for users navigating accession standards, disability evaluation workflows, or specialized care referrals.

4.3.3.2. Workflow Integration: Support tools shall be designed for seamless integration into daily operations, ensuring that clinicians and command staff have access to the latest policy interpretations without requiring formal classroom or scheduled training.

4.3.3.3. Develop, update, quality-check, publish, and maintain force development materials for Government review and release

4.3.4. Learning Asset Maintenance and Lifecycle Support. Ensure all instructional materials and support tools remain current and effective throughout the period of performance. Develop and maintain an N10D Force Development Plan that defines standard training products, target audiences, compliance timelines, update cycles, and dissemination methods.

4.3.4.1. Continuous Improvement: Gather and analyze user feedback to identify areas where learning solutions can be refined to improve user comprehension and operational accuracy.

4.3.4.2. Maintain force development product repositories and authorized dissemination platforms to ensure accessibility, version control, and currency.

4.3.4.3. Track training publication status, feedback, and available completion or compliance information to evaluate force development effectiveness and identify improvement actions.

4.3.4.4. Develop distribution guidance for force development products, including release timing, intended audiences, and dissemination channels.

4.4. Process Improvement and Modernization

The contractor shall document workflows, assess performance gaps, define requirements, and execute government-directed process improvement modernization activities that improve medical readiness operations

4.4.1. Identify, prioritize, scope, plan, and execute government-directed process improvement opportunities across N10D mission areas.

4.4.2. Document current-state and future-state workflows, decision points, roles, dependencies, business rules, pain points, and handoffs across N10D mission areas.

4.4.3. Leverage subject matter expertise to develop and apply standardized methodologies, tools, and templates to improve consistency, repeatability, and transparency across process improvement efforts.

4.4.4. Plan, coordinate, and execute activities that advances process modernization efforts, including on-site assessments and external stakeholder collaboration when required.

4.4.5. Produce leadership briefings and communications on process improvement efforts that summarize status, milestones, risks, issues, dependencies, decisions, and recommended next steps.

4.5. Clinical, Business, and Operational Advancement

The Contractor shall execute business and operational activities that advance N10D lines of effort, including initiative intake, scoping, prioritization support, action routing, risk tracking, drafting strategic planning products, knowledge management, and logistical coordination for daily operations and governance.

4.5.1. Draft, proofread, and format formal memos, instructions, and letters. The Contractor shall manage the "chop" process (routing for signature), tracking the status of packages through the directorate and higher headquarters.

4.5.2. Develop annual strategies and accompanying Plans of Action and Milestones for government review, track execution against operational metrics and measures of effectiveness, and identify opportunities to improve efficiency and outcomes.

4.5.3. Produce executive briefing materials and coordinate recurring, periodic, and ad hoc N10D collaboration activities, including action tracking, risk logging, and external coordination support to inform enterprise-level medical readiness decision making.

4.5.4. Plan, coordinate, and execute conferences that convene clinical, administrative, and operational subject matter experts to improve medical readiness process and alignment.

4.5.5. Have and maintain access to Enterprise Task Management System 2 system, create tasker packages and update tasker statuses and packages accordingly in a timely manner.

5. Pertinent Information Acronyms—

5.1. Acronyms—

5.2. Period of Performance— Period of Performance—The base period of performance for this requirement is 1 October 2026 - 30 September 2027. The resultant contract will feature 2 one year and 1 six-month option periods.

5.3. Place of Performance— Place of Performance— All work shall be conducted in accordance with the requirement of the government office program or project supported. The estimated ratio of on-site (Government facility) to off-site (Contractor facility) work is listed below; however, this could fluctuate in accordance with the requirements of the government project, office, or program supported:

On-site location is identified as Bureau of Medicine and Surgery (BUMED) located at 7700 Arlington Blvd Falls Church, VA 22042. The normal hours of operation at BUMED will typically be from Monday to Friday 0600 to 1800, but hours may flex given global communication requirements across various time zones. The contractor will not provide services outside the times noted unless given approval and directed by the government.

5.4. Level of Effort—

Level I (Entry/Junior) Less than 5 years’ experience Requires a Bachelor’s Degree and 0-5 Years of experience in the field or in a related area. Has knowledge of commonly used concepts, practices, and procedures within a particular field or related area. Primary job functions do not typically require exercising independent judgment. Works under general supervision; typically reports to a supervisor or manager.

Level II (Intermediate) 5-12 years’ experience Bachelor’s Degree Required (Master’s preferred); at least 5-12 Years of experience in the field or in a related area. Familiar with a variety of commonly used concepts, practices, and procedures. Relies on extensive experience and judgement to plan and accomplish goals. May lead and direct the work of others. May report to a supervisor or manager.

Level III (Senior) More than 12 years’ experience Master’s degree required and may require a PhD; at least 12 Years of experience in the field or in a related area. Familiar with a variety of commonly used concepts, practices, and procedures. Relies on extensive experience and judgement to plan and accomplish goals and independently performs a wide range of complicated tasks. May provide consultation on complex projects and is considered to be the top level contributor/specialist. May lead and direct the work of others. May report to an executive or director.

5.5. Minimum Qualifications—

5.5.1. Communications Analyst: Manages internal communications between stakeholders. Develops effective communication strategies. Drafts content for mass release between various departments. Assists in communication of strategies or messages from senior leadership. Liaise with various stakeholders in regards to multiple issues.

5.5.2. Performance Management/Metric Analyst: Provides analytical management assistance by planning, coordinating and directing programs, conducting surveys and studies, and special projects. Performs responsible administrative research and analyses and provides recommendations. Establishes, defines, and standardizes performance metrics, service level agreements (SLAs), and operational key performance indicators (KPIs). Gathers quantitative and qualitative data from multiple mission systems, performs statistical trend analysis, and conducts root-cause evaluations on performance gaps. Designs, builds, and maintains interactive enterprise-level business intelligence (BI) dashboards to visualize real-time mission readiness and project status. Generates executive summaries, recurring status reports, and structured briefings to present actionable optimization recommendations to senior leadership. Partners with project managers and technical teams to conduct workflow assessments, applying methodology to streamline complex organizational structures.

5.5.3. Program Manager: Serves as the contractor's single contract manager, and shall be the contractor's authorized interface with the Government Contracting Officer (CO), the contract level Contracting Officer's Representative (COR), government management personnel and customer agency representatives. Responsible for formulating and enforcing work standards, assigning contractor schedules, reviewing work discrepancies, supervising contractor personnel and communicating policies, purposes, and goals of the organization to subordinates. Shall be responsible for the overall contract performance and shall not serve in any other capacity under this contract.

5.5.4. Project Manager: Responsible for the overall management of the specific task order(s) and insuring that the technical/financial solutions and schedules in the specific delivery orders are implemented in a timely manner. Organizes, directs and coordinates the planning and production of all activities associated with assigned delivery order projects. Demonstrates competent writing and oral communication skills. Ensures quality products and services and delivered.

5.5.5. Policy Analyst: Responsible for supporting and assisting with research, development, drafting, or review of various studies, assessments, policies, regulations, and reports. Gathers and analyzes information from various sources to support decision-making, resource allocation, or policy goals.

5.5.6. Senior Health Policy Analyst: Provides high-level analysis and technical writing support for the development and revision of federal healthcare policy. Gathers and analyzes information from various sources to support decision-making and policy goals. Relies on extensive experience in military health systems to assist the Government in drafting complex policy and procedural documentation.

5.5.7. Senior Medical Compliance Analyst: Provides technical analysis and logistical support to assist the Government in monitoring the compliance of global medical IT programs. Conducts site assessments, compiles technical findings, and drafts proposed policy updates for Government review.

5.5.7.1. Niche Technical Requirement: Must possess at least 3 years of direct, hands-on experience supporting the Educational and Developmental Intervention Services (EDIS) program, to include conducting site compliance assessments and mapping system data structures.

5.5.8. Senior Data Migration Specialist: Provides technical expertise focused on the decommissioning of legacy IT systems and the secure migration of data. Extracts, formats, and validates data from disparate sources to support the consolidation of readiness information. Develops technical documentation to assist the Government in drafting data migration plans and roadmaps.

5.6. Government Furnished Equipment/Property/Information—

The Government will supply office supplies, computer and equipment, telephone, and reproduction resources when the contractor is working on-site to the extent permitted by the Government and contractor. If the contractor is working off-site, he/she will be permitted to have GFE should determination between the client and the contractor deem it is in the best interests to do so (e.g. need for routine access of network shared drives or access to data in secured servers are necessary for duties). For contractors not eligible for GFE, Common Access Card enabled card readers may be provided by the contractor for access to pertinent sites.

5.7. Security Requirements— Contractor personnel performing work under this contract must have a successful adjudicated Tier 3 (previously the National Agency Check with Agency Check and Credit Check [NACLC]) or Tier 3-R (previously the Access National Agency Check and Inquiries [ANACI]) background investigation per SECNAV M5510.30. Contract personnel who have access to non-critical sensitive information, such as personally identifiable information (PII) and protected health information (PHI), or are in Information Technology II positions require a Favorable Background Investigation completed on an SF86.

5.8. Travel—

The estimated travel requirements are as follows. The estimated travel cost per contract period is not-to-exceed $35,000 (not including applicable indirect costs).

5.9. Other Direct Costs (ODCs)— There is no estimated ODC requirements.

6. List of Deliverables Deliverables shall be prepared according to instructions as identified in the Contract Data Requirements List (CDRL) DD Form 1423 (attached).

A summary of the deliverables is as follows:

7. Performance Standards

8. Points of Contact

TBD

9. Privacy Information Personally Identifiable Information, Protected Health Information, and Federal Information Requirements (Revised 16 July 2025) Overview This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act) as amended, The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019, and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007; SECNAVINST 5211.5F, DON Privacy Program.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach, and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Bureau of Medicine and Surgery (BUMED) Privacy and Civil Liberties Office (N61) is the BUMED Privacy and Civil Liberties Office for Navy Medicine. The BUMED Echelon II Command Information Officer (CIO) is the senior proponent for the HIPAA Privacy and Security Officer functions across the Navy Medicine enterprise.

Defense Health Agency (DHA) Privacy and Civil Liberties Office (PCLO) is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office is the HIPAA Privacy and Security Officer for DHA components and Military Health System (MHS).

Records Management

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the SECNAV M-5210.1, Department of Navy (DON) Records Management Program.

Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the BUMED FOIA Officer for evaluation/action:

The Contractor shall inform DoD stakeholders that BUMED FOIA procedures require a written request preferably sent via the DON FOIA Portal at: www.securerelease.us. However, requesters may also submit requests via email at usn.ncr.bumedfchva.mbx.foia-bumed@health.mil or via postal delivery addressed to the BUMED Medical-Legal Affairs Office, Attn: FOIA, 7700 Arlington Boulevard, Suite 5124, Falls Church, Virginia 22042-5124. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking BUMED procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by BUMED, the Contractor shall act as quickly as possible and respond to BUMED within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents, and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of BUMED records and, specifically, all requests that reference FOIA shall be immediately forwarded to BUMED, Attention: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between BUMED contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the BUMED Medical-Legal Affairs FOIA Office. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the BUMED FOIA Officer or the Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

Systems of Records In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the BUMED Contracting Officer (CO) systems of records that are or will be maintained or operated for the Department of Navy (DON) where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the Contracting Officer, and prior to the lawful operation of such systems, the Contractor shall coordinate with the BUMED Privacy Office at usn.ncr.bumedfchva.list.bumed-privacy@health.mil to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the BUMED Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the BUMED Privacy Office of changes in systems of records or their use that may require a change in the SORN.

Privacy Impact Assessment (PIA)

If Department of Defense (DoD) data is stored on a Contractor owned system, a PIA is required from the Contractor, consistent with DoDI 5400.16, Privacy Impact Assessment (PIA) Guidance. All PIAs shall be coordinated with the BUMED Privacy Office for review and coordination with the applicable Authorizing Official (AO).

Data Sharing Agreement (DSA)

(Applies if contract requirements involve the use of DoD data (including PII/PHI, a limited data set, or de-identified data) under the custodial care of BUMED.

The Contractor shall consult with the BUMED Privacy Office to determine if the Contractor must obtain Data Sharing Agreement (DSA) or Data Use Agreement (DUA), when DoD data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances. Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the Defense Health Agency (DHA) Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the BUMED Privacy Office if the system is a Navy Medicine owned and managed system, while data required from DHA managed systems require coordination with the DHA Privacy and Civil Liberties Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of Navy Medicine data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the BUMED Privacy Office or the DHA Privacy Office as applicable.

(Applies if contract requirements may include human subject research)

This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the BUMED Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

Privacy Act and HIPAA Training

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with BUMED’s PII or PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the BUMED Fiscal Year Training Plan assigned to the employee.

HIPAA Business Associate Provisions

Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and BUMED meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and BUMED is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, which may be acquired from the BUMED Privacy Office at email: usn.ncr.bumedfchva.list.bumed-privacy@health.mil or the Medical-Legal Affairs Office (BUMED N00J).

Breach Response

Definitions Related to Breach response

Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI). DoD 5400.11-R, “DoD Privacy Program,” May 14, 2007, defines a breach as the “actual or possible loss of control, unauthorized disclosure, or unauthorized access of personal information where persons other than authorized users gain access or potential access to such information for other than authorized purposes where one or more individuals will be adversely affected.

The Contractor shall adhere to the reporting and response requirements set forth in the DoDM 5400.11, Volume 2 DoD Privacy and Civil Liberties Programs: Breach Preparedness and Response Plan, 6 May 2021; SECNAVINST 5211.5F, “DON Privacy Program,” May 20, 2019; BUMEDINST 5363.1C,“BUMED Privacy and Civil Liberties Program”; DoDM 6025.18 “Implementing HIPAA Privacy Rule in DoD Health Care Programs”, March 13, 2019; and DON CIO Memo, Defense Privacy Information Management System (DPIMS), 11 July 2023

A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether unauthorized access to the PII/PHI has occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as…