DRAFT PWS 5JAN22.docx

W81K04-18-C-0001 P00015

PWS DATED: 01/05/22

Performance Work Statement (PWS) Training, Maintenance, and Administrative Support Services for Regional Training Site – Medical (RTS-MED) Revised: 01/05/22

1. General. The contractor shall provide non-personal operations and training services in support of the United States Army Reserve (USAR) Regional Training Site – Medical (RTS-MED). The Government shall not exercise any supervision or control over the contract service providers (CSPs) performing the services herein. Such CSPs shall be accountable solely to the contractor, who in turn is responsible to the Government.

1.1. Background.

1.1.1. The RTS-MED is a program with training facilities equipped to provide and support collective and individual training to medical units and personnel. The RTS-MED program is responsible for training reserve component medical units, other Army components, joint medical units, and civil authorities in disaster assistance and response to weapons of mass destruction. The three primary sites are Camp Parks CA, which includes the sub-site at Fort Hunter-Liggett CA; Fort Gordon GA; and Fort McCoy WI. The term “RTS-MED” refers to these three primary sites. When referencing a specific site or one of the supported sites, they will be referred to by their location (e.g., “RTS-MED Camp Parks”). Each RTS-MED site is staffed by a military Site Director (SD), a military clinical coordinator, and four Department of Army civilians responsible, respectively, for training, logistics, maintenance and administration.

1.1.2. RTS-MED training and support is guided by the Sustainable Readiness Model (SRM), formerly Army Force Generation (ARFORGEN) model. SRM centers on task proficiency and applies to all echelons of the Army. The Standard Decisive Action Mission Essential Task List (METL) for medical units serves as the guide to ensure medical unit Commanders are supported in meeting their Objective Task Evaluation Criteria Matrix (Objective-T) Aim Points as they move through the SRM Cycle in their Prepare 2 (formerly TR1), Prepare 3 (formerly TR2) and Prepare 4 (formerly TR3) years.

1.1.3. The RTS-MED provides training services to all types of USAR medical units and to military services’ Active, National Guard, and Reserve units. However, the priority remains the USAR medical units. RTS-MED enhances the readiness of USAR and other DoD personnel and units through integrated clinical and tactical training.

1.2. Scope. The contractor shall provide all personnel, supplies, material, tools, equipment, and services except for those identified in Section 3, Government-Furnished Property, necessary to provide operations and training services as defined in this PWS. This scope includes the current state of operations and facilities as well as the future state of operations and facilities as may be achieved based on RTS-MED program changes.

1.3. Quality Control.

1.3.1. The contractor shall maintain a Quality Control Plan (QCP), to include performance metrics, which demonstrates how the contractor intends to ensure quality performance during the contract period of performance. The contractor shall submit the QCP to the contracting officer (KO) and contracting officer’s representative (COR)/Alternate COR (ACOR) no later than (NLT) 30 days after contract award for government review. The contractor shall update/revise the QCP, as necessary, and submit the updated/revised QCP to the KO, COR and ACOR not later than seven (7) business days for review/comments prior to implementation. The QCP shall be incorporated into the contract by reference as a compliance document.

1.3.2. Quality Control Inspection Report. The contractor shall submit a quarterly written report to the COR not later than three days prior to the quarterly review/quality meeting. The report shall detail the contractor’s quality inspection results and actions.

1.4. Quality Assurance (QA). The Government will evaluate the quality of the Contractor’s performance under this contract. In its assessments, the Government may use a wide variety of evaluation methodologies, to include but not limited to those in the Government’s Quality Assurance Surveillance Plan (QASP). In addition, the Government will record formal reports on the contractor’s performance in the Contractor Performance Assessment Reporting System.

1.5. Post Award Conference/Periodic Progress Meetings. The contractor shall attend the post award conference convened by the contracting activity or contract administration office in accordance with (IAW) Federal Acquisition Regulation (FAR) Subpart 42.5. The KO and COR may meet periodically (but not less than quarterly) with the contractor to review the contractor’s performance. At these meetings, the KO will apprise the contractor of how the government views the contractor’s performance and the contractor will apprise the government of issues/concerns, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

1.6. Hours of Operation. The contractor shall provide administrative support services during normal operational hours (0730-1630 local time) at each specific RTS-MED site, Monday – Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies or inclement weather.

1.6.1. After-Hours Operations. The contractor shall regularly provide services outside of normal operational hours to support various training requirements, exercises, etc. The contractor shall maintain CSP work schedules on the RTS-MED Sharepoint tool and update the schedules, at a minimum, weekly.

1.7. RECOGNIZED HOLIDAYS. Services are not required on the following federal holidays. The contractor shall comply with holiday administration as required by applicable wage determinations and/or collective bargaining agreements.

New Year’s Day, January 1st Martin Luther King’s Birthday, 3rd Monday in January Presidents’ Day, 3rd Monday in February Memorial Day, last Monday in May Juneteenth, June 19th Independence Day, July 4th Labor Day, 1st Monday in September Columbus Day, 2nd Monday in October Veteran’s Day, November 11th Thanksgiving Day, 4th Thursday in November Christmas, December 25th

1.8. Place of Performance. Services shall be performed primarily at Camp Parks CA, which includes the sub-site at Fort Hunter-Liggett CA; Fort Gordon GA; and Fort McCoy WI. Split-based operations for Ft. Hunter Liggett during Warrior Exercise (WAREX) and Combat Support Training Exercise (CSTX) are required at Camp Parks, and may be required at Camp Roberts and/or Camp San Luis Obispo, CA. Exercise locations may change based on mission requirements.

1.9. SECURITY.

1.9.1. Security Policy and Procedures. All CSPs shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures of RTS-MED sites.

1.9.2. For access to the applicable installations, CSPs shall provide all information required to meet all installation access requirements to the COR. The documents will be forwarded to the installation Provost Marshal Office or RTS-MED Security Office to be processed by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. The CSPs shall comply with all personal identity verification requirements as directed by DoD, Headquarters Department of the Army (HQDA), Headquarters Air Force and/or local policy in addition to the changes otherwise authorized by the changes clause of this contract. Should the Force Protection Condition (FPCON) at any individual facility or installation change, the government may require changes in contractor security matters or processes.

1.9.3. CSPs shall comply with the requirements of AR 380-10 (Foreign Disclosure and Contacts with Foreign Representatives), Army Regulation (AR) 380-5 (Information Security Program), DOD 5220.22–M (National Industrial Security Program Operating Manual), and any revisions to DOD 5220.22-M.

1.9.4. CSPs shall provide all information required for background checks to meet installation access requirements to be accomplished by the Installation Director of Emergency Services or Installation/Unit Security Office. CSPs must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. CSPs shall also comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-111) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable RTS-MED, installation, facility and area commander installation/facility access and local security policies and procedures. The Government may require monthly participation in the Installation Random Antiterrorism Program.

1.9.5. For contractors requiring Common Access Card (CAC). Before CAC issuance, the CSP requires, at a minimum, a favorably adjudicated Tier 1 (T1) or higher investigation IAW Army Directive 2014-05. The CSP will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the Federal Bureau of Investigation fingerprint check and a successfully scheduled T1 at the Office of Personnel Management. A T1 represents the type of background investigation to be conducted for this effort. A T1 is required for each CSP to access the DOD computer network.

1.9.5.1. The preferred method for the submission of fingerprints is via digital fingerprint machine through the Defense Manpower Data Center (DMDC) Secure Web Fingerprint Transaction (SWFT +) System. Digital fingerprints may be submitted at Army security offices. If digital fingerprints are not possible, a candidate must submit ink prints on the Standard Form (SF) 87 Finger Print Card. The use of hard copy fingerprint cards will delay the security review. The preparation and submission of the T1 shall be at the expense of the Government, upon commencement of services. The contractor shall advise their employees that a positive report is needed as a condition of employment under this contract. If the results of the T1 investigation result in derogatory findings, the Contractor shall be responsible for and pay all costs associated with the T1 investigation; the Government will not reimburse such costs.

1.9.6. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and TSDB (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative).

1.9.7. The contractor shall brief CSPs on the local iWATCH program (training standards provided by the requiring activity ATO). This Government developed training informs employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 45 calendar days of contract award and within 30 calendar days of new CSPs commencing performance, with the contractor reporting the results to the COR NLT 45 calendar days after contract award.

1.9.8. The contractor shall provide a contractor personnel report listing CSPs by name, site, position, and security clearance level. This report shall be provided to the COR in .xls or .csv format by the conclusion of the transition period and semi-annually thereafter.

1.9.9. The CSP operating contractor or personal vehicles on Federal property shall possess an operator's license for the category of vehicle being operated and automobile insurance as required by regulations/laws governing said Federal property. Privately owned and contractor vehicles are subject to being searched pursuant to applicable regulations.

1.9.10. Security of Classified Items, Systems, and Information. The contractor, as a general rule, shall not have access to classified information; however, should classified documents fall into the possession of the contractor, the contractor shall immediately contact the COR for disposition instructions.

1.9.11. Physical Security. The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. The contractor shall ensure a program is in place for site physical security, including checklists, telephone points of contact, etc. The contractor shall ensure all doors, windows, and gates are locked and checklists completed daily, and ensure all automation equipment is secured and turned off as appropriate. The contractor shall ensure that Government facilities, equipment, and materials are secured IAW AR 190-13 (The Army Physical Security Program); AR 190-16 (Physical Security), and AR 190-51, Security of Unclassified Army Property (Sensitive and Non-sensitive), daily at 1630 hours or upon conclusion of scheduled training, whichever is later.

1.9.12. The contractor shall maintain a physical security plan IAW AR 190-13, AR 190-16, AR 190-51, Installation/Garrison Standard Operating Procedure (SOP), and RTS-MED Site SOP to ensure protection of site personnel and the Government Furnished Property (GFP), facilities and supplies. The contractor shall maintain an activity security checklist using SF 701, Activity Security Checklist, for each individual facility as part of the Contractor’s Physical Security Plan.

1.10. Key Control.

1.10.1. The contractor shall maintain the approved key (the term “key” includes key cards) control procedures for all keys issued to the contractor by the government (see Exhibit H, Government Furnished Keys). The contractor shall orally report to the SD, not later than one hour after discovery, any lost, stolen or duplicated keys; and this oral notification shall be followed by a written report to the COR within 24 hours of discovery. If lost during hours when the SD is not available, the oral report shall be given to the applicable Administrative Officer of the Day (AOD), and followed the next business day with a written report to the COR.

1.10.2. In the event keys, other than master keys, are lost, stolen, or duplicated the contractor shall, upon direction of the KO, reimburse the Government for the cost to re-key or replace the affected lock or locks. The government may re-key or replace the affected lock or locks, at its option. In the event a master key is lost, stolen, or duplicated, all locks and keys for that area shall be replaced by the government and the cost may be charged to the contractor if determined the contractor is at fault. The contractor shall reimburse the government IAW FAR 52.245-1.

1.10.3. The contractor shall prohibit the use of government-issued keys by any persons other than CSPs. The contractor shall prohibit the opening of locked areas by CSPs to permit entrance of persons other than CSPs engaged in the performance of assigned work in those areas or personnel authorized entrance by the COR.

1.10.4. Lock Combinations. The contractor shall implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

1.10.5. The contractor shall be responsible for physical security in buildings and at the RTS-MED sites they occupy, and shall maintain a key control plan. The contractor shall comply with applicable installation and facility security requirements.

1.11. Data Rights. The Government has unlimited rights for all data first produced in the performance of this contract, to include form, fit, and function data delivered under this contract; data that constitute manuals or instructional and training material for installation, operation, or routine maintenance and repair of items, components, or processes delivered or furnished for use under this contract, and all other data delivered under this contract unless provided otherwise in the contract.

1.12. Trusted Associated Sponsorship System (TASS).

1.12.1. The contractor shall comply with agency personal identity verification procedures that implement Homeland Security Presidential Directive-12, Office of Management and Budget guidance M-05-24, and Federal Information Processing Standards Publication Number 201.

1.12.2. The contractor shall comply with agency personal identity verification procedures in all subcontracts when the subcontractor is required to have physical access to a federally-controlled facility or access to a Federal information system

1.12.3. The contractor shall ensure compliance with the provisions set forth below. For purposes of FAR 52.204-9, the government will designate a Trusted Agent (TA) for this contract. The government reserves the right to amend or supplement these provisions pursuant to the changes clause in the contract.

1.12.4. The contractor is responsible for absences of CSPs due to expired identification and access documents. Such absences shall not relieve the contractor of its obligation to perform the services required under this contract.

1.12.5. The government will sponsor the CSPs for an Enterprise email account. All CSP email addresses will identify them as a contractor and use the format firstname.middleinitial.lastname.ctr@mail.mil. The enterprise email account will be discontinued by the government when the CSPs no longer require access.

1.12.6. The Government TA will send a notice through the TASS to the e-mail address provided IAW the above requirement. The CSP’s user ID and password will be provided in the email and shall require a change at first log-in. In the event the e-mail message is not received the contractor may request the username and password from the TA and proceed to the website https://www.dmdc.osd.mil/tass to complete the process.

1.12.7. The CSP shall log into the TASS and complete the verification process by submitting the application back to the TA for approval.

1.12.8. The application will be accepted, returned, or rejected by the TA. Notice as to whether the application has been accepted, returned or rejected will be provided to the individual's e-mail address provided within 48 hours after submission. If the application is returned or rejected, the CSP shall contact the TA and comply with the TA's guidance to attempt to correct and resolve the issues.

1.12.9. Upon approval of the application, the CSP shall receive an e-mail sent to the address provided stating the CAC application was approved. The applicant must then go to a RAPIDS Issuing Facility to have the government credential issued. The CSP must present two acceptable forms of ID which include: Driver's License, Military ID, Contractor Company ID with picture and expiration date, charge card with picture imprinted, or passport.

1.12.10. Revalidation Requirements. The TA is required to revalidate all CSPs, in the TASS, every 180 days. In the event revalidation is denied, the CAC credentials shall be revoked and the CAC will not be useable to login.

1.12.11. Out-processing Requirements. When a CSP's performance under this contract ceases, the CSP shall personally bring the CAC to the TA and complete the Department of the Army (DA) Form 2962. The TA will revoke the CAC from the TASS.

1.13. INFORMATION ASSURANCE, SECURITY, AND CONFIDENTIALITY

1.13.1. Contract service providers will be issued a CAC which is required for access to government information systems. This must be acquired within 90 days of hiring.

1.13.2. The contractor shall comply with all applicable DoD security regulation and procedures during the performance of this contract. The contractor shall not disclose and must safeguard procurement sensitive information, computer systems and data, Privacy Act (PA) data, and Government personnel work products obtained or generated in the performance of this contract.

1.13.3. Certain data may be collected and analyzed as a component of the requirement. Such data shall be stored electronically in a secure manner to prevent disclosure to unauthorized parties, and for the purpose of making such data available by the government as needed.

1.13.4. Army Training Certification Tracking System (ATCTS). All CSPs requiring network access to a government information system shall successfully register in ATCTS prior to CAC issuance. The ATCTS website for registration is located at https://atc.us.army.mil/iastar/registration.php. The contractor is responsible for maintaining an active database of CSPs’ ATCTS status and providing status to the COR, as requested.

1.13.5. DoD Information Assurance (IA) Awareness Training. All CSPs requiring a CAC (e.g., smart card) and government information system access shall successfully complete the DoD Information Assurance Awareness training at prior to CAC issuance then annually thereafter. The contractor shall access DoD Information Assurance Awareness Training at the Cyber Security Training Center website, “DoD Cyber Awareness Challenge Training @ https://ia.signal.army.mil/dodiaa. The contractor is responsible for maintaining an active database of CSPs IA training status and providing annual training certificates to the MTF-specific COR, as requested.

1.13.6. HIPAA and PA Training. All CSPs requiring government information system access shall successfully complete the MHS PA and Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security training prior to government information system access then annually thereafter. The contractor shall submit a copy of the PA and HIPAA course certificate along with the completed System Access Authorization Request (SAAR), DA Form 2875 and DoD IA Awareness training certificate to the COR for each affected CSP. The contractor is responsible for maintaining an active database of CSPs HIPAA and PA training status and providing annual training certificates to the COR, as requested. The course is accessible via Joint Knowledge Online (JKO). Please refer to the Joint Knowledge Online (JKO) instructions on accessing JKO.

1.13.7. In order to gain government information system access, the contractor shall complete a SAAR. The contractor shall submit a completed SAAR to the COR for all hosted applications required for the CSP to perform services. The COR shall coordinate the review/approval of the SAAR for contractor access for all requested hosted applications. The fillable PDF form is located http://www.dtic.mil/whs/directives/forms/eforms/dd2875.pdf.

1.13.8. All CSPs working IA/IT functions shall comply with DoD and Army training requirements in Department of Defense Directive (DoDD) 8570.01 (Information Assurance Training, Certification, and Workforce Management), DoD 8570.01-M (Information Assurance Workforce Improvement Program), and AR 25-2 (Information Assurance) within 30 days of start of performance.

1.13.9. Per DoD 8570.01-M, Defense Federal Acquisition Regulation Supplement 252.239.7001, and AR 25-2, the CSPs supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

1.14. Key Personnel.

1.14.1. Program Manager and Site Managers. The contractor shall designate a program manager responsible for overall contract performance. In addition, the contractor shall designate three site managers responsible, respectively, for the three primary sites. These four individuals shall have full authority to act for the contractor on all matters related to contract operations under their purview/at their site. The Program Manager shall be available by email and phone 24/7/365/366. The Site Managers shall be available on site during all hours of operation, and available by phone outside of the hours of operation 24/7/365/366 (see paragraph 1.5).

1.14.2. Notification. The contractor shall provide in writing to the KO and the COR, prior to contract start date, a list of the names and phone numbers of these four managers, along with the names and phone numbers of their alternates, if applicable. The contractor shall provide updates to this list, if the information changes, NLT 10 calendar days prior to the change.

1.15. Identification of Contractor Personnel. All CSPs attending meetings, answering government telephones, and working in other situations where the CSP’s status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. The contractor shall ensure that all documents or reports produced are suitably marked as contractor products, or that they properly disclose contractor participation.

1.16. Travel. CSPs shall travel within the Continental United States (CONUS), Hawaii, Alaska, Puerto Rico, and the U.S. Virgin Islands during the performance of this contract to attend meetings, conferences, and government provided training. CSPs shall travel to off-site training locations. The contractor shall provide a travel projection report, to include number of personnel and estimated costs to the SD and the COR on a quarterly basis.

1.16.1. The contractor shall coordinate all travel with the COR through the Site Director NLT 30 days prior to travel. Unapproved travel shall be the liability of the contractor. The Government will reimburse the cost of any required and approved travel under this contract, using the Joint Travel Regulation (JTR) as a guide for allowable costs and cost caps. Travel costs will be considered reasonable and allowable only to the extent that they do not exceed on a daily basis, the maximum per diem rates in effect at the time of travel as set forth in the JTR. The JTR, while not wholly applicable to contractors, provides the basis for the determination as to reasonable and allowable. Maximum use is to be made of the lowest available customary standard coach or equivalent airfare accommodations available during normal business hours. There may be circumstances when the JTR authorizes a discretionary travel and transportation expense, but the contract remains silent. In such circumstances, the expense is not allowable under this contract and will not be reimbursed.

1.16.2. The contractor shall submit to the COR monthly: 1) a projected travel report covering anticipated future travel and 2) an actual travel report covering travel in the past month. Both reports shall be submitted in .xls format to the COR NLT five business days after the end of the month. In addition, the contractor shall submit all travel vouchers/documents in the iRAPT (invoicing, Receipt, Acceptance, Property Transfer) system NLT 30 calendar days after the completion of travel. The following attachments shall be included with the travel vouchers/documents:

1.16.2.1. Copies of all lodging receipts, regardless of amount.

1.16.2.2. Copies of all airline tickets (counter or web–based) that includes cost, regardless of amount.

1.16.2.3. Copies of all car rental and gas receipts, regardless of amount. Gas reimbursement will be provided for the official temporary duty (TDY) travel only and includes travel to, in, and around the associated TDY area, and return to the airlines or permanent duty station. The Government will not reimburse gas costs for personal travel in conjunction with official travel.

1.17. The contractor shall maintain Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports. All records remain property of the government.

1.18. ADVERTISEMENT AND SOCIAL MEDIA. The contractor shall not post information to public website or social media locations, personal or professional, that in any way disclose names, locations, discussions, pictures before, during, or after contract period of performance without the express consent of the Government.

1.19. Inquiries. Contractor shall ensure that its personnel do not respond to any media inquiries. Any inquiries from the media shall be immediately relayed to the COR, who will relay them to the US Army Reserve Medical Command (ARMEDCOM) Public Affairs office. There shall be no interviews, comments, or any other response without the knowledge and approval of the ARMEDCOM Public Affairs office. Other than routine inquiries from external agencies, all other inquiries and complaints shall be brought to the attention of the COR.

1.20. SEXUAL HARASSMENT AND ASSAULT RESPONSE PROGRAM (SHARP).

1.20.1. The contractor shall comply with US Army Office of the Surgeon General (OTSG)/MEDCOM Policy Memos, Policy for Reporting Incidents of Sexual Assault and Sexual Harassment under the Sexual Assault Prevention and Response Program (SHARP) and with OTSG/MEDCOM Policies, Sexual Harassment/Assault Response and Prevention (SHARP) Program. The SHARP reporting requirements apply only to knowledge obtained by contractor personnel while performing services under this contract.

1.20.2. The contractor shall require all CSPs with knowledge of an incident of sexual assault occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours) report the incident in writing to the government's COR. This reporting policy also applies to sexual assault incidents involving MEDCOM personnel that occur on the contractor’s owned or leased facility under this contract. All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals, when the incidents occur on a Government facility or a Government leased facility.

1.21. EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE PROGRAMS.

1.21.1. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at https://oig.hhs.gov/exclusions/exclusions_list.asp, and the TRICARE Sanctioned Provider list at http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-Healthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

1.21.2. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the KO that the Contractor has queried the Lists and no such names appear on either of the Lists.

1.21.3. During performance of the contract, and prior to persons other than those whose names were queried IAW paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the KO that the names of such new persons do not appear on either of the Lists.

1.21.4. The Contractor is advised that during performance of the contract, the COR will perform recurring rechecks of the names of contractor personnel against the Lists, as specified in OTSG/MEDCOM Policy Memos. The Government will notify the Contractor in the event any contractor personnel appear on either of the Lists.

1.21.5. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the KO, and (b) promptly remove that person from the contract.

1.21.6. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

1.21.7. The Contractor is further advised that, IAW Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a-7a):

1.21.7.1. There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

1.21.7.2. Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person.

1.21.8. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at http://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

1.22. Non-Defense Health Agency (Non-DHA) Health Insurance Portability and Accountability Act (HIPAA) Business Associate Agreement (BAA) (7 July 2014)

Introduction

In accordance with 45 Code of Federal Regulations (CFR) 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a BAA between the signatory parties for purposes of the HIPAA and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

—Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other Personally Identifiable Information (PII) (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

—Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [insert name of Business Associate signatory to this BAA].

—Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

—Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [insert name of MHS component signatory to this BAA].

—DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate.

—DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD MHS. These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

—DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

—HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

—HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by HHS and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

—Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by the Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of the Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively), as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in the Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in the Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in the Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in the Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall provide the Business Associate with the NoPP that the Covered Entity produces in accordance with 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

If the DHA Privacy Office determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the DHA Privacy Office, regardless of whether the breach occurs at DHA or at one of the Service components. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office. The Business Associate shall contact the Covered Entity for guidance when the incident is not an HHS Breach.

This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response, the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals, and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business Associate shall implement these breach response requirements immediately upon the Business Associate’s discovery of a possible breach.

(b) Government Reporting Provisions

The Business Associate shall report the breach within one hour of discovery to the Covered Entity and to the US Computer Emergency Readiness Team (US-CERT) -the other parties as deemed appropriate by the Covered Entity. The Business Associate is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer or other agent of the Business Associate.

The Business Associate shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report/. Before submission to US-CERT, the Business Associate shall save a copy of the on-line report. After submission, the Business Associate shall record the US-CERT Reporting Number. Although only limited information about the breach may be available as of the one hour deadline for submission, the Business Associate shall submit the US-CERT report by the deadline. The Business Associate shall e-mail updated information as it is obtained, following the instructions at http://www.us-cert.gov/pgp/email.html. The Business Associate shall provide a copy of the initial or updated US-CERT report to the -Covered Entity and the applicable Service-Level Privacy Office, if requested by either. Business Associate questions about US-CERT reporting shall be directed to the Covered Entity or Service-Level Privacy Office, not the US-CERT office.

The additional US Army and MEDCOM reporting requirements are addressed in the PII Breach Reporting and Notification Policy. The latest version of this policy can be obtained from the Covered Entity or the MEDCOM Privacy Act/Freedom of Information Act Office at: usarmy.jbsa.medcom.list.medcom-foia-users@mail.mil . If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances. The Business Associate shall inform the Covered Entity as soon as possible if it believes that “single event” breach response is appropriate; the Covered Entity will determine how the Business Associate shall proceed and, if appropriate, consolidate separately reported breaches for purposes of Business Associate report updates, beneficiary notification, and mitigation.

When a Breach Report initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the Business Associate shall submit a revised form or forms, stating the updated status and previous report date(s) and showing any revisions or additions in red text. Examples of updated information the Business Associate shall report include, but are not limited to: confirmation on the exact data elements involved, the root cause of the incident, and any mitigation actions to include, sanctions, training, incident containment, follow-up, etc. The Business Associate shall submit these report updates promptly after the new information becomes available. Prompt reporting of updates is required to allow the Covered Entity to make timely final determinations on any subsequent notifications or reports. The Business Associate shall provide updates to the same parties as required for the initial Breach Report. The Business Associate is responsible for reporting all information needed by the Covered Entity to make timely and accurate determinations on reports to HHS as required by the HHS Breach Rule and reports to the Defense Privacy and Civil Liberties Office as required by DoD Privacy Act Issuances.

In the event the Business Associate is uncertain on how to apply the above requirements, the Business Associate shall consult with the Covered Entity (or the Service-Level Privacy…