FINAL_PWS_-_FY15_Blood_Testing_(8_May_14).pdf

Solicitation No. FA3010-14-R-0011 Attachment 1

8 May 14

Page 1 of 15 pages

PERFORMANCE WORK STATEMENT (PWS)

for

BLOOD TESTING SERVICES

Non-Personal Services

1. DESCRIPTION OF SERVICES AND GENERAL INFORMATION. The Contractor shall provide testing services for blood specimens provided by Keesler Medical Center (KMC) as required for Government beneficiaries at Keesler Air Force Base (KAFB), hereafter referred to as Keesler Donor Center. Performance shall be in accordance with (IAW) this Performance

Work Statement (PWS) and the professional standards, guidelines, and regulations of the AABB, the Food and Drug Administration (FDA), and the Joint Commission (JC).

1.1. SPECIFIC PROCEDURES FOR WHICH THE CONTRACTOR SHALL BE

RESPONSIBLE. As an accredited and affiliated member of the Armed Services Blood

Program (ASBP) responsible for supplying blood to soldiers, sailors, airmen, and marines deployed worldwide, the Keesler Donor Center conducts frequent blood drives. Specimens of each donated unit must be tested by an independent agency.

1.1.1. The Contractor shall provide shipping containers for specimens to be tested under

Enzyme-linked Immunosorbent Assay (EIA) protocols, Nucleic Acid Testing as required by the

FDA.

1.1.2. The Contractor shall provide transportation from the Keesler Donor Center in an adequate amount of time to ensure results are transmitted via File-Transfer-Protocol (FTP) to the

KMC no later than 1300 hours (1:00 p.m.) the following day. (Fax may be used in extreme circumstances).

1.1.3. Procedures for single unit donor testing shall include but are not limited to:

a. Hepatitis B Surface Antigen (HBsAg) by EIA.

b. Human Immunodeficiency Virus (HIV-1, HIV-2) antibody by EIA.

c. Human T-cell Leukemia Virus (HTLV-I, HTLV-II) antibody by EIA.

d. Hepatitis C Virus (HCV) antibody by EIA.

e. Hepatitis B Core (HBc) antibody by EIA.

f. Serological Test for Syphilis (STS): Automated MHA-TP.

g. Antibody Screen (Indirect Coombs Test).

h. ABO/Rh Typing.

i. CMV antibody (when requested).

Page 2 of 15 Pages

j. HCV, HBV, and HIV combined test by nucleic acid testing (NAT) (mini-pool donor, no greater than pools of 16).

k. West Nile Virus (WNV) by NAT (mini-pool donor, no greater than pools of 16).

l. Chagas Testing by Enzyme Linked Immunosorbent Assay (ELISA).

1.1.4. The Contractor shall provide confirmatory testing (if required) services either at the

Contractor testing facilities or other outside testing facility registered/licensed by the FDA. FDA and AABB regulatory agencies require confirmatory testing on any units that initially test positive. Time limit would differ for each individual confirmatory test, but results of these tests would need to be received no later than one week. The Contractor shall provide the Keesler

Blood Donor Center Officer in Charge (OIC) of the name, location, and license status of the outside confirmatory testing facility. The Contractor shall also provide a list of the confirmatory tests and methodology to be performed by the outside confirmatory testing facility.

1.1.5. The Contractor shall provide residual leukocyte testing services using an automated method in order to determine the amount of white blood cells per microliter in the sample. The result must be reported to Keesler Blood Donor Center within two working days of receipt of samples.

1.2. PROCEDURE GUIDANCE. Contractor technologists shall perform procedures compatible with the medical treatment facility’s (MTF) operating capacity and equipment. New medical procedures/services shall not be introduced without prior recommendation to, and approval of, the MTF Commander or Blood Donor Center OIC.

1.3. FDA MANDATES/INDUSTRY STANDARD CHANGES. In the event the FDA mandates or industry standards require additional testing or other processes relative to the collection and provision of blood products and this necessitates an increase in test or processing cost, an equitable adjustment will be negotiated between the Contractor and the Contracting

Officer (CO) prior to implementation.

1.4. COMMUNICATION GUIDANCE. Contractor personnel shall maintain open and professional communication with members of the MTF staff. Complaints validated by the

Contracting Officer’s Representatives (COR) or Functional Requirements Evaluator Designees

(FRED) shall be reported in writing to the contract administrator and the Contractor for action.

Failure of the Contractor to correct validated complaints raised by the MTF staff and the CO will be considered a failure to perform.

1.5. DOCUMENTATION GUIDANCE. Contractor personnel shall prepare all specimen and test result reports to meet or exceed established standards of the MTF, to include but not limited to, timeliness, accuracy, content, and signature.

1.6. CONTRACTOR PERSONNEL REQUIREMENTS.

1.6.1. Point of Contact (POC). The Contractor shall provide a POC that shall be responsible for the performance of the work. The POC shall have full authority to act for the Contractor on all matters relating to the daily operation of this contract. All information regarding donor testing

Page 3 of 15 Pages will be coordinated with the Chief of the Keesler Donor Center. All reference testing will be coordinated through the Chief, Transfusion Services, or designee. POC shall meet all requirements as stated in para 1.3. of this PWS.

1.6.2. Availability. The Contractor shall pick up donor specimens between 2000 hours (8:00 p.m.) and 2300 hours (11:00 p.m.) on Mondays through Fridays. Donor testing services may also be needed Saturdays and Sundays on an “on-call” basis. Reference specimens shall be picked up by courier on scheduled route. Pick-up location shall be Transfusion Services in the hospital laboratory.

1.6.3. Holidays. The Contractor is not required to provide routine donor testing services on the following Federal holidays (or the actual day set aside for observation): New Year’s Day, Memorial Day, Independence Day, Labor Day, Thanksgiving Day, or Christmas Day.

1.6.4. Continuity of Services. Failure to provide services may subject the Contractor to reimbursement of any additional cost incurred by the Government as a result of the Contractor’s failure to perform. In the event blood testing services cannot be performed, the Contractor shall promptly notify the Blood Donor Center OIC. The Keesler Donor Center retains the right to seek these services elsewhere should services not be provided by the Contractor.

1.6.5. English Language Requirement. All Contractor personnel providing services to KAFB shall read, understand, speak, and write English. Reports or reference laboratory testing data shall be submitted to the Government in English.

1.6.6. Level 1 Anti-Terrorism (AT) Awareness Training. Level I Anti-Terrorism (AT)

Awareness Training is available upon request and will be conducted by the Installation Anti-

Terrorism Officer (ATO). Contact the 81st Security Forces Squadron (81 SFS/S5X), at 228-376-

6623.

1.7. CONTRACTOR REQUIREMENTS.

1.7.1. Contractor Manpower Reporting. The Contractor shall report ALL Contractor labor hours (including subcontractor labor hours) for performance of services under this contract via a secure data collection site. The Contractor is required to completely fill in all required data fields at http://www.ecmra.mil. Reporting inputs will be for all labor executed during the performance for each Government fiscal year (FY) which runs 1 October through 30 September.

While inputs may be reported at any time during the FY, all data shall be reported no later than

31 October of each calendar year. Contractors may direct questions to the Contractor Manpower

Reporting Application (CMRA) help desk.

1.7.2. Security.

1.7.2.1. Security Clearance: National Agency Check With Written Inquiries (NACI). As a minimum, Contractor personnel shall successfully complete a NACI before operating

Government-furnished workstations that have access to AF automated information systems.

Requests for Contractor personnel hired at the beginning of the contract shall be submitted to the

Government not later than 45 workdays from the contract start date. Requests for Contractor http://www.ecmra.mil/

Page 4 of 15 Pages personnel hired subsequent to contract start date shall be submitted to the Government not later than ten (10) workdays from the Contractor personnel’s first duty day. Contractor personnel receiving unfavorable NACIs shall not be employed. The Government will submit requests for investigations on AF IMT 2583, Request for Personnel Security Action, at no additional cost to the Contractor. Any personnel with access to classified material will be submitted by the

Contractor’s Facility Security Officer (FSO) for a Secret security clearance. The Contractor shall comply with the requirements of DoD 5200.2-R, Personnel Security Program; AFI 31-501, Personnel Security Program Management, 25 Jan 05; and AFI 33-119, Air Force Messaging, 24

Jan 05.

1.7.2.2. Contractor personnel shall comply with the requirements of AFI 71-101, Volume 1, Criminal Investigations, 01 Dec 99, and AFI 71-101, Volume 2, Protective Service Matters, 18

Nov 02, para 1.1. These regulations require Contractor personnel to report any information or circumstances of which they are aware that may pose a threat to the security of DoD personnel, Contractor personnel, resources, and classified or unclassified Defense information to their immediate supervisor. The immediate supervisor of Contractor personnel will brief on this requirement during initial on-base assignment and as required thereafter.

1.7.2.3. The Unit Security Manager will assist the Contractor with any Joint Personnel

Adjudication System (JPAS) Joint Clearance and Access Verification System (JCAVS) and eQIP by Design information for inputting NACIs with assistance from 81 SFS/IP.

1.7.2.4. Security Monitoring. The Contractor shall comply with all security requirements.

Submit reports, classified if appropriate, of any information coming to their attention concerning any of their employees who have been cleared or are in the process of being cleared for access to classified information, which indicates that such access or determination may not be clearly consistent with the national interest. Reports shall be submitted to the Defense Industrial

Security Clearance Office (DISCO) immediately upon notification of any adverse information, change in employee’s status, official investigation, or any other reason. In addition, a copy of this report shall be furnished to the contract Contracting Officer’s Representative(s) (COR(s))

(see para 1.10., Quality Assurance) and 81 TRW Installation Commander (81 TRW/CC).

1.7.2.5. Listing of Employees. The Contractor shall maintain a current listing of all Contractor personnel. The list shall include Contractor personnel’s names, Social Security numbers, and level of security clearance. The list will be validated and signed by the FSO and provided to the

CO, COR, Base Visual Information Manager (BVIM), 81 SFS/IP, Unit Security Manager, and

FSO prior to the contract start date. Updated listings shall be provided when a Contractor personnel’s status or information changes. Documents will be marked as FOUO as a minimum.

1.7.3. Operational Security (OPSEC).

1.7.3.1. OPSEC Training.

1.7.3.1.1. New Contractor personnel shall complete “An Introduction to OPSEC” compact disc

(CD) provided by the 81 MDG OPSEC Coordinator, along with unit OPSEC in-processing training, within 30 calendar days of reporting for duty.

Page 5 of 15 Pages

1.7.3.1.2. All Contractor personnel shall complete annual refresher OPSEC awareness training provided by the 81 MDTS OPSEC Coordinator.

1.7.3.2. Disclosure of Information.

1.7.3.2.1. The Contractor shall not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document, etc.), pertaining to execution of any part of this contract or any program related to this contract, unless:

a. The CO, the MDTS Commander or OPSEC Coordinator has given prior written approval; or

b. The information is otherwise in the public domain before the date of release.

1.7.3.2.2. Requests for approval shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit the request to the CO, the 81 MDTS Commander or OPSEC Coordinator at least 45 days before the proposed date for release.

1.7.3.2.3. The Contractor agrees to include a similar requirement in each subcontract under this contract. Subcontractors shall submit requests for authorization to release through the prime

Contractor to the CO, the MDTS Commander or OPSEC Coordinator.

1.7.4. Safety.

1.7.4.1. Obligations. Contractors shall comply with the Occupational Safety and Health Act

(OSHA, Public Law 91-596) and the resulting standards, OSHA Standards 29 CFR 1910 and

1926. The detailed provisions of the act for accident prevention are directly applicable to all

Contractor operations. Prime Contractors are also responsible for ensuring any sub-contractors also adhere to OSHA Guidance. OSHA compliance officers visit Contractor worksites on the installation.

1.7.4.2. Responsibilities. Following is a list of responsibilities for Contracting, Contractor, and

Wing Safety personnel.

a. Contractor Responsibilities.

(1) Contractors are responsible for ensuring all industrial safety provisions are followed.

(2) Contractors must report all accidents involving Air Force people, property, or equipment damage, and any Contractor personnel injured in the performance of the Air Force contract to the CO.

(3) Take immediate corrective action to comply with safety regulations if informed of a violation by the CO.

b. Contracting Officer (CO) Responsibilities.

Page 6 of 15 Pages

(1) Inform Contractor of non-compliance with safety regulations, which may cause injury to Air Force personnel or property.

(2) Notify Wing Safety of any injuries or damage to AF property reported by the

Contractor, in performance of an Air Force contract.

c. Wing Safety Responsibilities.

(1) 81st Training Wing Safety Personnel will periodically monitor Contractor operations to ensure safety regulation compliance as it applies to Air Force personnel and equipment.

(2) Wing Safety personnel are available to the CO for technical assistance on matters pertaining to accident prevention.

(3) Notify the CO if a safety procedure or condition exists which requires correction by the Contractor.

1.7.4.3. Safety Rules. Contractors shall pay particular attention to the following safety rules and ensure strict compliance while on the installation.

a. General Safety Rules While on the Installation.

(1) Ensure adequate lighting and barricading is available and used for day and night operations.

(2) Use proper shoring during trenching operations.

(3) Post proper warning signs at indoor and outdoor operations.

(4) Secure materials when doing high work, during high winds, or when high winds are forecasted.

(5) Use warning signs, barricades, or flagmen when operations present a hazard to drivers, pedestrians, or workers.

b. Traffic Safety Rules While on the Installation. All drivers, mobile equipment, and vehicles must comply with applicable federal, state, and local laws.

(1) Seat belts are mandatory for all passengers as well as drivers

(2) An approved bicycle helmet is required to be properly worn while riding bicycles on the installation.

(3) Drive the speed limit:

(a) Speed limit for the base proper is 25 mph or as posted.

Page 7 of 15 Pages

(b) Speed limit in the housing areas is 15 mph.

(c) Speed limit in parking lots is 5 mph.

(4) Give full attention to the operation of the vehicle. Avoid operator distrations, such as using cellular phones, text messaging, etc. while operating a vehicle.

(5) Park in designated areas and IAW Keesler AFB Instruction (KAFI) 31-218, Installation Traffic.

(6) No riding in the beds of trucks, buckets of front end loaders, or tandem riding on vehicles designed for one-person operation.

(7) Use safety chains in addition to towing hooks when towing equipment.

(8) Place a light on the rear of equipment being towed during the hours of darkness.

(9) Mark overhanging portions of loads with warning flags or lights.

(10) When driving or using a crane or cherry picker, be cautious around power lines crossing the road and don't position booms closer than 10 feet to overhead high voltage lines.

(11) Ensure electrical work is IAW the National Electric Code.

(12) Upon encountering troop formations on the installation:

(a) Maintain 50-foot distance behind formations until signaled to pass by the troop commander. When signed to pass troop formation, do not exceed 10 mph while passing.

(b) When passing from the front, proceed without stopping, but slow to 10 mph while passing.

1.7.5. Conflict of Interest. The Contractor shall not employ any person who is an employee of the United States Government if the employment of that person would create a conflict of interest. The Contractor shall not employ any person who is an employee of the Department of the Air Force, either military or civilian, unless such person seeks and receives approval IAW

DoD Directive 5500.7-R, Joint Ethics Regulation (JER), 30 Aug 93 (incorporating through

Change 7, 17 Nov 11) and Air Force policy.

1.7.6. Testing Site Board Certification. The testing site shall meet or exceed all FDA Good

Manufacturing Practice guidelines and be in good standing with the FDA.

1.7.7. Licensure/Registration. The Contractor shall be, and shall remain, licensed by the FDA and the State in which they are located (if required to be licensed by state law) and shall be accredited by the AABB to operate as a blood center.

1.7.7.1. The Contractor shall ensure that personnel performing testing procedures in the performance of this contract possess required credentials commensurate with testing difficulty in compliance with the Clinical Laboratory Improvement Act of 1988 (CLIA).

Page 8 of 15 Pages

1.7.8. Performance Evaluation Meetings. The CO will require the Contractor to meet with the

CO, contract administrator, Functional Commander/Director (FC/D), and other Government personnel as often as deemed necessary. The Contractor may request a meeting with the CO when deemed necessary. Meetings shall be documented in the contract file with written minutes signed by the Contractor and the CO, or contract administrator. Should the Contractor not concur with the minutes, such non-concurrence shall be provided in writing to the CO within ten calendar days of receipt of the minutes.

1.7.9. Records. The Contractor shall create, maintain, and provide Government-owned/Contractor-held records, regardless of media, in performance of this contract IAW the following directives:

AFI 33-322, Records Management Program, 4 Jun 12 and AFGM2013-01, 9 May 13

AFMAN 33-363, Management of Records, 1 Mar 08 and AFGM2013-01, 29 Aug 13

AFI 33-364, Records Disposition—Procedures and Responsibilities, 22 Dec 06

Air Force Information Management System database (AFRIMS) (access through the Air

Force Portal at https://www.my.af.mil/afrims/afrims/afrims/rims.cfm

Air Force Electronic Records Management Solution

1.7.9.1. The Contractor shall segregate the Government-owned records from the Contractor-owned records and identify all records required to be created by the PWS on the AFRIMS file plans. The Contractor shall create and maintain paper and electronic records (\\52mahg-fs-106) as appropriate. The Contractor shall maintain the software and background data to retrieve official electronic Government records throughout the lifecycle of the records.

1.7.9.2. The Contractor maintains and disposes of records IAW the AF records disposition schedules.

1.7.9.3. Electronically Stored Information (ESI). The Contractor shall maintain Government owned electronic non-official records on the organizational shared network drive according the subjective categories (example: template, common, reference material, and working files).

Grant the base records manager access to all files located on the organizational shared network drive. The Contractor shall maintain the official electronic records on the base designated shared network drive (\\52mahg-fs-106) IAW the Air Force Electronic Records Management System and AFMAN 33-363, Chapter 6.

1.7.9.4. Upon completion of this contract, all Government-owned/Contractor-held records

(regardless of media) received, created, maintained, or provided in the performance of the PWS shall be turned over to the Government. Background electronic data and records specified for delivery to the contracting agency must be accompanied by sufficient technical documentation and software to permit the Air Force to use the data. In the event of default or non-performance, the Government will have access to all records in order to ensure mission support is not interrupted.

http://www.e-publishing.af.mil/shared/media/epubs/AFI33-322.pdf http://www.e-publishing.af.mil/shared/media/epubs/AFMAN33-363.pdf http://www.e-publishing.af.mil/shared/media/epubs/AFMAN33-363.pdf https://www.my.af.mil/afrims/afrims/afrims/rims.cfm

Page 9 of 15 Pages

1.7.9.5. Contractor-Owned Records. Maintain records that relate exclusively to the

Contractor’s internal business or are of a general nature not specifically related the performance of work under the contract separately from the Government-owned records.

1.7.9.6. Freedom of Information Act (FOIA) Program. The Contractor shall comply with the requirements of DoD 5400.7-R/AFMAN 33-302, Freedom of Information Act Program, 21 Oct

10, and IC1, 24 Apr 12. If the Contractor receives a FOIA request, the Contractor shall ensure it is delivered immediately to the base FOIA manager (81 CS/SCOK) for processing. The FOIA manager will task a Government official who, as the authorized official, will make the decision on releasing Government records.

1.7.9.7. Privacy Act Program. The Contractor shall create, maintain, and destroy Privacy Act data IAW AFI 33-332, The Air Force Privacy and Civil Liberties Program, 5 Jun 13; and Privacy

Act systems of records notice(s) (http://dpclo.defense.gov/privacy/SORNs/SORNs.html). The

Contractor shall not create or maintain a Privacy Act system of records prior to public notice. If the Contractor receives a Privacy Act request, the Contractor shall be responsible for searching for the records and providing those records to a Government official who, as the authorized official, will make the decision on releasing the Government records.

1.7.9.8. Functional Requests. A functional request is a written request for DoD records received from any person (including a member of the public), or a business that does not cite either the FOIA or Privacy Act. The Contractor shall be responsible for searching for the records and providing those records to a Government official who, as the authorized official, will make the decision on releasing the Government records.

1.7.9.9. For Official Use Only (FOUO). The Contractor shall create and maintain FOUO material. When documents containing FOUO material are authorized for destruction, shred the records so that the pieces can’t be reconstructed. Degauss or overwrite magnetic tapes or other magnetic medium.

1.7.10. Patient Lists. Patient lists, no matter how developed, shall be treated as privileged information. All personnel shall add “FOR OFFICIAL USE ONLY” in the header or top and the following statement at the footer or bottom: “The information herein is For Official Use Only

(FOUO) which must be protected under the Freedom of Information Act of 1996 and Privacy

Act of 1974, as amended. Unauthorized disclosure or misuse of this PERSONAL

INFORMATION may result in criminal and/or civil penalties.” Lists and/or names of patients shall not be disclosed or revealed in any way for any use outside the MTF without prior written permission by the Chief of Hospital Services.

1.7.11. Release of Medical Information. The Contractor shall release medical information obtained during the course of this contract to MTF staff involved in the care and treatment of that individual patient only.

1.7.12. Environmental Management System (EMS). All Contractor personnel shall complete

Environmental Management System (EMS) Awareness training prior to commencement of any activities. Training is available through the Air Force Advanced Distributed Learning Service

(ADLS), the Environmental, Safety and Occupational Health Training Network (ESOHTN), or through the Environmental Office (KBOS/CEV).

http://dpclo.defense.gov/privacy/SORNs/SORNs.html

Page 10 of 15 Pages

1.7.12.1. Products and Materials. Custodial cleaning products required in the performance of this PWS shall meet as a minimum, Green Seal Product Standards

(http://www.greenseal.org/certproducts.htm). If it is determined that a product does not meet

Government performance requirements, the Contractor shall submit a proposed alternative that would meet the performance requirements with the lowest environmental impact for evaluation and acceptance. Products that fall under the Environmental Protection Agency (EPA)

Comprehensive Procurement Guidelines (CPG) (http://www.epa.gov/cpg) shall meet the minimum recovered (recycled) content. Bio-based products shall be used upon issuance of the bio-based product listing from the United States Department of Agriculture (USDA)

(http://www.usda.gov). The Contractor shall purchase and use Energy Star or other energy-efficient items listed on the Department of Energy’s Federal Energy Management Program

(FEMP) Product Energy Efficiency Recommendations product list. Supplements or amendments to listed publications from any organizational level may be issued during the life of the contract.

Before implementing any change that will result in a change to the contract price, the Contractor shall submit to the CO a price proposal within 30 calendar days following receipt of the change.

1.7.13. Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA is comprised of several different sections, each to be implemented by the Department of Health and

Human Services. The medical facilities of the military services and the DOD health plans are specifically listed as covered by HIPAA. Currently, HIPAA Privacy and Security Rules, as set forth in the Code of Federal Regulations, are in effect for all medical treatment facilities (MTF).

The specific implementation of HIPAA Privacy for DOD MTFs is set forth in DOD 6025.18-R, and for HIPAA Security, the requirements for AF MTFs are contained in DOD 8580.02 -R and

AFI 41- 217, which also contains additional Information Assurance requirements for all AF

MTFs. DOD 6025.18-R, DOD 8580.02-R, and AFI 41-217 are incorporated herein by reference.

MTFs are responsible to ensure overall compliance with HIPAA requirements, which includes incorporation of certain requirements in contracts entered or amended after the respective implementation dates. IAW these regulations, the Contractor and its employees meet the definition of Business Associates; therefore, a Business Associate Agreement is required by law to comply with both the HIPAA Privacy and Security regulations. This clause serves as that agreement for each MTF, whereby the Contractor and its employees agree to abide by all HIPAA

Privacy and Security requirements regarding health information as defined in this clause, DoD

6025-18-R, DOD 8520.02-R, and AFI 41-217. Additional HIPAA requirements will be addressed when implemented.

a. Introduction.

(1) Definitions, as used in this clause, generally refer to the Code of Federal

Regulations (CFR) definition unless a more specific provision exists in DOD 6025.18-R, DOD

8520.02-R, or AFI 41-217.

(a) HITECH Act shall mean the Health Information Technology for Economic and Clinical Health Act included in the American Recovery and Reinvestment Act of 2009.

(b) Individual has the same meaning as the term “individual” in 45 CFR 164.50 1 and 164.103 and shall include a person who qualifies as a personal representative IAW 45 CFR

164.502(g).

http://www.greenseal.org/certproducts.htm http://www.epa.gov/cpg http://www.usda.gov/

Page 11 of 15 Pages

(c) Privacy Rule means the Standards for Privacy of Individually Identifiable

Health Information at 45 CFR part 160 and part 164, subparts A and E.

(d) Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 164.501, limited to the information created or received by the

Contractor from or on behalf of the Government.

(e) Electronic Protected Health Information has the same meaning as the term

“electronic protected health information” in 45 CFR 160.103.

(f) Required by Law has the same meaning as the term “required by law” in 45

CFR 164.501 and 164.103.

(g) Secretary means the Secretary of the Department of Health and Human

Services or his/her designee.

(h) Security Incident shall have the same meaning as the term “security incident” in 45 CFR 164.304, limited to the information created or received by Contractor from or on behalf of the Covered Entity.

(i) Security Rule means the Health Insurance Reform: Security Standards at 45

CFR part 160,162 and part 164, subpart C.

(2) Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR 160.103, 160.502, 164.103, 164.304, and 164.501.

(a) The Contractor agrees to not use or further disclose Protected Health

Information other than as permitted or required by the Contract or as Required by Law.

(b) The Contractor agrees to use appropriate safeguards to maintain the privacy of the Protected Health Information and to prevent use or disclosure of the Protected Health

Information other than as provided for by this Contract.

(c) The HIPAA Security administrative, physical, and technical safeguards in 45

CFR 164.308, 164.310, and 164.312, and the requirements for policies, procedures, and documentation in 45 CFR 164.316 shall apply to the Contractor. The additional requirements of

Title XIII of the HITECH Act that relate to security and that are made applicable with respect to covered entities shall also be applicable to the Contractor. The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(d) The Contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the

Contractor in violation of the requirements of this Contract.

Page 12 of 15 Pages

(e) The Contractor agrees to report to the Government any security incident involving protected health information of which it becomes aware.

(f) The Contractor agrees to report to the Government any use or disclosure of the Protected Health Information not provided for by this Contract of which the Contractor becomes aware.

(g) The Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the

Contractor on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(h) The Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(i) The Contractor agrees to provide access, at the request of the Government, and in the time and manner designated by the Government to Protected Health Information in a

Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(j) The Contractor agrees to make any amendment(s) to Protected Health

Information in a Designated Record Set that the Government directs or agrees to pursuant to 45

CFR 164.526 at the request of the Government or an Individual, and in the time and manner designated by the Government.

(k) The Contractor agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor on behalf of, the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner designated by the Government or the

Secretary, for purposes of the Secretary determining the Government's compliance with the

Privacy Rule.

(l) The Contractor agrees to document such disclosures of Protected Health

Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health

Information IAW 45 CFR 164.528.

(m) The Contractor agrees to provide to the Government or an Individual, in time and manner designated by the Government, information collected IAW this Clause of the

Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information IAW 45 CFR 164.528.

b. General Use and Disclosure Provisions. Except as otherwise limited in this

Agreement, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, IAW the specific use and disclosure provisions below, if such use or disclosure of Protected

Health Information would not violate the HIPAA Privacy Rule, DOD 6025.18-R, the HIPAA

Security Rule, or DOD 8580.02-R if done by the Government. The additional requirements of

Page 13 of 15 Pages

Title XIII of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to the Contractor.

c. Specific Use and Disclosure Provisions.

(1) Except as otherwise limited in this Agreement, the Contractor may use Protected

Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(2) Except as otherwise limited in this Agreement, the Contractor may disclose

Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(3) Except as otherwise limited in this Agreement, the Contractor may use Protected

Health Information to provide Data Aggregation services to the Government as permitted by 45

CFR 164.504(e)(2)(i)(B).

(4) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j) (1).

d. Obligations of the Government. Provisions for the Government to Inform the

Contractor of Privacy Practices and Restrictions.

(1) Upon request, the Government will provide the Contractor with the notice of privacy practices that the Government produces IAW 45 CFR 164.520, as well as any changes to such notice.

(2) The Government will provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor's permitted or required uses and disclosures.

(3) The Government will notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to IAW 45 CFR

164.522.

e. Permissible Requests by the Government. The Government will not request the

Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, DOD 6025.18R, the HIPAA Security Rule, or DOD

8580.02-R, if done by the Government, except for providing Data Aggregation services to the

Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

f. Termination.

Page 14 of 15 Pages

(1) Termination. A breach by the Contractor of this clause may subject the Contractor to termination under any applicable default or termination provision of this Contract.

(2) Effect of Termination.

(a) If this contract has records management requirements, the records subject to the Clause should be handled IAW the records management requirements. If this contract does not have records management requirements, the records should be handled IAW paragraphs (b) and (c) below.

(b) If this contract does not have records management requirements, except as provided in paragraph c) of this section, upon termination of this Contract, for any reason, the

Contractor shall return or destroy all Protected Health Information received from the

Government, or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health

Information.

(c) If this contract does not have records management provisions and the

Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

g. Miscellaneous.

(1) Regulatory References. A reference in this Clause to a section in DOD 6025.18-R, HIPAA Privacy Regulation, or DOD 8580.02-R, HIPAA Security Regulation, or any CFR or

AFI provision means the section as currently in effect or as amended, and for which compliance is required.

(2) Survival. The respective rights and obligations of Business Associate agreements under the "Effect of Termination" provision of this Clause shall survive the termination of this

Contract.

(3) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DOD 6025.18-R, the CFR HIPAA Privacy Rule, DOD 8520.02-R, the CFR HIPAA Security Rule, and AFI 41-217.

2. SERVICES SUMMARY.

Performance Objective PWS Paragraph Performance Measure

1. Duties performed in a professional and timely manner.

1., 1.1.2., 1.1.4., 1.1.5., 1.4., and 1.5.

No more than 2 complaints per month.

Page 15 of 15 Pages

2. Test results prepared and returned in a timely manner with no errors.

1.1.2, 1.1.4., 1.5. 100% accuracy rate.

3. Maintains open and professional communication and displays a positive/cooperative attitude.

1.4. No more than 2 valid

complaints per quarter.

2.1. The Contractor shall utilize their own internal quality control processes in the performance of this contract. The quality control plan and supporting documentation shall be made available to the Government for review upon request. The Government will periodically evaluate the

Contractor’s performance by appointing CORs and/or FREDs to monitor performance to ensure services are received. The CORs/FREDs will evaluate the Contractor’s performance through inspections of call logs and reports and will receive/investigate all complaints from base personnel. The Government may inspect each task as completed or increase the number of quality assurance inspections if deemed appropriate because of repeated failures or because of repeated customer complaints. Likewise, the Government may decrease the number of quality assurance inspections if performance dictates. The CO shall make final determination of the validity of customer complaint(s).

2.2. If any of the services do not conform with contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount. When the defects in services cannot be corrected by re-performance, the Government may:

a. Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements; and

b. Reduce the contract price to reflect the reduced value of the services performed.

3. GOVERNMENT-FURNISHED EQUIPMENT AND SERVICES. None.

3.1. CONTRACTOR-FURNISHED EQUIPMENT AND SERVICES. Except for those items or services specifically stated above to be Government-furnished, the Contractor shall furnish everything required to perform this contract IAW all of its terms.