Atch 2 USAFE Ambulatory Medical Coding Audit Services PWS_14 Mar 11.docx

Attachment 2

PERFORMANCE WORK STATEMENT

for

United States Air Forces in Europe (USAFE)

Ambulatory Medical Coding Audit and Training Services

14 March 2011

Table of Contents

1. DESCRIPTION OF SERVICES/GENERAL INFORMATION………………………………

2. SERVICES SUMMARY (SS)…………………………………………………………………...16

3. GOVERNMENT FURNISHED PROPERTY AND SERVICES……………………………

4. APPENDIX A – DEFINITIONS………………………………………………………….…….. 18

5. APPENDIX B – APPLICABLE MANDATORY PUBLICATIONS AND FORMS………

6. APPENDIX C – WORKLOAD DATA ESTIMATES…………………………………….……..21

7. APPENDIX D – SAMPLE TEMPLATES……………………………………………………… 22

1. DESCRIPTION OF SERVICES/GENERAL INFORMATION

1.1. The Contractor shall provide all labor, materials, transportation and equipment to provide the non-personal services of ambulatory medical coding auditing (MCA); to include coding auditing analysis, review and oversight of the billing process, training, and coding consultation to the United States Air Forces Europe (USAFE) staff, in accordance with (IAW) Government regulations and established medical nomenclature. Contractor shall execute required training, conduct ambulatory record coding audits, provide feedback to the staff, coordinate and implement data collection tool improvements, answer coding inquiries (local and remote), and provide guidance on coding complex ambulatory medical records. Medical Coding Auditors (MCAs) shall be required to code for specific patients (i.e. Third Party Collections, pay patients or complex cases). MCAs shall not audit records that they have coded.

1.1.1. Performance for this contract shall meet the standards and requirements contained in this PWS and all pertinent current Civilian and DoD Directives, to include the American Medical Association Coding Practices International Classification of Diseases (ICD-9-CM or current edition); Current Procedural Terminology (CPT); Evaluation and Management (E&M); Healthcare Common Procedure Coding System (HCPCS), Title 10 United States Code (USC) 1095, 32 CFR part 220; Health Insurance Portability and Accountability Act standards (HIPAA) enacted on August 21, 1996; AFI 41-210, Patient Administration Functions; applicable legislation regulating coding practices and AF Directives (see Appendix B).

1.2. Required Outcomes and Specific Tasks.

1.2.1. Coding Audits. Contractor audits shall be used to identify and execute required training needed to ensure compliance with Government accuracy standards following the Air Force Medical Support Agency (AFMSA) New Coding Audit Methodology. Contractor audits shall be based on correctly coded Standard Ambulatory Data Records (SADRS). Contractor shall document and report accordingly 100% of all coding inaccuracies. Contractor shall contact AFMSA for additional guidance, if required. The audit results shall be reported no later than (NLT) the 10th calendar day of each month or as directed by AFMSA. Copies of the summary report shall be signed and forwarded to the Executive Committee, the Lead MCA and the Group Practice Manager (GPM).

1.2.2. Documentation Audits. Contractor shall assess encounter documentation using Center for Medicare and Medicaid Services (CMS), Joint Commission for the Accreditation of Healthcare Organizations (JCAHO), Healthcare Services Inspection (HSI), DoD and Air Force (AF) documentation standards. Contractor shall identify, based on the individual Primary Care Manager’s (Provider) documentation, possible documentation changes which, if implemented, would more accurately account for services provided. Claims and medical records shall be reviewed for compliance with applicable coding, billing and documentation requirements. Requests shall be reported NLT the 10th calendar day of each month or as directed by AFMSA.

1.2.3. Third Party Collection and Billing Process. When requested, the MCAs shall review denied claims and perform pre-billing audits of private pay (non-DoD) insurance patients. Contractor shall suggest modifications in coding to resolve the denial, to avoid future denials, and to improve coding. On average, there are no more than 10 denied claims per month for each site location.

1.2.4. Update Data Collection Tools. Contractor shall input monthly audit results into the existing data collection tools (i.e. Population Health Support Division/Clinical Informatics Branch Audit Tool) to assist facility personnel in data collection and entry of SADRs submitted to the central AF designated data repository. This includes implementing a Medical Treatment Facilities (MTF) process for sharing information on coding issues affecting reimbursement among billing, collections, and staff. Information can be obtained from MDG personnel (i.e. GPM, DQM, HCI and etc.) for data collection and data entry in establishing methods for quality improvement. The Contractor shall perform periodic review of encounter forms, super bills, Picks lists or other resource tools that involve clinical code assignment to ensure validity and appropriateness shall be performed every 12 months.

1.2.5. Coding Training and Instruction. Contractor shall implement, update, and execute a training program for all applicable staff (i.e., health care Provider teams, senior staff) that will be coding and interpreting coded data. The goal of the Contractor’s training program is to provide professional heath care and non-professional health care staff with the medical coding skills necessary as they relate to assigned job duties, and to improve the timeliness, completeness, and accuracy of ambulatory medical coding. Problem areas identified in coding audits shall be incorporated into training.

1.2.5.1. Educational Plan. The Contractor shall develop and maintain an Annual Education Plan. This plan provides an outline of annual training objectives required by initial training, periodic training and formal training. The Quality Assurance Personnel (QAP) will provide the submission requirements and due date that is mutually agreed upon with the Contractor. The QAP will review and approve or disapprove the plan within 14 calendar days upon receipt of the Contractor’s plan. In the event of disapproval, the Contractor shall submit a revised training plan with required revisions within 7 calendar days of receipt of non-approval. The Annual Education Plan shall include the following at a minimum: Purpose, Objectives (i.e. required training), Coding Updates, Education Format, and Reference Materials (see Appendix D).

1.2.5.2. Initial Training. Contractor shall conduct initial coding instruction review for all new MTF health care and support staff. New credentialed staff shall be provided with coding training within 30 calendar days of assignment and shall be audited (at least 20 encounters) within 2 months of assignment. The Government will assure that MCAs are added to the MTF in-processing checklist for all staff directly involved with billing, coding and other aspects of healthcare programs.

1.2.5.3. Periodic Training. Subsequent to initial training, the Contractor shall conduct Provider training based on audits demonstrating failure to meet the 90% or above accuracy rate. This training is intended to serve as direct corrective action to address specific deficiencies identified per Provider or group of clinic Providers. Training shall be performed at least quarterly for continued failure to meet the expected accuracy levels.

1.2.5.4. Formal Training. Includes training provided for the purpose of general education typically presented during formal MTF directed meetings such as Pro Staff, Executive Committee or similar type group meetings. Formal MTF directed meetings are “classroom” type settings in which formal coding education is provided through a scheduled preset curriculum. Training shall be provided at least quarterly.

1.2.5.5. Training Material. Contractor shall use the following (but not limited to): ICD-9-CM (or current edition), CPT and HCPCS when providing instruction. ICD instruction shall include diagnosis, factors influencing health, and external cause of injury coding. CPT training shall include evaluation, management, and procedure codes. Training shall also address DoD extender codes. Training and education information shall be documented and retained. At a minimum the documentation shall consist of the date of the training, attendees, objectives and feedback from the participants.

1.2.6. Reporting Requirements.

1.2.6.1. Individual Provider Audit Reports. For each site location (hub and spoke), Contractor shall document and forward each individual Provider’s audit results to the Chief of the Medical Staff (SGH), the audited Provider, and the Provider team IAW a schedule as mutually agreed with the QAP. Report is due NLT the 10th of the month following audit completion.

1.2.6.2. Aggregate Coding Reports. For each site location (hub and spoke), the Contractor shall document and forward the monthly aggregate coding audit report to the Group Practice Manager, Data Quality Manager, QAP and any applicable staff. The Contractor shall route problematic items to the ECOMS (Executive Committee of the Medical Staff), Data Quality Committee and Medical Record Review Committee. Report is due NLT the 10th of the month following audit completion.

1.2.6.3. Executive Committee of the Medical Staff. The Contractor shall present individual and aggregate coding audit results at scheduled committee meetings. Contractor shall provide coding audit results to ECOMS at least quarterly. ECOMS may request separate audit results. On average, these requests from ECOMS are no more than once a month. The Contractor shall provide audit results within 24 hours to such requests.

1.2.6.4. Data Quality Committee. The Contractor shall provide an aggregate coding audit report to the Data Quality Committee per scheduled meeting times.

1.2.6.5. Medical Record Review Committee and Health Record Review Committee. Contractor shall prepare an individual and aggregate coding audit result report that includes discrepancies and trends at each scheduled committee meeting.

1.2.6.6. Coding Super Bill, “Other Diagnoses” and “Other Procedures”. Based on documentation, the Contractor shall assign codes for diagnoses and procedures listed in the “Other Diagnoses” and “Other Procedures” section of the super bill. Contractor shall also recommend changes to the Pick lists and super bills based on revisions and deletions to ICD and CPT codes, changes in coding practices or nomenclature, and changes in clinic scope of practice. Contractor shall also ensure Pick lists and super bills have the most appropriate listing of diagnoses and procedures to reduce the number of write-ins and to ensure high accuracy of the data entered into the Ambulatory Data System.

1.2.6.7. Abstraction. Upon request of the Provider or support staff, the Contractor shall provide guidance on coding complex and unusual cases in which ambulatory data module (ADM) Pick lists or super bills prove inadequate. Reference material is provided through IM Cell Portal reports. On average, there are no more than 3 cases per month for all of USAFE.

1.2.7. Continued Guidance. The Contractor shall provide informal guidance to the MTF on topics that are time sensitive and of vital importance.

1.3. General Information.

1.3.1. Location of Contractor Performance. The Contractor shall provide services in 11 Government Furnished Facilities (GFF), to include HQ USAFE/SG and 10 MTFs (6 parent facilities with 4 spoke facilities). The different MTF locations are as follows: RAF Lakenheath, United Kingdom (UK); Spangdahlem and Ramstein AB, Germany; Incirlik AB, Turkey; Aviano AB, Italy; Lajes Field, Azores; RAF Upwood, Menwith Hill and Croughton in the UK; and Geilenkirchen, Germany.

1.3.1.1. Aviano. The MCA assigned to Aviano shall have RHIT, RHIA, or CCS credentials to audit inpatient charts, and RHIT, RHIA, CCS, CCS-P or CPC credentials to audit outpatient charts. In order to meet these stringent requirements of dual certification for inpatient and outpatient coding, outpatient coding certification is required at the time of employment. If not fully certified for inpatient coding at the time of employment, contract employee shall obtain full certification of CCS certification through AHIMA within one year of employment date at no additional cost to the Government. In this event, the Contractor shall provide the QAP and Contracting Officer (CO) a plan of action for auditor receiving CCS certification. Quarterly progress reports shall be provided to the QAP and CO to ensure that necessary training is being accomplished and that auditor will be prepared to pass the CCS exam. The auditor shall maintain full certification of both inpatient and outpatient certifications during employment. In addition to outpatient audit requirements, the Contractor shall review the inpatient medical record, ensuring that documentation supports the DRG (diagnostic related group), using ancillary services notes, nurses’ notes, Providers’ orders and notations.

1.3.1.2. Services at spoke Facilities. MCAs shall physically visit, at least quarterly, the spoke facilities for auditing and training. Associated costs shall be borne by the Contractor. MCAs shall provide telephonic or e-mail support to remote locations requiring technical assistance, and to the MAJCOM/SG on an as needed basis.

1.3.2. Key Personnel. All contractor personnel performing under this contract shall be fluent in reading, writing and speaking the English language.

1.3.2.1. Project/Program Manager (PM). The Contractor shall provide a PM with experience in managing international assignees for similar type services. The PM shall have full authority to act for the Contractor on all contract matters relating to the daily contract administration. The PM or the Contractor’s designated representative shall be available within 2 hours upon Government personnel request. The Contractor shall provide PM contact information to the QAP and CO within 7 days upon contract award.

1.3.2.2. Lead Medical Coding Auditor (LMCA). The Contractor shall provide a USAFE HQ LMCA to provide oversight of the coding auditors in the facilities; provide consultation and analysis; and to provide summary of facility audits to the HQ staff. The Lead MCA shall serve as the single and technical POC responsible for technical performance and quality of the work performed by the MCAs. This function may be dual-hatted with the PM. The Lead MCA shall interact with the QAP in responding to technical questions from the MTF MCAs. The Lead MCA shall, with concurrence of the QAP, disseminate information and guidance to the staff as applicable. The Contractor shall provide LMCA contact information to the QAP within 14 days upon contract award.

1.3.2.2.1. LMCA Certification. The Contractor shall provide a LMCA with at least one of the following certifications: Certified Coding Specialist-Physician Based (CCS-P) or Certified Professional Coder (CPC). The LCMA shall also have a Professional Medical Coding Course (PMCC) Certification or a like credential to provide the skills and necessary training to those individuals who are interested in becoming certified coders. Other acceptable credentials are: Registered Health Information Administrator (RHIA), Registered Health Information Technician (RHIT), Certified Coding Specialist (CCS), and Certified Professional Coder-Hospital (CPC-H).

1.3.2.2.2. LMCA Experience and Knowledge. The Contractor shall provide and maintain a LMCA with the following minimum experience and knowledge base:

1. Minimum of eight years of coding/auditing experience

1. Proficiency with Word, Excel and Power Point Microsoft office programs

1.3.2.3. MCA Certification. The Contractor shall provide and maintain MCAs with at least one of the following certifications: Certified Coding Specialist-Physician Based (CCS-P) or Certified Professional Coder (CPC). Other acceptable credentials are: Registered Health Information Administrator (RHIA), Registered Health Information Technician (RHIT), Certified Coding Specialist (CCS), Certified Professional Coder-Hospital (CPC-H).

1.3.2.3.1. MCA Experience and Knowledge. The Contractor shall provide MCAs with the following minimum experience and knowledge base:

0. Minimum of five years of coding/auditing experience

0. Experience in education techniques

0. Knowledge of reimbursement systems, federal, state and payer-specific regulations and policies pertaining to documentation coding and billing

0. Proficiency with Word, Excel and Power Point Microsoft office programs

1.3.2.4. Verification of Current Certification. The Contractor shall forward renewal certificates for all contractor personnel NLT the first calendar day of the Performance Period to the QAP.

1.3.2.5. HIPAA Training. The Contractor shall assure that all MCAs have completed the applicable initial HIPAA training modules prior to commencement of services and that all annual refresher training is completed per MTF guidance. Documentation of completion of HIPAA training shall be provided to the QAP and MTF upon the MCAs’ MTF report date.

1.3.3. Government Ownership and Title. All programs and materials purchased or developed during the course of this contract is the property of the U.S. Government. This includes but is not limited to Operating Instructions (OIs), pamphlets, leaflets, programs and manuals used for training purposes; videotapes, formats for presentations, and other records and ancillary materials and forms developed, used, or purchased during the course of the contract as it relates to medical coding audit services.

1.3.4. Conduct.

1.3.4.1. Contractor shall not introduce new procedures or services without prior approval of the QAP or designated Government representative. In disagreements or deviations from established guidelines or new protocols, the QAP will contact the CO for further action.

1.3.4.2. Contractor shall abide by federal and local MTF regulations and requirements concerning the nature of limited privileged communication between patients and contract personnel as may be necessary for security and personnel reliability programs. Contractor shall abide by federal and local MTF regulations concerning the confidentiality of patient records, as embodied in federal statutes including the Privacy Act of 1974 and the Health Insurance Portability & Accountability Act of 1996. All regulations referenced are available for review at the MTF. All medical records and reports shall remain the property of the Government.

1.3.4.3. Contractor shall abide by MTF bylaws, JCAHO, DoD and Medical Department regulations with regard to Compliance, Patient Safety, Performance Improvement and Risk Management directives, to include in-service training, maintenance of records, performance evaluation, release of medical information.

1.3.5. Conflict of Interest.

1.3.5.1. Contractor shall not bill the patient for services rendered under this contract. The Contractor is prohibited from receiving compensation of any kind for patients treated, procedures performed, or any other actions performed, except under the prices, terms and conditions of this contract.

1.3.5.2. Contractor shall not, while performing services under this contract, advise, recommend, or suggest to persons eligible to receive medical care at Government expense that such persons should receive care from an outside agency or Provider at any place other than as designated under this contract.

1.3.6. Security Requirements.

1.3.6.1. The contractor shall comply with the DoD 5200.2-R, Personal Security Program, AFI 31-501, Personnel Security Program Management and AFI 33-119, Electronic Mail Management and Use, requirements for contractor personnel operating Government workstations that have unclassified automated information systems (e-mail, MIS, Internet, CAMS, etc.) A back-ground investigation consisting of a National Agency Check with Inquiries (NACI) is required for all contractor employees under this contract. The Contractor shall fully adhere with the provisions of referenced publications by having each of their employees who are performing under this contract initiate and complete a NACI. Member will be fingerprinted and required to complete the appropriate forms (Standard Form 85/85P Questionnaire for Non-Sensitive Position and OF 306, Declaration for Federal Employment). The contractor shall advise employee that a favorable suitability determination is required as a condition of employment under this specific contract. The employee shall apply for the NACI prior to start of performance. The government is solely responsible for the cost associated with the initiation, application and completion of the background investigation with exceptions for expenses incurred for Police Checks for “local hire” personnel.

1.3.6.2. All background investigations will be initiated by 86 AW/IPP (Personnel Security Office). Previous background investigations must be recorded in and verified through the Joint Personnel Adjudication System (JPAS).

1.3.7. Security. The Contractor shall not employ persons for work on this contract if such employee is identified to the Contractor by the CO as a potential threat to the health, safety, security, general well being, or operational mission of the installation and its population.

1.3.8. Identification and Appearance. Contractor personnel shall present a neat, clean/hygienic appearance. The Contractor shall provide each employee with an identification badge that shall include the employee’s name, employee’s photograph, and contractor’s name. Identification shall be worn or attached to the outer garment at all times to be easily recognized as contractor employees.

1.3.9. Hours of Operation. Performance in the Government facilities shall be conducted Monday through Friday, excluding U.S. Federal holidays. Normal work hours are between 0730 and 1700, but may be changed to those established by each MTF. Hours may fluctuate to accommodate workload or project requirements at the site with prior approval by the QAP.

1.3.10. Liability Responsibility. If any suit or action is filed or any claim is made due to codes assigned by the Contractor, the Contractor shall cooperate with the Government, without further compensation, in the processing, review, settlement or defense of the suit, action or claim.

1.3.11. Patient Data. All patient data, irrespective of source, shall be treated as privileged information. Lists and/or names of patients shall not be disclosed to anyone who does not have a medical need to know without prior written permission by the MTF Commander.

1.3.12. Release of Medical Information. Contractor shall use patient information for this contract only. The information shall be used to improve MTF coding performance. The contractor shall maintain, transmit, retain in strictest confidence, and prevent the unauthorized duplication, use and disclosure of patient information. Contractor shall provide patient information only to authorized Government personnel having a need to know such information. The Contractor shall comply with safeguarding and proper disposition IAW HIPAA, DoD 6025.18-R, and other applicable privacy regulations and laws, prior to commencing work on this contract. The Contractor shall not make public any information by news release, interviews, comments, or any other response, advertising, copying, published professional papers, press releases or presentations covering all or any part of this effort without prior approval of the MDG/CC and the applicable Office of Public Affairs. Contractor shall not respond to any media inquiries. Any inquiries from the media shall be immediately relayed to the QAP or appointed representative.

1.3.13. Physical and Electronic Protection of Patient Data. In accordance with Department of Defense Instructions (DoDI) 5400.11-R, 8500.1 and 8500.2, Contractor shall ensure the following:

1.3.13.1. Any worksheets with individually identifiable information shall be disposed of according to TMA, HHS and local MTF guidelines.

1.3.13.2. Contractor shall treat all unclassified records that contain personal information that normally would be withheld from the public as if they were designated "For Official Use Only" even if they are not actually marked "For Official Use Only".

1.3.13.3 Contractor shall dispose of records containing personal data so as to prevent inadvertent compromise. Disposal methods are those approved by the Component or the National Institute of Standards and Technology. For paper records, disposal methods, such as tearing, burning, melting, chemical decomposition, pulping, pulverizing, shredding, or mutilation is acceptable. For electronic records and media, disposal methods, such as overwriting, degaussing, disintegration, pulverization, burning, melting, incineration, shredding or sanding are acceptable.

1.3.13.4. The IT environment subjects personal information to special hazards as to unauthorized compromise, alteration, dissemination, and use. Therefore, Contractor shall give special considerations to safeguarding personal information in IT systems consistent with the requirements of DoD Directive 8500.1.

1.3.13.5. Contractor shall establish administrative, technical, and physical safeguards that are adequate to protect the Government Private Health Information (PHI) personally identifiable information (PII) against unauthorized disclosure, access, or misuse.

1.3.13.6. Under no circumstances shall the Contractor store protected information at secondary sites.

1.3.13.7. Contractor shall follow MTF access procedures for unclassified computer rooms, tape libraries, micrographic facilities, decollating shops, product distribution areas, or other direct support areas that process or contain personal information subject to this Regulation that control adequately access to these areas.

1.3.13.8. Contractor shall ensure that all PHI/PII not explicitly cleared for public release is protected according to Confidentially Level Sensitive, as established in DoD Instruction 8500.2. Government and Contractor personnel shall conduct risk assessments of compilations of PHI/PII and identify those needing more stringent protection for remote access or mobile computing.

1.3.13.9. Contractor shall encrypt unclassified personal information in accordance with current Information Assurance (IA) policies and procedures.

1.3.13.10. Contractor shall ensure that all PII is protected according to Confidentially Level Sensitive, as established in DoD Instruction 8500.2.

1.3.13.11. Contractor shall establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained.

1.3.13.12. The following information categories pertain to this contract.

1.3.13.12.1. Mission Assurance Category III (MAC III). Systems handling information that is necessary for the conduct of day-to-day business, but does not materially affect support to deployed or contingency forces in the short-term. The consequences of loss of integrity or availability can be tolerated or overcome without significant impacts on mission effectiveness or operational readiness. The consequences could include the delay or degradation of services or commodities enabling routine activities. Mission Assurance Category III systems require protective measures, techniques, or procedures generally commensurate with commercial best practices.

1.3.13.12.2. Sensitive Information. Information, the loss, misuse, or unauthorized access to or modification of, could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of title 5, United States Code, "The Privacy Act" (reference (z)), but which has not been specifically authorized under criteria established by Executive order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. (Section 278g-3 of title 15, United States Code, "The Computer Security Act of 1987". Examples of sensitive information include, but are not limited to information in DoD payroll, finance, medical, logistics, and personnel management systems. Sensitive information sub-categories include, but are not limited to, the following:

1.3.13.12.3. For Official Use Only (FOUO). In accordance with DoD 5400.7-R, DoD information exempted from mandatory public disclosure under the Freedom of Information Act (FOIA).

1.3.13.12.4. Privacy Data. Any record that is contained in a system of records as defined in the Privacy Act of 1974 (5 U.S.C. 552a) and information the disclosure of which would constitute an unwarranted invasion of personal privacy.

1.3.14.13. Only authorized personnel with a need-to-know are granted physical access to computing facilities that process sensitive information or unclassified information that has not been cleared for release.

1.3.14.14. Contractor shall ensure that all email containing the following types of information will be encrypted regardless of its destination:

1.3.14.14.1. For Official Use Only (FOUO);

1.3.14.14.2. Privacy Act information;

1.3.14.14.3. Personally Identifiable Information (PII);

1.3.14.14.4. Individually identifiable health, DoD payroll, finance, logistics, personnel management, proprietary and foreign government information.

1.3.14.15. Encrypted email sent to wireless hand held devices can only be read if they are properly configured for DoD PKI configuration. Emails sent from wireless hand held devices containing the above types of information must also be encrypted and the devices must be configured for encrypting and signing using DoD PKI certificates.

1.3.15. BUSINESS ASSOCIATE AGREEMENT (BAA), HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) OF 1996

HIPAA is comprised of several different sections, each to be implemented by the Dept. of Health and Human Services. The AFMS and its components are specifically listed as covered entities (CE) under HIPAA. Currently, HIPAA Privacy and Security Rules, as set forth in the Code of Federal Regulations, are in effect for all AFMS CEs. The specific implementation of HIPAA Privacy for DOD medical facilities is set forth in DOD 6025.18-R, and for HIPAA Security, the requirements for the AFMS are contained in AFI 41-217, which also contains additional Information Assurance requirements. Both DOD 6025.18-R and AFI 41-217 are incorporated herein by reference. AFMS organizations are responsible to insure overall compliance with HIPAA requirements, which includes incorporation of certain requirements in contracts entered or amended after the respective implementation dates.

IAW DoD 6025.18-R, the Contractor and its employees meet the definition of Business Associate. Therefore, a Business Associate Agreement is required by law to comply with both the HIPAA Privacy and Security regulations.

This clause serves as that agreement for this contract/BAA, whereby the Contractor and its employees agree to abide by all HIPAA Privacy and Security requirements regarding health information as defined in this clause, DoD 6025.18-R, and AFI 41-217. Additional HIPAA requirements will be addressed when implemented.

Introduction

(a) Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DOD 6025.18-R or AFI 41-217.

Individual has the same meaning as the term “individual” in 45 CFR 164.50 1 and 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 164.501, limited to the information created or received by The Contractor from or on behalf of the Government.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term “required by law” in 45 CFR 164.501 and 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160,162 and part 164 subpart C.

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR 160.103, 164.501 and 164.304.

(b) The Contractor agrees to not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(c) The Contractor agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

(d) The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(e) The Contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Contract.

(f) The Contractor agrees to report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Contractor agrees to report to the Government any use or disclosure of the Protected Health Information not provided for by this Contract of which the Contractor becomes aware of.

(h) The Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Contractor on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(i) The Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Contractor agrees to provide access, at the request of the Government, and in the time and manner designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(k) The Contractor agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government or an Individual, and in the time and manner designated by the Government.

(1) The Contractor agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor on behalf of, the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner designated by the 'Government or the Secretary, for purposes of the Secretary determining the Government's compliance with the Privacy Rule.

(m) The Contractor agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Contractor agrees to provide to the Government or an Individual, in time and manner designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

General Use and Disclosure Provisions

Except as otherwise limited in this Agreement, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the Privacy Rule, the Security Rule or DOD 6025.18R if done by the Government.

Specific Use and Disclosure Provisions

(a) Except as otherwise limited in this Agreement, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Agreement, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Agreement, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1).

Obligations of the Government

Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

(a) Upon request the Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520, as well as any changes to such notice.

(b) The Government shall provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor's permitted or required uses and disclosures.

(c) The Government shall notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

Permissible Requests by the Government

The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

Termination

(a) Termination. A breach by the Contractor of this clause, may subject the Contractor to termination under any applicable default or termination provision of this Contract.

(b) Effect of Termination.

(1) If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with paragraphs (2) and (3) below.

(2) If this contract does not have records management requirements, except as provided in paragraph (3) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government, or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health Information.

(3) If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

Miscellaneous

(a) Regulatory References. A reference in this Clause to a section in DOD 6025.18R, Privacy Rule or Security Rule means the section as in effect or as amended, and for which compliance is required.

(b) Survival. The respective rights and obligations of Business Associate under the "Effect of Termination" provision of this Clause shall survive the termination of this Contract.

(c) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DOD 6025.18R, the CFR Privacy Rule, the CFR Security Rule and AFI 41-217.

1.3.16. Contractor Acquired Property.

1.3.16.1. Books, Publications and Reference Materials. At all times, the Contractor shall acquire reference materials and/or software required for MCAs to perform the tasks under this contract. At contract expiration, title and ownership of all reference materials shall be turned over to the MTF at no additional cost to the Government, with title passing to the Government.

Required list of materials is as follows:

1. CPT Professional Edition Spiral Bound

1. HCPCS Soft Bound

1. ICD-9 Spiral Bound Vol 1 and 2

1. ICD-9 Expert for Hospital Vol 1, 2 and 3

1. ICD-9 Coding Handbook

1. CPT Assistant subscription

1. Coder’s Desk Reference Diagnosis

1. Coder’s Desk Reference Procedures

1. DSM IV Text Revision

1. Clinical coding Workout w/answer key

1. Coding Clinic for HCPCS

1. Coding Clinic for ICD-9-CM

1. Faye Browne ICD-9 Coding Workbook/Training manual

1. Taber’s Cyclopedia Medical Dictionary

1. Nurse’s Drug Handbook

1. Mosby’s Handbook of Anatomy and Physiology

1. The Merck Manual

2.0. SERVICES SUMMARY (SS)

SS TABLE

SS

10th calendar day of each month.

1.2.1.

1.2.2.

1.2.6.1.

1.2.6.2.

Reports due on-time 98% of the time.

day of each month.

rate each month

the Contractor shall conduct Provider training based on audit demonstrating failure to meet the 90% or above accuracy rate, perform at least quarterly for continued failure to meet the expected accuracy levels.

rate each month

quarterly.

result reports within required timelines.

1.2.6.3.

1.2.6.4.

1.2.6.5.

100% Compliance

3.0. GOVERNMENT FURNISHED PROPERTY AND SERVICES

3.1. General. The Government will provide the facilities, equipment, materials, services and utilities listed below. Contractor shall use all Government furnished property and facilities provided for performance of this contract only. No equipment shall be disposed of without prior consent from the QAP. All equipment and material shall remain the property of the Government.

3.1.1. Workspace. 1 (each) desk and chair, with PC (personal computer), including Government network for email and internet, printer, telephone and utilities for each Contractor personnel.

3.1.2. Forms. All Government forms required.

3.1.3. Training.

0. Computer Program Training.

0. DoD Unique. The MTF will provide training on the Composite Health Care System (CHCS), Armed Forces Health Longitudinal Technology Application (AHLTA), Coding Compliance Editor (CCE), super user training on ADM, Biometric Data Quality Assurance System (BDQAS), and other DoD unique computer programs.

3.1.3.1.2. Government Provided Courses and Training. Contractor medical coding auditors may be required to attend Government courses and training. Attendance shall be during normal working hours. Any related travel costs associated with such courses and training shall be cost reimbursable at Government expense. The Contractor must submit a request to travel to include transportation costs and lodging, for example. The travel request must be submitted to the QAP and CO for approval prior to travel. General and Administrative costs, including profit are not authorized.

3.1.4. Orientation. All Contractor employees performing work on the MTF shall attend a briefing provided by the Government within 30 calendar days of commencing work in the MTF, to familiarize Contract personnel with the policies and procedures of the duty location.

End of Performance Work Statement.

APPENDIX A – DEFINITIONS

General Definitions: The following terms in this PWS have the meanings as set forth below.

1.1. ADS system: The computer system that captures all ambulatory data and where ICD9, CPT and HCPCS codes are entered by the physicians, ancillary, and administrative staff.

1.2. Ambulatory data module (ADM): CHCS module used to electronically collect codes for all outpatient (including Ambulatory Procedure Visits) encounters.

1.3. Ambulatory health care: Medical, surgical, and prevention care provided to patients who are not admitted to an inpatient facility (e.g., same-day surgery, outpatient office visits, group outpatient education and prevention training) and patients admitted to an inpatient facility who receive consults and services from other than the attending service (e.g., inpatient consults, inpatient physical therapy services).

1.4. Composite health care system (CHCS): Military Health Services’ clinical database that captures all patient demographic information, PROVIDER information, scheduling functions, inpatient, outpatient, and ancillary functions, workload capture, and medical record coding via the ADM.

1.5. Contracting officer (CO): A person duly appointed with the authority to enter into, administer, and terminate contracts on behalf of the Government.

1.6. Data Quality Manager: Individual assigned in writing by the Medical Group Commander to coordinate all data quality efforts in the MTF.

1.7. Hub: Parent MTF (Medical Treatment Facility), parent site.

1.8. MCA: Medical Coding Auditing or Medical Coding Auditor.

1.9. MEPRS: Medical Expense Performance Reporting System. Each clinical specialty is assigned a specific “MEPRS” code.

1.10. Military time: On a 24-hour clock, i.e.

8:00a.m. - 0800; 9:10a.m. - 0910; Noon - 1200 8:00p.m. - 2000; 9:10p.m. - 2110; Midnight - 2400; 12:01a.m. – 0001

1.11. Military dates: Written by placing the day of the month, followed by the first three letters of the month, followed by the last two digits of the year, i.e., Sep 2, 2002 - 2 Sep 02; Sep 10, 1994 - 10 Sep 94

1.12. Military treatment facility (MTF): An organized group of people, with the associated facilities and equipment, which provide medical services for a beneficiary population.

1.13. Provider team: Primary Care Management Team. Team comprises one physician, one nurse, two medical technicians and one administrative technician. The PROVIDER team manages the health care population of 1500 patients.

1.14. Pick list/ADM templates: A clinic specific series of diagnoses or procedures with the associated codes. These lists are in the ADM module of CHCS and are accessed by selecting the “DIAGNOSIS” option. Personnel entering data may use Pick lists to identify the most appropriate diagnosis or procedure while completing a Standard Ambulatory Data Record.

1.15. Quality Assurance Personnel (QAP): Individual assigned to monitor the performance of the contractor to ensure the standard and requirements as outlined in the SOW are being met.

1.16. Spoke: Geographically separated unit (GSU) to hub/parent MTF, satellite facility.

1.17. Standard Ambulatory Data Record: The electronic coded ambulatory medical record sent to the MHS Data Repository and finally to the ARS Bridge / M2 for query.

1.18. Super Bill: A clinic specific sheet of frequently used diagnoses, evaluation and management codes, procedures and disposition options. Data regarding an encounter is entered on the super bill and then entered into the ADM module of CHCS to complete a Standard Ambulatory Data Record.

1.19. Record: An original paper document that captures the hand-written or computer generated information collected during a…