PWS_Telehealth_Project_Management_Support_14_July_2015_FBO.pdf

U.S. AIR FORCE MEDICAL SUPPORT AGENCY

Healthcare Operations Directorate (AFMSA/SG3)

Medical Operations (SG3O) Telehealth Branch

Performance-Based Work Statement for

Telehealth Project Management Support

14 Jul 15

SG3_TH Project Management PWS

Table of Contents

35T1.35T 35TDESCRIPTION OF SERVICES35T

35T1.135T 35TBackground.35T

35T1.235T 35TScope and Summary of Requirements.35T

35T2.35T 35TSPECIFIC REQUIREMENTS35T

35T2.1 TASKS35T

35T2.1.1 TASK 1 –Telehealth Program Management Support35T

35T2.1.2 TASK 2 –System Analyst Support.35T

35T2.235T 35TDeliverables/Reporting Requirements.35T

35T2.2.135T 35TTransition Plan35T

35T2.2.235T 35TMonthly Status Report (MSR).35T

35T2.2.335T 35TQuality Control Plan (QCP).35T

35T2.335T 35TServices Summary and Method of Surveillance.35T

35T3.35T 35TGENERAL REQUIREMENTS35T

35T3.135T 35TContractor General Support.35T

35T3.1.135T 35TContinuation of Services.35T

35T3.1.235T 35TVacancies.35T

35T3.1.335T 35TProfessionalism.35T

35T3.1.435T 35TCommon Access Card (CAC).35T

35T3.1.535T 35TContractor Identification.35T

35T3.235T 35TGovernment Furnished Property/Information (GFP/GFI).35T

35T3.335T 35TSecurity Procedures35T

35T3.435T 35TTravel.35T

35T3.535T 35TPlace of Performance and Hours of Operation.35T

35T3.635T 35TPrivacy of Information.35T

35T3.735T 35TNon-personal Services.35T 35T3.835T 35TPeriod of Performance.35T

35TAPPENDIX A: APPLICABLE PUBLICATIONS35T

35TAPPENDIX B: BUSINESS ASSOCIATE AGREEMENT35T

35TAPPENDIX C: AF/SG ORGANIZATIONAL CONFLICT OF INTEREST35T

35TAPPENDIX D: HQ USAF/SG NON-DISCLOSURE AGREEMENT35T

35TAPPENDIX E: ACRONYMS, ABBREVIATIONS AND GLOSSARY OF TERMS35T

35TAPPENDIX F: TELEHEALTH PROJECTS35T

1. DESCRIPTION OF SERVICES

1.1 Background.

The Air Force Medical Support Agency (AFMSA), Office of the Air Force Surgeon General Healthcare Operations directorate (SG3) plans, programs, and provides Air Force (AF) medical expeditionary capabilities to support the national security strategy. SG3 defines and executes health care policy for 44,000 personnel at 75 military treatment facilities (MTFs). SG3 ensures a cost-effective, patient-centered, and prevention-based health care continuum for 2.6 million beneficiaries worldwide. SG3 builds strategic partnerships with Veterans Administration (VA) federal agencies, academia, and allied medical services.

Within SG3, the Medical Operations division (SG3O)/Telehealth (TH) branch is responsible for implementing plans and programs in relation to the development, deployment, maintenance and operation of all Telehealth Modernization and Information Management/Information Technology (IM/IT) resources supporting Air Force Medical Service (AFMS) clinical business practices.

AFMSA/SG3O/TH supports the modernization program, the IM/IT investment program and analyzes the Medical Health Services (MHS) IM/IT investment portfolio for impact on AFMS programs and capabilities. AFMSA/SG3O/TH receives direction/guidance from Headquarters Air Force/ United States Air Force Surgeon General (HQ USAF/SG), Deputy Surgeon General, Modernization, Air Force Chief Medical Information Officer and MHS CIO.

1.2 Scope and Summary of Requirements.

This is a requirement for advisory and assistance services. The Contractor shall provide project management support services to assist the AFMS in planning and managing its activities and programs. The Contractor shall assist by advising, tracking and making recommendations on new initiatives that impact the Telehealth programs and supporting sustainment activities on existing hardware, software, applications, help desk operations and maintenance. The Contractor shall support Telehealth project initiation, validation, testing and sustainment activities through the system lifecycle.

2. SPECIFIC REQUIREMENTS

The Telehealth office seeks support in two (2) strategic areas. The Contractor shall provide three

(3) full time equivalents (FTEs).

• Task 1 requires two (2) FTEs, Project Management, level III to provide advisory and assistance support for Telehealth projects and MTFs. The support shall include providing advisory and assistance on new project initiatives, existing systems lifecycle support, and monitoring projects.

• Task 2 requires one (1) FTE, Systems Analyst, level II to provide support to all

Telehealth projects. The support shall include advisory and assistance on hardware/software configuration and setup, support for IM/IT systems, and help desk operations.

2.1 TASKS

2.1.1 TASK 1 –Telehealth Program Management Support

The Contractor shall provide subject matter expert expertise and project management support to the Telehealth Program. The Contractor shall assist the Government with plans, initiatives, sustainment and strategies on worldwide implementation of medical information management systems supporting 2.6 million TRICARE beneficiaries and Defense of Defense (DoD) sites worldwide. The Contractor shall be a liaison between the AF and the clinical lead agent for MHS wide eConsultion enterprise. The project specialty areas include: Imagery for Cardiology, Dermatology, Radiology, Pathology, Ear, Nose and Throat (ENT), and Ocular. Other Telehealth specialty areas include Tele-Genetics, Tele-Sports Medicine, Tele-Nutrition, Tele-MNT (Medical Nutritional Therapy), Tele-ICU (Virtual Intensive Care Unit), Virtual PreOP, Remote Home Monitoring, and Tele-Podiatry. The Contractor shall provide support to Telehealth special projects: Defense Collaboration Services (DCS), (Desktop IP Video Platforms), AF to VA initiatives, Web-Based Supervision, Healthcare Executive Council (HEC) initiatives and Congressional Research Projects and the relationships to specific Telehealth specialty areas.

The Contractor shall provide two (2) Project Managers, level III to complete the following tasks.

2.1.1.1 Assist in researching, developing, and aligning strategic business plans.

2.1.1.2 Assist the Government program manager (PM) with coordinating actions such as new initiatives and sustainment between disparate groups of civilian contractors, industry representatives, MTF project teams, base CIOs, functional provider community, Air Force Medical Operations Agency (AFMOA) Hospital Administrator leadership, DoD service specialty consultants and Telehealth subject matter experts in other Federal Healthcare institutions.

2.1.1.3 Attend conferences, workshops, seminars geared to health care information systems and health care information technology with the Government PM. Assist the Government by recommending technology solutions and ensuring solutions are compliant with Air Force Instruction (AFI) standards on Telehealth projects.

Meeting minutes are due to the Government PM no later than (NLT) five (5) calendar days after attendance.

2.1.1.4 Assist the Government in developing management procedures for projects, proposing deadlines, and summarizing project progress. Interface with Government leaders and representatives on program management issues.

Recommend resolutions to solve issues on projects in regards to schedule, cost and quality management. Monitor and track cost estimates and administrative aspects of the project with respect to contract requirements. Assist with acquisition and employment of project resources. Track warranty dates, warranty extensions, and warranty expirations. Document and monitor ongoing warranty issues and provide problem resolution.

2.1.1.5 Review and update the Risk Management Framework documentation and prepare Defense Business Transformation certification documentation to obligate program funds and support the fielded systems. Conduct acceptance testing to confirm systems clinical efficacy and compliance to requirements. Document test results for Web-based Education & Training Supervision (WEBETS) and imaging systems.

2.1.1.6 Conduct site visits assessing the clinical workflow and business practices, in addition to the facility and network requirements required for Telehealth and imaging systems. Collect and assemble information such as risks, site conversations, deployed equipment, lessons learned and program information.

Recommend changes to balance workload and improve workflow.

2.1.1.7 Achieve expected results based on assessment needs of field sites and ensure that assessments uphold existing policies, plans, guidance and processes.

2.1.1.8 Prepare analyses, briefings, and responses for the Government PM. Analyses, briefings, and responses are due ten (10) calendar days after request.

2.1.1.9 Project Management Level III Qualifications:

A minimum of a Bachelor’s degree in Business Administration or IT or Information Systems (IS) and eight (8) years of experience in a related field to include:

• Providing assistance in Life Cycle Management.

• Experience with workflow modification, business process reengineering techniques, and interoperability to include providing technical assistance with health systems, clinical systems, electronic health care records, and health care system integration.

• Experience writing technical documentation, operating instructions, policy memorandums, concepts of operations and capabilities development documents, business case analyses, statements of work.

• Experience with in-patient or hospital setting electronic health record system deployments.

• Knowledge of military Telemedicine/Telehealth initiatives (Appendix F).

• Knowledge with image sharing and image intensive healthcare technologies and teleconsultation capabilities such as Tele-Radiology, Tele-Pathology, Tele-Dermatology, Tele-Otolaryngology, Tele-ENT, and Tele-Cardiology.

• CompTIA A+ certification desired.

2.1.2 TASK 2 –System Analyst Support.

The Contractor shall provide technical support on information systems supporting Telehealth applications and programs. The Contractor shall organize and manage a Tier I and Tier II level technical resource and information center supporting all Telehealth applications and programs.

The Contractor shall collaborate with the Air Force Medical Logistics Office (AFMLO) at Fort Detrick to ensure configuration/inventory management on Virtual Reality telemedicine and imaging equipment deployed under AFMSA/SG3O are adequately supported and maintained.

The Contractor shall provide support to the deployment of all Telehealth programs and initiatives including tele-consultation, tele-imaging, and Telehealth special projects.

The Contractor shall provide one (1) Systems Analyst, level II to complete the following tasks.

2.1.2.1 Provide Tier I and Tier II level technical resource and information center advice on equipment, software, and information systems for Telehealth equipment and applications to include answering incoming calls, solving technical and solving automation problems. Emergency requests shall be resolved or escalated to the next Tier level 72 hours from the time request is reported. Routine requests shall be resolved according to established resolution timelines agreeable between the Contractor and the Government.

2.1.2.2 Collaborate and assist AFMLO at Fort Detrick on configuration and inventory management of telemedicine and imaging equipment in support of Telehealth programs.

2.1.2.3 Set-up and implement a technical resource center to support all Telehealth applications and equipment acquired by AFMSA/SG3.

2.1.2.4 Create step-by-step technical manuals and training plans on all deployed

Telehealth applications and equipment.

2.1.2.5 Provide technical expertise on requirements on telemedicine projects to vendors and contractors.

2.1.2.6 Provide web design support and maintain the Telehealth & enterprise imaging website and other database tools.

2.1.2.7 Conduct acceptance testing to confirm systems clinical efficiency and compliance to defined requirements.

2.1.2.8 Assist at site visits assessing the clinical workflow, business practices, as well as the facility and network requirements required for Telehealth and imaging systems. Collect and compile workload data. Recommend changes to balance workload and improve workflow.

2.1.2.9 Document, monitor and track Service Level Agreements and Memorandum of

Understanding within AF MTFs and other DoD agencies. Assist the Government in facilitating documentation, such as obtaining leadership signatures, coordinating changes between Government agencies, coordinating templates for information between agencies on Service Level Agreements and Memoranda of Understanding within AF MTFs and other DoD agencies.

2.1.2.10 Interface with and use minicomputer and mainframe computer systems in addressing project objectives.

2.1.2.11 Assist the Government in planning, organizing, modifying and integrating data processing systems, computer hardware systems and simulation models by formulating architectural functional specifications, interfaces and documentation.

2.1.2.12 Coordinate and assist the Government program office with project transitions and sustainment activities. Document, monitor and track inventory during equipment lifecycles.

2.1.2.13 Document and inform prospective vendors of compliance with Health Insurance

Portability and Accountability Act (HIPAA), Information Assurance, AFIs, credentialing, and other Telehealth policies and standards.

2.1.2.14 Document user community feedback on Telehealth technologies via surveys.

2.1.2.15 Attend, document, and brief project status in weekly Telehealth & enterprise imaging meetings and other meetings as required, to include offsite meetings.

Meeting minutes are due to the Government PM NLT five (5) calendar days after attendance.

2.1.2.16 Submit documents, spreadsheets, and presentations in the appropriate format according to Telehealth leadership.

2.1.2.17 Create marketing materials in promoting all Telehealth projects (i.e. brochures, newsletters, and flyers).

2.1.2.18 System Analyst Level II Qualifications:

Minimum of an Associate’s degree in Information Technology, Information Systems, or related IT field and three (3) years of experience in a related field to include the following experience below:

Or eight (8) years of experience in a related IT field, five (5) years of which are in the AFMS to include the following experience below:

• Experience with health care information systems.

• Experience with receiving trouble tickets, troubleshooting and problem resolution.

• CompTIA A+ certification.

• Experience with help desk support.

• Experience with electronic health record requirements and concepts of operations.

2.2 Deliverables/Reporting Requirements.

Deliverables associated with this contract are specified below. All deliverables shall be submitted in a draft format mutually agreed upon by the Contractor and the Government.

Title PWS Para Delivery Date/Description Meeting Minutes 2.1.1.3 and

2.1.2.15 Due to the Government PM five (5) calendar days after attendance

Reports 2.1.1.8, and 2.1.2.16

Due to the Government PM 10 calendar days after request

Transition Plan 2.2.1 Update due to the Contracting Officer’s Representative (COR) 30 calendar days prior to contract expiration

Monthly Status Reports

2.2.2 Due to the COR by the 5th calendar day of the month

Quality Control Plan

2.2.3 Due to the COR no later than five (5) calendar days after contract award

Personnel Roster 3.3.1 Due to the Service Contract Manager and Unit Security Manager within 14 calendar days after Period of Performance start date

Trip Report 3.4.4 Submit trip reports to COR within five (5) calendar days after trip completion; electronically

Organizational Conflict of Interest

Appendix C

Due to the Contracting Officer (CO) and COR 10 calendar days after contract award; electronically, each employee must have one completed before start of work

Non-Disclosure Agreement

Appendix D

Due to the CO and COR within 10 calendar days after contract award; each employee must have one completed before any start of work; electronically

2.2.1 Transition Plan

The Contractor shall prepare an updated Transition Plan due to the COR thirty (30) calendar days prior to contract expiration. The Transition Plan shall include the following as a minimum:

• Coordination with government representatives,

• Review, evaluation and transition of current support services,

• Transition of historic data to the Government,

• Government approved training and certification process,

• Orientation phase and program to introduce government personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes,

• Distribution of Contractor- purchased government owned assets,

• Transfer of Government Furnished Equipment (GFE) and Government Furnished

Information (GFI) assets,

• Government Common Access Cards (CAC) and Identification Badges, and

Distribution of existing staff.

2.2.2 Monthly Status Report (MSR)

The Contractor shall provide a Monthly Status Report due to the COR NLT the by 5thP

Pcalendar day of the month. The report shall include:

a. A brief task description; a narrative review of tasks accomplished during the reporting period and/or significant events, status of major and minor milestones, and project/program deliverables.

b. Problem areas encountered and remedial actions taken or recommendations for solutions.

Potential problems shall be addressed at the time of occurrence to the COR, and/or CO but shall also be included in the MSR. Provide network impacts, downtime, scheduled/unscheduled maintenance, and other concerns.

c. A summary of the highlights of the previous month’s activities. The MSR shall include the key technical milestones met or actions accomplished. Also include planned work for the next period, deliverable status information on all active tasks, any problem areas, and other relative information impacting their attainment. Address staffing issues that affect the successful completion of all task order requirements.

d. Recommendations and/or actions that the Contractor took to overcome delays due to technical, regulatory or staffing issues.

e. Description of anticipated activities for the next reporting period, such as description of any travel or unique services to be provided and other relative information as necessary.

2.2.3 Quality Control Plan (QCP).

The Contractor shall develop and maintain a QCP to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The COR will provide a written notice of any changes to be made to QCP or notice of acceptance in writing to the Contractor. The Contractor shall e-mail the QCP to the CO and the CORs for the Government’s acceptance no later than five

(5) calendar days after contract award.

2.3 Services Summary and Method of Surveillance.

The Government will use the following standards to determine Contractor performance and will compare Contractor performance to the Acceptable Quality Level (AQL).

Performance Objective PWS Paras AQL/Performance Threshold

(Performance is acceptable if…) Surveillance/ Monitoring Method

Assist in researching and developing, aligning strategic business plans.

2.1.1.1 No more than one (1) missed

suspense in a six month period

Customer Feedback/Valid Customer Complaint

(Performance is acceptable if…) Surveillance/ Monitoring Method

Attend conferences, workshops, seminars geared to health care information systems and health care information technology with the Government PM and assist the Government by recommending technology solutions on Telehealth projects.

2.1.1.3 Meeting minutes are due to the

Government PM no later than (NLT) five (5) calendar days after attendance.

100% inspection

Monitor and report progress; assist with the acquisition and employment of project resources.

2.1.1.4

No more than one (1) due date is missed per six month period

Customer Feedback/Valid Customer Complaint and/or 100% inspection by the

COR

Conduct site visits assessing the clinical workflow, business practices, as well as the facility/network requirements required for Telehealth and imaging systems.

2.1.1.6 No more than one (1) customer

complaint received per assesment

Customer Feedback/Valid Customer complaint

Collect and assemble workload data.

Conduct acceptance testing to confirm systems clinical efficacy and compliance to defined requirements.

2.1.2.8 No more than one (1) customer

complaint received per test

Customer Feedback/Valid Customer complaint

Achieve expected results based on assessment needs of field sites and ensuring to uphold existing policies, plans, guidance and processes.

2.1.1.7 No more than one (1) customer

complaint received based on needs of the field sites

Customer

(Performance is acceptable if…) Surveillance/ Monitoring Method

Provide Tier I and Tier II level technical resource and information center advice on equipment, software, and information systems for Telehealth equipment and applications to include answering incoming calls, and solving technical and automation problems.

Emergency requests shall be resolved or escalated to the next Tier level within 72 hours from the time request is reported.

Routine requests shall be resolved according to established resolution timelines agreeable between the Contractor and the Government.

2.1.2.1 Answer 98% of calls, provide

successful resolutions to 95% of questions within the established timeframes for emergency and routine requests.

Customer

Collaborate and assist with AFMLO at Fort Detrick on configuration and inventory management of telemedicine and imaging equipment in support of Telehealth programs.

2.1.2.2 No more than two (2) errors per

project within 6 month period

Customer Feedback/Valid Customer Complaint

Provide technical expertise on requirements on telemedicine project to vendors and contractors.

2.1.2.5 No more than one (1) missed

suspense per project per six (6) month period

Customer

3. GENERAL REQUIREMENTS

3.1 Contractor General Support.

26T3.1.1 Continuation of Services.26T The Contractor shall ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that impact to the Government is minimal and position vacancies do not exceed 10 calendar days.

26T3.1.2 Vacancies.26T Shall not exceed 30 calendar days in length. The Contractor will not bill for and the Government will not pay for anytime position(s) that are vacant.

26T3.1.3 Professionalism.26T The CO may request that any Contractor whose conduct, in the opinion of the CO, interferes with proper order or professionalism at the installation where services are performed, be removed from such installation and the Contractor shall comply with such request. The Contractor shall present a neat, well-groomed appearance and neat, clean, business attire clothing shall be worn. The Contractor shall be required to observe all base and facility parking, safety and traffic regulations that apply to all facility employees.

26T3.1.4 Common Access Card (CAC).26T Each Contractor employee shall have the CAC in their possession at all times while working on any government installation and shall surrender the CAC at the end of his/her employment under this contract or when the CAC expires, whichever occurs first. The loss of any pass and identification items shall be reported as soon thereafter as possible to the issuing activity and the COR.

26T3.1.5 Contractor Identification.26T When conversing with Government personnel during business meetings, over the telephone or via electronic mail, Contractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractor personnel shall identify themselves as a contractor on any attendance sheet or any coordination documents they may review. Signature blocks shall identify their company affiliation. The Contractor shall follow any other applicable workplace policies.

3.1.6 Section 508 Compliance26T.26T The Contractor shall support the Government in its compliance with Section 508 throughout the development and implementation of the work to be performed. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S. Code.

794d), and implemented by 36 Code of Federal Regulations (CFR) 1194, requires that when Federal agencies develop, procure, maintain, or use electronic IT, federal employees with disabilities have access to and use of information and data that is comparable to the access and use by federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency. For additional Section 508 information, the Contractor should review the following websites:

http://www.section508.gov http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources

3.2 Government Furnished Property/Information (GFP/GFI).

The Contractor shall ensure accurate control and accountability of all GFP/GFI in accordance with the Government property clauses incorporated into the basic contract. The following GFP/GFI will be provided to the Contractor, on-site.

3.2.1 Documents, Data Rights and Intellectual Property. The Government will furnish or make available to the Contractor any documentation/material deemed necessary to accomplish requirements of this contract. Documents include access to databases, reference materials, and most unclassified AF policy documents. The Government will retain ownership of all data entered, processed, or generated by the Contractor in the performance of the tasks set forth in the PWS. Provisions of Federal Acquisition Regulation (FAR) 52.227-11, Patent Rights— Ownership by the Contractor (2007) will be applied to the contract. The full text of the clause may be accessed electronically at 35TUhttp://farsite.hill.af.mil/U35T.

3.2.2 Local Area Network (LAN). Contractor with a valid National Agency Check with Inquiries (NACI) verified through the Joint Personnel Adjudication System (JPAS) roster of validation from the Contractor’s security manager shall be provided access to the AFMS’s unclassified computer network and its inherent capabilities including, but not limited to: internet access, electronic mail, file and print services, and dial-in network access. The Contractor shall be aware of and abide with all Government regulations concerning the authorized use of the Government’s computer network.

3.2.3 Workspace. The Government will provide the Contractor working on site: office work space, desk, chair, filing cabinet, laptop and docking station, monitor, software, a CAC, telephone, access to LAN printers, scanners, fax machines, and miscellaneous office supplies.

The Government will provide other workspace amenities for individuals with disabilities in accordance with Section 508 laws. The Government will not be liable for any injury to the Contractor’s personnel or damage to the Contractor's property unless such injury or damage is due to negligence on the part of the Government and is recoverable under the Federal Torts Claims Act, or pursuant to other Federal statutory authority.

3.3 Security Procedures

Personnel clearance level required under this contract is Unclassified (UNCLAS). However, the CO must be kept abreast of issues dealing with the security clearances or certifications. No foreign national candidates shall be utilized within the scope of this contract without prior approval of the Government. In addition to the below and due to the nature of the work that the Contractor shall likely be exposed to, the Contractor shall sign and comply with Appendices C and D prior to commencing work in support of this performance-based work statement (PWS).

3.3.1 Security Provisions. The Contractor shall fully adhere with the provisions of the referenced publications by having each of their on-site employees submit the appropriate forms and maintain a favorable suitability determination to continue performing under this contract.

Within 14 calendar days after the Period of Performance (PoP) start date, the Contractor shall submit on-site employees’ names, and contract numbers, required/prospective start dates, and http://farsite.hill.af.mil/ telephone contact numbers to the Service Contract Manager and the Unit Security Manager identified in the contract.

3.3.2 SF-85 (Public Trust). The Contractor shall ensure that the Contractor’s personnel assigned to staff this requirement complete the SF-85 in the Electronic Questionnaires for Investigations Processing (e-QIP) after the Unit Security Manager contacts the Contractor’s personnel to establish an account in e-QIP Direct.

3.3.3 Joint Personnel Adjudication System (JPAS) Verification. A favorable report, verified through JPAS, is required as a condition of support at DHHQ under this contract. The Contractor shall understand that, while the unit Commander may allow contracted personnel temporary or interim access to government systems in non-sensitive positions pending the outcome of the NACI (usually through a 90-day waiver), contracted personnel will be immediately removed from the position if the NACI returns with unfavorable or denied adjudication.

3.3.4 Security Education. The Contractor shall be required to complete the security education training per DoD 5200.1-R (Information Security Program Regulation), AFI 31-401 (Information Security Program Management), and AFI 31-601 (Industrial Security Program Management).

All training is mandatory, to include initial, refresher, quarterly, annual, security and awareness training. Mandatory training also includes Anti-terrorism Awareness training and Operational Security (OPSEC) training. OPSEC training will also address specific security criteria for protecting critical information and OPSEC indicators within the Contractor's duties.

3.4 Travel.

The Government requires the Contractor to travel in order to meet the requirements in this PWS.

The Government expects to authorize the Contractor to travel an average of 12 times per year in the Continental United States and outside of the Continental United States over the contract period of performance. The Government estimates that each trip will average four (4) weekdays in duration, two (2) of which are travel days.

3.4.1 Travel Guidance. Contractor travel shall be in accordance with the Joint Travel Regulations: https://www.defensetravel.dod.mil/Docs/perdiem/JTR.pdf).

3.4.2 Travel Pre-Approval. The Contractor shall obtain written (emailed) authorization for travel from the COR prior to arranging travel logistics: all passenger transportation, lodging, and subsistence. The Contractor shall email the following information to the COR when seeking approval for travel: destination; dates; purpose; and the estimated cost of the trip broken down by airfare, lodging, meals and incidental expenses, car rental (if approved by the COR), taxi/parking, and other miscellaneous costs.

3.4.3 Travel Reimbursement. The Contractor shall invoice the Government for travel reimbursements in accordance with FAR 31.205-46. The Contractor shall notify the Government when invoiced travel expenditures are 75% of awarded travel funds. The Contractor shall travel using the lowest cost mode of transportation commensurate with the mission requirements.

3.4.4 Trip Report. The Contractor shall submit Trip Reports (TRs) within five (5) calendar days after travel completion. TR contents shall include:

• Supporting documents for each traveler: airline ticket/receipt, hotel invoice, car rental, gas, parking, tolls, etc.

• Inclusive Dates of Travel

• Destination

• Purpose

• Individuals Contacted

• Brief Synopsis

• Issues & Challenges

• Recommendations

• Signature Block

3.5 Place of Performance and Hours of Operation.

The Contractor shall comply with established security procedures for entering the installation and its facilities to include any special security procedures that may be established for entry to restricted, mission essential or vulnerable areas. The Contractor shall adhere to all announced guidance when the installation alters its security condition.

3.5.1 Primary Place of Performance. The work to be performed under this contract shall be performed at the Defense Health Headquarters (DHHQ), Falls Church, VA; and at the Defense Medical Logistics Agency, Fort Detrick, MD. The Contractor shall provide one (1) Project Manager Level III and one (1) Systems Analyst Level II to support onsite in Falls Church, VA two (2) days a week, and provide support onsite at Fort Detrick, MD three (3) days a week. The Contractor shall provide one (1) Project Manager Level III to provide support onsite at Falls Church, VA five (5) days a week. The Contractor shall on occasion be required to attend briefings or training at Bolling AFB, Fort Detrick, the Pentagon, or other locations within the Washington DC area. Defense Health Headquarters (DHHQ), Falls Church, VA; and the Defense Medical Logistics Agency, Fort Detrick, MD are smoke-free facilities.

Defense Health Headquarters 7700 Arlington Blvd.

Falls Church, VA 22042

Defense Medical Logistics Agency – Defense Heath Agency 693 Neiman Street Fort Detrick, MD 21702

3.5.2 Work Hours. A typical work day for the Government site is eight (8) hours between the hours of 7:00 am to 6:30 pm local time, Washington DC, Monday through Friday. The Government reserves the right to change hours of operation or restrict Contractor’s access.

3.5.3 Scheduled Government Holidays. Government holidays (non-workday weekdays) are New Year’s Day; Dr. Martin Luther King, Jr. Birthday; Presidents’ Day; Memorial Day;

Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day; and Christmas Day.

3.5.4 Facility Closures. The Government will notify the Contractor of anticipated closure of the facility, (i.e., training, holidays, administrative leave granted to the entire staff, or other closure including down days) five (5) business days in advance or as soon as possible. A down day is a day that the USAF leadership designates as a minimal manning/liberal leave day. In the event of unplanned closure of the facility due to natural disasters, military emergency or severe weather, the Government will notify the Contractor in the same manner as the Government notifies Washington D.C. area civilian personnel. In the event of emergencies, base or facility closures, or other reason the Contractor’s Government site workspaces are not available to Contractor personnel, the Contractor must have a plan (submitted as part of the Contractor’s proposal) to fulfill the PWS requirements from an off-site location. The Contractor shall submit updates to this plan if changes occur.

3.5.5 Telework.

Telework is authorized for this PWS. The Contractor telework policy and procedures should be closely aligned to that of the Government to ensure continuity and timeliness in completing tasks. The Contractor shall agree to a telework schedule with the Government PM. The Government shall have final approval of the telework schedule. Contractor shall propose an alternate work location of either his/her home or Contractor’s office. Telework is authorized in the event of unplanned closure of the facility due to natural disasters, military emergency or severe weather.

3.6 Privacy of Information.

The Contractor shall not release any personnel or medical/patient information to include patient content with personal health information. The Contractor shall comply with information privacy guidance in Appendix A.

3.6.1 Privacy Act of 1974. The Privacy Act of 1974 (5 U.S.C. § 552a), which includes Public Law 100-503, Department of Defense Directive (DoDD) 5400.11, and DoD 5400.11-R and must be treated as FOR OFFICIAL USE ONLY.

3.6.2 Need to Know. Contractor shall provide patient information only to Government employees, Government Contractor, and Subcontractors having a need-to-know such information in the performance of their duties for this contract.

3.7 Nonpersonal Services.

The Government will neither supervise the Contractor nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules, for the Contractor. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. The Contractor shall immediately notify the CO if any

Government action(s) constitute or have a perception of being personal services. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the Contractor shall be the sole responsibility of the Government.

3.8 Period of Performance.

The period of performance on this contract shall be a twelve (12) month base year, and two (2) 12 month option periods.

APPENDIX A: APPLICABLE PUBLICATIONS

Publications and forms are available electronically through the internet. Publications and forms applicable to this PWS are coded as mandatory. The Contractor shall comply with mandatory publications and forms to the extent specified in this PWS. The Contractor shall be responsible for all updates, supplements, and amendments to mandatory documents through the life of this contract. Publications applicable to the PWS, include, but are not limited to, those listed below.

The Contractor is obligated to follow all applicable publications. These publications are available online and are maintained by the Government. Supplements or amendments to listed publications from any organizational level may be issued during the life of the contract.

DoD Directives.

DoD Directives can be found at Uhttp://www.dtic.mil/whs/directives/index.htmlU. Consult this site for the latest change. Regulations are followed by a “-R” (e.g., DoD 6025.18-R) and can be located on the website by clicking on “Publications” instead of “Directives.”

PUB NO. TITLE DATE CHANGE

DoD 5200.2R DoD Personnel Security Program Jan 87 Ch 1, Feb 90 Ch 2, Jul 93 Ch 3, Feb 96

DoD 6025.18R DoD Health Information Privacy Regulation Jan 03

DoD 6010.13-M Medical Expense and Performance Reporting System for Fixed Military Medical and Dental Treatment Facilities Manual

Apr 08

DoDD 5400.11R DoD Privacy Program May 07 DoDD 5500.07 Standards of Conduct Nov 07 DoDD 55007.07R Joint Ethics Regulation Nov 11 Changes 1-7

DoDD 6040.41 Medical Records Retention and Coding at Military Treatment Facilities Apr 04

DoDD 8190.3 Smart Card Technology Aug 02 DoDD 8500.01E Information Assurance Oct 02

DoDI 1402.5 Criminal History Background Checks on Individuals in Child Care Services Jan 93

DoDI 3020.37 Continuation of Essential DoD Contractor Services During a Crises Nov 90 Ch. 1, Jan 96

DoDI 6000.11 Patient Movement Sep 98

DoDI 6015.23

Delivery of Healthcare at Military Treatment Facilities: Foreign Service Care; Third Party Collection; Beneficiary Counseling and Assistance Coordinators (BCACs)

Oct 02

DoDI 6025.8 Ambulatory Procedure Visit (APV) Sep 96

DoDI 6040.42 Medical Encounter and Coding at Military Treatment Facilities Jun 04

DoDI 6040.43 Custody and Control of Outpatient Medical Records Jun 04 http://www.dtic.mil/whs/directives/index.html

PUB NO. TITLE DATE CHANGE

DoD 5210.42R Nuclear Weapons Personnel Reliability Program (PRP) Regulation Jun 06

DoD 8580.02R HIPAA Security Rule Jul 07

Air Force Instructions/Manuals.

The Air Force’s E-Publishing website is at Uhttp://www.e-publishing.af.milU. Consult this site for the latest change.

PUB NO. TITLE DATE CHANGE

AFMAN 10-3902 Nuclear Weapons Personnel Reliability Program Nov 06 Ch 1, Sep 08 AFH 33-337 Tongue and Quill Aug 04

AFI 31-204 Air Force Motor Vehicle Traffic Supervision, Chapter 3 Jul 00 Ch 1, Jul 07

AFI 31-501 Personal Security Program Management Jan 05 AFI 31-601 Industrial Security Program Jun 05 AFI 33-129 Web Management and Internet Use Feb 05 Through IC-2 AFI 33-200 Information Assurance Management Dec 08 AFI 33-322 Records Management Program Oct 03 AFI 33-332 Privacy Act Program Jan 04

AFI 33-364 Records Disposition – Procedures and Responsibilities Dec 06

AFPD 33-3 Information Management Mar 06 Ch 1, Sep 07 AFMAN 33-363 Management of Records Mar 08 AFI 34-242 Mortuary Affairs Program Apr 08 Ch 1, Apr 08 AFI 36-2910 Line of Duty (Misconduct) Determinations Oct 02 AFI 36-3002 Casualty Services Jul 05 AFI 40-102 Tobacco Use in the USAF Jun 02

AFI 41-102

The Medical Expense and Performance Reporting System For Fixed Military Medical and Dental Treatment Facilities

Mar 08

AFI 41-210 Patient Administrative Functions Mar 06

AFI 41-217 Health Information Assurance for Military Treatment Facilities Dec 05

AFJI 41-315 Patient Regulating to and Within the Continental U.S. Mar 90

AFI 44-102 Medical Care Management May 06 AFI 44-119 Clinical Process Improvement Sep 07

AFI 48-105

Surveillance, Prevention, and Control of Disease and Conditions of Public Health or Military Significance

Mar 05 Ch 1, Aug 06

AFI 48-123 Medical Examinations and Standards Jun 06 AFI 63-124 Performance-Based Services Acquisition (PBSA) Aug 05

INFORMATION SOURCE LOCATION

http://www.e-publishing.af.mil/

INFORMATION SOURCE LOCATION

The Unified Biostatistical Utility (UBU)

- MHS Coding Guidelines

Uhttp://www.tricare.mil/ocfo/bea/ubu/coding_guidelin es.cfmU.

The Unified Biostatistical Utility (UBO) programs: Third Party Collections (TPC), Medical Services Account (MSA), and Medical Affirmative Claims

(MAC)

Uhttp://www.tricare.mil/ocfo/mcfs/ubo/index.cfmU

CHCS Software Configuration Management Release Notes Uhttp://www.chcs.org/U

Military Health System Guide to Access Success Uhttp://www.tricare.mil/tma/tai/cguide.aspxU

Defense Enrollment Eligibility Reporting System (DEERS) Uhttp://www.tricare.mil/DEERSU

Patient Safety Guide Uhttp://www.tricare.mil/ocmo/U

American College of Surgeons (ACS) National Surgical Quality Improvement Program (NSQIP) program

Uhttps://acsnsqip.org/login/default.aspxU http://www.tricare.mil/ocfo/bea/ubu/coding_guidelines.cfm http://www.tricare.mil/ocfo/bea/ubu/coding_guidelines.cfm http://www.tricare.mil/ocfo/mcfs/ubo/index.cfm http://www.chcs.org/ http://www.tricare.mil/tma/tai/cguide.aspx http://www.tricare.mil/DEERS http://www.tricare.mil/ocmo/ https://acsnsqip.org/login/default.aspx

APPENDIX B: BUSINESS ASSOCIATE AGREEMENT

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA.

Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean Office of the Air Force Surgeon General, Healthcare Operations Directorate.

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45

CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and/or HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of this Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, and corresponding DoD HIPAA Issuances, as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524 and corresponding DoD HIPAA Issuances.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526, and corresponding DoD HIPAA Issuances.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528 and corresponding DoD HIPAA Issuances.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of the HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in this Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d)…