Attachment__2__PWS_-CPI_-7_Jul_2016.pdf

AIR FORCE MEDICAL SUPPORT AGENCY (AFMSA)

PERFORMANCE WORK STATEMENT (PWS)

FOR

CONTINUOUS PROCESS IMPROVEMENT (CPI)

Falls Church, VA

7 July 2016

ACQUISITION SENSITIVE

Table of Contents

1. DESCRIPTION OF SERVICES

1.1 Background

1.2 Scope

2.0 SUMMARY OF REQUIREMENTS:

2.1 Description of Duties/Qualifications:

2.2 Description of Duties/Qualifications:

2.2.8 Minimum Qualifications:

2.3 Deliverables

2.3.1 Monthly Status Report (MSR)

2.3.2 Quality Control Plan (QCP)

2.4 Services Summary

3. GENERAL REQUIREMENTS

3.1 Requirements Common to All Contractor Personnel

3.1.1 Contractor Personnel Conduct

3.1.2 Software and Language Proficiency

3.1.3 Personnel Vacancies

3.1.4 Continuation of Services

3.1.5 Treatment of sensitive information

3.1.6 Contractor Identification

3.1.7 Personal Services

3.2 Government Furnished Services/Information/Property/Materials (GFS/I/P/M)

3.3 Travel

3.3.1 Travel Guidance

3.3.2 Travel Pre-Approval

3.3.3 Travel Reimbursement

3.3.4 Trip Report (TR)s

3.4 Security Procedures

3.4.1 SF-85 (Public Trust)

3.4.2 Joint Personnel Adjudication System (JPAS) Verification

3.4.3 Security Education

3.5 Place of Performance

3.6 Post Award Meeting

3.7 Section 508 Compliance

3.8 Local Area Network (LAN)

APPENDIX A: APPLICABLE PUBLICATIONS

APPENDIX B: BUSINESS ASSOCIATE AGREEMENT

1. DESCRIPTION OF SERVICES

1.1 Background

The Air Force Medical Service (AFMS) is a complex healthcare system encompassing 76 worldwide Military Treatment Facilities (MTFs) providing services to over 2.6 million beneficiaries. The AFMS medics and their leaders are committed to providing world-class care at home and at deployed locations. As leading non- AFMS healthcare organizations adopt concepts such as: Continuous Process Improvement (CPI), safety, reliability and transparency, it is critical the AFMS embrace these leading practices in order to provide high quality, safe, and cost effective healthcare. In pursuit of this aim, the Air Force Medical Support Agency (AFMSA) leadership is requesting CPI consultant expertise to assist the AFMSA in evaluating the findings and identify gaps in current processes compared with leading industry practices to develop a prioritized framework and action plan to facilitate the AFMS progress towards a high reliability healthcare organization. To further the goal of Air Force (AF) CPI, the AFMS is strengthening its commitment to CPI with a goal of “Every Airmen, Every Day, a Problem Solver” as the nucleus for achieving the system change required to reach the visions of Zero Harm and Healthiest, and Highest Performing Segment of the UnitedStates. Population by 2025. The AFMSA Commander (AFMSA/CC), leads and is responsible for transformation within the

AFMSA.

1.1.1 AF Smart Operations for the 21st Century (AFSO21) began nearly a decade ago as a campaign focused on growing Airmen into effective and efficient thinkers and problem solvers, primarily through the use of Lean-Six Sigma. Although resourced with a major push for education, action and results, the adoption and widespread use of Lean and other CPI methods (i.e.,Six Sigma, Business Process Reengineering, Theory of Constraints) met with limited success. The experience was no different within the AFMS.

1.1.2 At the same time the AF was reviewing its success with AFSO21, in 2014 the Secretary of Defense mandated an assessment of Military Health System access, patient safety and quality of care performance. The AFMS subsequently contracted external consultants to perform a gap analysis and identify actionable recommendations for the AFMS to adopt leading practices in safety, high reliability and CPI. As a result, the AFMS began its transformation to a high reliability health system focused on provision of safe, superb quality patient care in-garrison and deployed. This transformation is termed Trusted Care and focuses on: 1) applying proven high reliability principles; 2) improving leadership engagement; 3) developing a culture of safety with a single-minded focus of Zero Harm; and 4) establishing CPI as the method by which we manage daily operations. In addition to Trusted Care, the AF Surgeon General established the strategic vision for the AFMS that “…our supported population is the healthiest and highest performing segment of the U.S. by 2025.” Achieving this vision under the AF Medical Home (AFMH) construct requires a supporting learning and innovation system to continuously improve processes for the delivery of health and healthcare services.

1.2 Scope

This will be an Advisory and Assistance Services (A&AS) non-personal service contract. This Performance Work Statement (PWS) defines requirements for CPI expertise and experience required to facilitate the AFMS and AFMSA in establishing CPI the keystone by ingraining it as the method by which the AFMSA is managed. It delineates the expected scope of activities to accelerate this transformation. The support includes: advancing the Government’s overall effectiveness and efficiency; recommending business transformation efforts; sharing data;

building enterprise solutions; building business architecture; and managing and integrating CPI into daily and strategic operations. The end result of the contractor’s support shall be achievable recommendations for improvements with structure, processes and inherent practices in a highly reliability healthcare organization. AFMSA anticipates six (6) projects to be conducted in a 12-month period of performance with the possibility that some projects may be conducted simultaneously. AFMSA estimates the duration of each project will last two (2) weeks each.

The contractor shall use evidence-based CPI concepts, tools and management prescriptions consistent with AF CPI to ensure work within the area of responsibility is complete, meets customer requirements, and is of high quality.

2.0 SUMMARY OF REQUIREMENTS: The following lists key tasks and defines personnel qualifications and labor categories.

2.1 Description of Duties/Qualifications:

One (1) Black Belt (BB)/AFSO21/Lean Six Sigma (LSS) Subject Matter Expert (SME) for 480 hours). (1) Management Assistant (MA) for 480 hours. The contractor shall provide overall direction to the contract team members in accordance with the PWS and in consultation with the Contracting Officer’s Representative (COR). The BB/AFSO21/LSS SME here after will be referred to as the BB.

2.1.1 Tasks

2.1.2 Assist in applying AFSO21/LSS tools and methodologies toward the continuous improvement of AFMSA/AFMS processes.

2.1.3 Assist and support AFMSA in identifying key opportunities that improve climate assessment gaps.

2.1.4 Facilitate planning and executing follow-up of CPI projects using the full complement of CPI tools and techniques to include completion of the 8-Step Process on CPI programs described below.

1. Clarify and Validate the Problem.

2. Break Down the Problem and Identify Performance Gaps

3. Set Improvement Target

4. Determine Root Cause

5. Develop Countermeasures

6. See Through

7. Confirm Results and Process

8. Standardize Successful Processes

2.1.5 Write and complete CPI reports, presentations and summarize activities and findings in hard and electronic format. These deliverables shall be delivered at a date and time specified by the COR.

2.1.6 Participate in the development, reviews and facilitates training on the use of CPI tools and techniques. The training shall be delivered to the COR in hard and electronic format and delivered at a date and time specified by the COR.

2.1.7 Mentor AFMSA Green Belt (GB) and BB candidates to project completion/certification, individually, or in a conference room setting. Assist the AFMSA GB candidates develop the skills to continue the use of CPI tools and techniques in the diagram below:

2.1.8 Execute exceptional interpersonal communication skills and interacts professionally with groups.

2.1.9 Stimulate the interaction and ideas to AFMSA selected GB/BB candidates to project completion.

2.1.10 Complete a quarterly progress report beginning first quarter after contract award.

Reports shall highlight progress made to date, obstacles to successful completion of duties, and recommendations to accelerate progress. The report shall include assessment of overall progress

Support the successful implementation of strategically-aligned CPI activities

IMPLEMENTATION

Facilitate work-process value stream mapping and analysis on an On-going basis

Facilitate CPI goal alignment, encourage commitment to CPI and seek to standardize CPI as a way of work life

Structure/Behavior Support employee CPI education, training, and use of CPI tools and techniques within the AFMSA against projected timelines for completion of activities, as well as performance against designated targets. Format for this report is at the discretion of the COR.

This quarterly report is due the 15th day business day after the end of the each quarter.

2.1.11 Create and provide an annual progress report. Reports shall include: progress made over the previous year; current performance against targets designated at start of contract. Format for this report is at the discretion of the COR. This annual report is due the 15th day after the end of the contract performance period.

2.1.12 BB Minimum Qualifications: The contractor shall provide a BB SME that meets the following standards:

2.1.12.1 Master’s Degree in Engineering, Healthcare, Business or Sciences and a minimum 10 years’ experience in a process improvement function.

2.1.12.2 Read, write, speak and understand English.

2.1.12.3 BB training and certification in Lean/Six Sigma from a nationally recognized certifying organization with seven (7) years of experience as a BB.

2.1.12.4 Two (2) years of experience managing/working with Department of Defense (DoD) or AF transformation.

2.1.12.5 Three (3) years of experience working with senior level (e.g., Chief Executive Officer, Chief Operating Officer, General Officers, Colonels and GS-15) leaders in a complex organization with multiple service lines/value streams. Possess an acute understanding of organizational issues and challenges.

2.1.12.6 Three (3) years of experience guiding leadership teams and project teams at all levels of an organization to develop a workable set of goals, build unit understanding and execute a CPI management system. Familiar with project management approaches, tools and phases of the project lifecycle.

2.1.12.7 Ability to clearly articulate messages to a variety of audiences as deemed necessary.

2.1.12.8 Seven (7) years of experience with planning and facilitation skills.

2.1.12.9 Seven (7) years of experience in spending time in place of work, observing, asking questions, coaching and allowing proactive dialogue.

2.1.12.10 Seven (7) years of experience with change management with large-scale organizational change efforts. Shall have an understanding of how people go through a change and the change process; knowledge of change management principles; and methodologies and tools. Skilled at evaluating and ensuring personnel readiness for change.

2.1.12.11 Seven (7) years of experience planning strategy and tactics. Shall have the ability to work autonomously, relying on their experience and judgment to plan and accomplish goals.

2.1.12.12 Seven (7) years of experience with building relationships with the people performing the work, while being respectful of their knowledge and experience. Skilled in the following:

(1) Investing the time necessary to coach using learn-by-doing methods; (2) Assists those being coached to maintain focus on the process and goal at hand; and provides feedback that is clear, relevant, non-evaluative, helpful, and positive.

2.1.12.13 Three (3) years of experience with government regulations, policies, procedures, and limitations within their scope of responsibilities.

2.1.12.14 The ability to coordinate with the appropriate management levels, as required by applicable policies or procedures.

2.2 Description of Duties/Qualifications: One (1) Management Assistant (MA) for 480 hours. The contractor shall provide overall direction to the contract team members in accordance with the PWS and in consultation with the Contracting Officer’s Representative

(COR).

2.2.1 Assist the BB, AFMSA/CC, and staff in monitoring, tracking and providing administrative and support of CPI activities.

2.2.2 Provide excellent customer service and communication with BB, AFMSA/CC and staff, CPI team leads/members, and other program/project offices external to AFMSA/AFMS.

2.2.3 Maintain AFMSA/CC and staff customer support by scheduling courses, receiving and distributing taskings and suspenses, meeting internal/external suspense and related CPI tasks as required completing all on time or ahead of schedule.

2.2.4 Maintain comprehensive data management files on AFMSA/CC’s critical CPI management information and activities.

2.2.5 Create and produce presentations and graphic products (e.g., posters and graphs) for CPI activities in accordance with a date and time specified by the COR.

2.2.6 Maintain skills in office automated software and use standard DoD-provided software to include business process management software and cloud-based software.

2.2.7 Schedule meetings, events and venues for CPI activities and provide support for events held at AFMSA and within the AFMSA Area of Operations. Disseminate information to all participants.

2.2.8 Minimum Qualifications:

2.2.8.1 Bachelor’s degree in Business Administration or a minimum of five (5) years of administrative experience in a DoD environment.

2.2.8.2 Must be detailed oriented and multi-task capable.

2.2.8.3 Shall be able to read, write and speak in English.

2.2.8.4 Knowledgeable of current standard office automation software programs, tools, and techniques.

2.2.8.5 Knowledgeable of principles, practices, and tools, such as customer surveys, performance measurement, and benchmarking.

2.2.8.6 Ability to interact effectively with high-ranking personnel within and outside the immediate organization.

2.2.8.7 Minimum four (4) years of experience managing/working with DoD or AF projects or CPI preference peferred.

2.3 Deliverables

Deliverables associated with this PWS are specified below. All deliverables shall be submitted in a draft format mutually agreed upon by the contractor and the Government. If the business day falls on a Government observed holiday, or the facility is closed then the deliverable shall be due the next business day.

DELIVERABLE PWS

PARAGRAPH

DELIVERY DATE

Reports, Presentations and Training

2.1.4, 2.1.5, and 2.1.6

Draft and final copies will be delivered both electronically and one hard copy to the COR in accordance with a date and time specified by the COR.

Participate in the development, reviews and facilitates training on the use of CPI tools and techniques

2.1.6 Delivered in hard and electronic format and delivered at a date and time specified by the COR.

Quarterly Progress Report

2.1.10 Due by the 15th business day after the end of the quarter.

Annual Progress Report

2.1.11 Due by the 15th business day after end of the year.

Monthly Status Report

2.3.1 The no later than the tenth 10th business day of every

month.

Quality Control Plan 2.3.2 Within five (5) business days after contract award and any updates thereafter.

Signed Organizational Conflict of Interest

3.1.5 (d) Within ten (10) business days after contract award.

Travel Requests 3.3.2 Submit authorization request for travel ten (10) business days prior to trip.

Trip Reports 3.3.4 Five (5) business days after the trip completion.

2.3.1 Monthly Status Report (MSR)

The contractor shall submit MSRs to the COR no later than the 10th business days of every month reflecting the support provided in the previous month. The MSR shall include the following information:

• A task description of the area(s) of focus being worked

• A narrative review of work accomplished during the reporting period or significant events

• Problem areas with proposed corrective actions

• Proposed staff changes

• Progress report with contract execution trends

• Schedule of activities planned and estimated date/time of completion

2.3.2 Quality Control Plan (QCP)

The contractor shall develop and maintain a QCP to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor shall submit a QCP within five (5) business days after contract award. The COR will provide a written notice of acceptance to the contractor. The Contractor is responsible for contract management.

2.4 Services Summary

Performance Objectives

PWS

Para.

Performance Threshold Surveillance Method

Facilitates planning and executing follow-up of CPI projects using the full complement of CPI tools and techniques to include completion of the 8-Step Process.

2.1.4 No more than two (2) deficiencies, to

include late, missed, unaccomplished responses or suspense, as substantiated by the COR, in any four (4) month period.

Customer Feedback Valid Customer Complaint

Writes and completes CPI reports, presentations and summarizes activities and findings in hard and electronic format.

2.1.5 No more than two (2) deficiencies, to

include late, missed, unaccomplished responses or suspense, as substantiated by the COR, in any six (6) month period.

Customer Feedback Valid Customer Complaint

Performance Objectives

PWS

Para.

Performance Threshold Surveillance Method

Participates in the development, reviews and facilitates training on the use of CPI tools and techniques.

2.1.6 No more than two (2) deficiencies, to

include late, missed, unaccomplished responses or suspense, as substantiated by the COR, in any six (6) month period.

Customer Feedback Valid Customer Complaint

Mentor AFMSA Green Belt (GB) and BB candidates to project completion/ certification

2.1.7 No more than two (2) deficiencies, to

include late, missed, unaccomplished responses or suspense, as substantiated by the COR, in any six (6) month period.

Customer Feedback Valid Customer Complaint

Stimulates the interaction and ideas to AFMSA selected Green/Black Belt candidates to project completion.

2.1.9 No more than two (2) deficiencies, to

include late, missed, unaccomplished responses or suspense, as substantiated by the COR, in any six (6) month period.

Customer Feedback Valid Customer Complaint

3. GENERAL REQUIREMENTS

3.1 Requirements Common to All Contractor Personnel

3.1.1 Contractor Personnel Conduct. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, contractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. The contractor shall follow any other applicable workplace policies. The contractor shall maintain good personal hygiene and a well-groomed, professional appearance. The Contracting Officer (CO) may request that any contractor whose conduct, in the opinion of the CO, interferes with proper order or professionalism at the installation where services are performed, be removed from such installation and the contractor shall comply with such request. The contractor shall be required to observe all base and facility parking, safety and traffic regulations that apply to all facility employees.

3.1.2 Software and Language Proficiency. The contractor shall have the proficiency and ability to manipulate and create documents in structured formats, graphics, tables within text, and multiple columns with the latest version of Microsoft Office Professional Suite.

3.1.3 Personnel Vacancies. In instances where the contractor projects vacancies exceeding 30 business days, the CO and COR shall be notified no later than one (1) business day of the projected vacancy. The contractor shall provide follow-up documentation within 72 hours after notification, stating the date and time the position will be vacant, and the reason for the personnel vacating the position, the anticipated replacement date of personnel, and what management corrective action will be taken to ensure contract mission completion.

3.1.4 Continuation of Services. Whenever possible, the contractor shall provide the Government with a two-week notice prior to loss of current contractor personnel. The contractor shall ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment to ensure impact to the Government is minimal and position vacancies do not exceed 30 business days.

3.1.5 Treatment of sensitive information. Contractor personnel shall not release any personal or medical/patient information to include patient personal health information during the course of this contract. Treatment of information shall be in accordance with the following:

a. Applicable Publications. A list of applicable publications is found at (Appendix A).

b. Business Associate Agreement. The Contractor shall sign and comply with the requirements in (Appendix B).

c. Non-Disclosure Agreement (NDA). The Contractor shall provide the COR with signed NDAs for each Contractor personnel (Appendix C) within ten (10) business days after contract award and on first day of reporting for replacement personnel.

d. Organizational Conflict of Interest: (OCI). The Contractor shall provide to the COR within ten (10) business days after contract award a signed OCI (Appendix D) addressing the activities of all contract personnel. Contractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information). Contractor personnel may receive budget information or analyses, specification or work statements or perform evaluation services that may create current or subsequent OCIs as defined in Federal Acquisition Regulation (FAR), Subpart 9.5. The contractor shall notify the CO immediately when such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid OCI or mitigate. The contractor’s mitigation plan shall be determined to be acceptable solely at the discretion of the CO. In the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary. This may include prohibiting the Contractor from participation in subsequent contracted requirements that are affected by the OCI. (FAR Subpart 9.5)

e. DoD Directives and Instructions Compliance. The contractor shall comply with the latest versions of DoD Directive (DoDD) 8570.1M, Information Assurance Workforce Improvement Program; DoD Instruction (DoDI) 8500.2, Information Assurance Implementation; DoDD 5400.11, DoD Privacy Program; and DoDI 5200.2-R, DoD Personnel Security Program.

f. Other Applicable Regulations. Other Military Health System and AFMSA regulations and other Federal and State laws regarding the treatment of sensitive information may also be applicable.

3.1.6 Contractor Identification. All contractor personnel shall wear a Government issued Common Access Card (CAC) identification badge at all times while performing under this effort.

When attending meetings or answering phones or via electronic mail, the contractor personnel shall identify themselves as a contractor employee to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

3.1.7 Personal Services. The Government will neither supervise the contractor nor control the method by which the contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules, for the contractor. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. The contractor shall immediately notify the CO if any Government action(s) constitute or have a perception of being personal services. These services shall not be used to perform work of a policy/decision making or management nature, inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

3.2 Government Furnished Services/Information/Property/Materials (GFS/I/P/M).

3.2.1 The contractor shall ensure accurate control and accountability of all GFS/I/P/M in accordance with the terms and conditions of this contract. Information provided by the Government and/or developed during the performance period of this contract shall not be disseminated without approval of the project/program manager and shall be the sole property of the Government.

3.2.2 The Government will provide initial passwords to appropriate systems/databases, access to military internet/email, facility entry badges, vehicle passes and escorts (as required), if applicable, contractor employees shall be provided access to Government facilities and Government office space as required for performing work under this contract.

3.2.3 Standard operating procedures will be made available to contractor employees. Initial familiarization/orientation will be provided by the Government agency.

3.2.4 The contractor shall ensure any contractor furnished property/material/equipment meet with local, AF and DoD policies and requirements. If the equipment is connected to authorize military systems, the contractor must allow Government Information Technology personnel access to this equipment for security and software updates and additions.

3.3 Travel.

The Government requires the contractor to travel in order to meet the requirements in this PWS.

The Government expects to authorize the contractor to travel an average of three (3) to four (4) times per year during the contract period of performance. The Government estimates that each trip will average five (5) weekdays of duration, (2) two of which are travel days.

3.3.1 Travel Guidance. Contractor travel shall be in accordance with the Joint Travel Regulations: https://www.defensetravel.dod.mil/Docs/perdiem/JTR.pdf.

3.3.2 Travel Pre-Approval. The contractor shall obtain written (emailed) authorization 10 business days prior to the travel from the COR prior to arranging travel logistics: all passenger transportation, lodging, and subsistence. The contractor shall email the following information to the COR when seeking approval for travel: destination; dates; purpose; and the estimated cost of the trip broken down by airfare, lodging, meals and incidental expenses, car rental (if approved by the COR), taxi/parking, and other miscellaneous costs.

3.3.3 Travel Reimbursement. Contractor shall invoice the Government for travel reimbursements in accordance with the FAR 31.205-46. The contractor shall notify the Government when invoiced travel expenditures are 75% of awarded travel funds. The contractor shall travel using the lowest cost mode of transportation commensurate with the mission requirements. When necessary to use air travel, the contractor shall use economy class and make reservation as soon as the Government authorizes travel in order to minimize higher costs for last minute airline reservations. The contractor shall select lodging accommodations that are the most economically advantageous; to the extent they are available and practicable, commensurate with the mission requirements. Contractor travel shall be in accordance with the Joint Travel Regulations: https://www.defensetravel.dod.mil/Docs/perdiem/JTR.pdf.

3.3.4 Trip Report (TR)s. The contractor shall submit TRs within five (5) business days after travel completion. TR contents shall include:

• Supporting documents for each traveler: airline ticket/receipt, hotel invoice, car rental, gas, parking, tolls, etc.

• Inclusive Dates of Travel

• Destination

• Purpose

• Individuals Contacted

• Brief Synopsis

• Issues & Challenges

• Recommendations

• Signature Block

3.4 Security Procedures.

Minimum facility and personnel clearance level required under this contract is Unclassified.

However, the CO must be kept abreast of issues dealing with the security clearances and/or certifications. No Foreign National candidates shall be utilized within the scope of this contract without prior approval of the Government. In addition to the below and due to the nature of the work that the contractor will likely be exposed to, the contractor shall sign and comply with Appendices C and D prior to commencing work in support of this PWS.

3.4.1 SF-85 (Public Trust). The contractor shall ensure the contractor employee completes the SF-85 (Public Trust) in the Electronic Questionnaires for Investigations Processing (e-QIP) after the Unit Security Manager contacts the contractor employee to establish an account in e-QIP Direct.

3.4.2 Joint Personnel Adjudication System (JPAS) Verification. A favorable report, verified through JPAS, is needed as a condition of support at Defense Health Headquarters (DHHQ) Falls Church VA, Ft Detrick MD, and Joint Base San Antonio under this PWS. The contractor shall understand, while the unit Commander may allow contracted personnel temporary or interim access to government systems in non-sensitive positions pending the outcome of the National Agency Check with Inquiry (NACI) (usually through a 90-day waiver), contracted personnel will be immediately removed from the position if the NACI returns with unfavorable or denied adjudication.

3.4.3 Security Education. The Government activity will administer security education per DoD Manual 5200.01, DoD Information Security Program; Air Force Instruction (AFI) 31-401, Information Security Program Management; and 16-1406 (Air Force Industrial Security Program) The contractor shall attend and complete all Government administered training to include initial, refresher, quarterly and annual security awareness training. Security training also includes Antiterrorism Awareness training and Operational Security (OPSEC) training. OPSEC training addresses specific criteria for protecting critical information and OPSEC indicators within the contractor’s duties. The COR is responsible for ensuring that the Contractor attend or accomplish this training.

3.4.4 Security Provisions. The contractor shall adhere with the provisions of security publications by having on-site employees submit the appropriate forms and maintain a National Agency Check with Inquiries to continue performing under this contract. Within 14 business days after the contract’s period of performance start date, the contractor shall submit on-site employee’s name, contract and task order number, required/prospective start date, and telephone contact number to the Service Contract Manager and the Unit Security Manager(s).

3.4.5 Installation Entry. The contractor personnel shall comply with established security procedures for entering the place of performance installations (paragraph 3.5) and its facilities to include any special security procedures for entry to Restricted Areas or mission essential or vulnerable areas.

3.4.6 The Government reserves the right to terminate entry of any contractor personnel upon disclosure of information that indicates the individual’s continued entry to the installation is not in the best interest of the national security. Additionally, Contractor personnel violation of or deviation from established security procedures may result in confiscation of identification media and denial of future entry to the installation.

3.5 Place of Performance.

Primary place of performance under this contract is at the DHHQ, 7700 Arlington Blvd, Falls Church, VA 22042. The Government may require contractor personnel to attend briefings or training at other locations, such as the Pentagon. The DHHQ (building, parking lot and all surrounding grounds) is a tobacco-free campus.

3.5.1 Work Hours. A typical workweek shall be Monday through Friday and a typical workday shall be eight (8) hours between the hours of 8:00 a.m. to 5:00 p.m. The Government reserves the right to change hours of operation or restrict contractor access. The contractor requires CO approval in order to work outside these typical workday hours.

3.5.2 Facility Closures. The Government will notify the contractor of anticipated closure of the facility, (training, holidays, administrative leave granted to the entire staff, or other closure including down days) five (5) business days in advance or as soon as possible. In the event of unplanned closure of the facility due to natural disasters, military emergency or severe weather, the Government will notify the contractor in the same manner as the Government notifies Washington D.C. area civilian personnel. In the event of emergencies, base or facility closures, or other reason the contractor’s Government site workspaces are not available to contractor personnel, the Contractor must have a plan (submitted as part of the Contractor’s proposal) to fulfill the PWS requirements from an off-site location. The Contractor shall submit to the COR updates to this plan if changes occur. Scheduled Government holidays are as follows: New Year’s Day, Dr. Martin Luther King, Jr. Birthday, President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day and Christmas Day.

3.6 Post Award Meeting.

In accordance with FAR Subpart 42.5, the CO will schedule a post award meeting within 10 business days after contract award. The purpose of this meeting is to initiate the communication process between the COR and the contractor. Anything stated or discussed at this meeting is not contractually binding on either party unless documented by contract modification. The post award meeting will be on-site at the DHHQ. After contract award, both parties will mutually agree to the date and time of this meeting. This meeting shall be at no additional cost to the Government.

3.7 Section 508 Compliance.

The Contractor shall support the Government in its compliance with Section 508 throughout the development and implementation of the work to be performed. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S. Code. 794d) and implemented by 36 Code of Federal Regulations (CFR) 1194, requires that when Federal agencies develop, procure, maintain, or use electronic Information Technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency. For additional Section 508 information, the Contractor should review the following websites:

http://www.section508.gov http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources

3.8 Local Area Network (LAN)

Contractors with a favorable NACI verified through the JPAS roster of validation from the contractor’s security manager will be provided access to the AFMS’s unclassified computer network and its inherent capabilities including, but not limited to: internet access, electronic mail, file and print services, and dial-in network access. The contractor shall be aware of and abide with all Government regulations concerning the authorized use of the Government’s computer network.

APPENDIX A: APPLICABLE PUBLICATIONS

Publications and forms are available electronically through the internet. Publications and forms applicable to this PWS are coded as mandatory. The Contractor shall comply with mandatory publications and forms to the extent specified in this PWS. The Contractor shall be responsible for all updates, supplements, and amendments to mandatory documents through the life of this contract. Publications applicable to the PWS include, but are not limited to, those listed below.

The Contractor is obligated to follow all applicable publications. These publications are available online and are maintained by the Government. Supplements or amendments to listed publications from any organizational level may be issued during the life of the contract.

DoD Directives.

DoD Directives can be found at http://www.dtic.mil/whs/directives/index.html. Consult this site for the latest change. Regulations are followed by a “-R” (e.g., DoD 6025.18-R) and can be located on the website by clicking on “Publications” instead of “Directives.”

DoD Regulations/Manuals/Instructions/Directives.

Air Force Instructions/Manuals.

The Air Force’s E-Publishing website is at http://www.e-publishing.af.mil. Consult this site for the latest change.

Other Guidelines, References and Sources.

http://www.dtic.mil/whs/directives/index.html http://www.e-publishing.af.mil/

APPENDIX B: BUSINESS ASSOCIATE AGREEMENT

Introduction

In accordance with 45 CFR 164.502(e) (2), 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18- R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below).

The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other Personal Identificaftion Information (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances and in reference to this BAA, shall mean [INSERT NAME OF

BUSINESS ASSOCIATE].

Agreement means this BAA together with the documents or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean Headquarters Air Force, Office of the Surgeon General Medical Plans and Programs Directorate

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45

CFR 164.402.

HIPAA Rules means collectively the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act or HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of this Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e) (1) (ii)) and 164.308(b) (2) respectively and corresponding DoD HIPAA Issuances, as applicable the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or as directed by the Covered Entity to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524 and corresponding DoD HIPAA Issuances.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526 and corresponding DoD HIPAA Issuances.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528 and corresponding DoD HIPAA Issuances.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of the HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s).

(i) The Business Associate shall make its internal practices, books and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate.

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in this Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in this Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in this Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in this Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions.

(a) The Covered Entity shall notify the Business Associate of any limitation(s) in the notice of privacy practices of the Covered Entity under 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by fewer than 45 CFR 164.522 and the corresponding DoD HIPAA Issuances, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity.

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response.

(a) In general.

(1) In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall report the breach to the Covered Entity in accordance with Section VII, assess the breach incident, take mitigation actions as applicable and notify affected individuals, as directed by the Covered Entity.

(2) The Business Associate shall coordinate all investigation actions with the Covered Entity and at a minimum, follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

(3) The Business Associate shall, at no cost to the government, bear any costs associated with a breach of PII/PHI that the Business Associate has caused or is otherwise responsible for addressing.

(b) Government Reporting Provisions

(1) If the Covered Entity determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the Covered Entity, regardless of where the breach occurs. If the Covered Entity determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office.

(2) This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business Associate shall implement these breach response requirements immediately upon the Business Associate’s discovery of a possible breach.

(3) The following provisions of Part V set forth the Business Associate’s Privacy Act and HIPAA breach response requirements for all…