Atch_1_-_PWS_dated_22_July_2016_(Revised).pdf

Air Force Medical Operations Agency

Performance Work Statement

For

Air Force Centralized Credentials Verification Office

22 July 2016

TABLE OF CONTENTS

Page

1.0 DESCRIPTION OF SERVICES 3

1.1 Background 3

1.2 Scope 3

1.3 Definitions 3

1.4 Acronyms 3

2.0 SUMMARY OF REQUIREMENTS 5

2.1 Tasks and Responsibilities 5

2.2 General Contractor Requirements 9

2.3 Services Summary 13

2.4 Government Furnished Support 14

2.5 Travel/Other Direct Costs (ODC) 14

2.6 Deliverables 15

3.0 QUALITY CONTROL/ASSUARANCE 17

4.0 NON-PERSONAL SERVICES 18

5.0 CONTRACTOR IDENTIFICATION 18

6.0 HOURS OF OPERATION 18

7.0 APPENDICES

7.1 APPENDIX A Business Association Agreement 19

7.2 APPENDIX B HQ USAF/SG Organizational Conflict of Interest 28

7.3 APPENDIX C HQ USAF/SG Non-Disclosure Agreement 31

7.4 APPENDIX D Customer Complaint Record 33

7.5 APPENDIX E Publications and Regulations 37

1.0 DESCRIPTION OF SERVICES

1.1 Background: The purpose of the Air Force Centralized Credentials Verification

Office (AFCCVO) is to provide a turn-key operation for credentialing support to the Air

Force Medical Service (AFMS) by gathering required credentials, performing Primary

Source Verification (PSV) of applicable credentials, conducting databank queries, and entering all data into the Centralized Credentials Quality Assurance System (CCQAS). The

AFCCVO will also provide required data for future credentialing and privileging decisions to appropriate customers within the AFMS, Air Force Recruiting Services (AFRS), Air

Force Personnel Center (AFPC), Air Reserve Personnel Center (ARPC), Air Force Reserve

Command (AFRC) and Air National Guard (ANG) recruiters and units.

1.2 Scope: AFCCVO will provide credentialing support to the AFMS by gathering required credentials, performing PSV of appropriate credentials and conducting databank queries, entering all data into CCQAS and providing required data for credentialing and privileging decisions to appropriate customers.

1.3 Definitions: The following definitions shall apply to the context of this Performance

Work Statement (PWS). If used outside the context of this PWS, the definitions described by the clause at FAR 52.202-1 Definitions, will apply:

1.3.1 Primary source verification: The process of obtaining information directly from the originating source or the designated agent - one who can verify the accuracy of a qualification reported by a healthcare practitioner. “Copies of diplomas, certificates, licenses, and so forth are not primary source verification. Additionally, documents that are delivered or provided directly from the practitioner are not primary source verification.”

1.3.2 Practitioner: Means any healthcare professional required to have a license, certification, or registration to practice healthcare. The term “provider” in this PWS is used interchangeably with “practitioner”.

1.3.3 Provider: – see Practitioner.

1.4 Acronyms:

ACRONYM DEFINITIONS

AF Air Force

AFCCVO Air Force Centralized Credentials Verification Office

AFIT Air Force Institute of Technology

AFMOA Air Force Medical Operations Agency

AFMS Air Force Medical Service

AFPC Air Force Personnel Center

AFRC Air Force Reserve Command

AFRS Air Force Recruiting Services

ANG Air National Guard

ARC Air Reserve Components

ARPC Air Reserve Personnel Center

CCQAS Centralized Credentials Quality Assurance System

CM Credentials Manager

CMRA Contractor Manpower Reporting Requirements Application

CO Contracting Officer

CVO Credentials Verification Office

C&P Credentialing and Privileging

DHHS Department of Health and Human Services

DMHRSI Defense Medical Human Resources System- Internet

DoD Department of Defense

DPDB Defense Practitioner Data Bank e-PCF Electronic Provider Credentials File (Within CCQAS)

FAR Federal Acquisition Regulation

FSMB Federation of State Medical Boards

FTC Federal Trade Commission

GME Graduate Medical Education

HHS Health and Human Services

HIPAA Health Insurance Portability and Accountability Act

LPN Licensed Practical Nurses

LVN Licensed Vocational Nurses

MHS Military Health System

MPRS Medical Profession Recruiting Station

MTF Military Treatment Facility

NACI National Agency Check with Inquiries

NCRMD National Capital Region Medical Directorate

NoPP Notice of Privacy Practices

NPDB National Practitioner Data Bank

NPI National Provider Identifier

PII Personally Identifiable Information

PCF Provider Credentials File

PCS Permanent Change of Station

PDF Portable Document Format

PGY2 Post Graduate Year 2

PHI Protected Health Information

PII Personally Identifiable Information

POP Period of Performance

PSV Primary Source Verification

PWS Performance Work Statement

SGHQ Clinical Quality Management Division

SSNs Social Security Numbers

RN Registered Nurse

UIC Unit Identification Code

US CERT US Computer Emergency Readiness Team

2.0 SUMMARY OF REQUIREMENTS

2.1 Tasks and Responsibilities: The contractor shall provide labor and management resources not otherwise furnished by the government to perform the following technical services associated with the scope and desired capabilities defined in this

PWS during the Period of Performance (POP).

2.1.1 Description of Duties: The contractor shall perform the following duties:

2.1.1.1 Establish and manage a centralized Credentials Verification Office

(CVO) in San Antonio, TX for the Clinical Quality Management Division, Air

Force Medical Operations Agency (AFMOA/SGHQ).

2.1.1.2 Facilitate and support the Credentialing and Privileging (C&P) processes performed by Credentials Managers (CM) at approximately 76 active duty Military Treatment Facilities (MTFs) and approximately 144 non-collocated Air Reserve Components (ARC) across the Air Force (AF).

2.1.1.3 Facilitate and support the credentialing process for potential new accessions, deferred and non-deferred providers; providers enrolled in Air

Force Institute of Technology (AFIT) training programs, healthcare students enrolled in military scholarship programs.

2.1.1.4 Collect the credentials outlined in AFI 44-119, process IAW AFI 44-

119 and AFMOA/SGHQ, and transmit to the end user the C&P information electronically and via hard copy (when required) for healthcare providers required to obtain a license, certification or registration.

2.1.1.5 Capture receipt date stamp on all credentialing documentation received.

2.1.1.6 Create or update the existing (if record has previously been established) electronic Provider Credentials Files (e-PCFs) in CCQAS.

2.1.1.7 Perform PSVs of required credentials (as established in AFI 44-119, Medical Quality Operations), and perform required databank queries for non-privileged and privileged healthcare personnel.

2.1.1.8 Identify incomplete new accession applications and obtain the required information to complete the credentialing process.

2.1.1.9 Identify and elevate potential red flags identified during PSV and databank querying. Report red flag on new accession applicants to accession source (AFRS/ANG/HQ AF Reserve) and the Contracting Officer

Representative (COR) for resolution.

2.1.1.10 Perform a one-time National Practitioner Data Bank (NPDB) query for Registered Nurses (RNs), Licensed Vocational Nurses (LVNs), and

Licensed Practical Nurses (LPNs), if a previous query result is not on file in the e-PCF.

2.1.1.11 Scan as a Portable Document Format (PDF) file, appropriately name and upload credentials documentation, verifications and query results to the e-

PCFs in accordance with (IAW) the standard naming conventions provided by

AFMOA/SGHQ.

2.1.1.12 Transmit credentialing summaries, e-PCFs, and other credentialing information and documentation to requestors as established by

AFMOA/SGHQ.

2.1.1.13 Maintain the e-PCFs and if provided, the established 6-part Provider

Credentials File (PCFs), on AF providers assigned to non-Military Treatment

Facility (MTF) administrative positions, civilian medical treatment facilities or out-of-service training programs at non-Department of Defense (DoD) institutions. The contractor shall generate monthly expiration reports within

CCQAS to track time limited credentials. The contractor shall obtain and upload updated credentials IAW AFI 44-119.

2.1.1.14 Respond within two (2) business days to telephone calls, faxes or email inquiries regarding the management or status of provider’s C&P information. These inquiries may be received from providers, CMs at MTF or medical units, AFRS, AFPC, HQ ANG/SG or HQ AF Reserve/SG offices, or

AFMOA/SGHQ.

2.1.1.15 Complete PSVs and databank queries as required with appropriate updates to the e-PCF upon receipt of a CCQAS PSV task when an e-

Application is routed to the CVO or upon receipt of the MTF or unit request form or when request query block is checked within CCQAS.

2.1.1.16 Track the status and report on physician licensure to ensure physician students have obtained an active unrestricted license by the end of Post

Graduate Year 2 (PGY 2) (30 June of each year) IAW AFI 44-119. Reports will be made to AFPC and AFMOA/SGHQ by 1 September of each year.

2.1.1.17 Review e-PCFs maintained by the AFCCVO to ensure all credentials are updated, perform licensure PSV and a NPDB query not earlier than 30 days prior to forwarding e-PCF to MTF or medical unit.

2.1.1.18 Obtain the provider’s National Provider Identifier (NPI) number from the new accessions and providers in out-of-service training programs. Scan and upload documentation of the NPI to the e-PCF.

2.1.1.19 Enter the NPI number in the Defense Medical Human Resources

System-Internet (DMHRSi) when the unit does not have access to DMHRSi and the NPI is not displayed in CCQAS.

2.1.1.20 Obtain access and then be trained to input provider NPIs into

DMHRSi by the DMHRSi program office.

2.1.1.21 Conduct Department of Health and Human Services

DHHS/TRICARE sanction checks for all newly hired providers. Uploads query results to the e-PCF.

2.1.1.22 Develop metrics to monitor turnaround times of the CVO processes for monthly reporting to Clinical Quality Management Division, AFMOA/SGHQ. Metrics should include: 1) tracking the number of providers, by category, processed by the CVO per year, 2) turnaround time to monitor timelines in the process to include turnaround time from receipt of accession application and credentials information to the generation and transmission of the completed credentialing summary to the requestor, turnaround time for receiving a Complete PSV Task within CCQAS to returning the completed task to the requestor, turnaround time for completion of task received via MTF or medical unit paper request form for PSV/databank query to returning the completed task to the requestor, 3) turnaround time from when C&P documents are sent out to be completed by the practitioner and returned to the

CVO, 4) turnaround time to update the C&P information into CCQAS for the records being maintained by the AFCCVO, 5) number of requests for information received by CVO, and 6) number NPI numbers entered into

DMHRSi.

2.1.1.23 Maintain frequent contact with the COR to ascertain progress and problem areas that need to be resolved. The Chief, Professional Staff

Management assigned to AFMOA/SGHQ (or designee) will be available as resources to assist the contractor with guidance and direction.

2.1.2 POSITION DESCRIPTIONS: The Government anticipates this requirement would be fulfilled with some mix, but not limited to, the labor categories listed below:

2.1.2.1 Duties for Credentialing Specialists:

2.1.2.1.1 Designated AFMS agent to gather credentialing information, perform PSV of healthcare professionals’ credentials and conduct databank queries. This supports the credentialing and privileging processes at AF MTFs and ARC medical units.

2.1.2.1.2 Completes written PSV documentation capturing the required components to document the PSV IAW AFI 44-119.

2.1.2.1.3 Reviews credentialing applications, conduct follow-up to obtain missing credentials/information, conduct verifications, create provider credentialing records within CCQAS and maintain the

CCQAS record.

2.1.2.1.4 Contacts medical office staff, educational institutions, licensing and certifying agencies, to obtain and complete the verification of credentials.

2.1.2.1.5 Obtains required credentials and complete PSV of the credentials from the originating source or designated agent, date stamps the documentation upon receipt.

2.1.2.1.6 Updates the appropriate screens within CCQAS to capture the credential and PSV of the credential. Converts documentation to a PDF format, scans, appropriately names and uploads the documentation to the provider’s electronic credentials file.

2.1.2.1.7 Completes credentialing tasks routed to the AFCCVO for action and appropriately updates the provider’s electronic credentials file IAW AFI 44-119.

2.1.2.1.8 Identifies and reports potential “red flags” to the requestor and submits required credentials verification summaries, completes verification tasks within CCQAS and scans, appropriately names and uploads required documentation to CCQAS.

2.1.2.1.9 Audits provider credentials application and credentials file for compliance with requirements outlined in AFI 44-119.

2.1.2.1.10 Transfers provider credentials files to MTF credentials office or training office as appropriate. Closes out and inactivates electronic

CCQAS records when appropriate.

2.1.2.1.11 Responds to queries/request for information and resolves originating request or routes the request to the appropriate individual for resolution.

2.1.2.1.12 Security Requirement: Contractor shall have an active favorable NACI prior to hiring.

2.1.2.2 Credentialing Specialists Additional Duties (4 FTEs):

2.1.2.2.1 Performs credentialing tasks in support of the processes managed by the senior credentialing specialists and in response to

MTFs requests.

2.1.2.2.2 Minimum Education/Experience:

2.1.2.2.2.1 Three (3) years of experience in medical

credentialing to include one (1) year of knowledge of the credentialing and privileging process, the required credentials for health care professionals, and the appropriate sources used to complete PSV and databank queries.

2.1.2.2.2.2 One (1) year of credentialing experience with the

DoD utilizing CCQAS.

2.1.2.3 Senior Credentialing Specialists Additional Duties (3 FTEs):

2.1.2.3.1 Designated by the lead senior credentialing specialist to manage specific processes with the C&P process.

2.1.2.3.2 Minimum Education/Experience:

2.1.2.3.2.1 Five (5) years of experience in medical

credentialing to include knowledge of the credentialing and privileging process, the required credentials for healthcare professionals, knowledge of appropriate sources used to complete PSV and databank queries.

2.1.2.3.2.2 Three (3) years of credentialing experience with

the DoD utilizing CCQAS.

2.1.2.4 Lead Senior Credentialing Specialists Additional Duties (1 FTE):

2.1.2.4.1 Responsible for management of the internal operations within the CVO.

2.1.2.4.2 Minimum Education/Experience:

2.1.2.4.2.1 Ten (10) years of experience in medical

credentialing to include knowledge of the credentialing and privileging process, the required credentials for healthcare professionals, knowledge of appropriate sources used to complete PSV and databank queries.

2.1.2.4.2.2 Five (5) years of credentialing experience with the

DoD utilizing CCQAS.

2.1.2.5 Administrative Assistant Functional Responsibilities (2 FTEs):

2.1.2.5.1 Process incoming hard-copy and electronic documentation to include date received; conversion of documents to PDF format;

naming documents utilizing standard name convention to facilitate retrieval; sorting documentation into correct category to be worked;

and for requests received via email, send a receipt email to the requestor.

2.1.2.5.2 Assist credentialing specialists, senior credentialing specialists, and lead senior credentialing specialist in sending and receiving PSV requests/provider credentials files and other credentialing documentation.

2.1.2.5.3 Answer phone and email inquiries and direct requestor appropriately for resolution.

2.1.2.5.4 Perform clerical duties in support of the AFCCVO processes.

2.1.2.5.5 Minimum Education/Experience:

2.1.2.5.5.1 High school diploma or equivalent and three (3)

years of experience performing administrative and clerical duties within an office environment.

2.1.2.5.5.2 Security Requirement: Contractor shall have

an active favorable NACI prior to hiring.

2.2 General Contractor Requirements:

2.2.1 The contractor shall provide personnel to accomplish the following support services:

2.2.1.1 Communicates clearly, both orally and in writing in English.

2.2.1.2 Coordinate with the management levels, as required by DoD policies or procedures.

2.2.1.3 Knowledge of government regulations, policies, procedures, and limitations within their scope of responsibilities.

2.2.1.4 Knowledge of standard software programs such as the Microsoft Office

Professional Suite.

2.2.1.5 Assist the Government in a smooth transition of services when a change of personnel is necessary, whether due to contractor personnel’s notice of discontinuance of service or by Government cancellation of the contract. The transition service will entail providing familiarization, on-the-job training, and appropriate documentation required by replacement personnel. Provide this transition service to the replacement personnel, whether that person belongs to the current contractor, another contractor or is a Government employee.

2.2.1.6 Works independently and as a member of the team to:

2.2.1.6.1 Complete required tasks to track, obtain credentials, and perform credentials verification and databank queries for providers in training programs, administrative positions, and potential accessions.

2.2.1.6.2 Perform credentials verification and databank queries for healthcare providers upon request from MTF, medical unit or other authorized agent

2.2.1.6.3 Create and maintains e-PCF for healthcare providers whose

CCQAS record is assigned to one of the unit identification codes (UICs) the Air Force Centralized Credentials Verification Office (AFCCVO) manages.

2.2.2 Personnel Staffing: The contractor shall accomplish, at a minimum, the following personnel staffing performance management outcomes:

2.2.2.1 Ensure positions are filled 90% within 15 calendar days and 100% of personnel are present for duty no later than 20 calendar days after contract award or start of period of performance.

2.2.2.2 Ensure continuation of services during personnel absences due to sickness, leave, or termination from employment such that impact to the

Government is minimal and position vacancies do not exceed 20 calendar days.

The contractor shall maintain an overall filled rate of 90%.

2.2.2.3 The substitute/replacement personnel shall begin work no later than 20 calendar days after notification or immediately after departure of the incumbent personnel, whichever is earlier.

2.2.2.4 The contractor shall promptly notify the contracting officer and COR within five (5) calendar days of any projected vacancies exceeding 20 calendar days.

2.2.2.5 Provide a stable workforce with less than 30% turnover across all contracted positions. A turnover is recorded when a worker leaves a position for any reason and the Government still has a requirement for that position.

2.2.3 Post Award Meeting: A post award meeting will be held within 10 calendar days after contract award.

2.2.4 Personnel Security Requirements: The contractor shall implement and administer a security program in accordance with DoD 5220.22-M National Industrial

Security Program Operating Manual, February 2006 change 2 May 18, 2016 to ensure that sensitive information and government documentation are protected.

2.2.4.1 Disclosure of Sensitive Data: The contractor recognizes in the performance of the contracts, it shall receive and have access to certain sensitive information. Contractor agrees to use and examine this information exclusively in the performance of the contract and to take the necessary steps to prevent disclosure of such information to any party outside the Government. Work performed under the contract is unclassified but confidential in nature and employees must be trained in Health Insurance Portability and Accountability

Act (HIPAA). However, the technical and medical privacy data used within the scope of this contract requires adherence to security/privacy requirements imposed by the Government, DoD, AF and other security clearance requirements as applicable to this contract. The contractor shall handle and protect all data as directed by the AFMS enterprise and its implementation of the HIPAA and the

Business Associate Agreement (BAA). (Appendix A)

2.2.4.2 Release of Medical Information: Contractor personnel are prohibited from releasing any personal or medical/patient information to include patient/person-level content with personal health information during the course of this contract. Information shall be treated in accordance with the following:

2.2.4.2.1 The BAA (Public Law 104-191), which includes DoD 6025.18-

R and is FOR OFFICIAL USE ONLY. (Appendix A)

2.2.4.2.2 Other Military Health Services, AFMOA, Federal and State laws shall be applicable.

2.2.4.2.3 Contractor shall provide patient information only to

Government employees, Government contractor, and subcontractors having a need-to- know such information in the performance of their duties for this project.

2.2.4.2.4 The Health Insurance Portability & Accountability Act of

1996: The HIPAA (Public Law 104-191), which includes DoD 6025.18-

R DoD Health Information Privacy Regulation dated January 24, 2003 and is FOR OFFICIAL USE ONLY.

2.2.4.2.5 Privacy Act: The Privacy Act of 1974 (5 U.S.C. § 552a), which includes Public Law 100-503, Department of Defense Directive (DoDD)

2.2.4.2.6 5400.11 DoD Privacy Program dated May 8, 2007 change 1

September 1, 2011, and DoD 5400.11-R Department of Defense Privacy

Program dated May 14, 2007 and must be treated as FOR OFFICIAL

USE ONLY.

2.2.4.2.7 Organizational Conflict of Interest (OCI): All contractor employees shall sign the OCI provided in the PWS Appendix B at the time of acceptance of employment. The contractor must then provide a copy of the signed/dated OCI to the COR within five (5) business days of the employee’s signature is accomplished. (FAR Sub-Part 9.5)

2.2.4.2.8 Non-Disclosure Agreement (NDA) Statement: All contractor employees shall sign the non-disclosure statement provided in the PWS

Appendix C at the time of acceptance of employment. The contractor must then provide a copy of the signed/dated NDA to the COR within five (5) business days of the employee’s signature is accomplished.

2.2.5 Pass and Identification Items/disposition/notification requirements: The contractor shall ensure contractor personnel obtain pass and identification items and understand their obligations to report lost/stolen items, return these items (if they depart for any reason) and other security reporting requirements as follows:

2.2.5.1 Common Access Card: Each contractor employee shall have the CAC in his/her possession at all times while working and shall surrender the CAC at the end of his/her employment under this contract or when the CAC expires, whichever occurs first. All contractor employees shall have/obtain an active favorable NACI or meet the requirements of DoDM 1000.13-M-VI, January 23, 2014. The COR shall be kept abreast of issues dealing with the NACI. The contractor’s security officer shall ensure timely notification of all hires to the

Air Force Surgeon General’s Security Office located at the AFMOA/SGA

JBSA Lackland Air Force Base (AFB).

2.2.5.2 Report the loss of any pass and identification items as soon as possible to the issuing activity and the COR.

2.2.5.3 Retrieving Identification Media: The contractor shall retrieve all identification media from contractor employees who depart for any reason before the contract expires (e. g., terminated for cause, retirement) and return such media to Pass and Identification section for proper disposition.

2.2.5.4 Reporting Requirements: Automated Data Processing Security

Requirements: Contractor personnel shall report to an appropriate authority, any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, and resources. The security manager/COR shall brief the contractor employees upon initial assignment and as required thereafter.

2.2.5.5 Contractor shall comply with DoD 8570.1M, Information Assurance

Workforce Improvement Program, dated December 19, 2005 Change 3 January

24, 2012, DoDI 8500.2, Information Assurance (IA) Implementation dated

February 6, 2003, and DoDD 5200.2 DoD Personnel Security Program dated

April 19, 1999.

2.2.6 Government’s Liability: The government shall not be liable for any injury to the contractor’s personnel or damage to the contractor's property unless such injury or damage is due to negligence on the part of the government and is recoverable under the Federal Torts Claims Act, or pursuant to other Federal statutory authority.

2.2.7 Section 508 Compliance: The industry partner shall support the government in its compliance with Section 508 throughout the development and implementation of the work to be performed. Section 508 of the Rehabilitation Act of 1973, as amended

(29 U.S. Code. 794d), and implemented by 36 Code of Federal Regulations (CFR)

1194, requires that when Federal agencies develop, procure, maintain, or use electronic Information Technology (IT), federal employees with disabilities have access to and use of information and data that is comparable to the access and use by federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency. For additional Section 508 information, the industry partner should review the following websites:

http://www.section508.gov http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources

2.2.8 Place of Performance: The place of performance for this tasking will be at the contractor’s offices in San Antonio, Texas. Work under this contract will be performed off-site, the Government shall not provide work space.

2.2.9 Data Rights: The government shall retain ownership of all data entered, processed, and/or generated by the contractor's personnel in the performance of the tasks set forth in the PWS, DFARS 227.7102-2.

2.2.10 Intellectual Property: The contractor is advised that provisions of FAR

52.227-11, Patent Rights—Ownership by the contractor (2007) will be applied to the contract. The full text of the clause may be accessed electronically at this address:

http://farsite.hill.af.mil/

2.2.11 Installation Entry: Contractor personnel will comply with established security procedures for entering installation and its facilities as needed to include any special security procedures for entry to Restricted Areas or mission essential or vulnerable areas. Government reserves the right to terminate entry of any contractor employee upon disclosure of information that indicates the individual’s continued entry to the installation is not in the best interest of the national security. Additionally, violation of or deviation from established security procedures by contractor employees may result in confiscation of identification media and denial of future entry to the installation.

2.2.12 Conduct of Contractor Personnel:

2.2.12.1 Observe all base and facility parking, safety and traffic regulations that apply to all facility employees.

http://www.section508.gov/ http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources http://farsite.hill.af.mil/

2.2.12.2 Alcoholic beverages and use of illegal drugs on the job shall not be tolerated.

2.2.12.3 There shall be no loud, profane, or abusive language used on the job.

2.2.12.4 Contract personnel shall wear neat, clean, casual business attire clothing and present a neat well-groomed appearance.

2.2.13 Contractor Manpower Reporting Requirements Application (CMRA):

2.2.13.1 The contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this PWS via a secure data collection site. The contractor is required to fill in all required data fields at http://www.ecmra.mil.

2.2.13.2 Reporting Period: Reporting inputs will be for the labor executed during the period of performance for each Government Fiscal Year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. Contractors may direct questions to the CMRA help desk.

2.2.13.3 Uses and Safeguarding of Information. Information from the secure web site is considered proprietary in nature when the contract number and contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the contractor name and contract number associated with the data.

2.2.13.4 User Manuals. Data for Air Force service requirements must be input at the Air Force CMRA link. However, user manuals for contractors are available at the Army CMRA link at:

http://www.ecmra.mil.

2.3 Services Summary (SS): The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service for each requirement.

These thresholds are critical to mission success.

2.3.1 Services Summary:

Performance Objectives PWS Paragraph Performance Threshold

Process Applicants to Include

Students 2.1.1.4

Contractor accurately and timely completes the collection of required credentials/information, PSVs and databank queries and enters data in the CCQAS database with no more than 6 substantiated errors during a six-month period.

Personnel Staffing Positions 2.2.2.1

Ensure positions are filled 90% within 15 calendar days and

100% of personnel are present for duty no later than 20 calendar days after contract http://www.ecmra.mil/ http://www.ecmra.mil/ award or start of period of performance

Continuation of Services During

Personnel Absences 2.2.2.2

Contractor shall ensure position vacancies do not exceed 10 calendar days. The contractor shall maintain an overall filled rate of 95%

Substitute/Replacement

Personnel 2.2.2.3

Shall begin work no later than

10 calendar days after notification or immediately after departure of the incumbent personnel, whichever is earlier.

Projected Vacancies Notification 2.2.2.4

Contractor shall promptly notify the contracting officer and COR within five (5) calendar days

Provide Stable Workforce 2.2.2.5 Less than 30% turnover across all contracted positions

Provide Credentials Verification

Office Activities 2.1.1.12; 2.1.1.15

The Contractor accurately and timely completes credentialing summaries/ PSV e-Application tasks/verified credentials and databank query results with no more than six substantiated complaints during a six month period.

Provide Credentials Verification

Office Activities

2.1.1.19

Contractor successfully enters the NPI in DMHRSi for display in CCQAS when required within 14 days of receipt, 100

% of the time.

Maintenance of e-PCFs 2.1.1.17

Contractor maintains the e-PCF and ensures expirable credentials are tracked and updated when appropriate with not more than 2 substantiated errors during a six month period.

2.4 Government Furnished Support: Government will provide the appropriate authorization to use the government-provided DoD CCQAS and DMHRSi for entry and storage of credentials data for the performance of this work.

2.5 Travel/Other Direct Costs (ODC):

2.5.1 Travel: Travel may be required during the performance period of this contract at the request of the Government and within the Continental United States. Dates and destinations are not available at this time. The contractor shall coordinate travel requirements with the COR no less than 14 calendar days prior to travel date and commence travel upon receipt of Government authorization. The contractor shall be responsible for obtaining all passenger transportation, lodging, and subsistence at the best value for the Government and in accordance with FAR 31.205-46, Travel Costs.

All travel costs shall be reimbursed on actual costs only and receipts shall be submitted with invoices. The travel costs shall not be burdened with fee, profit, or overhead.

Travel receipts for all expenses related to the travel shall be submitted to the COR with invoices. The travel payment request shall be submitted to the COR within 30 days of completed travel. Travel to and from work shall be considered a cost of doing business and shall not be reimbursable.

2.5.2 Other Direct Costs (ODC): The contractor shall charge the AF for all fees associated with the performance of PSV for practitioners, approved by the Air Force in

AFI 44-119. These costs may be, but are not limited to, fees charged by state boards to provide verification of licenses, specialty boards, educational institutions and database queries. A detailed accounting of these costs will be provided to the AF as part of the monthly project report.

2.6 Deliverables: Any letters, papers, and recommendations the contractor submits are drafts, not final copies. The Government reserves the right to make changes on drafts prior to delivery of the final product. The Government reserves the right to make changes on delivery dates.

2.6.1 Data Deliverable Table:

Title PWS Paragraph Delivery Date/ Description

Credentialing potential new accession packages for

Medical Professions

Recruiting Stations to include

AF Reserve and ANG

2.1.1.3

Within 30 calendar days of receipt of application/required credentials, documentation of PSV, results of databank queries, update of

CCQAS generate Credentialing

Summary and provide to end user.

NPDB Databank Query 2.1.1.7

Within two (2) business days of receiving MTF or medical unit request.

Deferred, out of service training and AFIT providers:

Collecting credentials, PSV, databank queries, creation/update/ and ongoing maintenance of CCQAS records

2.1.1.3

Within five (5) business days upon receipt of documents: scan and upload credentials/PSV results/databank queries (except

NPDB query results) to CCQAS record

Release of up-to-date

CCQAS record to gaining 2.1.1.2; 2.1.1.3

Within 14 calendar day after graduation date forward CCQAS

2.6.2 Monthly Status and Financial Reports: The contractor shall prepare and submit monthly a status/financial reports concurrently to the COR, and Contracting Officer (CO) by the 10th of the current month for the preceding month. The contractor shall include the contract number and reporting period. With concurrence of the CO and COR, the contractor may combine the financial and monthly status report if so desired.

2.6.2.1 Monthly Status Report (referred to as “the report): The status report shall be used to review and evaluate the overall progress along with any existing or potential problem areas.

2.6.2.2 The Contractor shall include a brief task description; a narrative review of tasks accomplished during the reporting period and/or significant events, status of major and minor milestones and project/program deliverables in the report.

MTF or military training program records to the gaining MTF or military training program, if appropriate

Providers in training programs for which the contractor is tasked to track and report physician students who have not obtained an active unrestricted license by completion of PGY2

2.1.1.16

By 1 Sep of each year, prepare report of physician students who have not obtained an active unrestricted license by completion of PGY2

Response to MTF/Medical

Units Requests or CCQAS

PSV Tasks, PSV of

Credentials and , databank queries for CMs

2.1.1.2

Within 14 calendar days of receipt of application or request/required credentials, documentation of PSV, results of databank queries (except for NPDB query) results, update of

CCQAS

For records assigned to the

AFCCVO UICs, perform

Quality Review and Update of PCFs and CCQAS Records

2.1.1.17 Within 30 days of receipt

For records assigned to the

AFCCVO UICs, the contractor shall generate monthly expiration reports within CCQAS to track time limited credentials. The contractor shall obtain and upload updated credentials

IAW AFI 44-119.

2.1.1.13 Within 30 days of expiration

Monthly Status Report 2.6.2 By 10th of the Current Month for the Preceding Month

Travel request 2.5.1 14 calendar days prior to trip

Quality Control Plan 3.1– 3.2 Submitted at time of proposal

2.6.2.3 The Contractor shall address problem areas encountered and remedial actions taken or recommendations for solutions. Potential problems should also be in the report to the COR and/or CO at the time of occurrence.

2.6.2.4 The Report shall include, contract number, contractor name, period covered by report, management issues, summary description of activities/accomplishments during report period, work to be accomplished during the following reporting period, status of open problems or issues identified in previous monthly reports(s), problems solutions/recommendations, and trend analysis.

2.6.2.5 Address staffing issues that affect the successful completion of all requirements.

2.6.2.6 Recommendations and/or actions the contractor expects to take to overcome any delays due to technical, regulatory or staffing issues.

2.6.2.7 Provide description of anticipated activities for the next reporting period, such as description of any travel or unique services to be provided and other relative information as necessary.

2.6.2.8 Financial Report: Financial Information to be provided shall include:

2.6.2.8.1 A brief narrative of financial transactions during the reporting period.

2.6.2.8.2 The financial report shall document expenditure of funds.

2.6.2.8.3 The contractor shall submit invoices monthly. Each invoice should have only one billing period covered except in the case of travel or other direct cost (ODC) that were not charged on the previous invoice.

2.6.2.8.4 The contractor shall separate charges in line with the contract line items for all invoices submitted.

2.6.2.9 Other Data Requirements: In addition to the monthly status reports, the contractor shall provide the following data deliverables:

2.6.2.10 Provide presentation materials used in briefing and conferences 10 calendar days before briefing/conference.

2.6.2.11 Provide conference agenda 10 calendar days before conference or meeting.

2.6.2.12 Provide a Privacy Risk Assessment and Action Plan, and a Security

Risk Assessment and Action Plan which lists the specific steps taken to protect all protected health information and Privacy Act data, as well as the actions that shall be taken in the event of an improper disclosure of protected health information or a breach in the security of Privacy Act information.

3.0 QUALITY CONTROL/ASSURANCE:

3.1 Quality Control Plan (QCP): The contractor shall submit a QCP at time of proposal and maintained/updated thereafter.

3.2 Quality Assurance: Work and documentation produced by the contract personnel will be reviewed monthly by the COR. Only the COR may accept or reject deliverables provided by the contractor. The government requires complete and accurate verifications of required credentials and databank queries and appropriate processing of all applicants. The COR will monitor the performance of tasks via monthly reports, on-going review of CCQAS records for CVO activities and applicant packages by the COR and clients and feedback received from clients.

3.3 Customer Complaint Record: This form may be utilized by the contractor, Government and/or Government customer to provide feedback on issues affecting the performance of this contract. (See Appendix D)

4.0 NON PERSONAL SERVICES: The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the CO immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

5.0 CONTRACTOR IDENTIFICATION: All contractor/subcontractors personnel will identify themselves as Government contractor employees during all forms of communications such as business meetings, telephone conversations, electronic mail, attendance sheets, coordination documentations, reports, and the signature blocks utilized in all correspondence. If a contract requires Government workspace, the contractor/subcontractor personnel shall wear a picture identification badge and identify their workspace area with their name and company affiliation.

6.0 HOURS OF OPERATION: Normal duty hours are 7:30 am to 4:30 pm, local San Antonio, TX time, Monday through Friday (excluding Federal Holidays), unless mutually agreed upon by

Government and contractor personnel. Due to mission need or due to unforeseen acts of nature or emergency, the CO/COR and contractor may agree to different duty hours/work days/duty locations. No overtime is authorized.

6.1 Scheduled Holidays: New Year’s Day, Dr. Martin Luther King, Jr. Birthday, Presidents

Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, and Christmas Day.

7.0 APPENDICES:

7.1 Appendix A Business Associate Agreement (BAA)

7.2 Appendix B HQ USAF/SGR Organizational Conflict of Interest (OCI)

7.3 Appendix C HQ USAF/SG Non-Disclosure Agreement (NDA)

7.4 Appendix D Customer Complaint Record

7.5 Appendix E Publications and Regulations

APPENDIX A: BUSINESS ASSOCIATE AGREEMENT

This BAA can serve as a separate standalone agreement or may be used for new or existing contracts between the MTF and the business associate.

Business Associate Agreement

[USE FOR STANDALONE BAA ONLY] This Business Associate Agreement (this "Agreement") is entered into this ___ day of ________, _____ (the “Effective Date”) between [NAME OF MHS

COVERED ENTITY] ("Covered Entity") and [NAME OF BUSINESS ASSOCIATE], a [type of business entity] ("Business Associate").

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the

HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health

System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates.

Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph

C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated

Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy

Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other Personally Identifiable Information (PII) (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD

HIPAA Issuances, and in reference to this BAA, shall mean [INSERT NAME OF BUSINESS

ASSOCIATE].

Agreement means this BAA together with the documents and/or other arrangements under which the

Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA

Issuances, and in reference to this BAA, shall mean [INSERT NAME OF MTF COMPONENT].

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office

Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region

Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD MHS.

These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD

5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR

164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part

164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D

(Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June

7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air

Force) with oversight authority over Privacy Act and/or HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by this

Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this

Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic

PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of this Agreement. If at any point the Business

Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, and corresponding

DoD HIPAA Issuances, as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524 and corresponding DoD HIPAA Issuances.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526, and corresponding DoD HIPAA Issuances.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered

Entity’s obligations under 45 CFR 164.528 and corresponding DoD HIPAA Issuances.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of the HIPAA

Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in this Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under

DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity [MODIFY

THIS SECTION IF THE PURPOSE OF THE AGREEMENT/CONTRACT IS FOR THE

BA TO DEIDENTIFY PHI FOR THE CE].

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA

Privacy Rule “minimum necessary” standard and corresponding DHA policies…