PWS_Inpatient_Accreditation_Surveys.pdf

AIR FORCE MEDICAL OPERATIONS AGENCY

PERFORMANCE WORK STATEMENT

FOR

ACCREDITATION SURVEYS FOR INPATIENT

MEDICAL TREATMENT FACILITIES

14 December 2016

TABLE OF CONTENTS

Page

1.1 DESCRIPTION OF SERVICES 3

1.2 Background 3

1.3 Scope 3

1.4 Policy Conflict with Accrediting Agencies 3

1.5 Adherence to the Contractor’s Standards, Policies Procedures, Eligibility

Requirements, Participation Requirements, and National Patient Safety Goals 3

1.6 Prohibition on the Use of Surveyors as Consultants 3

1.7 Acronyms 4

2.1 SUMMARY OF REQUIREMENTS 6

2.2 Description of Duties 6

2.3 General Contractor Personnel Requirements 9

2.4 Services Summary 13

2.5 Government Furnished Support 14

2.6 Travel 14

2.7 Security Requirements 15

2.8 Deliverables 15

2.9 Data Reporting Requirements 16

3.0 QUALITY CONTROL PLAN 16

4.0 NON-PERSONAL SERVICES 16

5.0 CONTRACTOR IDENTIFICATION 16

6.0 HOURS OF OPERATION 17

7.1 APPENDICES 17

7.2 APPENDIX A: Business Associate Agreement 18

7.3 APPENDIX B: HQ USAF/SGR Organizational Conflict of Interest (OCI) 29

7.4 APPENDIX C: HQ USAF/SG Non-Disclosure Agreement 32

7.5 APPENDIX D: Customer Complaint Record 35

7.6 APPENDIX E: Survey Schedule 2017-2021 39

1.0. DESCRIPTION OF SERVICES

1.1 Background: Air Force (AF) Medical Treatment Facilities (MTFs) require a hospital accreditation survey for the purpose of “Accreditation” by an accreditation source approved by the Assistant Secretary of Defense Health Affairs (ASD HA). All other inpatient MTFs will receive a hospital accreditation survey with Primary Care Medical Home (PCMH) certification once every three (3) years, with the exception of Osan AB, Korea which receives an accreditation survey every two (2) years. (Reference Appendix E for the survey schedule).

1.2 Scope: The selected organization (Referred to as “contractor”) shall furnish the necessary personnel, materials, facilities and other services as required to enter and survey the US Air

Force Inpatient MTFs for the purpose of hospital accreditation only and PCMH certification.

The place of performance shall include: 23 on-site hospital surveys at 13 inpatient MTFs located throughout the Continental United States (CONUS) and outside the Continental United States

(OCONUS). All work performed shall comply with policies, procedures and appendices as defined in the accrediting organization’s standards manual for hospital accreditation. Survey schedules are to indicate survey year as specified in Appendix E. Approximately six (6) months prior to each option year the Air Force Medical Operations Agency/SGHQ (AFMOA/SGHQ)

Contracting Officer Representative (COR) located in San Antonio, Texas and applicable Major

Command (MAJCOM) will confirm with the civilian accreditation organization their determined specific dates, month and year for surveys, and take into consideration wartime and Air Force

Expeditionary Force (AEF) requirements.

1.3 Policy Conflict with Accrediting Agencies: The AF supports accreditation by civilian agencies, but when military mission requirements result in a conflict with agency standards, the

AF mission and policy prevails. AFMOA/SGHQ or another appropriate authority will pursue resolution of any policy conflicts with the accrediting agency.

1.4 Adherence to the Contractor’s Standards, Polices, Procedures, Eligibility

Requirements, Participation Requirements, and National Patient Safety Goals: The AF acknowledges its responsibility in keeping abreast of the accrediting organization’s standards, policies, procedures, and eligibility requirements. This also includes staying up to date with new and revised standards, as well as participation requirements in the National Patient Safety Goals

(NPSG) as provided in The Joint Commission’s (TJC’s) accreditation manuals that are periodically revised and relevant to the programs per DoD Manual 6025.13. The AF also acknowledges and further agrees it will be bound by any such new or revised standards, policies, procedures, eligibility requirements, accreditation participation requirements, or NPSG requirements per DoD Manual 6025.13 and will take necessary actions to come into compliance with the change(s) in a reasonable period of time, and understands that failure to do so can result in loss of accreditation. Further the AF agrees to adhere and engage in good faith participation of the accreditation process and to provide relevant and accurate information at all times. The

AF will furnish any reasonable certifications required by the contractor.

1.5 Prohibition on the Use of Surveyors as Consultants: The AF agrees that it will adhere to the TJC’s prohibition in the use of its surveyors as consultants. Examples of such services include but are not limited to; helping the AF meet accreditation standards, self-assessment monitoring and conducting mock surveys for the AF as well as providing consultation to an organization to address Priority Focus Process information.

1.6 Acronyms:

ACRONYMS

ACRONYM DEFINITIONS

ADP Automatic Data Processing

AEF Air Force Expeditionary Forces

AF Air Force

AFIA Air Force Inspection Agency

AFIT Air Force Institute of Technology

AFJI Air Force Joint Instruction

AFIT Air Force Institute of Technology

AFMS Air Force Medical Service

AFMOA Air Force Medical Operations Agency

AIS Automated Information System

AFMSA Air Force Medical Support Agency

AHLTA Armed Forces Health Longitudinal Technology Application

ASCAS Automated Security Clearance Approval Systems

ASD HA Assistant Secretary of Defense Health Affairs

BAA Business Associate Agreement

CC Commander

CFR Code of Federal Regulations

CHCS Composite Health Care System

CMS Center for Medicare and Medicaid Services

CMRA Contractor Manpower Reporting Requirements Application

CO Contracting Officer

COFC Court of Federal Claims

CONUS Continental United States

COR Contracting Officer Representative

CPAR Contractor Performance Assessment Report

DCS Defense Collaborative Services

DoD Department of Defense

DoDD Department of Defense Directive

FAR Federal Acquisition Regulation

FOIA` Freedom Of Information Act

FPCON Force Protection Condition

GAO Government Accounting Office

GFI Government Furnished Information

HIPAA Health Insurance Portability and Accountability Act of 1996

HQ USAF/SG Headquarters United States Air Force Surgeon General

IA Information Assurance

IM/IT Information Management/Information Technology

INS Immigration and Naturalization Service

IAW In Accordance With

IMS Information Management System

JTR Joint Travel Regulation

MAJCOM Major Command

Kx Knowledge Exchange

MES Mission Essential Services

MHS Military Health System

MTF Medical Treatment Facility

NACI National Agency Check and Inquiries

NDA Non-Disclosure Agreement

NLT No Later Than

NPSGs National Patient Safety Goals

OASD HA Office of Assistant Secretary of Defense for Health Affairs

OCI Organizational Conflict of Interest

OCONUS Outside Continental United States

ODC Other Direct Cost

OPSEC Operations Security

PA Privacy Act

PCMH Primary Care Medical Home

PJM Project Manager

POC Point of Contact

POP Period of Performance

PWS Performance Work Statement

QCP Quality Control Plan

QM Quality Manager

QSPAR Quality Systems Program Assessment Review

RAMS Random Antiterrorism Measures

SAF Secretary of the Air Force

SG Surgeon General

SGHQ Clinical Quality Division at AFMOA

SI Sensitive Information

SME Subject Matter Expert

TJC The Joint Commission

UEI Unit Effectiveness Inspection

2.1 SUMMARY OF REQUIREMENTS:

2.2 Description of Duties: The contractor shall:

2.2.1 Use a peer-based, consultative accreditation process utilizing nationally recognized standards for hospitals.

2.2.1.1 Utilize practicing health care professionals to perform the accreditation survey, and National Patient Safety Goals that are appropriate to each type of health care AF organization accredited.

2.2.2 Maintain Medicare Deemed Status by the Centers for Medicare and Medicaid

Services (CMS).

2.2.3 Provide a Project Manager (PJM) Point of Contact (POC) for this contract within three (3) working days after contract award and ensure a continuous point of contact. The contractor may also assign an alternate representative.

2.2.3.1 The PJM POC shall be responsible for oversight of the performance of the work and manage the daily needs of the AF in answering all issues revolving around surveys and hospital accreditation.

2.2.3.2 The PJM POC will be available for telephone and/or e-mail consultation and assistance during the application process, as well as, before and after surveys, for

MTFs, MAJCOMs, and Contracting Officer Representative (COR). The contractor shall provide the AF with a secure, contractor specific Web site with full rights and access for each MTF and AFMOA, if the contractor uses such a service.

2.2.3.3 The PJM POC will provide their contact information to include e-mail addresses and phone numbers to the COR within three (3) working days after contract award. Any changes to the designated individual(s) and the contact information shall be provided to the COR within three (3) working days of occurrence.

2.2.3.4 The PJM will assist the AF in responding to inquiries from the contractor, as well as provide support in accessing and utilizing any contractor electronic based services and/or communication systems.

2.2.3.5 Provide the AF with access to a team of knowledgeable health care professionals, and provide various resources for organizational improvement, such as

Sentinel Event Alert.

2.2.4 Coordinate with the COR on all administrative, logistical matters to include survey schedules and the following pre-survey activities:

2.2.4.1 Coordinate with the COR on the annual scheduling of all surveys no later than three (3) months prior to the beginning of the first survey for that year, excluding the base year period, which will be coordinated upon contract award.

2.2.4.2 Ensure that survey dates are mutually agreed upon by both parties, the COR and the contractor when applicable. Please reference Appendix E for the five (5) year full accreditation survey schedule which indicates the year each MTF will be surveyed.

2.2.4.3 Coordinate any repeat visits or off cycle surveys that may arise, with the

COR, no less than 10 calendar days prior to the visit.

2.2.4.4 Notify the COR verbally or in writing of the location of repeat visit or off cycle survey, no less than 10 calendar days prior to visit or survey by contractor to include, but not limited to, unannounced visits or surveys or those previously coordinated on the annual schedule and within this Performance Work Statement

(PWS).

2.2.5 Notify the applicable MTF and COR no less than 10 calendar days for CONUS and

30 calendar days for OCONUS, prior to the date of survey.

2.2.6 Include the COR and alternate COR, if applicable, in the annual surveyor training conducted by contractor and provide dates and location no less than four (4) months prior to annual training. If the annual training does not occur, contractor shall provide training through Defense Collaborative Services (DCS).

2.2.7 Notify the COR of MTF’s application status and information in accordance with contractor application requirements.

2.2.8 Provide a written on-site accreditation survey debrief, to include a verbal out-brief of the major findings at the end of any survey to the MTF Executive staff and any other staff as identified by the MTF Commander (MTF/CC).

2.2.9 Deliver one (1) completed final survey report to the surveyed MTF/CC and the COR within 10 calendar days from the end date of the survey.

2.2.10 Provide each MTF an opportunity to submit an appeal or reconsideration to the accreditation committee for any type of adverse finding within 15 calendar days from receipt of the written report. The MTF will follow the reconsideration or appeal process as determined by the contractor’s requirements.

2.2.11 AFMOA/SGHQ or another appropriate authority (provided by the COR) will pursue resolution of any policy conflicts or conflicts with standards interpretation that may impact all AF MTFs surveyed by the accrediting agency. COR will collaborate with the contractor

PJM.

2.2.12 Provide all copies of hospital accreditation standard publications in a hardcopy plus an electronic format within 30 calendar days of the publication of the accreditation product to the COR, MTFs, MAJCOM and SG staff as outlined in 2.1.14 and directed by the COR.

2.2.13 Provide all updates to the hardcopy and electronic products within 30 calendar days of the publication of the changes(s) to the COR, MTFs and SG staff as outlined in 2.1.14 and directed by the COR.

2.2.14 Provide publication products* directly to the COR and MTFs. The COR will provide a list of point of contact information for COR, MTFs and Air Force Inspection

Agency (AFIA) no later than December tenth (10th) of each year. This includes the following:

●Hardcopies - Includes one (1) hardcopy of the hospital accreditation publication per COR, MTF, and AFIA staff as determined by the COR. The contractor shall provide one (1) hardcopy manual or updated material within 30 days of the published changes – to the COR, MTF, and AFIA staff as determined by the COR.

●Electronic format (Internet based) or its equivalent (CD) - Includes access to one (1) electronic version of the hospital accreditation standards and scoring guidelines, an unrestricted Internet-based site license for hospital accreditation standards and scoring guidelines, any technical support as needed, and any published updates per COR and MTF.

●Electronic Standards for Annual Self-Inspection - Unless the contractor has a web-based self-inspection tool, the contractor shall provide the current year’s standards to the COR in an electronic word format compatible with AFMOA computer technology within 10 calendar days of publication and/or revision. The standards will be distributed for AF self-inspection use only.

*Contractor shall include postage and handling relative to the distribution of products and publications, to include but not limited to Express or overnight mail.

2.2.15 If the contractor is present when the Air Force Inspection Agency (AFIA) inspection team is on site to inspect medical activities, the contractor shall participate in daily discussions or “crosstalk” with the team for the purpose of collaboration and discussion of common standards. This does not preclude the accrediting organization from independently assessing any standards in order to determine compliance from the accrediting organization’s prospective.

2.2.16 Provide the COR a written and electronic report in Excel containing an annual summary of all AFMOA findings for that year, including collated data on the most frequent findings, and number of facilities. This report shall be provided quarterly by the

10th of January, April, July and October of each year.

2.2.17 Provide the MTFs with one (1) certificate for accreditation and one (1) PCMH certificate within 10 calendar days once approval process is completed and accreditation is granted after six (6) to eight (8) weeks. Additional copies shall be made available for purchase by the individual MTF via their request. In the event there is a name change to the

MTF, the contractor shall issue one (1) new certificate reflecting the name change.

Certificates will be returned to the accrediting organization if the MTF’s need for hospital accreditation status is withdrawn or in the event of closure.

2.2.18 Participate in annual coordination meeting with the COR and/or representative(s) from AFMOA/SGHQ for up to one (1) day in length. The annual meeting shall take place at the contractor’s facility or contractor’s designated location, between the months of

September and December, with mutually agreed upon dates and location, with no less than three (3) months advanced notification.

2.2.19 Provide at least one (1) educational program annually, in conjunction with the

Quality Systems Program Assessment Review (QSPAR) conference, or alternate conference as determined by the COR. The educational program will be up to one (1) day in length with an estimated number fifty (50) participants (dictated by the size of the venue). Audience will include representatives from the accredited MTFs and AFMOA staff who work with accredited hospitals. The dates and locations for the conference shall be coordinated with the

COR. Travel procedures are in 2.6.1. The presenter shall be a contractor surveyor with AF military facility or DoD Account Executive experience.

2.2.20 If QSPAR or other conference venues are cancelled, provide at least one (1) presenter for the educational program for year 2017 thru 2021 using Defense Collaboration Services

(DCS) or other compatible audio/video web conferencing venue. The date(s) for the conference shall be coordinated with the COR and the contractor shall also electronically provide one (1) set of educational handouts and/or other related reading material to the COR for the presentation, to be shared with the MTF Quality Manager (QM) and posted on

AFMOA/SGHQ’s Knowledge Exchange (Kx) website.

2.3 General Contractor Personnel Requirements: The contractor shall meet the following requirements:

2.3.1 Contractor shall employ individuals who can effectively communicate with all Department of

Defense employees.

2.3.2 Contractor personnel, shall read, understand, speak and write the English language.

2.3.3 Contractor shall be responsible for all costs associated with Personnel Security onboarding. Documentation required for security certification will be the responsibility of the contractor and the client organization. Contractor personnel must have a National

Agency Check and Inquiries (NACI) investigation accomplished prior to beginning work.

2.3.4 Work performed under the contract is unclassified, however the technical and medical privacy data used within the scope of this contract requires adherence to security/privacy requirements imposed by the Government, Department of Defense (DoD), AF and other applicable security clearance requirements as applicable to this contract. The contractor shall handle and protect all data as directed and implemented by the Air Force Medical

Operation Agency (AFMOA) enterprise and its implementation of the Health Insurance

Portability and Accountability Act of 1996 (HIPAA).

2.3.5 Release of Medical Information: Contractor personnel shall be well-versed in

Health Insurance Portability and Accountability Act (HIPAA) privacy and security practices. Contractor shall not release any personal or medical/patient information to include but not limited to patient/person-level content with personal health information.

Contractor shall treat information in accordance with (IAW) the following:

2.3.5.1 The Privacy Act of 1974 (5 U.S.C. § 552a), which includes Public Law 100-

503, Department of Defense Directive (DoDD) 5400.11, DoD Privacy Program dated

May 8, 2007 change 1 September 1, 2011 and DoD 5400.11-R Department of

Defense Privacy Program dated May 14, 2007 and must be treated as FOR

OFFICIAL USE ONLY.

2.3.5.2 The Business Associate Agreement (BAA) (Public Law 104-191), which includes DoD 6025.18-R and is FOR OFFICIAL USE ONLY. (Appendix A)

2.3.5.3 Non-Disclosure Agreement (NDA) and Organization Conflict of Interest

(OCI): Contractor employees shall sign the NDA (Appendix C) and OCI (Appendix B) documentation prior to beginning of contract performance. The contractor’s employees must then provide a copy of the signed/dated NDA and OCI to be on file prior to beginning work. (Appendices B&C)

2.3.5.4 Contractor shall provide patient information only to Government employees, Government contractor and subcontractors having a need-to-know such information in the performance of their duties for this project.

2.3.5.5 Contractor shall keep the COR abreast of issues dealing with the security clearances and/or certifications. No foreign national candidates shall be utilized within the scope of this contract without prior approval of the Government (COR will contact local Foreign Disclosure Officer for guidance).

2.3.5.6 Contractor personnel and their subcontractors must identify themselves as contractors or subcontractors during meetings, telephone conversations, and correspondence or in electronic messages related to this contract.

2.2.5.7 Conduct of Contractor Personnel:

2.2.5.7.1 Contractor personnel shall be required to observe government facility parking, safety and traffic regulations that apply to all facility employees.

2.2.5.7.2 Alcoholic beverages on the job are prohibited.

2.2.5.7.3 There shall be no loud, profane or abusive language used on the job.

2.2.5.7.4 Contract personnel shall present a neat, clean, well-groomed appearance.

2.2.5.7.5 Business attire clothing will be worn.

2.3.5.8 Contractor shall comply with DoD Directive 8570.01-M, Information Assurance

Workforce Improvement Program 25 Feb 2010, incorporating Change 4, 10 Nov 2015:

DoD Instruction 8500.2, Information Assurance (IA) Implementation dated 6 Feb 2003 and DoD Instruction 5400.11, DoD Privacy Program, DoD Directive 8522, AF Systems

Security Instruction and DoD Instruction 5200.2-R, Personnel Security Program.

2.3.5.9 Other Military Health Services and AF guidance, and Federal and State laws shall be applicable.

2.3.6 Disclosure of Sensitive Data: The contractor recognizes that in the performance of this contract it will receive and/or have access to certain sensitive information. Contractor agrees to use and examine this information exclusively in the performance of the contract and to take the necessary steps to prevent disclosure of such information to any party outside the Government.

Work performed under the contract is unclassified but confidential in nature and employees must be trained in HIPPA. However, the technical and medical privacy data used within the scope of this contract requires adherence to security/privacy requirements imposed by the Government, DoD, AF and other applicable security clearance requirements as applicable to this contract. The contractor shall handle and protect all data as directed and implemented by the AFMSA enterprise and its implementation of the Health Insurance Portability and Accountability Act of

1996 (HIPAA).

2.3.7 Contractor personnel that require “view only” access to MHS, AHLTA, CHCS, and

Essentris®, or other Electronic Health Record must have NACI level security clearances, as determined by the Government PJM/COR. The contractors must be able to work in an environment applicable to classified and unclassified DoD information systems. The contractors shall access and analyze For Official Use Only (FOUO), Operations Security

(OPSEC), Privacy Act Information and Protected Health Information, including data feeds from the MHS Mart (M2), required to execute the responsibilities of the positions. This designator is based on the potential for an individual assigned to these positions to adversely impact DoD missions or functions. The position categories on this contract include Limited Privileged and

Non-Privileged, as defined in DoD 5200.2-R, Personnel Security Program.

Investigative requirements for each category vary. Ensure that IA awareness, training, education, and professionalization are provided to all contractor personnel, commensurate with their respective responsibilities for developing, using, operating, administering, maintaining, and retiring DoD information systems in accordance with Deputy Secretary of Defense Guidance and

DoD 5220.22-M, National Industrial Security Program Operating Manual.

2.3.8 Obtaining and Retrieving Identification Media: As prescribed by the AFFAR

5352.242-9000, Contractor access to Air Force installations, the contractor shall comply with the following requirements:

2.3.8.1 The contractor shall obtain base identification and vehicle passes for all contractor personnel who make frequent visits to or perform work on the AF installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished identification badges while visiting or performing work on the installation.

2.3.8.2 Contractor shall work with each MTF to meet the requirements for base entry prior to arrival of the scheduled survey. No later than three (3) working days prior to a survey, the following information will be provided: contract number, location of work site, start and stop dates, and names of contractor employees needing access to the base.

The authorized MTF project manager will endorse the request and forward it to the issuing base pass and registration office or security forces for processing. Contractors will present Government (state or federal) issued identification, and Immigration and

Naturalization Service (INS) Form 9 (I-9), before being issued a pass to enter the installation. Before being issued a pass to enter the installation, a Wants and Warrants check will be conducted for every individual requesting a pass.

2.3.8.3 Failure to comply with these requirements may result in withholding of final payment.

2.3.9 Network Access: The contractor, with a valid National Agency Check and Inquiries verified through the Automated Security Clearance Approval Systems (ASCAS) roster or validation from the on-site contractor’s security manager, shall be provided access to the

Government unclassified computer networks and their inherent capabilities when available including, but not limited to: internet access, electronic mail, file and print services, and dial- in network access. The contractor shall be held accountable for all actions that he or she initiates while on the network and shall conduct his or her business in accordance with all AF and local base instructions, manuals, and policies. Any conduct that does not adhere to sound or just network usage as stipulated in official guidance will cause revocation of all network privileges.

All personnel having access to Center program information will be required to execute non-disclosure and information protection agreements. The Center will supervise the release of data from the Information Management System (IMS) and will designate an individual to oversee and advise the contractor on all data released and/or exported from the system.

2.3.10 Data Rights: The Government shall retain ownership of all data entered, processed and/or generated by the contractor’s personnel in the performance of the tasks set forth in the

PWS.

2.3.11 Government’s Liability: The Government shall not be liable for any injury to the contractor’s personnel or damage to the contractor’s property unless such injury or damage is due to negligence on the part of the Government and is recoverable under the Federal Torts Claims

Act, or pursuant to other Federal statutory authority.

2.3.12 Place of Performance: The place of performance for this effort is at the following locations: Aviano Air Base (AB), Italy, Elmendorf Air Force Base (AFB), Alaska, Langley

AFB, Virginia, Yokota AB, Japan, Osan AB, Korea, Nellis AFB Nevada, Wright-Patterson

AFB, Ohio, Eglin AFB, Florida, Mountain Home AFB, Idaho, Misawa AB, Japan, Lakenheath

AB, England, Travis AFB, California, and Kessler AFB, Mississippi.

2.3.13 Freedom of Information Act Program (FOIA): The contractor shall comply with DoD

Regulation 5400.7-R/AF Supplement, DoD FOIA Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting and safeguarding For Official Use Only (FOUO) material. The contractor shall comply with AFI 33-332, Privacy Act Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013.

The contractor shall remove or destroy official records only in accordance with AFI 33-332

Records Management or other directives authorized in AFI 33- 364, Records Disposition-

Procedures and Responsibilities.

2.4 Services Summary: The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service for each requirement. These thresholds are critical to mission success and required by the Government in contractor performance.

Performance Objectives PWS

Paragraph

Performance Threshold/Standard

Contractor Project Manager to provide assistance to MTFs and

AFMOA/SGHQ before, during and after application process and inspections.

2.1.3.2 95% response to telephone calls and email inquiries within 24 hours of receipt during normal contractor business hours.

Verify with the COR the list of accreditation surveys of AF

MTFs

2.1.4.1 100% coordination no later than three

(3) months prior to the beginning of the first survey for the year, excluding the base year which will be coordinated upon contract award.

Notify the COR verbally via telephone and/or in writing via email work address, no less than ten (10) calendar days prior to any visit or survey conducted by contractor to include unannounced surveys or visits and those surveys or visits previously coordinated on the annual schedule and within this contract.

2.1.4.4 100% notification to the COR and

MTFs.

Notify the COR in the event

MTFs are not updating their application information in accordance with contractor application requirements.

2.1.7 100% notification to the COR.

2.5 Government Furnished Support: The Government will provide all necessary space and support necessary for contractor to complete the survey process.

2.6 Travel:

2.6.1 Travel: Travel within the Continental United States (CONUS) and Outside of the

Continental United States (OCONUS) shall be required during the performance period of this contract at the request of the Government and within the scope of the contract. Certain

OCONUS locations have country entrance requirements and all AF bases have entrance requirements. The contractor can collaborate with an individual MTF for assistance to gain base access. Dates and destinations are not available at this time. The Contractor shall utilize the following procedures:

Submit a written request to proceed with travel to the COR six (6) weeks prior to travel or as soon as identified. Contractor shall not travel until authorization from COR is received.

Arrange transportation and other travel-related requirements to ensure attendance by appropriate contractor personnel at the best value for the Government and in accordance with FAR 31.205-46, Travel Costs. Lodging and meals shall be reimbursed in accordance with the standard per diem rates in the DoD Joint Travel

Regulation.

Travel Reports shall be submitted to the COR five (5) calendar days after trip completion. Travel Report format shall include at a minimum the following: dates of travel, destination, purpose, individuals’ contacted, brief synopsis, issues & challenges, recommendations, and a signature.

The contractor shall travel using the lower cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the contractor shall use the tourist class, economy class, or similar lodging accommodations to the extent they are available and commensurate with the mission requirements. Travel will be reimbursed on a cost basis; no profit or fee will be paid.

2.7 Security Requirements: The contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data accessed or generated by contractor during the performance of this contract. At a minimum, this shall include provisions for personnel security, electronic security and physical security. Contractor personnel will be escorted on base while performing under this effort. They will not require usage of a

Government computer or e-mail access.

2.8 Deliverables: The Government understands the Accreditation Survey Reports, Certifications and Publications will be in final form when submitted. The Government reserves the right to protest to make changes on final survey reports or errors in certifications that are applicable to normal accreditation processes for contractor.

2.8.1 Deliverable Table:

DELIVERABLE SOW

PARAGRAPH

DELIVERY DATE

Verification of accreditation surveys of AF

MTFs

2.1.4 NLT three (3) months prior to

the beginning of the first survey for the year, excluding the base year which will be coordinated upon contract award

Accreditation Survey Reports 2.1.9 Within ten (10) calendar days following a final accreditation decision

Publications 2.1.12 Within thirty (30) calendar days of publication of the accreditation product and / or updates

Electronic Standards 2.1.13 Within ten (10) calendar days of publication / revision of the standards

Summary of Findings 2.1.16 By the 10th calendar day of January, April, July and

October

Certificate of accreditation and PCMH certificate

2.1.17 Within ten (10) calendar days

of accreditation approval

Summary of Findings Report 2.8.2.3 10th calendar day of January of the following year

Quality Control Plan 3.2 At time of proposal submission and any updates after contract award

2.8.2 Criteria for Acceptance: All deliverables shall be submitted in a mutually agreed draft format by the contractor and the Government with the final acceptance from the

Government on the quality/content of the reports..

2.9 Data Reporting Requirements:

2.9.1 Other Data Requirements: In addition to the monthly status reports, the contractor shall provide the following data deliverables:

Develop and maintain a complete Quality Control Plan (QCP): Initial

QCP shall be provided during the proposal phase and any updates as they become final during the entire performance period.

Submit Summary of Findings reports as specified within the PWS. Any draft copies and final copies will be delivered both electronically and one hard copy to the

COR in accordance with project milestones.

3.1 QUALITY CONTROL PLAN: The contractor is responsible for Contract Management and Quality Control, not the Government.

3.2 The contractor shall be responsible for Quality Control for all work accomplished during the performance of this contract. All work shall be accomplished using the best commercial practices and be within the Government guidelines. Work and documentation produced by the contract personnel will be regularly reviewed by the COR.

3.3 The contractor shall provide to the Government a QCP at time of proposal and any updates after contract awarded. Any update to the QCP must be reviewed by the Government.

4.0 NON-PERSONAL SERVICES: The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the CO immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

5.0 CONTRACTOR IDENTIFICATION: All contractor/subcontractor personnel shall wear a Government identification badge at all times while performing under this effort. When attending meetings and/or answering phones or via electronic mail, the contractor/subcontractor personnel shall identify themselves as a contractor employee to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, contractor/subcontractors occupying collocated space with their

Government program customer should identify their work space area with their name and company affiliation or as a minimum “contractor” after name.

6.1 HOURS OF OPERATION: Contractor shall schedule surveys during each MTFs normal hours of operation, excluding scheduled holidays and down times.

6.2 Scheduled Holidays: Government offices are closed on the following holidays: New

Year’s Day, Mr. Martin Luther King Jr. Birthday, Presidents Day, Memorial Day, Independence

Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day and Christmas Day.

7.0 APPENDICES:

7.1 APPENDIX A. Business Associate Agreement

7.2 APPENDIX B. HQ USAF/SGR Organizational Conflict of Interest (OCI)

7.3 APPENDIX C. HQ USAF/SG Non-Disclosure Agreement

7.4 APPENDIX D. Customer Complaint Record

7.5 APPENDIX E. Survey Schedule 2017-2021

7.6 APPENDIX F. Education with Industry (EWI) Fellow Job Description

APPENDIX A

BUSINESS ASSOCIATE AGREEMENT

This BAA can serve as a separate standalone agreement or may be used for new or existing contracts between the MTF and the business associate.

Business Associate Agreement

[USE FOR STANDALONE BAA ONLY] This Business Associate Agreement (this

"Agreement") is entered into this day of , (the “Effective Date”) between

[NAME OF MHS COVERED ENTITY] ("Covered Entity") and [NAME OF BUSINESS

ASSOCIATE], a [type of business entity] ("Business Associate").

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD

6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the

Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a

HIPAA covered entity, and a DoD Contractor, acting as a HIPAA business associate. The

HIPAA Rules require BAAs between covered entities and business associates. Implementing this

BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data

Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum

Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required

By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other Personally Identifiable Information (PII) (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD

Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [INSERT NAME OF

BUSINESS ASSOCIATE].

Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the

MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD

HIPAA Issuances, and in reference to this BAA, shall mean [INSERT NAME OF MTF

COMPONENT].

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy

Office Director is the HIPAA Privacy and Security Officer for DHA, including the National

Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD

Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18

(2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are

DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45

CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement

Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45

CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and

Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and/or HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA

Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of this Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the

Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, and corresponding DoD HIPAA Issuances, as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business

Associate agree to the same restrictions, conditions, and requirements that apply to the Business

Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered

Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered

Entity obligations under 45 CFR 164.524 and corresponding DoD HIPAA Issuances.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526, and corresponding

DoD HIPAA Issuances.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528 and corresponding DoD HIPAA

Issuances.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of the HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the

Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in this Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity [MODIFY THIS SECTION IF THE PURPOSE OF THE

AGREEMENT/CONTRACT IS FOR THE BA TO DEIDENTIFY PHI FOR THE CE].

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the

HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD

HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in this Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in this Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the

Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in this Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and

Restrictions

(a) The Covered Entity shall notify the Business Associate of any limitation(s) in the notice of privacy practices of the Covered Entity under 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR

164.522 and the corresponding DoD HIPAA Issuances, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable

Government regulations (including without limitation, DoD HIPAA Issuances) if done by the

Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

(1) In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall report the breach to the Covered Entity in accordance with Section VII, assess the breach incident, take mitigation actions as applicable, and notify affected individuals, as directed by the

Covered Entity.

(2) The Business Associate shall coordinate all investigation actions with the Covered Entity, and at a minimum, follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business

Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS

Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD

Privacy Act Issuances.

(3) The Business Associate shall, at no cost to the Government, bear any costs associated with a breach of PII/PHI that the Business Associate has caused or is otherwise responsible for addressing.

(b) Government Reporting Provisions

(1) If the Covered Entity determines that a breach is an HHS Breach, then the Business

Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the Covered Entity, regardless of where the breach occurs. If the Covered Entity determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy

Office.

(2) This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach

Rule as implemented by the DoD HIPAA Issuances. In general, for breach response, the

Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals, and take mitigation actions as applicable. Because DoD defines

“…