DRAFT_PALS_PWS.pdf

PERFORMANCE WORK STATEMENT

for

AIR FORCE MEDICAL OPERATIONS AGENCY

Pre-Award Acquisition Liaison Support (PALS)

Solicitation/Contract Number: TBD

30 September 2017

TABLE OF CONTENTS

Section Page Number

1. DESCRIPTION OF SERVICES 4

1.1. Background 4

1.2. Scope 4

2. GENERAL INFORMATION 4

2.1. Contractor Identification 4

2.2. Contractor Training 4

2.3. Contractor/Government Communication 5

2.4. Place of Performance 5

2.5. Travel Requirements 5

2.6. Mission/Emergency Essential 5

2.7. Duty Hours 6

2.8. Federal Holidays 6

2.9. Conduct of Contractor Personnel 6

3. CONTRACTOR REQUIREMENTS 6

3.1. PALS Services 6

3.2. Security Requirements 10

3.3. Manpower Reporting Requirements 11

3.4. Quality Control Plan 12

3.5. Post-Award Meeting 12

3.6. Monthly Status and Financial Reports 12

4. PERFORMANCE OBJECTIVES 12

4.1. Services Summary 12

5. GOVERNMENT FURNISHED PROPERTY 13

6. DELIVERABLES 14

7. APPENDICES

7.1. APPENDIX- Acronyms

7.2. APPENDIX B- Applicable Publications

7.3. APPENDIX C- Business Associate Agreement (BAA)

7.4. APPENDIX D- HQ USAF/SG Non-Disclosure Agreement

7.5. APPENDIX E- Customer Complaint Record

7.6. APPENDIX F- DD Form 254, DOD Contractor

Security Classification Specification

Section Page Number

8. EXHIBIT

8.1. EXHIBIT A Contractor Data Requirements List (CDRL) &

Data Item Descriptions (DIDs) Table of Contents

1. DESCRIPTION OF SERVICES.

1.1. Background. The Headquarters United States Air Force Surgeon General’s Office (HQ

USAF/SG), serves as the Air Force Medical Service’s (AFMS) resource management support for

Air Force Medical Support Agency (AFMSA), the Air Force Medical Operations Agency

(AFMOA), and other HQ USAF/SG agencies. The Pre-award Acquisition Liaison Support

(PALS) contract team was created to assist Government Program Managers (PMs) and

Contracting Officer Representatives (CORs) assigned to the Air Force (AF) with developing pre-solicitation requirement packages and serve as the liaison between the PMs/CORs and

Contracting Officers (COs) of procuring agencies.

1.2 Scope.

The Contractor shall support the AFMS missions by providing non-personal, professional, and advisory and assistance for PALS services in support of the acquisition lifecycle. The Contractor shall provide guidance and assistance to PMs and CORs in the course of developing, preparing, writing, reviewing and editing pre-solicitation documentation as described in Section 3 of this

Performance Work Statement (PWS) and any other documents appropriate for each particular requirement. The contactor shall assist in the preparation of briefings on acquisition/contract status for monthly Program Management Review (PMR), Annual Execute Review (AER) and the Health of Services (HoS). These services are non-performance based.

2. GENERAL INFORMATION

2.1. Contractor Identification. All contractor/subcontractors personnel will identify themselves as Government contractor employees during all forms of communications such as business meetings, telephone conversations, electronic mail, attendance sheets, coordination documentations, reports, and the signature blocks utilized in all correspondence. If a contract requires Government workspace, the contractor/subcontractor personnel shall wear a picture identification badge and identify their workspace area with their name and company affiliation.

2.2. Contractor Training. When directed by the COR or CO, contract employees shall attend all such Government provided training in a paid status as part of normal services required and billed under the contract. The COR may direct required training other than the web-based training required below:

2.2.1. Department of Defense (DoD) IAA Cyber Awareness Challenge (ADLS Course).

2.2.2. Environmental Management Systems (EMS) – General Awareness Training.

2.2.3. Security Administration (ADLS Course).

2.2.4. HIPAA and Privacy Act Training (JKO Course).

2.2.5. Operation OPSEC Awareness Training (ADLS Course).

2.3. Contractor/Government Communication. The Contractor shall designate a focal point

(FP) to be the single point of contact for all Contractor and Government correspondence. The contractor FP shall provide clear and consistent written and verbal response to Government within 12 business hours of Government initiated communication (e.g., return phone calls, emails or other communication).

2.3.1. The contractor’s focal point shall meet with the Government team at least quarterly, and additional meetings may be requested by the Government or the Contractor as necessary. The

CO, contractor Focal Point, CORs and/or other designated representative will provide monthly performance feedback to the Contractor.

2.4. Place of Performance. The work under this contract shall be performed at three (3) locations:

2.4.1. Six (6) full-time equivalents (FTEs) are located at AFMOA, Kelly Field Annex, 3515 S.

General McMullen, Suite 200, Joint Base San Antonio (JBSA) Lackland AFB, TX 78226-1865.

2.4.2. Four (4) FTEs are located at the Defense Health Headquarters (DHHQ), 7700 Arlington

Blvd, Falls Church, VA 22042-5164.

2.4.3. One (1) of the five (5) FTEs at Falls Church, VA is required to commute approximately 2 days per week or as required to the Defense Medical Logistics Center, 693 Neiman Street, Fort

Detrick, MD 21702.

2.5. Travel Requirements. The COR will notify the Contractor no later than 14 days in advance of any scheduled travel requirements. Notification will include specific travel dates, in-scope work tasks to be accomplished, and the specific Contractor personnel required to travel.

The COR will provide notice of any urgent unscheduled CONUS travel requirements no later than five (5) calendar days prior to the required travel start date. The Contractor may on occasion be required to attend briefings or training at other locations within the Washington DC area and/or the San Antonio TX area. Contractor travel shall be in accordance with (IAW) the

Federal Acquisition Regulation (FAR) Part 31.205-46 and the Federal Travel Regulations.

2.5.1. The Contractor employee shall arrange their own transportation and other travel-related requirements.

2.5.2. The COR will grant or deny authorization to proceed no later than seven (7) calendar days prior to the travel start date, or no later than three (3) calendar days prior to the travel start date for urgent unscheduled travel requirements. If the COR denies authorization to proceed, Contractor personnel shall not travel and the travel event concerned shall not be invoiced and shall not be paid to the Contractor. Only those travel events which are authorized in advance by the COR and fulfilled by the Contractor are billable under this contract.

2.6. Mission/Emergency Essential. None of the services listed in this PWS are mission/emergency essential.

2.7. Duty Hours. Normal duty hours range between the hours of 7:00 a.m. to 5:00 p.m.

central/eastern standard time, Monday through Friday (excluding federal holidays). The

Government reserves the right to change the hours of operation or restrict contractor access provided there is written coordination with the contractor and CO.

2.7.1. Telework/Telecommuting: While telework/telecommuting is authorized for this contract, the contractor shall meet the required on-site requirements of this PWS. Contractor may also telework during unplanned closures of the facility due to natural disasters, military emergency, or severe weather. A laptop with a VPN account and CAC accessibility will be provided to contractor employees by the COR.

2.8. Federal Holidays. Federal offices are closed on New Year’s Day, Dr. Martin Luther King, Jr. Birthday, Presidents Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, and Christmas Day.

2.9. Conduct of Contractor Personnel. The CO or designated Government representative may require the Contractor to remove from the job site Contractor personnel working under this contract. Removal from the job site or dismissal from the premises shall not relieve the

Contractor of the contract requirements.

2.9.1. Contractor personnel shall be required to observe Government facility parking, safety and traffic regulations that apply to all facility employees.

2.9.2. Alcoholic beverages on the job are prohibited.

2.9.3. There shall be no loud, profane or abusive language used on the job.

2.9.4. Contractor personnel shall present a clean, neat and well-groomed appearance. Casual business attire shall be worn. Contractor personnel may participate in AFMSA/AFMOA dress down attire policy.

3. CONTRACT REQUIREMENTS.

3.1. PALS Services. The Contractor shall provide PALS services to perform pre-solicitation support by providing guidance and assistance to PMs/CORs and other customers in the course of developing, preparing, writing, reviewing and editing pre-solicitation packages for submission to the contracting activity for all new and recurring services. The Contractor shall review all pre-solicitation documents and facilitate recommended edits/revisions to the requirements owners

(PMs/CORs) to improve consistency with industry best practices, commercial practices and ensure the documentation is compliant with the appropriate regulatory guidance and statutory limitations (e.g. inherently governmental functions, personal services, etc.) to include the FAR, DFARS, AFFARS, contract-related AF Instructions (AFIs), contracting operating instructions, and any other applicable regulatory guidance. Ensure documentation is prepared by utilizing the most recent FAR, DoD, AF and local templates provided by the COR or contracting agency.

The Government requires contractor employees to be on-site as much as practicable for meetings held with requirements owners (PMs/CORs), contracting activity personnel and PALS’ COR including but not limited to kick-off meetings, workload update meetings, and any meetings to resolve issues that may arise. The required pre-solicitation documentation includes, but is not limited to, the documents listed below.

Kick Off Agenda and Acquisition Strategy Kickoff Meeting Sheet

Performance Work Statement (PWS), Statements of Work (SOW), and Statement of

Objectives (SOO)

Contract Data Requirements List/Data Item Description (CDRL/DID)

DoD Contract Security Classification Specification (DD Form 254)

Quality Assurance Surveillance Plan (QASP)

Independent Government Cost Estimate (IGCE)

Market Research Report (MRR)

Requirements Authorization Document (RAD)

Authority to Advertise (ATA) or Assurance of Funds Letters

Electronic Staff Summary Sheet (e-SSS)

Assurance of Funds Letter

Justification and Approval (J&A) or sole source justification memorandum

Technical Evaluation Criteria Factors

Late-to-Need Request Letters

Determination and Findings (D&F); i.e., personal services, non-DoD agency acquisitions, Unauthorized Telework, etc.

Memoranda of Agreement/Understanding (MOA/MOU)

Cooperative Agreements

Other Service Designated Official (SDO) Approvals

Grants

3.1.1. Multi-Functional Kick-Off Meetings. Coordinate and facilitate multi-functional kick-off and acquisition meetings between requirements owners (PMs/CORs) and their management, the budget/finance POC, the security POC, the CO/Contract Specialists (CSs), the Quality

Assurance Program Coordinator (QAPC), and the PALS’ COR, as applicable to the complexity and visibility of the specific requirement.

3.1.2. PWS, SOW and SOO. The PWS, SOW or SOO shall be prepared IAW the contracting activity’s provided templates and tailored as required for each individual requirement. For performance-based requirements, include workload data provided by the COR/PM. Firm fixed price travel shall include travel data provided from the COR/PM. Include CDRLs/DIDs when the delivery of data is required. Include any other attachments as applicable to each requirement.

3.1.3. QASP – Services Summary. Provide requirements owners (CORs/PMs) recommendations in the development of the QASP to include the services summary section performance objectives and threshold standards that objectively measure contractor performance consistent with industry standards and best practices.

3.1.4. IGCE and Market Research. Conduct market research IAW FAR Part 10 (as supplemented) to arrive at the most suitable approach to acquire the requirement to assess the availability of sources and provide guidance to requirements owners (CORs/PMs) on the development of sound IGCEs and MRRs. The extent of market research varies based on factors of urgency, estimated dollar value, complexity, and past experience.

3.1.5. RAD, ATA, and Assurance of Funds Letter. The RAD, ATA, and Assurance of Funds

Letter shall be prepared IAW the COR provided templates to include appropriate coordination and approval levels.

3.1.6. Pre-Solicitation Package Submission. The initial package submission to the contracting activity for each requirement shall include the PWS, IGCE, and QASP. This submission shall be followed with the remaining documents applicable to each acquisition.

3.1.6.1. Electronic Format. Documentation shall be submitted in electronic format using

AFMS’s most current version of Microsoft Office suite applications for Word and Excel and any updated software versions.

3.1.6.2. Documentation. The Contractor shall prepare all documentation to meet established standards of the contracting activity and AF to include: timeliness, legibility, and accuracy of content. Deliver a wide variety of error-free, regulatory compliant documents by its milestone or due date including: letters, electronic staff summary sheets (eSSS), presentations, spreadsheets, forms, metrics, and other acquisition-related documentation. Only AFMS and AF approved abbreviations may be used in documentation. All electronic documentation shall be maintained on Government computers, servers, or shared drives as applicable.

3.1.7. COR/PM Final Acceptance. Ensure requirement owners’ (CORs/PMs) final acceptance of documents prior to submission to the contracting activity’s CO/CS. Ensure timely submission of requirement packages, based on dollar value, scope, complexity, so that delivery of documents is prior to the contracting activity’s established acquisition lead times for processing the acquisition by the required contract award date.

3.1.8. Late-to-Need Request Letters. The Contractor shall ensure the initial package submission is accompanied by a Late-to-Need letter when the package is not received by the contracting activity’s year-end established timelines.

3.1.9. Comment Resolution Matrix (CRM) Review Process. For each pre-solicitation package submission, the contracting activity will perform a review of the documents and provide a CRM to be addressed by the Contractor and the CORs/PMs. CRM comments are categorized by the reviewer as administrative (does not affect the scope of the requirement), critical (affects the scope of the requirement), and substantive (between “administrative” and “critical”). The

Contractor, based on feedback from the PMs/CORs or the COs/CSs and QAPC shall be responsible for revising the pre-solicitation documentation through the time of the contracting activity’s solicitation release. Ensure the disposition of all comments is clearly and concisely documented, consistent with the contracting agency’s practices. The Contractor shall have 10 business days to address CRMs, revise documentation and resubmit to the contracting activity.

3.1.10. PALS Workload Updates, PMR Briefings, and Other Administrative

Requirements.

3.1.10.1. PALS Workload Status Reports and Update Meetings. The PALS’ COR shall determine the frequency of these meetings. The Contractor shall report project status changes on the Government’s database, to be updated by the Contractor on a weekly basis. The Contractor shall also report the contracting activity’s acquisition status and include status of expiring contracts requiring re-procurement (e.g. recurring services). The Contractor shall schedule, coordinate, and furnish copies of project status reports for the workload status update meetings with the PALS’ COR and the contracting activity.

3.1.10.2. Assistance with PMR, AER and HoS Briefings. The Contractor shall assist as required with draft presentations/briefings of pre-solicitation and acquisition status of requirements for the CORs monthly PMR briefings, the AER, the HoS and other briefings if needed. Briefing slides shall be completed in latest AFMS version of Microsoft Office suite application for Power Point and any subsequent updated software versions.

3.1.10.3. Trend Analysis. Conduct data analysis on length of review and revision process and limiting factors affecting project milestones and brief the PALS’ COR on recommended actions needed to minimize impact to the project.

3.1.10.4. Programmatic Guidance. Provide overarching programmatic guidance to internal/external AFMS requirement owners (CORs/PMs) during formal and informal meetings and conferences.

3.1.10.5. Meeting Attendance and Set Up. Attend meetings on-site as practicable and assist in setting up meetings, seminars, working groups, and telecons that routinely include the contracting activity, PMs/CORs, Major Command, or other Government contracting agencies to formulate/draft AFMS pre-solicitation documentation.

3.1.10.6. Training Assistance. Assist the COR in providing acquisition-related training to

AFMS Government personnel.

3.1.11. Staffing. The Contractor shall provide eleven (11) full-time equivalent (FTE) personnel to support the requirements of this PWS at each of the Government sites as indicated in Section 2.4 within ten (10) business days after the contract start date (pending security clearances). Each FTE shall be based on 1,920 hours per year. A resume of proposed personnel, redacted of the individual’s name and personal information, shall be submitted to the COR/CO for Government verification of the PWS qualifications 10 business days after contract award or prior to replacement of personnel in the course of the contract.

3.1.11.1. Minimum Experience/Education: Six (6) years of experience is required in the field of contracting, procurement or acquisition support of DoD services requirements. The

Contractor shall possess the necessary analytical and problem solving skills to meet the requirements outlined in this PWS. Skilled in operating Microsoft Office suites include such applications for Word, Excel, PowerPoint and Outlook as required by the AFMS.

3.1.11.2. Substitute/Replacement of Personnel. The contractor shall notify the CO/COR of any projected personnel vacancy(s) or in the case where a vacancy is not projected, notify no later than the next business day after the vacancy occurs. In instances where the Contractor projects vacancies may exceed 10 business days, the Contractor shall provide a notification within five (5) calendar days from the day the vacancy occurred. The notification shall include the anticipated date for the replacement personnel and the action taken to ensure contract performance is not impacted. The Contractor shall additionally provide weekly update notifications until the position is filled. The contractor shall provide a one-week advance notice of any proposed substitute/temporary personnel and the period they will be utilized. The

Contractor shall not invoice, nor will the Government compensate, for any period of time a position(s) is in a vacant status.

3.1.11.3. Continuation of Services. The Contractor is responsible for continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment ensuring minimal impact to the Government. Position vacancies shall not exceed

30 calendar days.

3.2. Security Requirements.

3.2.1. Security Clearance Requirements: All Contractor employees shall have/obtain an active favorable Tier 1 (T1) – NACI/NAC or meet the requirements of DoDM 1000.13-M-VI, January 23, 2014. Costs and documentation required for security certification will be the responsibility of the Contractor. The Contractor shall provide documentation received from the appropriate Government agency as to the verification of contract personnel’s Tier 1 certification.

In case the certification has been requested, but not received, the Contractor may provide documentation on any Contractor employee where certification has been requested. In this instance, the Contractor employee will be able to begin work in areas that would not conflict with Government security issues. The COR shall be kept abreast of issues dealing with the Tier

1 certification. The Contractor’s security officer shall ensure timely notification of all hires to the Air Force Surgeon General’s Security Office located at the AFMOA/SGA, JBSA Lackland

AFB, TX and AFMSA/SGE, DHHQ, Falls Church, VA.

3.2.2. List of Contractor Personnel: The Contractor shall maintain a current listing of

Contractor personnel. The list shall include Contractor personnel’s name, social security number, and level of security clearance. The list shall be validated and signed by the company

Facility Security Officer (FSO) and provided to the COR and Information Protection Office (IP

Office) at each performance site 30 calendar days prior to the service start date. Updated listings shall be provided when a Contractor employee’s status or information changes. A Visit Request for all Contractor personnel with security clearances is required to be sent through the Joint

Personnel Adjudication System (JPAS), and must be updated at least annually. The Contractor shall notify the Information Security Program Management (ISPM) at each operating location 30 calendar days before on-base performance of the service. The notification shall include:

3.2.2.1. Name, address, and telephone number of the company key management representatives.

3.2.2.2. The contract number and contracting agency.

3.2.2.3. The highest level of classified information to which employees require access.

3.2.2.4. The location(s) of service performance and future performance, if known.

3.2.2.5. The date service performance begins.

3.2.2.6. Any change to information previously provided under this paragraph.

3.2.3. Local Area Network (LAN). All Contractor employees requiring access to the

Government unclassified computer network shall have a valid Tier 1 (T1) verified through Joint

Personnel Adjudication System (JPAS). No Contractor employee will be provided access to unclassified computer network or its inherent capabilities (i.e., internet access, electronic mail, file and print services, etc.) without a valid Tier 1 (T1). The Contractor shall be aware of and abide by all Government regulations concerning the authorized use of the Government’s computer network including the restriction against using the network to recruit Government personnel or advertise job openings.

3.2.4. Disclosure of Information. In the performance of this contract, the Contractor employee may have access to data and information proprietary to a Government agency or to another

Government Contractor, or of such nature that its dissemination or use, other than as specified in this contract, would be illegal or otherwise adverse to the interests of the Government or others.

The Contractor and its personnel shall not divulge or release data or information developed or obtained under performance of this contract, except to authorized Government personnel or upon written approval of the CO. The Contractor and its personnel shall not use, disclose, or reproduce proprietary information bearing a restrictive legend, other than as specified in the contract.

3.2.5. Non-Disclosure Agreement (NDA). All Contractor employees shall sign the non-disclosure statement provided at Appendix X prior to beginning of contract performance. The

Contractor must then provide a copy of the signed/dated NDA to the COR five (5) business days prior to beginning work.

3.3. Contractor Manpower Reporting Requirements Application (CMRA). The Contractor shall report ALL Contractor labor hours (including subcontracted labor hours) required for performance of services provided under this contract for the Air Force and Army via a secure data collection site. The Contractor is required to completely fill in all required data fields at http://www.ecmra.mil. Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September.

While inputs may be reported at any time during the FY, all data shall be reported no later than

31 October of each calendar year. Contractors may direct questions to the CMRA help desk.

3.3.1. Uses and Safeguarding of Information. Information from the secure web site is considered to be proprietary in nature when the contract number and Contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the Contractor name and contract number associated with the data.

3.3.2. User Manuals. Data for Air Force service requirements must be input at the Air Force

Contract Manpower Reporting Application (CMRA) link. However, user manuals for

Government personnel and Contractors are available at the Army CMRA link http://www.ecmra.mil.

http://www.ecmra.mil/

3.4. Quality Control Plan (QCP). The Contractor is responsible for Contract Management and Quality Control, not the Government. The Contractor shall submit a QCP (10) business days after contract award and maintain/update it thereafter.

3.5. Post-Award Meeting. The Government will host a post-award meeting with the

Contractor within ten (10) business days after Contractor award. The CO shall contact the

PM/COR and the Contractor to schedule this meeting. Telecom/teleconference is permissible for the post-award meeting. The purpose of the post-award meeting is introduce the Contractor to the Government representatives (PM/COR) the Contractor will support; provide the Contractor the opportunity to explain in more detail their proposal’s technical approach; and entertain questions from either party. Take-aways from the meeting should be an exchange of contact information; a timeline of when direct support will start, if not yet started; and an understanding by all parties of all the requirements to be performed by the Contractor and the support the

Government will provide the Contractor to perform the requirements, safely and efficiently. The

Contractor shall also attend an Initial Contractor Performance Review thirty (30) calendar days after the Contractor assumes full performance responsibilities (i.e. after completion of transition/mobilization) to ensure that the Contractor has successfully started performance, completed transition, is fully operational, and is within the estimated cost, schedule, and performance parameters of the Contractor. The Contractor shall also attend a follow-up meeting

90 calendar days after Contractor award to assess status of performance.

3.6. Monthly Status and Financial Reports (MS-FR). The Contractor shall prepare and submit a monthly status/financial report identifying all tasks performed, status, issues, and anticipated actions consistent with the PWS each month. The Contractor shall provide the Monthly Status/ Financial

Report IAW CDRL _____.

3.6.1. MS-FRs. The MS-FRs should include, but not limited to task description, summary of technical milestones/activities, and problem/issues.

4. PERFORMANCE OBJECTIVES.

4.1. Services Summary (SS). The Contractor services requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service for each requirement. These thresholds are critical to mission success.

Services Summary

Performance Objectives

PWS

Paragraph Performance Threshold/Standard

Provides PALS services to requirements owners

(PMs/CORs) contracting activity personnel and PALS’

COR

3.1

No more than three (3) substantiated negative customer feedbacks in a 3-month period.

Services Summary

Performance Objectives

PWS

Paragraph Performance Threshold/Standard

Provide timely submission of initial pre-solicitation packages.

3.1.6

3.1.6.1

3.1.6.2

3.1.7

No more than three (3) substantiated negative customer feedbacks in a 3-month period.

Address CRM comments and provide revised documents by required timelines.

3.1.9

No more than three (3) substantiated negative customer feedbacks in a 3-month period.

Provide timely and concise

PALS Workload Status/Updates by required COR timeline.

3.1.10

No more than two (2) substantiated negative customer feedbacks per fiscal year calendar quarter.

Utilizes latest versions of required templates for documentation preparation and maintains organized e-files on all generated documentation

3.1 thru 3.1.6

No more than nine (3) substantiated negative customer feedbacks for each annual contract period.

Provides qualified staffing capable of performing contract requirements and replacement personnel are filled with required timelines.

3.1.11

3.1.11.1

3.1.11.2

3.1.11.3

(1) No more than one (1) FTE at Falls

Church location and no more than one

(1) FTE at Lackland AFB location shall remain vacant for more than thirty (30) calendar days at any time.

(2) No more than one (1) substantiated negative customer feedback for each annual contract period for filling a position with an unqualified candidate.

5. GOVERNMENT FURNISHED PROPERTY (GFP). No GFP is being provided to the

Contractor in support of this contract. The Government will provide the Contractor with the facilities, equipment, and information necessary to perform the tasks stipulated in this contract.

Facilities include office space in both classified and unclassified work areas. Equipment includes computers (unclassified), desks, chairs, access to printers, unclassified networks, copy machines, classified destruction equipment, telephones (secure, DSN, commercial access capabilities), basic office supplies, and Government vehicles, if necessary and available. These items are incidental to the place of performance and remain accountable to the Government. In addition, the Government shall require each individual Contractor employee to sign hand receipts for all Information Technology Equipment (ITE) that they exclusively use (i.e., all equipment on their desks). This includes laptops for travel or out-of-office use. Contractor employees are not required to sign for multiple user ITE such as network equipment, network printers, and servers. Information includes all reference material or documentation required to perform. All facilities, equipment, and information used by the Contractor will remain the property of the Government and the Contractor shall return all facilities, equipment, and information to the COR or other designated representative upon the request of the Government or at the end of the contract period of performance.

6. DELIVERABLES

6.1. The Contractor shall submit all deliverables as specified in this PWS and Exhibit A, Contract Data Requirements List (CDRL) and applicable Data Item Description (DID).

6.1.1. All deliverables must be submitted electronically to the COR(s).

6.1.2. The COR may approve extensions to the delivery timeline based on magnitude and complexity of the document topic.

6.1.3. Provide informal reports by e-mail as requested by the COR.

7. APPENDICES

7.1. APPENDIX A - Acronyms

7.2. APPENDIX B - DoD Regulations/Manuals/Instructions/Directives

7.3. APPENDIX C - Business Associate Agreement (BAA)

7.4. APPENDIX D - HQ USAF/SG Non-Disclosure Agreement

7.5. APPENDIX E - Customer Complaint Record

8. EXHIBIT

8.1. EXHIBIT A Contractor Data Requirements List (CDRL)

APPENDIX A

ACRONYMS & DEFINITIONS

ACRONYMS

AER Annual Execute Review

AF Air Force

AFFARS Air Force Federal Acquisition Regulation Supplement

AFI Air Force Instruction

AFMOA Air Force Medical Operations Agency

AFMS Air Force Medical Service

AFMSA Air Force Medical Support Agency

ASK Acquisition Strategy Kick-Off

CAC Common Access Card

CFR Code of Federal Regulations

CRM Comment Resolution Matrix

CO Contracting Officer

COR Contracting Officer’s Representative

CORT Contracting Officer Representative Tool

CS Contract Specialist

DFARS Defense Federal Acquisition Regulation Supplement

DHHQ Defense Health Headquarters

DoD Department of Defense

DoDD Department of Defense Directive e-QIP Electronic Questionnaires for Investigations Processing eSSS Electronic Staff Summary Sheets

FAR Federal Acquisition Regulation

FP Focal Point

FTE Full Time Equivalent

GFP/GFI Government Furnished Property/Information

HoS Health of Services

HQ USAF Headquarters United States Air Force

HQ USAF/SG Headquarters United States Air Force Surgeon General

IGCE Independent Government Cost Estimate

J&A Justification and Approval

JBSA Joint Base San Antonio

JPAS Joint Personnel Adjudication System

JTR Joint Travel Regulation

KSA Knowledge, Skills and Abilities

LAN Local Area Network

MOAs/MOUs Memoranda of Agreement/Understanding

MRR Market Research Report

MSR Monthly Status Report

NACI National Agency Check with Inquiries

NLT No Later Than

OPSEC Operational Security

PALS Pre-award Acquisition Liaison Support

PM Program Manager

PMR Program Management Review

PWS Performance Work Statement

QASP Quality Assurance Surveillance Plan

QCP Quality Control Plan

RAD Requirement Authorization Document

SG Surgeon General

SG5 Research and Acquisition Directorate

SOO Statement of Objectives

SOP Standard Operating Procedure

SOW Statement of Work

TEC Technical Evaluation Criteria

TR Trip Report

UNCLAS Unclassified

USAF United States Air Force

DEFINITIONS

Advisory and Assistance Services: Services provided under contract by non-governmental sources to support or improve organizational policy development, decision-making; management and administration, program and/or project management and administration, or Research and

Development activities. It can also be defined as professional advice or assistance rendered to improve the effectiveness of federal management processes or procedures (including those of an engineering and technical nature). In rendering the foregoing services, deliverables may take the form of information, advice, opinions, alternatives, analyses, evaluations, recommendations, training, and the day-to-day aid of support personnel needed for the successful performance of ongoing federal operations.

Business Day: All due dates/days listed in this PWS are calendar days. Dates listed as

“business days” are counted as government working days (Monday through Friday except

Government holidays).

Contracting Officer’s Representative (COR): The individual(s) designated to perform quality assessment functions. They serve as on-site technical managers assessing the Contractor’s performance against contract performance standards.

Deliverable: Any tangible item that the Contractor produces and delivers to the Government.

Down Day: A day that USAF leadership designates as a minimal manning/liberal leave day.

National Agency Check with Inquires: NACI is the type of personnel security investigation that the Government conducts for the FTE performing under this contract. The Contractor performing the requirements under this contract is in a public trust position and requires a suitability determination and not an investigation for a security clearance higher than

Unclassified.

On Site: “On-site” means at the Government’s primary place of performance for this contract:

Defense Health Headquarters (DHHQ and Kelly Field Annex).

Supported Agencies: Includes but is not limited to: AFMS, AFMSA, AFMOA, HHS, Major

Commands, MTFs, and DHA.

APPENDIX B

DEPARTMENT OF DEFENSE (DoD) REGULATIONS/MANUALS

INSTRUCTIONS/DIRECTIVES

*Most current versions will apply*

Applicable Publications. Publications applicable to this requirement include, but are not limited to, those listed below. The Contractor shall follow all applicable publications and references thereto. Supplements or amendments to listed publications from any organizational level may be issued by the AF Publications Office during the life of the Contractor. The

Contractor shall immediately implement those changes in publications which result in a decrease or no change in the price and notify the CO in writing of such change. Should a decrease in

Contractor price result; the Contractor shall provide a proposal for reduction in the price to the

CO. Prior to implementing any change that will result in a price increase; the Contractor shall submit to the CO a price proposal within 30 calendar days of receipt of notice of the change by the Contractor. The CO and the Contractor shall negotiate the change into the Contractor under the provisions of the Contractor clause entitled "Changes.” Failure of the Contractor to submit a price proposal within 30 calendar days from receipt of notice of the change shall entitle the

Government to performance IAW such change at no increase in price.

Publications and forms are maintained and available electronically for Contractor download through the internet.

DoD Directives can be found at http://www.dtic.mil/whs/directives/index.html

Regulations are followed by a “---R” (e.g., DOD 6025.18-R) and can be located on the website by clicking on Publications instead of Directives.

The Air Force’s e-Publishing site (http://www.e-publishing.af.mil) shall be used to obtain

Air Force Instructions.

PUBLICATION NUMBER TITLE APPLICABLE

PARAGRAPHS

29 CFR 541 Defining And Delimiting Entire AFI-63-124 Performance Based Service Contracts Entire DoD 6025.18-R DoD Health Information Privacy Regulation Entire DoD 8580.02-R DoD Health Information Security Regulation Entire DoD 5220.22-M National Industrial Security Program Operating

Manual (NISPOM) 2.6

DoD 6025.18-R DoD 8580.02-R

AFI 41-217

45 CFR 164.50 1

45 CFR 164.103

45 CFR 164.520

45 CFR 164.524

45 CFR 164.526

45 CFR 164.528

Health Insurance Portability and Accountability

Act of 1996, Title II (P.L. 104-191) 2.7

DoDD 5500.7 Standards of Conduct 2.8

AFI 63-601 Industrial Security Program Management 5.0

CFR Title 48, Chapter 1, Subchapters A & H

Federal Acquisition Regulation (FAR) and supplements: Defense Federal Acquisition

Regulation Supplement (DFARS) and Air

Force Federal Acquisition Regulation

Supplement (AFFARS)

Entire

DFARS 227.7103-7 Noncommercial Items or Processes/Use and

Non-Disclosure Agreement 2.3

APPENDIX C

BUSINESS ASSOCIATE AGREEMENT

This BAA can serve as a separate standalone agreement or may be used for new or existing Contractors between the

MTF and the business associate.

Business Associate Agreement

[USE FOR STANDALONE BAA ONLY] This Business Associate Agreement (this "Agreement") is entered into this ___ day of ________, _____ (the “Effective Date”) between [NAME OF MHS COVERED ENTITY]

("Covered Entity") and [NAME OF BUSINESS ASSOCIATE], a [type of business entity] ("Business Associate").

Introduction

In accordance with 45 CFR 164.502(e) (2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health

Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DOD Contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance

(DOD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the Contractor or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (Nap), Protected Health

Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health

Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other

Personally Identifiable Information (PII) (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA

Issuances, and in reference to this BAA, shall mean [INSERT NAME OF BUSINESS ASSOCIATE].

Agreement means this BAA together with the documents and/or other arrangements under which the Business

Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this

BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [INSERT NAME OF MTF COMPONENT].

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the

HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate

(NCRMD).

DoD HIPAA Issuances means the DOD issuances implementing the HIPAA Rules in the DoD Military Health

System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11

(2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S.

Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E

(Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the

2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-

5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and/or HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose Personal Health Information (PHI) other than as permitted or required by this Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business

Associate shall also respond to any security incident of which it becomes aware in accordance with any Information

Assurance provisions of this Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, and corresponding DoD HIPAA

Issuances, as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45

CFR 164.524 and corresponding DoD HIPAA Issuances.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526, and corresponding DoD HIPAA Issuances.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45

CFR 164.528 and corresponding DoD HIPAA Issuances.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the

HIPAA Privacy Rule, the Business Associate shall comply with the requirements of the HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in this

Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity [MODIFY THIS SECTION IF THE

PURPOSE OF THE AGREEMENT/CONTRACTOR IS FOR THE BA TO DEIDENTIFY PHI FOR THE

CE].

(b) The Business Associate agrees to use, disclose, and request PHI only in accordance with the HIPAA Privacy

Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA

Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in this Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in this Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business

Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business

Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in this Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall notify the Business Associate of any limitation(s) in the notice of privacy practices of the Covered Entity under 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an

Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the

Covered Entity has agreed to or is required to abide by under 45 CFR 164.522 and the corresponding DoD HIPAA

Issuances, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the

Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

(1) In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall report the breach to the Covered Entity in accordance with Section VII, assess the breach incident, take mitigation actions as applicable, and notify affected individuals, as directed by the Covered Entity.

(2) The Business Associate shall coordinate all investigation actions with the Covered Entity, and at a minimum, follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD

Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the

Business Associate shall comply with both Privacy Act and HIPAA breach response…