HHSM-500-2014-RFP-BFCCNCC_RFP_Amendment_1.docx

Table of Contents

End Stage Renal Disease Network CMS-2012-Contractor-DQC Firm Fixed Price (FFP) Renewal

Beneficiary and Family Centered Care (BFCC) National Coordinating Center (NCC) HHSM-500-2014-RFP-BFCCNCC Amendment 1 as of April 25, 2014 v

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 Description of Services

The purpose of this work is to establish a National Coordinating Center (NCC) to support the Beneficiary and Family Centered Care (BFCC) provisions of the Medicare Quality Improvement Organization (QIO) Program. The Beneficiary and Family Centered Care National Coordinating Center (BFCC NCC) supports the work of Quality Improvement Organizations (QIOs) as they work to improve the quality of care available to Medicare beneficiaries in the U.S. health care system. QIOs, and by extension, the BFCC NCC, do this in a manner that aligns with the work that Centers of Medicare & Medicaid Services (CMS) does in its efforts towards achieving the goals of the National Quality Strategy (NQS) and the CMS Quality Strategy along with the other strategies, goals, recommendations, and priorities listed in this Statement of Work. Specifically, the BFCC NCC shall work with BFCC-QIOs to improve healthcare services for Medicare beneficiaries by coordinating numerous statutory review functions, including but not limited to, quality of care reviews, beneficiary complaint reviews, discharge and termination of service appeals in various provider settings, medical necessity reviews, and Emergency Medical Treatment and Active Labor Act (EMTALA) reviews.

B.2 Type of Contract

The Government contemplates awarding one (1) five (5) year Cost-Plus-Fixed-Fee (CPFF) contract resulting from this solicitation.

NOTE: Please be advised that if the Offeror does not have an accounting system that is adequate for determining costs applicable to the contract (FAR 16.301-3) and for accumulating and segregating costs under a Cost Reimbursement (CR) contract, it will not be eligible to receive an award.

B.3 Cost Plus Fixed Fee (CPFF)

A. Total Contract Amount The total estimated cost plus fixed fee for this contract is $(to be entered at the time of award). The total cost is $(to be entered at the time of award) and the total fixed fee of $(to be entered at the time of award).

B. Reimbursement The BFCC NCC , upon successful completion of the work required, will be reimbursed monthly in accordance with Section I, Federal Acquisition Regulation (FAR) clauses 52.216-7 Allowable Cost and Payment (JUN 2013) and 52.216-8 Fixed Fee (JUN 2011). Monthly vouchers shall be submitted in accordance with contract Section G.2 Payments-Vouchers (Cost Reimbursement Contracts).

C. Table of Total Estimated Cost Plus Fixed Fee The BFCC NCC shall provide the necessary personnel, materials, services, facilities and supplies (except as may be otherwise specified in the contract) and otherwise do all things necessary for, or incident to, the performance of the work as set forth in Section C, Statement of Work/Services. In consideration of successful contract performance based on the evaluation criteria set forth in Section H.5, the BFCC NCC will be reimbursed as stated in the Table of Total Estimated Cost and Fixed Fee provided on the on the following page:

$0

Total

B.4 Schedule for Payment of Fixed Fee Payment of the fixed fee will be made in accordance with the schedule provided below. As authorized under FAR 52.216-8, after payment of 85% of the fixed fee, CMS may elect to withhold 15% or $100,000 (whichever is less).

Month Payment Total 1-59 Withholding Total

B.5 Ceiling Rates

A. General The cost limitations addressed in this Section apply to the total contract ceiling amount of the contract. The BFCC NCC is advised that all costs associated with this contract, either directly or indirectly, are subject to audit.

B. Indirect Cost Rates

The indirect cost rate ceiling(s) for this contract is/are:

TBD

B.6 Medical Records Photocopying The BFCC NCC will be paid for a properly certified invoice/voucher for medical records photocopying costs at a rate of $.12 per page (hardcopies) for reproduction of PPS provider records and $.15 per page (hard copies) for reproduction of non-PPS institutions and practitioner records, plus first class postage. Specifically, hospitals and other providers (such as critical access hospitals) under a Medicare cost reimbursement system, receive no photocopying reimbursement from the BFCC NCC. Capitation providers such as HMOs and dialysis facilities receive $.12 per page. No fixed fee will be paid on photocopying.

B.7 Overnight Mail Contract deliverables shall not be submitted utilizing overnight mail. All other overnight mailings (e.g., provider-based discharge appeals, etc.) shall be at the discretion of the BFCC NCC and are subject to the Contracting Officer’s (CO) determination of reasonableness.

B.8 Transition Services

In the event that CMS requires transition services from an incumbent (2014) BFCC NCC to a successor (2019) BFCC NCC, CMS will request a separate technical and business proposal for these services. These services will be incorporated into the contract, if applicable.

In the event that CMS requires transition services from an incumbent BFCC NCC to a successor BFCC NCC, the incumbent will be responsible for funding the cost of transfers which includes, but not limited to, the packing, shipping, etc. of any GFE to the location identified by CMS.

The contractor is responsible for adhering to the CMS HHS-22 and HHS-565 processes which focuses on asset management and transition of equipment (transfers, disposals, donations, etc.).

Within 60 days of end of contract, the incumbent BFCC NCC shall communicate with the QualityNet Help Desk to identify the shutdown/transition of their contract to initiate the QIO Startup/Shutdown transition procedure.

B.9 Contract Limitations The following chart indicates the contract limitations for the structure of the QIO Program. These contract limitations also include any subcontracting arrangements or corporate affiliates (as defined in H.11.C.4).

· Any BFCC-QIO Area

· BFCC NCC

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

· Any BFCC-QIO Area

· BFCC NCC

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

· Any QIN-QIO Area

· QIN NCC

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

BFCC National Coordinating Center

(BFCC NCC)

· Any QIN-QIO Area

· QIN NCC

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

BFCC Oversight & Review Center

(BFCC ORC)

· Any QIN-QIO Area

· QIN NCC

· Any BFCC-QIO Area

· BFCC NCC

· PCC

· IEC

· VIQRC: 1) Outreach/ Education for Inpatient/ Cancer/ Psych; or 2) Appeals

Program Collaboration Center

(PCC)

· Any QIN-QIO Area

· QIN NCC

· Any BFCC-QIO Area

· BFCC NCC

· BFCC ORC

· SIE

· IEC

· VIQRC (Any)

· PCC

· IEC

· BFCC ORC

· VIQRC (Appeals Only)

· PCC

· IEC

· PCC

· PCC

· Any QIN-QIO Area

· Any BFCC-QIO Area

· QIN NCC

· BFCC NCC

· BFCC ORC

· PCC

· SIE

· VIQRC (Any Other)

· BFCC ORC

· PCC

· IEC

· VIQRC Appeals

· Any QIN-QIO Area

· Any BFCC-QIO Area

· QIN NCC

· BFCC NCC

· BFCC ORC

· PCC

· SIE

· VIQRC (Any)

CMS shall not enter into a contract under this part with any entity (prime or subcontractor) which is, or is affiliated with (through management, ownership, or common control), a health care facility, within the area served by such entity or which would be served by such entity if it entered into a contract with the CMS under this part.

An entity shall not be considered to be affiliated with a health care facility by reason of management, ownership, or common control if the management, ownership, or common control consists of no more than twenty (20) percent of the members of the governing board of the entity being affiliated (through management, ownership, or common control) with one or more of such facilities.

SECTION C – STATEMENT OF WORK/SERVICES

C.1. Background and Overview The statutory authority for this Statement of Work (SOW) is found in Part B of Title XI of the Social Security Act; The statutory provisions originated with the Peer Review Improvement Act of 1982 (P.L. 97-248, §§ 141-143, 96 Stat. 324) which established the Utilization and Quality Control Peer Review Organization program, now known as the Quality Improvement Organization (QIO) program. These provisions were significantly amended by the Trade Adjustment Assistance Extension Act of 2011 (P.L. 112-40, § 261, 125 Stat. 401).

The statutory mission of the Program, as set forth in Section 1862(g) of the Act, involves the Secretary entering into contracts with Quality Improvement Organizations (QIOs) for purposes of making determinations about whether items and services provided to Medicare beneficiaries are reasonable and necessary for the diagnosis or treatment of illness or injury or to improve the functioning of a malformed body member, and are not for custodial care. In addition, the Secretary must enter into these contracts to improve the effectiveness, efficiency, economy, and quality of services delivered to Medicare beneficiaries. Toward those goals, Section 1154(a) of the Act requires the QIO contractors to perform one or more functions listed in that section.

Among the statutory duties is the review of some or all of the professional activities of providers and practitioners in the QIO area, subject to the terms of their contracts, in the provision of health care items or services to Medicare beneficiaries; such reviews are for purposes of determining whether services are or were reasonable and medically necessary, whether the quality of the services meets professionally recognized standards of care, and, for inpatient services, whether the proposed services could be effectively provided more economically on an outpatient basis or in a different type of inpatient facility. These reviews are integral to the determination whether items and services should be payable under the Medicare program.

Section 1154(a)(18) also includes provisions that involve broader authority for QIOs to improve the effectiveness, efficiency, economy, and quality of services under the Medicare program. Section 1154(a)(10) of the Act, for example, specifically requires that the QIO “coordinate activities, including information exchanges, which are consistent with economical and efficient operation of programs among appropriate public and private agencies or organizations, including other public or private review organizations as may be appropriate.” The Centers for Medicare & Medicaid Services (CMS) regards this as authority for the QIO to coordinate and operate a broad range of collaborative and community activities among private and public entities, as long as the predicted outcome will likely directly benefit the Medicare program.

In addition, Section 1156(c) of the Act states that it is the duty of each QIO to use such authority or influence as it may possess as a professional organization, and to enlist the support of any other professional or governmental organization having influence or authority over health care practitioners or entities furnishing services in its area, in assuring that each practitioner or entity shall comply with all obligations imposed on them under Section 1156(a) of the Act. Under these obligations, providers and practitioners must assure that they shall provide services economically and only when, and to the extent medically necessary and that those services will be of a quality that meets professionally recognized standards of care.

Section 1867(d)(3) of the Act requires the U.S. Secretary of Health and Human Services (HHS) to request a QIO to: 1) assess whether an individual had an emergency medical condition that had not been stabilized; and 2) provide a report to the Secretary in certain circumstances. As part of the implementation of this provision, CMS and the HHS Office of the Inspector General consult with QIOs in order to determine whether, with respect to EMTALA requirements, an individual had an emergency medical condition that had not been stabilized, and whether a medical screening examination, stabilizing treatment or a transfer was appropriate.

C.2. Contract Purpose The purpose of this work is to establish a National Coordinating Center (NCC) to support the Beneficiary and Family Centered Care (BFCC) provisions of the Medicare Quality Improvement Organization (QIO) Program. The Beneficiary and Family Centered Care National Coordinating Center (BFCC NCC) supports the work of Quality Improvement Organizations (QIOs) as they work to improve the quality of care available to Medicare beneficiaries in the U.S. health care system. QIOs, and by extension, the BFCC NCC, do this in a manner that aligns with the work that Centers of Medicare & Medicaid Services (CMS) does in its efforts towards achieving the goals of the National Quality Strategy (NQS) and the CMS Quality Strategy along with the other strategies, goals, recommendations, and priorities listed in this Statement of Work. Specifically, the BFCC NCC shall work with BFCC-QIOs to improve healthcare services for Medicare beneficiaries by coordinating numerous statutory review functions, including but not limited to, quality of care reviews, beneficiary complaint reviews, discharge and termination of service appeals in various provider settings, medical necessity reviews, and Emergency Medical Treatment and Active Labor Act (EMTALA) reviews.

C.2.1. Overall Purpose of QIO Program While the purpose of this contract is to carry out the goals listed in section 1862(g) of the Act, QIOs ultimately fulfill their program requirements in ways that support CMS in its efforts to seek to improve health and health care for all Medicare beneficiaries and promote quality of care to ensure the right care at the right time, every time.

Although the QIOs’ tasks do not fulfill requirements under the Affordable Care Act (P.L. 111-148 as amended by P.L. 111-152), we have designed the contractual requirements here in alignment with the Affordable Care Act goals that are relevant to the QIO program and that seek to increase access to high-quality, affordable health care for all Americans. We seek to align the goals of the QIO program in general, and successful performance of this contract, with National Strategy for Quality Improvement in Health Care (the NQS) established by the Secretary pursuant to the Affordable Care Act. The NQS sets priorities to achieve the goals of the Affordable Care Act and includes a strategic plan for how to achieve them. The NQS articulates six priorities that build on the three broad aims of better care, improvement of health, and lowering costs through improvement, and forms the basis for the CMS Quality Strategy’s six goals, which are aligned as follows:

The NQS notes that an effective national strategy must support effective local strategies. National standards and consistency in their measurement are essential components of the NQS. At the same time, the unique needs and characteristics of local communities must be supported to ensure activities that are responsive to and driven by local circumstances, needs and capacities.

In working to achieve goals at the local level, the QIOs’ work will serve an essential role in helping CMS to achieve the goals of the NQS. In most instances, the QIO local level activities will be conducted in coordination with the QIO NCC, which are entities that work under contract to CMS as part of the QIO program, to support the QIOs by facilitating the flow of information to and from each of the QIOs.

C.3 QIO Program Structure and Requirements This section provides the QIO Program Structure. In accordance with the QIO Program changes and flexibilities afforded to the Secretary in the Trade Adjustment Assistance Extension Act of 2011, the QIO Program operations are restructured as prescribed in the following subsections.

C.3.1. QIO Program Structure The QIO contracts are structured by function and categorized as follows:

1. A number of Quality Innovation Network QIOs (QIN-QIOs);

1. Five (5) Beneficiary and Family Centered Care QIOs (BFCC-QIOs);

1. One (1) Program Collaboration Center (PCC);

1. One (1) National Coordinating Center (NCC) for BFCC (this contract);

1. One (1) National Coordinating Center for QIN;

1. Five (5) Value Incentives and Quality Reporting Centers (VIQRCs);

1. One (1) Strategic Innovation Engine (SIE);

1. One (1) Independent Evaluation Center (IEC); and

1. One (1) BFCC Oversight and Review Center (BFCC ORC).

The QIO Program is based upon two core contract functions; quality improvement and case review. Each contract within the QIO program structure will support at least one of these functions.

Quality Innovation Network (QIN)-QIOs QIN-QIOs will perform a vast range of quality improvement services across the spectrum of the health care delivery system. A series of QIN-QIOs will work across the country to facilitate large-scale, widespread improvements in care delivery for Medicare beneficiaries.

Beneficiary- and Family-Centered Care (BFCC)-QIOs Five BFCC-QIOs across the nation will perform BFCC-related services for designated areas across the nation. In particular, BFCC services include case reviews, quality of care reviews, diagnosis-related group (DRG) reviews, EMTALA reviews, appropriateness of setting reviews, medical necessity reviews, readmission reviews, Physician Acknowledgement Statement monitoring, appeals and sanctions.

Program Collaboration Center (PCC) The PCC will provide overall national coordinating services for the QIO program as a whole and all QIO contractors. The PCC contract shall include, but is not limited to, the following work: strategic integrated communications about the QIO Program and its associated projects/tasks; helping QIOs report data and helping CMS analyze and interpret those data to assess program progress; providing support for all QIO Learning and Action Networks; and coordinating training opportunities for national-level QIO training.

National Coordinating Centers (NCCs) The NCCs provide direct support services to QIOs and their responsibilities shall include, but not be limited to, coordinating program activities, and providing assistance to QIOs for BFCC activities and quality improvement activities. Specifically, one NCC will focus on BFCC activities while the other focuses on QIN, which includes better healthcare at the population level, and better health for individuals.

Value Incentive and Quality Reporting Centers (VIQRCs) Five VIQRC contractors will each focus on one facet associated with providing quality of care information to Medicare beneficiaries and improving quality of care through measurement and surveillance.

Strategic Innovation Engine (SIE) The SIE contractor will recommend best practices and potential projects that QIOs may adopt as part of their clinical quality improvement work. The SIE will identify practices from QIOs and from peer-reviewed literature that are worthy of spread within and beyond the QIO program, recommend future special innovation projects that CMS can award to QIOs, and document effective strategies QIOs can use to deliver technical assistance to communities and providers seeking to improve care with the QIOs’ help.

Independent Evaluation Center (IEC) As a separate contractor, the IEC will provide impartial and unencumbered evaluations which shall include, but are not limited to, overall QIO program impact.

Beneficiary and Family Centered Care Oversight and Review Center (BFCC ORC) The BFCC ORC shall provide independent review and findings relating to case reviews performed by BFCC-QIOs.

C.4. Technical Considerations The contractor (hereinafter referred to as “BFCC NCC”) undertaking this BFCC NCC SOW shall comply with all requirements outlined in this contract, together with statutory and regulatory provisions and any amendments to those provisions that might occur during the course of the contract and formal instruction from CMS, through the CO.

The Glossary (Section J, Attachment J-1, BFCC NCC Glossary) and List of Acronyms (Section J, Attachment J-2, BFCC NCC Acronyms) shall be used when interpreting the requirements of this contract.

C.4.1. Technical Requirements The following are included in Section J, Attachment J-3:

1. QIO Manual

1. Code of Federal Regulations, including

0. 42 CFR Parts 475

0. 42 CFR Part 476

0. 42 CFR Part 478

0. 42 CFR Part 480

0. 42 CFR Part 489.20 and 489.24

0. 42 CFR Part 1004

C.4.2. Information Technology Architecture for the QIO Program The contractor must be knowledgeable of a wide range of information technology systems. Section J, Attachment J-10 provides a list of the known systems that may be used by the contractor and provides high level details of the systems and applications. The core functionality, support systems and interdependencies of each system are described in the attachment. While those users of the system that are QIOs (“QIO users”) will not directly interface with all of systems and applications described, the inclusion of the support and subsystem descriptions will assist each QIO in obtaining a global view of the Health Care Quality Information System (HCQIS) infrastructure. Further, the attachment is categorized by the lines of business using each system, including Enterprise Services that are used by multiple lines of business.

C.4.2.1. Hardware/Software (HW/SW)

CMS, either directly or through a CMS contractor, shall provide the BFCC NCC with a file/print server, a domain controller, a database server, network/telecomm equipment, and a workstation and/or laptop for each 0.5 or greater full-time-equivalent (FTE) employee at award of contract to cover their base needs. The servers, workstations, and laptops shall be equipped with a standard operating system and a software suite following the approved CMS Federal Desktop Core Configuration (FDCC) standard which is also referred to as the United States Government Configuration Baseline (USGCB). Please refer to Section J, Attachment J-17 (HCQIS QIO Basic Procurement List) as it provides a standard list of basic IT HW/SW and the associated pricing that is used within the HCQIS environment. Please note that this listing in not an all-inclusive list and should be used to identify basic IT needs and current associated costs for a startup office. The list and pricing identified should be used for budgeting purposes only as they are subject to change. All HW/SW required will be procured via the HCQIS Remedy Purchase System/Engineering Review Board (ERB) process which is used to help track and maintain all Government Furnished Equipment (GFE). The amount of hardware & software provided will be dependent on the agreement between CMS and the contractor based on the work identified. Any additional resources required including, but not limited to, printers, faxes, etc. the contractor will be responsible for funding the procurement of the equipment.

The BFCC NCC must receive approval from their Contracting Officer Representative (COR) prior to submitting a purchase request via the HCQIS procurement process, currently identified as the ERB to be procured. No additional hardware peripherals or non-approved software may be connected or installed to any GFE or on the QualityNet infrastructure without prior written approval by CMS. If there are items that are not listed in Section J, Attachment J-17 in which the contractor would like to use in support of their contract, a request will have to be submitted thru their CMS COR to begin the approval process.

The BFCC NCC shall update Remedy inventory for all procured GFE and maintain the necessary documentation such as HHS-565 and HHS-22’s located in the Remedy Purchase System to ensure proper asset management and tracking of all GFE.

C.4.3. Information Systems Security Requirements In addition, the following Information Systems policies and procedures are incorporated into the contract by reference. Section J, Attachment J-3, Requirements Incorporated by Reference provides the hyperlinks for each of the listed policies and procedures.

0. QIO Infrastructure Operations and Support Manual, Chapter 8 of QIO Manual

0. QIO Information Technology (IT) Administrator Manual

0. Health Care Quality Information Systems (HCQIS) Database Systems Administrator Guide

0. CMS Information Security Virtual Handbook

0. QualityNet System Security Policy

0. QualityNet Incident Response Procedures

0. CMS Federal Desktop Core Configuration Standards

0. CMS Contractor Website Guidelines

0. CMS Policy for Information Security Program (PISP)

0. Federal Information Security Management Act (FISMA) of 2002

0. E-Government Act of 2002 (Public Law 107-347)

0. IOM Pub. 100-17

0. FISMA requirements

The BFCC NCC shall comply with all present and future statutes, Federal, HHS, and CMS regulations and program instructions relating to providing a secure computer operations environment. Additional Policies and Procedures may be released requiring the QIO to comply.

The BFCC NCC shall maintain all necessary documentation that meets or exceeds the performance standards specified in Chapter 8, Infrastructure Operations Support and Data Management, of the QIO Manual and deliverables specified in Section F.

C.4.3.1 Certification By Security Point of Contact (SPOC) for Compliance with CMS Security Requirements The BFCC NCC shall appoint a Security Point of Contact (SPOC) or equivalent. The SPOC shall assist the CMS ISSO in ensuring the BFCC NCC adheres and complies with the CMS Information Security (IS) program requirements located at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html.

0. Administer and Adhere to the CMS Information Security (IS) Program

1. The BFCC NCC shall comply with the CMS Policy for the Information Security and Privacy (PISP) and all CMS methodologies, policies, standards, and procedures contained within the CMS PISP, unless otherwise directed by CMS in writing. The BFCC NCC shall also adhere and comply with any specific policies as they relate to security within the Health Care Quality Improvement System.

1. The BFCC NCC shall comply with all CMS security program requirements as specified within the CMS Information Security “Virtual Handbook” (a collection of CMS policies, procedures, standards and guidelines that implements the CMS Information Security Program) and the QualityNet Security Policy. The Virtual Handbook can be found at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and the QualityNet System Security Policy is located at http://qualitynet.org/.

1. The BFCC NCC shall provide a list of assigned BFCC NCC Information Technology (IT) staff with required information.

1. The BFCC NCC shall conduct Security Awareness Training (SAT) for all employees utilizing or accessing CMS data within the HCQIS environment on an annual basis. Security Awareness Training for employees will be tracked and logged locally by the BFCC NCC SPOC as identified by the CMS ISSO. A QNET SAT Certification Letter shall be provided to the CMS QNET ISSO 90 days after contract award and annually thereafter in accordance with the Schedule of Deliverables.

1. The BFCC NCC shall visit the CMS security website http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and the QualityNet security website http://qionet.sdps.org at least every 30 calendar days for updates. [Note: The QualityNet security website is an Intranet website; thus, access is restricted to only active users within the QualityNet Enterprise.]

6) The BFCC NCC shall submit to the COR and CMS QNET ISSO a Business Continuity and Contingency Plan (BCCP) within 90 days after contract award in accordance with the Schedule of Deliverables. Updates shall be provided 30 days after completion of any serious structural changes. Serious structural changes consist of building relocations or major structural changes to the current infrastructure. The BCCP shall demonstrate how the organization shall establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations. In addition, updates shall be provided after any serious structural changes. Serious structural changes consist of building relocations or major structural changes to the current infrastructure.

0. FISMA Compliance

1. The BFCC NCC shall comply with CMS, FISMA, OIG, and other relevant audits, reviews, evaluations, tests, and assessments of BFCC NCC systems, processes, and facilities as it relates to program security and compliance. The BFCC NCC shall provide all related artifacts upon request. The BFCC NCC shall deliver the artifacts in the format and method prescribed by CMS.

1. The BFCC NCC shall provide CMS with a System Security Plan (SSP) and Information Security (IS) Risk Assessment (RA) within 90 days of after task order award, annually thereafter, and also within 30 days after any major changes.

1. The BFCC NCC shall document its compliance with CMS security requirements and maintain such documentation in the BFCC-QIO System Security Plan (SSP) and the IS Risk Assessment (RA) as directed by CMS.

1. The BFCC NCC shall develop, in conjunction with CMS, Corrective Action Plan (CAP) for all identified weaknesses, findings, gaps, or other deficiencies in the IS Program (e.g., those items identified during a FISMA audit or similar activity) in accordance with IOM Pub. 100-17 (BPSSM) or as otherwise directed by CMS. CAPs shall be submitted to the CMS QNET ISSO within 30 days after the audit or finding in accordance with the Schedule of Deliverables.

Moreover, the BFCC NCC shall comply with the guidance and requirements of the CMS Information Security Plan of Action & Milestones (POA&M) Procedure, which is located at www.cms.hhs.gov/InformationSecurity in the Information Security Library. The POA&M shall be submitted to the CMS QNET ISSO within 15 days of approval of a CAP and monthly thereafter until the CAP is closed.

The BFCC NCC shall comply with the guidance for reporting requirements for all CAPs and the CMS Information Security POA&M Procedure.

0. Inventory of Government Furnished Equipment The BFCC NCC shall comply with CMS guidance for requirements associated with Government Furnished Equipment. The BFCC NCC shall update Remedy inventory for all procured, transferred and received Government Property (including hardware and software). The BFCC NCC will be responsible for keeping a list of all purchased and leased equipment in a HHS 565 submission Final Report.

0. Maintenance of Systems and Software The BFCC NCC shall comply with all CMS system and software maintenance procedures. All digital media must be encrypted before physically leaving the BFCC NCC. The BFCC NCC shall perform maintenance of systems and software in compliance with applicable configuration requirements. BFCC NCC IT staffs are responsible for completion of IT tasks as assigned in Remedy tickets for BFCC NCC local systems.

0. Security Incident Response The BFCC NCC shall comply with CMS Incident Handling Standards and Procedures (RMH Vol III Standard 7-1 Incident Handling, RMH Vol II Procedure 7-2 Incident Handling Procedure) located at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and report suspected security breaches within the designated time periods. The BFCC NCC shall assist the CMS ISSO on active investigations and provide requested documentation as needed.

C.4.3.2 Transition of Equipment In the event that CMS requires transition services from an incumbent BFCC NCC to a successor BFCC NCC, the incumbent will be responsible for funding the cost of transfers which includes, but not limited to, the packing, shipping and so forth of any GFE.

The BFCC NCC is responsible for adhering to the CMS HHS-565 and HHS-22 processes (including any associated deliverables) which focuses on asset management and transition of equipment (transfers, disposals, donations, etc.).

1. At the end of a contract period, the contractor must follow the QualityNet Contractor Transition Procedures to Shutdown and Startup Operations process to ensure that proper transition of all GFE is done in timely manner.

C.5. General Requirements The BFCC NCC, acting independently and not as an agent of the Federal Government, shall furnish the necessary personnel, materials, services, facilities, and supplies (except as may be otherwise specified in the contract) and otherwise do all things necessary for, or incident to, the performance of the work as set forth in this SOW. “Necessary personnel” means such staff and professionals (as employed or under subcontract) with the expertise, experience, and educational and/or professional accomplishments to complete services described in this SOW satisfactorily.

The BFCC NCC shall adhere to all requirements of this section as they apply to the tasks described in this SOW.

Additionally, the BFCC NCC must comply with all present and future statutes, as well as non-HHS, CMS and other Federal regulations and program instructions affecting this contract.

C.5.1. General Reporting Requirements The BFCC NCC shall report to CMS as directed in the Items to be Furnished and Delivery Schedule (Section F). The BFCC NCC shall use all components and adhere to all procedures of the HCQIS data collection and reporting systems and Items to be Furnished and Delivery Schedule or systems that may replace HCQIS functionality to manage and report work performed under this SOW.

C.5.2. Confidentiality The BFCC NCC shall adhere to the privacy, confidentiality, and disclosure requirements set forth in Section 1160 of the Act, and in Title 42 of the Code of Federal Regulations (CFR) Part 480, which are incorporated by reference in Section J, Attachment J-3 (Requirements Incorporated by Reference). The BFCC NCC shall be prepared to document adherence to these privacy, confidential and disclosure requirements.

The confidentiality training requirement specified in 42 CFR Part 480 of the regulations is separate and distinct from the Annual QualityNet Security Awareness Training requirement outlined in the CMS Information Security Acceptable Risks and Safeguards. Upon request from CMS, the BFCC NCC must provide a copy of training materials developed or used to meet the confidentiality training requirement specified in 42 CFR 480.115. CMS may request documentation that users of the BFCC NCC review system have been trained in the proper handling of confidential information prior to being given access to that information and review system.

In any instances in which CMS designates any data or information the BFCC NCC has collected, acquired or generated in the exercise of its duties and functions under the QIO and Medicare statutory provisions as “quality review study” (QRS) information (as defined in 42 CFR § 480.101(b), the BFCC NCC is bound by the disclosure limitations for QRS information in § 480.140. BFCC NCCs should note that, under § 480.140(g), they must disclose information with identifiers of patients, providers and/or practitioners, to CMS or CMS’s contractors when CMS deems it necessary for purposes of evaluating the performance of the BFCC NCC. If the BFCC NCC is in doubt about whether data qualify as QRS data, the BFCC NCC must contact the Contracting Officer Representative (COR) for direction.

The BFCC NCC shall also adhere to Section H.16 of this contract, which limits uses and disclosures of individually identifiable health information (IIHI) when the BFCC NCC is using or disclosing such data in its capacity acting as a Health Insurance Portability and Accountability Act (HIPAA) “business associate” of the health care components of CMS. CMS’ health care components consist of the Medicare Fee-for-Service Program. Section H.16 contains the “business associate agreement” provisions required by 45 CFR 164.504(e)(1) of the HIPAA Privacy Rule, authorized by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, as well as the HIPAA Privacy and Security Rules at 45 C.F.R. Parts 160 and 164; the applicable provisions of the HIPAA Privacy, Security, and Breach Notification Rules; the QIO Manual (which is incorporated by reference); and other relevant Federal laws, regulations and administrative directives as outlined in this contract.

The business associate agreement requirement applies if and when the BFCC NCC uses or discloses IIHI to conduct any activities on behalf of CMS’ Medicare fee-for-service (FFS) health plan function or the PCIP program. IIHI used in this manner is protected health information (PHI) or, when applicable, “electronic protected health information” (ePHI). The use or disclosure of PHI or ePHI for these purposes would include instances in which such information is used by the BFCC NCC to carry out a Medicare FFS or PCIP program function (such as for “payment” or “health care operation” of the Medicare FFS or PCIP programs). The business associate agreement in Section H.16 applies only where the BFCC NCC is serving in a HIPAA business associate for CMS’ Medicare FFS health plan or PCIP function, which includes conducting payment or health care operations activities for those programs. The business associate agreement does not apply when the BFCC NCC is not serving as a HIPAA business associate for CMS’ Medicare FFS health plan or PCIP program function (such as when the BFCC NCC is performing health oversight activities as defined by the Social Security Act).

C.5.3. Government Data A listing of data to be supplied by CMS and the schedule by which they shall be provided appears in Section J, Attachment J-4 Data Supplied by CMS. In general, Part A reported data shall be available from the CMS Data Warehouse. CMS Information Systems contractors shall create and deliver to CMS measurement and analytic datasets, broken down by BFCC NCC area, for distribution to the BFCC NCC.

Although CMS will provide data to the BFCC NCC as specified above, CMS will not provide all data that is needed by a BFCC NCC to effectively perform as required by the contract. The BFCC NCC is responsible for determining what additional data is necessary and collecting it as appropriate.