HHSM-500-2014-RFP-BFCC-QIO_12-5-2013_Final_RFP.docx

Table of Contents

End Stage Renal Disease Network CMS-2012-Contractor-DQC Firm Fixed Price (FFP) Renewal

Beneficiary and Family Centered Care (BFCC) Quality Improvement Organization (QIO) HHSM-500-2014-RFP-BFCC-QIO v

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 Description of Services

The purpose of the Beneficiary and Family Centered Care (BFCC) Quality Improvement Organization (QIO) contract is to improve healthcare services for Medicare beneficiaries through BFCC performance of numerous statutory review functions, including, but not limited to, quality of care reviews, beneficiary complaint reviews, discharge and termination of service appeals in various provider settings, medical necessity reviews, and Emergency Medical Treatment and Active Labor Act (EMTALA) reviews.

B.2 Type of Contract

The Government contemplates awarding five (5) Cost-Plus-Fixed-Fee (CPFF) contracts (one (1) in each BFCC-QIO Area as indicated in Section B.9) resulting from this solicitation. This solicitation represents 5 separate solicitations unto themselves. Separate proposals are required for each proposed BFCC-QIO Area.

NOTE: Please be advised that if the Offeror does not have an accounting system that is adequate for determining costs applicable to the contract (FAR 16.301-3) and for accumulating and segregating costs under a Cost Reimbursement (CR) contract, it will not be eligible to receive an award.

B.3 Cost Plus Fixed Fee (CPFF)

A. Total Contract Amount The total estimated cost plus fixed fee for this contract is $(to be entered at the time of award). The total cost is $(to be entered at the time of award) and the total fixed fee of $(to be entered at the time of award).

B. Reimbursement The BFCC Contractor, upon successful completion of the work required, will be reimbursed monthly in accordance with Section I, Federal Acquisition Regulation (FAR) clauses 52.216-7 Allowable Cost and Payment (JUN 2013) and 52.216-8 Fixed Fee (JUN 2011). Monthly vouchers shall be submitted in accordance with contract Section G.2 Payments-Vouchers (Cost Reimbursement Contracts).

C. Table of Total Estimated Cost Plus Fixed Fee The BFCC Contractor shall provide the necessary personnel, materials, services, facilities and supplies (except as may be otherwise specified in the contract) and otherwise do all things necessary for, or incident to, the performance of the work as set forth in Section C, Statement of Work. In consideration of successful contract performance based on the evaluation criteria set forth in Section H.5, the BFCC Contractor will be reimbursed as stated in the Table of Total Estimated Cost and Fixed Fee provided on the on the following page:

Case Review and Other Review Activity

Reimbursement of Medical Records (hard copies only)

$0

Total

B.4 Schedule for Payment of Fixed Fee Payment of the fixed fee will be made in accordance with the schedule provided below. As authorized under FAR 52.216-8, after payment of 85% of the fixed fee, CMS may elect to withhold 15% or $100,000 (whichever is less).

Month Payment Total 1-59 Withholding Total

B.5 Ceiling Rates

A. General The cost limitations addressed in this Section apply to the total contract ceiling amount of the contract. The BFCC-QIO Contractor is advised that all costs associated with this contract, either directly or indirectly, are subject to audit.

B. Indirect Cost Rates

The indirect cost rate ceiling(s) for this contract is/are:

TBD

B.6 Medical Records Photocopying The BFCC-QIO Contractor will be paid for a properly certified invoice/voucher for medical records photocopying costs at a rate of $.12 per page (hardcopies) for reproduction of PPS provider records and $.15 per page (hard copies) for reproduction of non-PPS institutions and practitioner records, plus first class postage. Specifically, hospitals and other providers (such as critical access hospitals) under a Medicare cost reimbursement system, receive no photocopying reimbursement from the BFCC Contractor. Capitation providers such as HMOs and dialysis facilities receive $.12 per page. No fixed fee will be paid on photocopying.

B.7 Overnight Mail Contract deliverables shall not be submitted utilizing overnight mail. All other overnight mailings (e.g., provider-based discharge appeals, etc.) shall be at the discretion of the BFCC-QIO Contractor and are subject to the Contracting Officer’s (CO) determination of reasonableness.

B.8 Transition Services In the event that CMS requires transition services from an incumbent (2014) BFCC-QIO Contractor to a successor (2019) BFCC-QIO Contractor, CMS will request a separate technical and business proposal for these services. These services will be incorporated into the contract if applicable.

B.9 BFCC-QIO Areas

The following chart is the breakdown of the BFCC-QIO Areas, as “QIO area” is defined in 42 CFR Part 475:

Area 1:

Connecticut Maine Massachusetts New Hampshire New Jersey New York Pennsylvania Puerto Rico Rhode Island Vermont Virgin Islands Area 2:

District of Columbia Delaware Florida Georgia Maryland North Carolina South Carolina Virginia West Virginia Area 3:

Alabama Arkansas Colorado Kentucky Louisiana Mississippi Montana North Dakota New Mexico Oklahoma South Dakota Tennessee Texas Utah Wyoming Area 4:

Iowa Illinois Indiana Kansas Michigan Minnesota Missouri Nebraska Ohio Wisconsin

Area 5:

Alaska Arizona California Hawaii * Idaho Nevada Oregon Washington

* Hawaii includes the Pacific Territories of American Samoa, Guam and the Commonwealth of the Northern Mariana Islands.

The Government contemplates awarding one contract for each of the BFCC-QIO Area but reserves the right to combine two (2) or more Areas into one (1) contract. Each proposal must identify the region to which it pertains, and an offeror must submit a separate proposal for each proposed BFCC-QIO Area in which it wishes to be considered for award. Note that no contractor may receive a contract for more than four (4) of the five (5) areas.

B.10 Contract Limitations The following chart indicates the contract limitations for the structure of the QIO Program. These contract limitations also include any subcontracting arrangements or corporate affiliates (as defined in H.11.C.4).

· Any BFCC-QIO Area

· BFCC NCC

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

· Any BFCC-QIO Area

· BFCC NCC

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

· Any QIN-QIO Area

· QIN NCC

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

BFCC National Coordinating Center

(BFCC NCC)

· Any QIN-QIO Area

· QIN NCC

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

BFCC Oversight & Review Center

(BFCC ORC)

· Any QIN-QIO Area

· QIN NCC

· Any BFCC-QIO Area

· BFCC NCC

· PCC

· IEC

· VIQRC: 1) Outreach/ Education for Inpatient/ Cancer/ Psych; or 2) Appeals

Program Collaboration Center

(PCC)

· Any QIN-QIO Area

· QIN NCC

· Any BFCC-QIO Area

· BFCC NCC

· BFCC ORC

· IEC

· VIQRC (Any)

· PCC

· IEC

· BFCC ORC

· VIQRC (Appeals Only)

· PCC

· IEC

· PCC

· PCC

· Any QIN-QIO Area

· Any BFCC-QIO Area

· QIN NCC

· BFCC NCC

· BFCC ORC

· PCC

· VIQRC (Any Other)

· Any QIN-QIO Area

· Any BFCC-QIO Area

· QIN NCC

· BFCC NCC

· BFCC ORC

· PCC

· VIQRC (Any)

CMS shall not enter into a contract under this part with any entity (prime or subcontractor) which is, or is affiliated with (through management, ownership, or common control), a health care facility, within the area served by such entity or which would be served by such entity if it entered into a contract with the CMS under this part.

An entity shall not be considered to be affiliated with a health care facility by reason of management, ownership, or common control if the management, ownership, or common control consists of no more than twenty (20) percent of the members of the governing board of the entity being affiliated (through management, ownership, or common control) with one or more of such facilities.

SECTION C – STATEMENT OF WORK/SERVICES

C.1 Background and Overview

The statutory authority for this Statement of Work (SOW) is found in Part B of Title XI of the Social Security Act; The statutory provisions originated with the Peer Review Improvement Act of 1982(P.L. 97-248, §§ 141-143, 96 Stat. 324) which established the Utilization and Quality Control Peer Review Organization program, now known as the Quality Improvement Organization (QIO) program. These provisions were significantly amended by the Trade Adjustment Assistance Extension Act of 2011 (P.L. 112-40, § 261, 125 Stat. 401).

The statutory mission of the Program, as set forth in Section 1862(g) of the Act, involves the Secretary entering into contracts with Quality Improvement Organizations (QIOs) for purposes of making determinations about whether items and services provided to Medicare beneficiaries are reasonable and necessary for the diagnosis or treatment of illness or injury or to improve the functioning of a malformed body member, and are not for custodial care. In addition, the Secretary must enter into these contracts to improve the effectiveness, efficiency, economy, and quality of services delivered to Medicare beneficiaries. Toward those goals, Section 1154(a) of the Act requires the QIO contractors to perform one or more functions listed in that section.

Among the statutory duties is the review of some or all of the professional activities of providers and practitioners in the QIO area, subject to the terms of their contracts, in the provision of health care items or services to Medicare beneficiaries; such reviews are for purposes of determining whether services are or were reasonable and medically necessary, whether the quality of the services meets professionally recognized standards of care, and, for inpatient services, whether the proposed services could be effectively provided more economically on an outpatient basis or in a different type of inpatient facility. These reviews are integral to the determination whether items and services should be payable under the Medicare program.

Section 1154(a)(18) also includes provisions that involve broader authority for QIOs to improve the effectiveness, efficiency, economy, and quality of services under the Medicare program. Section 1154(a)(10) of the Act, for example, specifically requires that the QIO “coordinate activities, including information exchanges, which are consistent with economical and efficient operation of programs among appropriate public and private agencies or organizations, including other public or private review organizations as may be appropriate.” The Centers for Medicare & Medicaid Services (CMS) regards this as authority for the QIO to coordinate and operate a broad range of collaborative and community activities among private and public entities, as long as the predicted outcome will likely directly benefit the Medicare program. In addition, Section 1156(c) of the Act states that it is the duty of each QIO to use such authority or influence as it may possess as a professional organization, and to enlist the support of any other professional or governmental organization having influence or authority over health care practitioners or entities furnishing services in its area, in assuring that each practitioner or entity shall comply with all obligations imposed on them under Section 1156(a) of the Act. Under these obligations, providers and practitioners must assure that they shall provide services economically and only when, and to the extent medically necessary and that those services will be of a quality that meets professionally recognized standards of care.

Section 1867(d)(3) of the Act requires the Secretary of Human Health and Services (HHS) to request a QIO to assess whether an individual had an emergency medical condition which had not been stabilized and to provide a report to the Secretary in certain circumstances. As part of the implementation of this provision, CMS and the Office of the Inspector General consult with QIOs in order to determine whether, with respect to EMTALA requirements, an individual had an emergency medical condition that had not been stabilized, and whether a medical screening examination, stabilizing treatment or a transfer was appropriate.

C.2 Contract Purpose

The purpose of the BFCC contract is to improve healthcare services for Medicare beneficiaries through BFCC-QIO performance of numerous statutory review functions including, but not limited to, quality of care reviews, beneficiary complaint reviews, discharge and termination of service appeals in various provider settings, medical necessity reviews, and EMTALA reviews. See Sections 1151 and 1862(g) of the Act.

C.2.1 Overall Purpose of the QIO Program

While the purpose of this contract is to carry out the goals listed in section 1862(g) of the Act, we want to fulfill the QIO program requirement in a manner that supports CMS in its efforts to seek to improve health and health care for all Medicare beneficiaries and promote quality of care to ensure the right care at the right time, every time. Although the QIOs’ tasks do not fulfill requirements under the Affordable Care Act (P.L. 111-148 as amended by P.L. 111-152), we have designed the contractual requirements here in alignment with the Affordable Care Act goals that are relevant to the QIO program and that seek to increase access to high-quality, affordable health care for all Americans. We seek to align the goals of the QIO program in general, and successful performance of this contract, with National Strategy for Quality Improvement in Health Care (the NQS) established by the Secretary pursuant to the Affordable Care Act. The NQS sets priorities to achieve the goals of the Affordable Care Act and includes a strategic plan for how to achieve them. The NQS articulates six priorities that build on the three broad aims of better care, improvement of health, and lowering costs through improvement, and forms the basis for the CMS Quality Strategy’s six goals, which are aligned as follows:

The NQS notes that an effective national strategy must support effective local strategies. National standards and consistency in their measurement are essential components of the NQS. At the same time, the unique needs and characteristics of local communities must be supported to ensure activities that are responsive to and driven by local circumstances, needs and capacities. In working to achieve goals at the local level, the QIOs’ work will serve an essential role in helping CMS to achieve the goals of the National Quality Strategy. In most instances, the QIO local level activities will be conducted in coordination with the QIO National Coordinating Centers (NCC), which are entities that work under contract to CMS as part of the QIO program, to support the QIOs by facilitating the flow of information to and from each of the QIOs.

C.3 QIO Program Structure and Requirements

This section provides the QIO Program Structure, Eligibility Requirements, and award limitations. In accordance with the QIO Program changes and flexibilities afforded to the Secretary in the Trade Adjustment Assistance Extension Act of 2011, the QIO Program operations are restructured as prescribed in the following subsections.

C.3.1. QIO Program Structure The QIO contracts are structured by function and categorized as follows:

1. A number of Quality Innovation Network QIOs (QIN-QIOs);

1. Five (5) Beneficiary and Family Centered Care QIOs (BFCC-QIOs) (this contract);

1. One (1) Program Collaboration Center (PCC);

1. One (1) National Coordinating Center (NCC) for BFCC;

1. One (1) National Coordinating Center for QIN;

1. Six (6) Value Incentives and Quality Reporting Centers (VIQRCs);

1. One (1) Independent Evaluation Center (IEC); and

1. One (1) BFCC Oversight and Review Center (BFCC ORC).

The QIO Program is based upon two core contract functions; quality improvement and case review. Each contract within the QIO program structure will support at least one of these functions.

Quality Innovation Network (QIN)-QIOs QIN-QIOs will perform a vast range of quality improvement services across the spectrum of the health care delivery system. A series of QIN-QIOs will work across the country to facilitate large-scale, widespread improvements in care delivery for Medicare beneficiaries.

Beneficiary and Familly Centered Care (BFCC)-QIOs Five BFCC-QIOs across the nation will perform BFCC-related services for designated areas across the nation. In particular, BFCC services include case reviews, quality of care reviews, diagnosis-related group (DRG) reviews, EMTALA reviews, appropriateness of setting reviews, medical necessity reviews, readmission reviews, Physician Acknowledgement Statement monitoring, appeals and sanctions.

Program Collaboration Center (PCC) The PCC will provide overall national coordinating services for the QIO program as a whole and all QIO contractors. The PCC contract shall include, but is not limited to, the following work: strategic integrated communications about the QIO Program and its associated projects/tasks; helping QIOs report data and helping CMS analyze and interpret those data to assess program progress; providing support for all QIO Learning and Action Networks; and coordinating training opportunities for national-level QIO training.

National Coordinating Centers (NCCs) The NCCs provide direct support services to QIOs and their responsibilities shall include, but not be limited to, coordinating program activities, and providing assistance to QIOs for BFCC activities and quality improvement activities. Specifically, one NCC will focus on BFCC activities while the other focuses on QIN, which includes better healthcare at the population level, and better health for individuals.

Value Incentive and Quality Reporting Centers (VIQRCs) Six VIQRC contractors will each focus on one facet associated with providing quality of care information to Medicare beneficiaries and improving quality of care through measurement and surveillance.

Independent Evaluation Center (IEC) As a separate contractor, the IEC will provide impartial and unencumbered evaluations which shall include, but are not limited to, overall QIO program impact.

Beneficiary and Family Centered Care Oversight and Review Center (BFCC ORC) The BFCC ORC shall provide independent review and findings relating to case reviews performed by BFCC-QIOs.

C.4 Technical Considerations The contractor (hereinafter referred to as “BFCC-QIO”) undertaking this BFCC-QIO SOW shall comply with all requirements outlined in this contract, together with statutory and regulatory provisions and any amendments to those provisions that might occur during the course of the contract and formal instruction from CMS, through the CO.

The Glossary (Section J, Attachment J-1, BFCC Glossary) and List of Acronyms (Section J, Attachment J-2, BFCC Acronyms) shall be used when interpreting the requirements of this contract.

C.4.1 Technical Requirements

The following Section J, Attachment J-3.A (Requirements Incorporated by Reference) documents are incorporated into the contract by reference:

· QIO Manual: http://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/Internet-Only-Manuals-IOMs-Items/CMS019035.html

· Code of Federal Regulations: http://www.ecfr.gov

· 42 CFR Parts 405

· 42 CFR Parts 422

· 42 CFR Parts 475

· 42 CFR Part 476

· 42 CFR Part 478

· 42 CFR Part 480

· 42 CFR §§ 489.20 and 489.24

· 42 CFR Part 1004

· 508 Compliance Standards: http://508.hhs.gov

C.4.2 Information Technology Architecture for the QIO Program

The contractor must be knowledgeable of a wide range of information technology systems. Section J, Attachment J-3.B (Requirements Incorporated by Reference) provides a list of the known systems that may be used by the contractor and provides high level details of the systems and applications. The core functionality, support systems and interdependencies of each system are described in the attachment. While those users of the system that are QIOs (“QIO users”) will not directly interface with all of systems and applications described, the inclusion of the support and subsystem descriptions will assist each QIO in obtaining a global view of the Health Care Quality Information System (HCQIS) infrastructure. Further, the attachment is categorized by the organizational components using each system, including Enterprise Services that are used by multiple organizational components.

C.4.2.1 HCQIS IT Hardware/Software Procurement The BFCC-QIO, acting independently and not as an agent of the Federal Government, shall furnish the necessary personnel, materials, services, facilities, and supplies (except as may be otherwise specified in the contract) and otherwise do all things necessary for, or incident to, the performance of the work as set forth in this SOW.

The BFCC-QIO shall comply with all present and future statutes, Federal, HHS, and CMS regulations and program instructions affecting this contract.

C.4.3 Infrastructure Operations Support and Data Management Unless otherwise directed by CMS, the contractor shall adhere to the most current version of the policies and procedures outlined and posted on any of the HCQIS identified websites (e.g. QIOnet, QualityNet, etc). These include, but are not limited to, the Quality Improvement Organization Infrastructure Operations and Support Manual, the Quality Improvement Organization Network Information Technology (IT) Administrator Manual, the HCQIS Database Systems Administrator Guide, the QualityNet System Security Policy, and the QualityNet Incident Response Procedures. Please note that name changes can/will occur so specifics can be provided upon contract award. The contractor shall comply with all present and future statutes as well as federal, HHS, and CMS regulations and program instructions relating to providing a secure computer operations environment. Additional policies, procedures, updates in documents may be released, requiring the contractor to comply.

The contractor shall not develop software products for use by other contractors, partners, etc. without written prior approval from CMS. In addition, no funds from this contract shall be used for data collection activities not specified in this contract without prior approval from the COR and in accordance with other CMS administrative guidance.

The contractor shall maintain all necessary documentation that meets or exceeds the performance standards specified in the Infrastructure Operations Support and Data Management chapter of the QIO Manual, the deliverables specified in Section F – Deliverables or Performance of the contract and as identified by CMS.

C.4.3.1 Hardware/Software

CMS, either directly or through a CMS contractor, shall provide each BFCC-QIO with a file/print server, a domain controller, a database server, and a workstation and/or laptop for each 0.5 or greater full-time-equivalent (FTE) employee at award of contract to cover their base needs. The servers, workstations, and laptops shall be equipped with a standard operating system and a software suite following the approved CMS Federal Desktop Core Configuration (FDCC) standard which is also referred to as the United States Government Configuration Baseline (USGCB). The list below outlines the basic core equipment that CMS provides to a contractor to support the basic connectivity to the HCQIS environment. The amount of laptops provided will be dependent on the understanding between CMS and the contractor based upon on the work identified. Any additional resources (HW/SW) required after the base award, the contractor will be responsible for funding within their contract. Below is a listing of what equipment CMS will provide to the contract at the start of the contract.

Example of CMS provided equipment to the contractor

Number based on initial award needs

The contractor is responsible for covering the cost for any additional hardware/software out of their contract funds. This means that the contractor is responsible for bidding back, within their proposal, the expected costs for non-inclusive HW/SW items. If the contractor requires additional hardware and/or software outside of the CMS provided equipment in the base award listed above, they must receive approval from their COR and then submit a request via the HCQIS procurement process, currently identified as the Remedy Purchase Request/Engineering Review Board (ERB) to be procured. Within the Remedy system, there is an inventory of approved HW/SW that can be procured. Any items outside of the approved listing will need to be submitted through the approval process before procuring and using within QualityNet. These items include, but are not limited to, printers, fax machines, software outside the standard issue, etc. Please refer to the following table “Examples of non-provided IT items” that the contractor will be responsible for funding and the estimated current cost for each. Note that this list is not all-inclusive so any specific HW/SW needs to support this contract award will need to be budgeted for within your contract. No additional hardware peripherals or non-approved software may be connected or installed to any Government Furnished Equipment (GFE) without prior written approval by CMS. If there are items that are not listed below in which the contractor would like to use in support of their BFCC-QIO contract, a request will have to be submitted thru their COR to begin the approval process. No equipment, such as non-CMS approved equipment or corporate equipment, shall be connected to the HCQIS environment unless specifically approved by CMS.

Example of non-provided IT items

The following chart below provides examples of non-provided IT items or equivalent the contractors would need to include in their proposal.

C.4.4 Security Certification by Security Point of Contact (SPOC) for Compliance with CMS Security Requirements

The BFCC-QIO shall appoint a Security Point of Contact (SPOC) or equivalent. The SPOC shall assist the CMS ISSO in ensuring the BFCC-QIO adheres and complies with the CMS Information Security (IS) program requirements located at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html.

C.4.5 Administer and Adhere to the CMS Information Security (IS) Program

The BFCC-QIO shall comply with the CMS Policy for the Information Security and Privacy (PISP) and all CMS methodologies, policies, standards, and procedures contained within the CMS PISP, unless otherwise directed by CMS in writing. The BFCC-QIO shall also adhere and comply with any specific policies as they relate to security within the HCQIS.

The BFCC-QIO shall comply with all CMS security program requirements as specified within the IS “Virtual Handbook” (a collection of CMS policies, procedures, standards and guidelines that implements the CMS Information Security Program) and the QualityNet Security Policy. The Virtual Handbook can be found at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and the QualityNet System Security Policy is located at http://qualitynet.org/.

The BFCC-QIO shall conduct Security Awareness Training (SAT) for all employees utilizing or accessing CMS data within the HCQIS environment on an annual basis. Security Awareness Training for employees will be tracked and logged locally by the BFCC-QIO SPOC as identified by the CMS ISSO.

The BFCC-QIO shall visit the CMS security website http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and the QualityNet security website http://qionet.sdps.org at least every 30 calendar days for updates. [Note: The QualityNet security website is an Intranet website; thus, access is restricted to only active users within the QualityNet Enterprise.]

C.4.6 FISMA Compliance

The BFCC-QIO shall comply with CMS, FISMA, Office of Inspector General (OIG), and other relevant audits, reviews, evaluations, tests, and assessments of BFCC-QIO systems, processes, and facilities as it relates to program security and compliance. The BFCC-QIO shall provide all related artifacts upon request. The BFCC-QIO shall deliver the artifacts in the format and method prescribed by CMS.

The BFCC-QIO shall document its compliance with CMS security requirements and maintain such documentation in the BFCC-QIO System Security Plan (SSP) and the Information Security (IS) Risk Assessment (RA) as directed by CMS.

The BFCC-QIO shall develop, in conjunction with CMS, Corrective Action Plans (CAP) for all identified weaknesses, findings, gaps, or other deficiencies in the IS Program (e.g., those items identified during a FISMA audit or similar activity) in accordance with IOM Pub. 100-17 (BPSSM) or as otherwise directed by CMS.

The BFCC-QIO shall comply with the guidance for reporting requirements for all CAPs and the CMS Information Security Plan of Action & Milestones (POA&M) Procedure, which is located at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.htm.

C.4.7 Inventory of Government Furnished Equipment

The BFCC-QIO shall comply with CMS guidance for requirements associated with Government Furnished Equipment. The BFCC-QIO shall update Remedy inventory for all procured, transferred and received Government Property (including hardware and software). The BFCC-QIO will be responsible for keeping a list of all purchased and leased equipment in a HHS 565 submission Final Report.

C.4.8 Maintenance of Systems and Software

The BFCC-QIO shall comply with all CMS system and software maintenance procedures. All digital media must be encrypted before physically leaving the BFCC-QIO. The BFCC-QIO must perform maintenance of systems and software in compliance with applicable configuration requirements. BFCC-QIO IT staffs are responsible for completion of IT tasks as assigned in Remedy tickets for BFCC-QIO local systems.

C.4.9 Security Incident Response

The BFCC-QIO shall comply with CMS Incident Handling Standards and Procedures (RMH Vol III Standard 7-1 Incident Handling, RMH Vol II Procedure 7-2 Incident Handling Procedure) located at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and report suspected security breaches within the designated time periods. The BFCC-QIO shall assist the CMS ISSO on active investigations and provide requested documentation as needed.

C.5 General Requirements

The BFCC-QIO, acting independently and not as an agent of the Federal Government, shall furnish the necessary personnel, materials, services, facilities, and supplies (except as may be otherwise specified in the contract) and otherwise do all things necessary for, or incident to, the performance of the work as set forth in this SOW. “Necessary personnel” means such staff and professionals (as employed or under subcontract) with the expertise, experience, and educational and/or professional accomplishments to satisfactorily complete services described in this SOW.

The BFCC-QIO shall adhere to all requirements of this section as they apply to the tasks described in this SOW.

Additionally, the BFCC-QIO must comply with all present and future statutes, Federal, HHS, and CMS regulations and program instructions affecting this contract.

C.5.1 General Reporting Requirements The BFCC-QIO shall report to CMS as directed in the Items to be Furnished and Delivery Schedule (Section F.3). The BFCC-QIO shall use all components and adhere to all procedures of the HCQIS data collection and reporting systems and Items to be Furnished and Delivery Schedule (Section F.3) or systems that may replace HCQIS functionality to manage and report work performed under this SOW.

C.5.2 Confidentiality The BFCC-QIO shall adhere to the privacy, confidentiality, and disclosure requirements set forth in Section 1160 of the Act, and in Title 42 of the Code of Federal Regulations (CFR) Part 480, which are incorporated by reference in Section J, Attachment J-3.A.2 (Requirements Incorporated by Reference). The QIO shall be prepared to document adherence to these privacy, confidential and disclosure requirements.

The confidentiality training requirement specified in 42 CFR Part 480 of the regulations is separate and distinct from the Annual QualityNet Security Awareness Training requirement outlined in the CMS Information Security Acceptable Risks and Safeguards (compliance with which is required pursuant to section C.4.3 above). Upon request from CMS, the BFCC-QIO must provide a copy of training materials developed or used to meet the confidentiality training requirement specified in 42 CFR 480.115. CMS may request documentation that users of the BFCC-QIO review system have been trained in the proper handling of confidential information prior to being given access to that information and review system.

In any instances in which CMS designates any data or information the BFCC-QIO has collected, acquired or generated in the exercise of its duties and functions under the QIO and Medicare statutory provisions as “quality review study” (QRS) information (as defined in 42 CFR § 480.101(b), the QIO is bound by the disclosure limitations for QRS information in § 480.140. QIOs should note that, under § 480.140(g), they must disclose information with identifiers of patients, providers and/or practitioners, to CMS or CMS’s contractors when CMS deems it necessary for purposes of evaluating the performance of the BFCC-QIO. If the BFCC-QIO is in doubt about whether data qualify as QRS data, the BFCC-QIO must contact the Contracting Officer Representative (COR) for direction.

The BFCC-QIO shall also adhere to Section H.16 of this contract, which limits uses and disclosures of individually identifiable health information (IIHI) when the BFCC-QIO is using or disclosing such data in its capacity acting as a Health Insurance Portability and Accountability Act (HIPAA) “business associate” of the health care components of CMS. CMS’ health care components consist of the Medicare Fee-for-Service Program. Section H.16 contains the “business associate agreement” provisions required by 45 CFR 164.504(e)(1) of the HIPAA Privacy Rule, authorized by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, as well as the HIPAA Privacy and Security Rules at 45 C.F.R. Parts 160 and 164; the applicable provisions of the HIPAA Privacy, Security, and Breach Notification Rules; the QIO Manual (which is incorporated by reference); and other relevant Federal laws, regulations and administrative directives as outlined in this contract.

The business associate agreement requirement applies if and when the BFCC-QIO uses or discloses IIHI to conduct any activities on behalf of CMS’ Medicare fee-for-service (FFS) health plan function or the PCIP program. IIHI used in this manner is protected health information (PHI) or, when applicable, “electronic protected health information” (ePHI). The use or disclosure of PHI or ePHI for these purposes would include instances in which such information is used by the BFCC-QIO to carry out a Medicare FFS or PCIP program function (such as for “payment” or “health care operation” of the Medicare FFS or PCIP programs). The business associate agreement in Section H.16 applies only where the BFCC-QIO is serving in a HIPAA business associate for CMS’ Medicare FFS health plan or PCIP function, which includes conducting payment or health care operations activities for those programs. The business associate agreement does not apply when the BFCC-QIO is not serving as a HIPAA business associate for CMS’ Medicare FFS health plan or PCIP program function (such as when the BFCC-QIO is performing health oversight activities as defined by the Social Security Act).

C.5.3 Government Data A listing of data to be supplied by CMS and the schedule by which they shall be provided appears in Section J, Attachment J-4 Data Supplied by CMS. In general, Part A reported data shall be available from the CMS Data Warehouse. CMS Information Systems contractors shall create and deliver to CMS measurement and analytic datasets, broken down by BFCC-QIO area, for distribution to the BFCC-QIO.

Although CMS will provide data to the BFCC-QIO as specified above, CMS will not provide all data that is needed by a BFCC-QIO to effectively perform as required by the contract. The BFCC-QIO is responsible for determining what additional data is necessary and collecting it as appropriate. See e.g., Section 1154(a)(7)(C) and (a)(9)(A) of the Act and 42 CFR § 476.78(b)(2).

a. Data Use Agreements- A Data Use Agreement (DUA) is a legally binding agreement between a BFCC-QIO and any external entity (e.g., contractor, private industry, academic institution, other Federal government agency, or state agency), that is used when an external entity requests and receives the use of personally identifiable data…