HHSM-500-2014-RFP-QINNCC_Amendment_6_RFP_.docx

Table of Contents

End Stage Renal Disease Network CMS-2012-Contractor-DQC Firm Fixed Price (FFP) Renewal

Quality Innovation Network (QIN) National Coordinating Center (NCC) HHSM-500-2014-RFP-QINNCC Amendment 1: June 12, 2014 v

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 Description of Services

The purpose of this multi-year contract is to procure expert healthcare quality improvement technical support services of a National Coordinating Center (NCC) to assist the network of Quality Innovation Network-Quality Improvement Organizations (QIN-QIOs). National Coordinating Centers (NCCs) support QIOs in achieving the QIO Program’s Three-Part Aim for better care, better health for populations and communities, and lower costs of care for an initial term of five (5) years per 41 USC 3903. The QIO Program 11th Statement of Work (SOW) operational structure includes two NCCs; one supporting the BFCC-QIOs and the other supporting the QIN-QIOs. NCCs are considered QIOs and must comply with QIO eligibility requirements in order to provide technical assistance, improvement tools, and facilitate communication between QIOs, providers, state and federal agencies, internal and external stakeholders, communities, caregivers/families, and Medicare beneficiaries at both the national and local levels to promote better health, improve the healthcare delivery system, and lower healthcare costs through improvement. In addition, NCCs assist CMS with creating an environment for continuous learning across the country, and perform data collection, evaluation, analysis, and reporting.

B.2 Type of Contract

The Government contemplates awarding one (1) five (5) year Cost-Plus-Fixed-Fee (CPFF) contract resulting from this solicitation.

NOTE: Please be advised that if the Offeror does not have an accounting system that is adequate for determining costs applicable to the contract (FAR 16.301-3) and for accumulating and segregating costs under a Cost Reimbursement (CR) contract, it will not be eligible to receive an award.

B.3 Cost Plus Fixed Fee (CPFF)

A. Total Contract Amount The total estimated cost plus fixed fee for this contract is $(to be entered at the time of award). The total cost is $(to be entered at the time of award) and the total fixed fee of $(to be entered at the time of award).

B. Reimbursement The QIN NCC, upon successful completion of the work required, will be reimbursed monthly in accordance with Section I, Federal Acquisition Regulation (FAR) clauses 52.216-7 Allowable Cost and Payment (JUN 2013) and 52.216-8 Fixed Fee (JUN 2011). Monthly vouchers shall be submitted in accordance with contract Section G.2 Payments-Vouchers (Cost Reimbursement Contracts).

C. Table of Total Estimated Cost Plus Fixed Fee The QIN NCC shall provide the necessary personnel, materials, services, facilities and supplies (except as may be otherwise specified in the contract) and otherwise do all things necessary for, or incident to, the performance of the work as set forth in Section C, Statement of Work/Services. In consideration of successful contract performance based on the evaluation criteria set forth in Section H.5, the QIN NCC will be reimbursed as stated in the Table of Total Estimated Cost and Fixed Fee provided on the on the following page:

$0

Total

B.4 Schedule for Payment of Fixed Fee Payment of the fixed fee will be made in accordance with the schedule provided below. As authorized under FAR 52.216-8, after payment of 85% of the fixed fee, CMS may elect to withhold 15% or $100,000 (whichever is less).

Month Payment Total 1-59 Withholding Total

B.5 Ceiling Rates

A. General The cost limitations addressed in this Section apply to the total contract ceiling amount of the contract. The QIN NCC is advised that all costs associated with this contract, either directly or indirectly, are subject to audit.

B. Indirect Cost Rates

The indirect cost rate ceiling(s) for this contract is/are:

TBD

B.6 Medical Records Photocopying The QIN NCC will be paid for a properly certified invoice/voucher for medical records photocopying costs at a rate of $.12 per page (hardcopies) for reproduction of PPS provider records and $.15 per page (hard copies) for reproduction of non-PPS institutions and practitioner records, plus first class postage. Specifically, hospitals and other providers (such as critical access hospitals) under a Medicare cost reimbursement system, receive no photocopying reimbursement from the QIN NCC. Capitation providers such as HMOs and dialysis facilities receive $.12 per page. No fixed fee will be paid on photocopying.

B.7 Overnight Mail Contract deliverables shall not be submitted utilizing overnight mail. All other overnight mailings (e.g., provider-based discharge appeals, etc.) shall be at the discretion of the QIN NCC and are subject to the Contracting Officer’s (CO) determination of reasonableness.

B.8 Transition Services

In the event that CMS requires transition services from an incumbent (2014) QIN NCC to a successor (2019) QIN NCC, CMS will request a separate technical and business proposal for these services. These services will be incorporated into the contract, if applicable.

In the event that CMS requires transition services from an incumbent QIN NCC to a successor QIN NCC, the incumbent will be responsible for funding the cost of transfers which includes, but not limited to, the packing, shipping, etc. of any GFE to the location identified by CMS.

The contractor is responsible for adhering to the CMS HHS-22 and HHS-565 processes which focuses on asset management and transition of equipment (transfers, disposals, donations, etc.).

Within 60 days of end of contract, the incumbent QIN NCC shall communicate with the QualityNet Help Desk to identify the shutdown/transition of their contract to initiate the QIO Startup/Shutdown transition procedure.

B.9 Contract Limitations The following chart indicates the contract limitations for the structure of the QIO Program. These contract limitations also include any subcontracting arrangements or corporate affiliates (as defined in H.11.C.4).

· Any BFCC-QIO Area

· BFCC NCC QIO

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

QIN National Coordinating Center QIO

(QIN NCC)

· Any BFCC-QIO Area

· BFCC NCC QIO

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

· Any QIN-QIO Area

· QIN NCC QIO

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

BFCC National Coordinating Center QIO

(BFCC-NCC QIO)

· Any QIN-QIO Area

· QIN NCC QIO

· BFCC ORC

· PCC

· IEC

· VIQRC (Appeals Only)

BFCC Oversight & Review Center

(BFCC ORC)

· Any QIN-QIO Area

· QIN NCC QIO

· Any BFCC-QIO Area

· BFCC NCC QIO

· PCC

· SIE

· IEC

· VIQRC: 1) Outreach/ Education for Inpatient/ Cancer/ Psych; or 2) Appeals

Program Collaboration Center

(PCC)

· Any QIN-QIO Area

· QIN NCC QIO

· Any BFCC-QIO Area

· BFCC NCC QIO

· BFCC ORC

· SIE

· IEC

· VIQRC (Any)

· PCC

· IEC

· BFCC ORC

· VIQRC (Appeals Only)

· PCC

· IEC

· PCC

· PCC

· Any QIN-QIO Area

· Any BFCC-QIO Area

· QIN NCC QIO

· BFCC NCC QIO

· BFCC ORC

· PCC

· SIE

· VIQRC (Any Other)

· BFCC ORC

· PCC

· IEC

· VIQRC Appeals

· Any QIN-QIO Area

· Any BFCC-QIO Area

· QIN NCC QIO

· BFCC NCC QIO

· BFCC ORC

· PCC

· SIE

· VIQRC (Any)

CMS shall not enter into a contract under this part with any entity (prime or subcontractor) which is, or is affiliated with (through management, ownership, or common control), a health care facility, within the area served by such entity or which would be served by such entity if it entered into a contract with the CMS under this part.

An entity shall not be considered to be affiliated with a health care facility by reason of management, ownership, or common control if the management, ownership, or common control consists of no more than twenty (20) percent of the members of the governing board of the entity being affiliated (through management, ownership, or common control) with one or more of such facilities.

Quality Innovation Network (QIN) National Coordinating Center (NCC) HHSM-500-2014-RFP-QINNCC Amendment 1: June 12, 2014

SECTION C – STATEMENT OF WORK/SERVICES

C.1. CONTRACT PURPOSE

The purpose of this contract is to procure expert healthcare quality improvement technical support services of a National Coordinating Center (NCC) to assist the network of Quality Innovation Network-Quality Improvement Organizations (QIN-QIOs). National Coordinating Centers (NCCs) support QIOs in achieving the QIO Program’s Three-Part Aim for better care, better health for populations and communities, and lower costs of care. The QIO Program 11th Statement of Work (SOW) operational structure includes two NCCs; one supporting the BFCC-QIOs and the other supporting the QIN-QIOs. NCCs are considered QIOs and must comply with QIO eligibility requirements in order to provide technical assistance, improvement tools, and facilitate communication between QIOs, providers, state and federal agencies, internal and external stakeholders, communities, caregivers/families, and Medicare beneficiaries at both the national and local levels to promote better health, improve the healthcare delivery system, and lower healthcare costs through improvement. In addition, NCCs assist CMS with creating an environment for continuous learning across the country, and perform data collection, evaluation, analysis, and reporting.

The QIN NCC is strategically positioned to facilitate and provide essential technical assistance to the QIN-QIOs and CMS through services supporting:

· Innovation in health and healthcare quality improvement

· Improvement of quality measures

· Improvement of health outcomes for Medicare beneficiaries

· Effective communication and coordination care

· Development and implementation of health information technology for care management

· Primary care prevention and early diagnosis

· Reduction in healthcare disparities among underserved populations

· Spread of best practices

· Development and dissemination of tools

· Learning and Action Networks (LANs) including but not limited to IHI Breakthrough Series-type Collaboratives

· Training and Education including but not limited to virtual and in-person learning events

· Data collection and analysis

· Strengthening of infrastructure and data systems

· Monitoring and evaluation of the impact of QI activities

· Community involvement, patient/beneficiary and family engagement

· Coordination and collaboration with stakeholder organizations working on comparable efforts or interested in teaming

· Quality improvement (QI) activities that

· Reduce healthcare-acquired conditions

· Improve the quality of nursing home care

· Employ medication management strategies

· Improve care coordination and delivery

· Improve value and efficiency

C.2. BACKGROUND AND OVERVIEW

The Centers for Medicare & Medicaid Services (CMS) is the federal agency tasked with overseeing a variety of healthcare programs, including Medicare and Medicaid. It strives to ensure that beneficiaries receive the highest quality of care, consisting of personalized, prevention-oriented, and beneficiary-centered care, based on evidence about the benefits and costs applicable to each individual beneficiary.

The Quality Improvement Organization (QIO) Program serves an important role in the administration of the Medicare Program by conducting reviews to ensure that items and services provided under the Medicare Program adhere to statutory and regulatory requirements regarding, for example, the medical necessity, reasonableness and quality of care, the appropriateness of the setting in which care is provided, and whether certain standards under the Emergency Medical Treatment and Active Labor Act (EMTALA) have been met. These kinds of reviews will be covered under the Beneficiary and Family-Centered Care (BFCC) SOW. The QIO statute, as amended by Section 261 of the Trade Adjustment Assistance Extension Act of 2011, also requires QIOs to perform, subject to the terms of their contracts, activities that the Secretary of the Department of Health and Human Services (HHS) determines may be necessary for the purposes of improving the quality of care furnished to Medicare beneficiaries. This provision, in addition to several others, provides specific authority for much of what we anticipate will be included in the Quality Innovation Network (QIN) SOW for quality improvement.

We seek to align the QIO Program with broader quality goals, initiatives, and activities developed and implemented by the HHS, such as the National Quality Strategy (NQS) and the CMS Quality Strategy. We anticipate that this alignment will help maximize the benefits of the QIO Program for Medicare beneficiaries, while potentially producing secondary benefits for the national healthcare system. We have described these broader HHS goals, initiative, and activities in C.6.3, of this contract.

C.2.1. OVERALL PURPOSE OF QIO PROGRAM

While the purpose of this contract is to carry out the goals listed in section 1862(g) of the Act, the QIO program requirement shall be fulfilled in a manner that supports CMS in its efforts to seek to improve health and healthcare for all Medicare beneficiaries and promote quality of care to ensure the right care at the right time, every time. Although the QIOs’ tasks do not fulfill requirements under the Affordable Care Act (P.L. 111-148 as amended by P.L. 111-152), the contractual requirements are designed to align with the Affordable Care Act goals that are relevant to the QIO program and seek to increase access to high-quality, affordable healthcare for all Americans. We seek to align the goals of the QIO program in general, and successful performance of this contract, will align with National Strategy for Quality Improvement in Health Care (the NQS) established by the Secretary pursuant to the Affordable Care Act. The NQS sets priorities to achieve the goals of the Affordable Care Act and includes a strategic plan for how to achieve them. The NQS articulates six goals that build on the three broad aims of better care, better health, and lowering costs through improvement, and forms the basis for the CMS Quality Strategy six goals aligned as follows:

The NQS notes that an effective national strategy must support effective local strategies. National standards and consistency in their measurement are essential components of the NQS. At the same time, the unique needs and characteristics of local communities must be supported to ensure activities that are responsive to and driven by local circumstances, needs and capacities. In working to achieve their own goals at the local level, the QIOs’ work will serve an essential role in helping CMS to achieve the goals of the National Quality Strategy by working to achieve their own goals at the local level. In most instances, the QIO local level activities will be conducted in coordination with the QIO National Coordinating Centers, which are entities that work under contract to CMS as part of the QIO program, to support the QIOs by facilitating the flow of information to and from each of the QIOs.

C.2.2. QIO Program Structure The QIO contracts are structured by function and categorized as follows:

1. A number of Quality Innovation Network QIOs (QIN-QIOs);

1. Five (5) Beneficiary and Family Centered Care QIOs (BFCC-QIOs);

1. One (1) Program Collaboration Center (PCC);

1. One (1) National Coordinating Center (NCC) for BFCC;

1. One (1) National Coordinating Center (NCC) for QIN (this contract);

1. Five (5) Value Incentives and Quality Reporting Centers (VIQRCs);

1. One (1) Strategic Innovation Engine (SIE);

1. One (1) Independent Evaluation Center (IEC); and

1. One (1) BFCC Oversight and Review Center (BFCC ORC).

The QIO Program is based upon two core contract functions; quality improvement and case review. Each contract within the QIO program structure will support at least one of these functions.

Quality Innovation Network (QIN)-QIOs QIN-QIOs will perform a vast range of quality improvement services across the spectrum of the health care delivery system. A series of QIN-QIOs will work across the country to facilitate large-scale, widespread improvements in care delivery for Medicare beneficiaries.

Beneficiary- and Family-Centered Care (BFCC)-QIOs Five BFCC-QIOs across the nation will perform BFCC-related services for designated areas across the nation. In particular, BFCC services include case reviews, quality of care reviews, diagnosis-related group (DRG) reviews, EMTALA reviews, appropriateness of setting reviews, medical necessity reviews, readmission reviews, Physician Acknowledgement Statement monitoring, appeals and sanctions.

Program Collaboration Center (PCC) The PCC will provide overall national coordinating services for the QIO program as a whole and all QIO contractors. The PCC contract shall include, but is not limited to, the following work: strategic integrated communications about the QIO Program and its associated projects/tasks; helping QIOs report data and helping CMS analyze and interpret those data to assess program progress; providing support for all QIO Learning and Action Networks; and coordinating training opportunities for national-level QIO training.

National Coordinating Centers (NCCs) The NCCs provide direct support services to QIOs and their responsibilities shall include, but not be limited to, coordinating program activities, and providing assistance to QIOs for BFCC activities and quality improvement activities. Specifically, one NCC will focus on BFCC activities while the other focuses on QIN, which includes better healthcare at the population level, and better health for individuals.

Value Incentive and Quality Reporting Centers (VIQRCs) Five VIQRC contractors will each focus on one facet associated with providing quality of care information to Medicare beneficiaries and improving quality of care through measurement and surveillance.

Strategic Innovation Engine (SIE) The SIE contractor will recommend best practices and potential projects that QIOs may adopt as part of their clinical quality improvement work. The SIE will identify practices from QIOs and from peer-reviewed literature that are worthy of spread within and beyond the QIO program, recommend future special innovation projects that CMS can award to QIOs, and document effective strategies QIOs can use to deliver technical assistance to communities and providers seeking to improve care with the QIOs’ help.

Independent Evaluation Center (IEC) As a separate contractor, the IEC will provide impartial and unencumbered evaluations which shall include, but are not limited to, overall QIO program impact.

Beneficiary and Family Centered Care Oversight and Review Center (BFCC ORC) The BFCC ORC shall provide independent review and findings relating to case reviews performed by BFCC-QIOs.

C.3. TECHNICAL CONSIDERATIONS

The contractor undertaking this QIN NCC contract shall comply with all requirements outlined in this contract, together with statutory and regulatory provisions and any amendments to those provisions that might occur during the course of the contract and formal instruction from CMS, through the Contracting Officer. Attachment J-1, Glossary of Terms and Acronyms shall be used when interpreting the requirements of this contract.

C.3.1. TECHNICAL REQUIREMENTS

The following are included in Section J, Attachment J-2:

· QIO Manual

· Code of Federal Regulations, including

· 42 CFR Parts 475

· 42 CFR Part 476

· 42 CFR Part 478

· 42 CFR Part 480

· 42 CFR Part 489.20 and 489.24

· 42 CFR Part 1004

C.3.2. INFORMATION TECHNOLOGY ARCHITECTURE FOR THE QIO PROGRAM

The contractor must be knowledgeable of a wide range of information technology systems. Section J, Attachment J-3 provides a list of the known systems that may be used by the contractor and provides high level details of the systems and applications. The core functionality, support systems and interdependencies of each system are described in the attachment. While those users of the system that are QIOs (“QIO users”) will not directly interface with all of systems and applications described, the inclusion of the support and subsystem descriptions will assist each QIO in obtaining a global view of the Health Care Quality Information System (HCQIS) infrastructure. Further, the attachment is categorized by the lines of business using each system, including Enterprise Services that are used by multiple lines of business.

C.3.2.1 HARDWARE/SOFTWARE

CMS, either directly or through a CMS contractor, shall provide the QIN NCC with a file/print server, a domain controller, a database server, network/telecomm equipment, and a workstation and/or laptop for each 0.5 or greater full-time-equivalent (FTE) employee at award of contract to cover their base needs. The servers, workstations, and laptops shall be equipped with a standard operating system and a software suite following the approved CMS Federal Desktop Core Configuration (FDCC) standard which is also referred to as the United States Government Configuration Baseline (USGCB). Please refer to Section J, Attachment J-17 (HCQIS QIO Basic IT Procurement List) as it provides a standard list of basic IT HW/SW and the associated pricing that is used within the HCQIS environment. Please note that this listing in not an all-inclusive list and should be used to identify basic IT needs and current associated costs for a startup office. The list and pricing identified should be used for budgeting purposes only as they are subject to change. All HW/SW required will be procured via the HCQIS Remedy Purchase System/Engineering Review Board (ERB) process which is used to help track and maintain all Government Furnished Equipment (GFE). The amount of hardware & software provided will be dependent on the agreement between CMS and the contractor based on the work identified. Any additional resources required including, but not limited to, printers, faxes, etc. the contractor will be responsible for funding the procurement of the equipment.

The contractor must receive approval from their Contracting Officer Representative (COR) prior to submitting a purchase request via the HCQIS procurement process, currently identified as the ERB to be procured. No additional hardware peripherals or non-approved software may be connected or installed to any GFE or on the QualityNet infrastructure without prior written approval by CMS. If there are items that are not listed in Section J, Attachment J-17 in which the contractor would like to use in support of their contract, a request will have to be submitted thru their COR to begin the approval process.

The contractor shall update Remedy inventory for all procured GFE and maintain the necessary documentation such as HHS-565 and HHS-22’s located in the Remedy Purchase System to ensure proper asset management and tracking of all GFE.

C.3.3. INFORMATION SYSTEMS SECURITY REQUIREMENTS:

Unless otherwise directed by CMS, the QIN NCC shall adhere to the most current version of the policies and procedures outlined and posted on QIONET. These include the following Section J, Attachment J-7, Information Systems documents are incorporated into the contract by reference:

· QIO Infrastructure Operations and Support Manual, Chapter 8 of QIO Manual

· QIO Information Technology (IT) Administrator Manual

· Health Care Quality Information Systems (HCQIS) Database Systems Administrator Guide

· CMS Information Security Virtual Handbook

· QualityNet System Security Policy

· QualityNet Incident Response Procedures

· CMS Federal Desktop Core Configuration Standards

· CMS Contractor Website Guidelines

· CMS Policy for Information Security Program (PISP)

· Federal Information Security Management Act (FISMA) of 2002

· E-Government Act of 2002 (Public Law 107-347)

· IOM Pub. 100-17

· FISMA requirements

The QIO shall comply with all present and future statutes, Federal, HHS, and CMS regulations and program instructions relating to providing a secure computer operations environment. Additional Policies and Procedures may be released requiring the QIO to comply.

The QIN NCC shall maintain all necessary documentation that meets or exceeds the performance standards specified in Chapter 8, Infrastructure Operations Support and Data Management, of the QIO Manual and deliverables specified in Section F.

C.3.3.1 CERTIFICATION BY SECURITY POINT OF CONTACT (SPOC) FOR COMPLIANCE WITH CMS SECURITY REQUIREMENTS The QIN NCC shall appoint a Security Point of Contact (SPOC) or equivalent. The SPOC shall assist the CMS ISSO in ensuring the QIN NCC adheres and complies with the CMS Information Security (IS) program requirements located at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html.

a. Administer and Adhere to the CMS Information Security (IS) Program

1) The QIN NCC shall comply with the CMS Policy for the Information Security and Privacy (PISP) and all CMS methodologies, policies, standards, and procedures contained within the CMS PISP, unless otherwise directed by CMS in writing. The QIN NCC shall also adhere and comply with any specific policies as they relate to security within the Health Care Quality Improvement System.

2) The QIN NCC shall comply with all CMS security program requirements as specified within the CMS Information Security (IS) “Virtual Handbook” (a collection of CMS policies, procedures, standards and guidelines that implements the CMS Information Security Program) and the QualityNet Security Policy. The Virtual Handbook can be found at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and the QualityNet System Security Policy is located at http://qualitynet.org/.

3) The QIN NCC shall provide a list of assigned QIN NCC Information Technology (IT) staff with required information.

4) The QIN NCC shall conduct Security Awareness Training (SAT) for all employees utilizing or accessing CMS data within the HCQIS environment on an annual basis. Security Awareness Training for employees will be tracked and logged locally by the QIN NCC SPOC as identified by the CMS ISSO. A QNET SAT Certification Letter shall be provided to the CMS QNET ISSO 90 days after contract award and annually thereafter in accordance with the Schedule of Deliverables.

5) The QIN NCC shall visit the CMS security website http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and the QualityNet security website http://qionet.sdps.org at least every 30 calendar days for updates. [Note: The QualityNet security website is an Intranet website; thus, access is restricted to only active users within the QualityNet Enterprise.]

6) The QIN NCC shall submit to the COR and CMS QNET ISSO a Business Continuity and Contingency Plan (BCCP) within 90 days after contract award in accordance with the Schedule of Deliverables. Updates shall be provided 30 days after completion of any serious structural changes. Serious structural changes consist of building relocations or major structural changes to the current infrastructure. The BCCP shall demonstrate how the organization shall establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations. In addition, updates shall be provided after any serious structural changes. Serious structural changes consist of building relocations or major structural changes to the current infrastructure.

b. FISMA Compliance

1) The QIN NCC shall comply with CMS, FISMA, OIG, and other relevant audits, reviews, evaluations, tests, and assessments of QIN NCC systems, processes, and facilities as it relates to program security and compliance. The QIN NCC shall provide all related artifacts upon request. The QIN NCC shall deliver the artifacts in the format and method prescribed by CMS.

2) The QIN NCC shall provide CMS with a QIN System Security Plan (SSP) and Information Security (IS) Risk Assessment (RA) within 90 days of after task order award, annually thereafter, and also within 30 days after any major changes.

3) The QIN NCC shall document its compliance with CMS security requirements and maintain such documentation in the QIN System Security Plan (SSP) and the IS Risk Assessment (RA) as directed by CMS.

4) The QIN NCC shall develop, in conjunction with CMS, Corrective Action Plans (CAP) Performance Improvement Plans (PIPs)for all identified weaknesses, findings, gaps, or other deficiencies in the IS Program (e.g., those items identified during a FISMA audit or similar activity) in accordance with IOM Pub. 100-17 (BPSSM) or as otherwise directed by CMS. CAPs shall be submitted to the CMS QNET ISSO within 30 days after the audit or finding in accordance with the Schedule of Deliverables.

Moreover, the QIN NCC shall comply with the guidance and requirements of the CMS Information Security Plan of Action & Milestones (POA&M) Procedure, which is located at www.cms.hhs.gov/InformationSecurity in the Information Security Library. The POA&M shall be submitted to the CMS QNET ISSO within 15 days of approval of a CAP PIP and monthly thereafter until the CAP is closed.

The QIN NCC shall comply with the guidance for reporting requirements for all CAPs and the CMS Information Security POA&M Procedure.

c. Inventory of Government Furnished Equipment The QIN NCC shall comply with CMS guidance for requirements associated with Government Furnished Equipment. The QIN NCC shall update Remedy inventory for all procured, transferred and received Government Property (including hardware and software). The QIN NCC will be responsible for keeping a list of all purchased and leased equipment in a HHS 565 submission Final Report.

d. Maintenance of Systems and Software The QIN NCC shall comply with all CMS system and software maintenance procedures. All digital media must be encrypted before physically leaving the QIN NCC. The QIN NCC shall perform maintenance of systems and software in compliance with applicable configuration requirements. QIN NCC IT staffs are responsible for completion of IT tasks as assigned in Remedy tickets for QIN NCC local systems.

e. Security Incident Response The QIN NCC shall comply with CMS Incident Handling Standards and Procedures (RMH Vol III Standard 7-1 Incident Handling, RMH Vol II Procedure 7-2 Incident Handling Procedure) located at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html and report suspected security breaches within the designated time periods. The QIN NCC shall assist the CMS ISSO on active investigations and provide requested documentation as needed.

C.3.3.2 TRANSITION OF EQUIPMENT

In the event that CMS requires transition services from an incumbent contractor to a successor contractor, the incumbent will be responsible for funding the cost of transfers which includes, but not limited to, the packing, shipping and so forth of any GFE.

The contractor is responsible for adhering to the CMS HHS-565 and HHS-22 processes (including any associated deliverables) which focuses on asset management and transition of equipment (transfers, disposals, donations, etc.).

· At the end of a contract period, the contractor must follow the QualityNet Contractor Transition Procedures to Shut down and Startup Operations process to ensure that proper transition of all GFE is done in timely manner.

C.4. GENERAL REQUIREMENTS

The QIN NCC, acting independently and not as an agent of the Federal Government, shall furnish the necessary personnel, materials, services, facilities, and supplies (except as may be otherwise specified in the contract) and otherwise do all things necessary for, or incident to, the performance of the work as set forth in this SOW. “Necessary personnel” means such staff and professionals (as employed or under subcontract) with the expertise, experience, and educational and/or professional accomplishments to satisfactorily complete services described in this SOW.

The QIN NCC shall adhere to the following requirements as they apply to the tasks described in Section C. Additionally, the QIN NCC must comply with all present and future statutes, Federal, HHS, and CMS regulations and program instructions affecting this contract.

C.4.1. GENERAL REPORTING REQUIREMENTS:

The QIN NCC shall report to CMS as directed in the Schedule of Deliverables. The QIN NCC shall use all components and adhere to all procedures of the HCQIS data collection and reporting systems to manage and report work performed under this SOW.

In the event any template(s) and/or space is unavailable for data entry into DDST or any designated CMS system during this contract period of performance, the QIN NCC shall collect and internally store any and all such data. During this time period, the QIN NCC shall provide these data and/or deliverables to their COR and GTL through MyQualityNet; or e-mail; or via hardcopy; as directed by CMS. Upon template and/or space availability, the QIN NCC shall backload such data into DDST or any designated CMS system.

C.4.2. CONFIDENTIALITY:

The QIN NCC shall adhere to the privacy, confidentiality, and disclosure requirements set forth in Section 1160 of the Act, and in Title 42 of the Code of Federal Regulations (CFR) Part 480, which are incorporated by reference in Section J, Attachment J-2. http://www.access.gpo.gov/nara/cfr/waisidx_02/42cfr480_02.html. The QIN NCC shall be prepared to document adherence to these privacy, confidential and disclosure requirements.

The confidentiality training requirement specified in 42 CFR Part 480 of the regulations is separate and distinct from the Annual QualityNet Security Awareness Training requirement outlined in the CMS Information Security Acceptable Risks and Safeguards (compliance with which is required pursuant to section C.3.3). The QIN NCC may be required to provide a copy of training materials developed or used to meet the confidentiality training requirement specified in 42 CFR 480.115. CMS may request documentation that users of the QIN NCC review system have been trained in the proper handling of confidential information prior to being given access to that information and review system.

In any instances in which CMS designates any data or information the QIN NCC has collected, acquired or generated in the exercise of its duties and functions under the QIN NCC and Medicare statutory provisions as quality review study (QRS) information (as defined in 42 CFR § 480.101(b) http://www.gpo.gov/fdsys/pkg/CFR-2012-title42-vol4/pdf/CFR-2012-title42-vol4-part480.pdf), the QIN NCC is bound by the disclosure limitations for QRS information in § 480.140. The QIN NCC should note that, under § 480.140(g), they must disclose information with identifiers of patients, providers and/or practitioners, to CMS or CMS’s contractors when CMS deems it necessary for purposes of evaluating the performance of the QIN NCC. If the QIN NCC is in doubt about whether data qualify as QRS data, the QIN NCC must contact the COR for direction.

The QIN NCC shall also adhere to Section H of this contract, which limits uses and disclosures of individually identifiable health information (IIHI) when the QIO or QIN NCC is using or disclosing such data in its capacity acting as a Health Insurance Portability and Accountability Act (HIPAA) “business associate” of the healthcare components of CMS. CMS’ healthcare components consist of the Medicare Fee-for-Service Program and the Pre-existing Condition Insurance Program (PCIP). Section H contains the “business associate agreement” provisions required by 42 CFR 164.504(e)(1) of the HIPAA Privacy Rule, authorized by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, as well as the HIPAA Privacy and Security Rules; the applicable provisions of the HIPAA Privacy, Security, and Breach Notification Rules; the QIO Manual (which is incorporated by reference); and other relevant Federal laws, regulations and administrative directives as outlined in this contract.

The business associate agreement requirement applies if and when the QIN NCC uses or discloses IIHI to conduct any activities on behalf of CMS’ Medicare fee-for-service (FFS) health plan function or the PCIP program. IIHI used in this manner is protected health information (PHI) or, when applicable “electronic protected health information” or ePHI. The use or disclosure of PHI or ePHI for these purposes would include instances in which such information is used by the QIN NCC to carry out a Medicare FFS or PCIP program function (such as for “payment” of “healthcare operation” of the Medicare FFS or PCIP programs). The business associate agreement in Section H applies only where the QIN NCC is serving in a HIPAA business associate for CMS’ Medicare FFS health plan or PCIP function, which includes conducting payment or healthcare operations activities. The business associate agreement does not apply when the QIN NCC is not serving as a HIPAA business associate for CMS’ Medicare FFS health plan or PCIP program function (such as when the QIN NCC is providing health oversight activities as defined by the Social Security Act).

C.4.3. GOVERNMENT DATA

A listing of data to be supplied by CMS and the schedule by which they shall be provided appears in Section J, Attachment J-4, Data Supplied by CMS. In general, variables from Part A, Part B and Part D reported data shall be available from the CMS Data. CMS Information Systems contractors shall create and deliver analytic datasets to the QIN NCC.

Although CMS will provide data to the QIN NCC as specified above, CMS will not provide all data that is needed by a QIN NCC to effectively perform as required by the contract. The QIN NCC is responsible for determining what additional data is necessary and collecting it as appropriate. See e.g., Section 1154(a)(7)(C) and (a)(9)(A) of the Act and 42 CFR § 476.78(b)(2).

C.4.3.1 DATA USE AGREEMENTS

A Data Use Agreement (DUA) is a legally binding agreement between the QIN NCC and any external entity (e.g., contractor, private industry, academic institution, other Federal government agency, or state agency), that is used when an external entity requests and receives the use of personally identifiable data held by the QIN NCC (“QIO data”).