Attachment 1_Scope and Ordering Guide HT003821R0001-0001.pdf

HT003821R0001

Workforce 3.0 1

Attachment 1: Scope and Ordering Guide 2 Solicitation Number: HT003821R0001 5 Program Executive Office, Healthcare Management Systems (PEO DHMS) 6

SECTION I 7

1.0 DESCRIPTION OF RELATIONSHIP 9

1.1 Purpose. 11

The purpose of this IDIQ solicitation is to form contractual relationships necessary to deliver workforce components 12 of the “world-class technology firm” that is a core tenet of the PEO 3.0 Strategy. As such, the resulting IDIQ 13 contracts are referred to as “Workforce 3.0” and will be supported by the other PEO 3.0 efforts. 14 Workforce 3.0 is a managed solution that leverages innovative new processes, methods, and/or best-in-class 16 methodologies from the private sector to enable the entire PEO DHMS workforce to deliver world-class technology. 17 Contractor employees shall not perform inherently governmental functions as discussed in FAR Subpart 7.5, 19 “Inherently Governmental Functions” nor personal services as defined in as discussed in FAR 37.104. 20

1.2 Background 22

As a nation, our health is one of our most critical and important resources. Whether in the context of maintaining 23 economic output, the readiness of our military to defend our national security, or paying the debt we owe to those 24 who made sacrifices to do so, a healthy society is the engine for these activities. The Office of the National 25 Coordinator (ONC) recently published its 2020-2025 Federal Health IT Strategic Plan (the “Plan”), laying out the 26 Federal Government’s role in healthcare and how it uses Health Information Technology (Health IT) to fulfill that 27 role. In short, the Government regulates, purchases, and uses healthcare while also regulating, purchasing, 28 developing, and using Health IT. The Plan further lays out some of the biggest challenges facing the healthcare 29 industry and how the Government plans to use technology to address these and improve health outcomes. Among 30 these are cost growth, capacity in the system, and poor health outcomes especially in areas such as obesity, 31 substance abuse, and mental health. 32 PEO DHMS is a key Federal Health IT partner, and is chartered to deliver the single Electronic Health Record 34 (EHR) and other Health IT for the Departments of Defense (DoD), the Department of Veterans Affairs (VA), and 35 the United States Coast Guard (USCG). Sitting at the nexus of healthcare and defense, which together account for 36 approximately 40% of that national budget, PEO DHMS is in a unique position to substantially impact strategic 37 challenges facing the nation. National defense, like healthcare, faces challenges in resources, capacity, and 38 capability that can be addressed through innovative technology strategies. 39 In its official Purpose, Goals, and Strategies (PGS) document, PEO DHMS lays out its vision for maximizing its 41 impact on healthcare and defense. While many tend to equate PEO DHMS with EHR, PEO DHMS and its 42 subordinate/partner offices have a considerably broader and continually expanding mission. According to data 43 collected by ONC, EHR adoption across the country is approaching 100% (Office of the National Coordinator for 44 Health Information Technology, OCT 2020). The Federal Health IT Strategic Plan looks well beyond core EHR 45 capabilities while PEO DHMS missions are pivoting to provide comprehensive health management, advanced data 46 applications, improved usability, reduced provider/patient burden, and other priorities. PEO DHMS recognizes 47 technology will enable these missions to achieve success. 48 PEO DHMS delivers on these missions with a strong workforce comprised of federal civilians from multiple 50 Agencies, military personnel from each Service, support contractors, and Prime mission product contractors. This 51 workforce is organized into major program offices, project teams, coordinating offices, and a back office/corporate 52 team. 53 PEO DHMS’ workforce strives to deliver world-class technologies in the health information field. In order to 55 succeed at one of the Department of Defense’s most important missions, PEO DHMS must, to the greatest extent 56 possible, ensure its technologies and conduct are indistinguishable from those of leading private-sector technology 57 firms. This includes: 58

● Frictionless and seamless solutions and products that create the best possible user experience 59

● Quality products to drive demand from Government and non-Government users 60

● Increased competition and ignited innovation from other Health IT developers in the private sector 61

● Attracting the best people in these fields to join and stay in the PEO DHMS workforce 62 To achieve these lofty and worthy goals, PEO DHMS must undergo a fundamental shift in how it does business. 64 In its continual evolution to achieve these objectives, PEO DHMS has transitioned across three distinct operational 65 paradigms: 66

● (2013 - 2014) The first and previous phase, PEO 1.0, was launched via the 2013 Secretary of Defense 67 (SECDEF) charter to establish an Electronic Health Record (EHR) for use by the Department of Defense 68 (DoD) DoD and the Department of Veterans Affairs (VA). This phase represents the “crawl” of the PEO 69 DHMS organization as operational processes were identified and initially established. 70

● (2014 - Present) The second and current phase, PEO 2.0, is anchored by the successful procurement and 71 ongoing deployment of the MHS GENESIS EHR. This phase represents the “walk” of the PEO DHMS 72 organization as operational processes entered sustainment and flagship products were launched into the 73 market to achieve initial customer value. 74

● (Present - 2026) This third and next phase, PEO 3.0, is characterized by achieving a digitally transformed 75 organization with ambitious year-over-year growth in product portfolio value and customer outcomes. This 76 phase represents the “run” of the PEO DHMS organization as focus shifts from internal organizational 77 deployment to fostering external product development across the portfolio. 78

● PEO DHMS seeks to launch the PEO 3.0 phase in FY21 with a four-pronged strategic effort that mirrors 79 the operational strategies of leading commercial counterparts: Workforce 3.0 (“WF3”) to perform business 80 support services, Workplace 3.0 (“WP3”) to provide business infrastructure, DevMAC to provide software 81 development support services, and Federal XaaS (“XaaS”) to provide software development infrastructure. 82 For communications purposes, this strategy has been distributed through a graphical metaphor outlining 83 parallels to the construction industry. 84

Inherently, the more time passes, the more a given set 86 of circumstances change. Since PEO 2.0 began, there 87 has already been substantial change throughout the 88 PEO portfolio of programs, and more change is 89 certain in the coming years, most likely at an 90 accelerated pace. 91 Notably, on 01 JUL 2017, the Secretary of Veterans 93 Affairs (VA) issued a Determination and Findings 94 (D&F) pursuant to 41 U.S.C. § 3304(a)(7) that it was 95 in the public interest for VA to issue a solicitation 96 directly to Cerner for the acquisition of the EHR 97 system being deployed by the DoD, in order to enable 98 seamless healthcare to Veterans and qualified 99 beneficiaries. Moreover, on 22 MAR 2018, the 100 Deputy Commandant for Mission Support, United 101 States Coast Guard (USCG), formally requested to 102 partner with PEO DHMS to implement MHS 103 GENESIS for the USCG to ensure that every military 104 beneficiary and retiree has access to a single, unified 105 Electronic Health Record. These decisions set off a 106 chain of events that created a need to rethink how 107 health IT products behave across all PEO DHMS 108 programs and at partner agencies. These events 109 ultimately resulted in Congress’ creation of the 110 Federal Electronic Health Record Modernization 111 Program Office (FERHM), chartered in DEC 2019. 112 The FEHRM tightly partners with and works side-by-113 side with PEO DHMS to implement health IT across 114 the Federal ecosystem. This focal point for Federal 115 health IT has already significantly increased the 116 complexity of the PEO DHMS mission and is likely to 117 drive further growth as additional health IT partners are brought into the fold, and additional technology needs are 118 identified. 119 PEO DHMS recognizes that these changes will drive considerable growth in requirements and complexity. 121 Moreover, PEO DHMS is cognizant that the organization is not currently constructed to handle even its current 122 product line efficiently let alone a significantly expanded one. In order to maintain its ability to meet this rapidly 123 growing mission, without requiring substantial additional resources which may not be available, substantial 124 transformation of its operations are required. As a result, PEO DHMS developed a comprehensive strategy to 125 transform into a world-class technology organization. 126 To begin, PEO DHMS engaged in identifying specific and measurable characteristics of a “world class technology 128 organization.” The resultant assessments supported the conclusion that PEO 2.0 was some way off the standard of a 129 mature, let alone a world-class, organization. 130 Perhaps more telling than the roll-up scores are some of the statements from current PEO and Program leadership in 132 the figure below (comments are non-attributional, sources are omitted for privacy reasons): 133

● “[There is] no coherent strategy; everyone has a different answer. We need to know what we want to be, 134 [need to] know where we want to go, and need to have someone who has a voice for the customer.” 135

● “One of key things is we’re all here for the mission - some of us hang on because we believe and are 136 passionate about the mission. But it needs to trickle down to how we do that on a day-to-day basis. You can 137 love the mission but not understand how to satisfy the mission.” 138

● “Some [people] are lazy, some want to be spoon fed, and sometimes people don’t have an understanding of 139 what’s going on. They have blinders on purpose [but] there are times that there’s clarity needed.” 140

● “We want to be more like [industry]. We want good people around; you know it when you see it.” 141

● “We’re not taking advantage of [our] vehicles to get the best and brightest out of Silicon Valley. There are 142 people out there; why can’t they support us?” 143

● “DHMS should have a culture of being inspired. Innovation is the result of being inspired; but right now, 144 we aren’t inspired.” 145 Overwhelmingly, the assessments drive a conclusion that the level of organizational transformation required is 147 substantial and that the PEO DHMS working environment is not currently able to recruit, retain, or leverage the 148 talent required to deliver high quality technology products. World-class technology organizations are incredibly 149 competitive in the talent market. Many best practices and techniques that make organizations attractive to the best 150 talent are traditionally unavailable in Government, especially in the DoD. In many cases, existing policies and 151 standards are significant barriers to performing as a world-class technology organization. This will substantially 152 complicate any effort to transform. 153 Moreover, persistent blockers across the enterprise result in downstream degradation of personnel morale. A recent 155 Defense Health Agency (DHA) staff survey indicated a Net Promoter Score (NPS) of (-20) in employee fulfillment 156 (Defense Health Agency, JAN 2021). This is substantially lower than industry-wide figures ranging from 27 on the 157 lowest end for Healthcare and 71 on the highest end for Education & Training (Retently, 2020). 158

1.3 Outcomes 160

When the transformation efforts are complete, the PEO will: 161

1. Manage a portfolio of product teams and products that prioritize the experience of those using the products 162

2. Have a culture that prioritizes continuous improvement, rapid decision-making, and streamlining business 163 priorities by maximally leveraging policy and regulatory flexibilities to adopt the very best practices in 164 each area of its business. 165

3. Be a center of excellence for dynamic, multifaceted technologies, platforms, applications, and cyber 166 security compliance. 167

4. Adopt effective communications with internal and external stakeholders. 168

5. Employ technology operations that reduce redundancies across the organization to achieve cost savings and 169 improve agility. 170

6. Drive collaboration between the federal government, industry, and academia to improve the nation’s health. 171

7. Expertly manage the portfolio to rapidly deliver capabilities across the organization. 172

8. Recruit high-performing, innovative personnel who are accountable to the organization’s mission by 173 making PEO DHMS an employer and business partner of choice. 174

9. Follow efficient and accountable processes that support corporate operations and audit readiness. 175

SECTION II 176

2.0 IDIQ CONTRACT SCOPE 178

2.1 Scope 180

PEO DHMS defines Workforce 3.0 as a self-driven, high-agency talent pool focused on actively enabling PEO 181 DHMS to achieve its strategic vision and the strategic vision of its subordinate organizations. These ambitions must 182 be achieved while continuously and incrementally transforming PEO DHMS into a high-achieving technology 183 organization that can deliver world-class technology. Workforce 3.0 will be a seamless, badge-less team working in 184 concert to achieve the goals necessary to deliver the PEO DHMS vision. The Workforce will include Government 185 employees and military personnel fulfilling inherently governmental functions, providing strategic direction, 186 performance management, and stakeholder engagement. However, Government personnel cannot deliver all 187 capabilities necessary to operate and transform a high-achieving technology company. This contract will form the 188 relationships with industry necessary to deliver those capabilities; subject matter expertise; and related studies, 189 assessments, plans, and models. 190 The Government considers a managed solution to cover the full breadth of digital workforce capabilities from 192 technical, administrative, and organizational, across its subordinate and full partner organizations (e.g., the Federal 193 Electronic Health Record Modernization (FERHM) office, the United States Coast Guard, DHA Health Informatics, 194 etc.). In this manner, a managed solution will enable one seamless workforce where an individual’s Agency or 195 employment status does not affect the individual’s experience at work and where this condition can easily scale and 196 accommodate fluctuations in demand rapidly. It is an actively managed “stack” of capabilities, where the burden 197 does not fall on the Government to execute tactical actions, perform all critical thinking, or specify labor 198 requirements. Additionally, the managed solution must be capable of rapid evolution as the needs of the workforce 199 or cutting-edge technology and capabilities evolve. The overarching outcome desired by PEO DHMS of this effort is 200 that the Workforce will have the same capabilities and talent of a leading-edge technology firm. PEO DHMS will 201 measure the results of contract performance against the extent to which this outcome is satisfied, considering the 202 strategic goals being pursued by its organizations. It is critically important to emphasize that for PEO DHMS to 203 attract/retain the caliber of workforce it requires; solutions should include the full “stack” of capabilities and 204 innovative teaming arrangements. Workforce solutions should ensure the “stack” contains the most cutting-edge 205 private-sector ideas and methodologies throughout. 206 Contract Types: Task Orders shall be Firm Fixed Price (FFP) 208

2.2 Lot Definitions 210

WF3 consists of two (2) Task Order lots covering differing aspects of the transformation. The SF-1449 specifies to 211 which Lot each awardee is assigned, and each prime awardee is assigned to only one of the two Lots. 212 Awardees cannot propose on Task Order Fair Opportunity competitions in a lot to which they are not assigned. A 214 prime contractor from Lot 1 may not perform as a subcontractor on Lot 2. 215

2.2.1 Lot 1 217

Lot 1 consists of Task Orders necessary to establish one, seamless team accountable for achieving the specified 218 transformation and growth metrics over a specified length of time to be continuously evaluated against the 219 overarching outcomes specified in Paragraph 1.3. This Lot includes the work necessary to ensure that all functions 220 necessary for operation of the “world class technology” organization are performed in accordance with the agreed 221 upon designs. Lot 1 awardees are accountable to the overall delivery of the new workforce paradigm. 222

2.2.2 Lot 2 224

Lot 2 awardees will perform the work necessary to solve finite, specific projects that cover the full spectrum of 225 complexity and difficulty, and may result in the delivery of events, reports, studies, processes, or operations. Rather 226 than focusing on the full breadth of transformation and operation over a specified duration, and on an annual basis 227 like Lot 1, Lot 2 orders will identify one or more specific problems to be solved over flexible durations, when they 228 are identified. Lot 2 orders may independently supplement the functions and transformation activities occurring in 229 Lot 1 from time-to-time. It is expected that more than one Lot 2 order will be active, solving their respective 230 problems, at any given time. 231

2.3 Responsibilities 233

2.3.1 Contracting Officer (CO) 235

The CO is responsible for the award, administration, and management of the IDIQ contract and any solicitations, 236 source selections, Task Orders and Task Order modifications utilizing the Workforce 3.0 IDIQ contract. 237

• Proactively partners with, maintains, and manages relationship with contractors, especially on higher-238 vis/prime mission efforts 239

• Provides advice and guidance to appointed Contracting Officer Representative (CORs), senior leaders, and 240 WF3 primary contract holders regarding all WF3 related matters 241

• Understands execution of WF3 operational and transformational activities and maintain readiness to satisfy 242 business needs 243

• Provides direction, oversees changes, and referees all WF3 related issues 244

• Product manager for contracting products (e.g., RFPs, Source Selections), including reporting 245 status/risk/schedule for contracting events 246

• Provides final decisions on contract matters in coordination with leadership 247

• Coordinates/approves public communications about contracting matters 248

• Appoints and terminates all CORs utilizing WF3 and provides contract specific training to all appointed 249

CORs 250

• Determines if/when Ad-Hoc Task Orders are necessary 251

2.3.2 Government Board of Directors 253

The Government BoD consists of executive leaders to include but not limited to the PEO Director and Director of 254 Contracting. 255

• The BoD will meet at the Government discretion no less than quarterly 256

• Ensures WF3 transformational activities remain in alignment with overall PEO 3.0 Strategy 257

• Approves proposed transformation designs 258

• Provides advice, guidance, and assistance to the Contracting Officer 259

• Helps with WF3 issue resolution when elevated, especially when an issue involves more than one product 260 team 261

• Oversees “Gamechanger” award plan and Incentive evaluation operations 262

2.3.3 Task Order Contracting Officer Representatives (CORs) 264

• Monitor and evaluate contractor performance using Quality Assurance Surveillance Plan (QASP) and 265 provide data supporting logical follow-on/Fair Opportunity determinations 266

• Monitor contractor adherence to PWS and manage deliverables submitted by contractor (i.e., CDRLs) 267

• Gather and provide periodic reporting of performance to Contracting Officer (as requested) 268

• Manage and ensure all aspects of compliance (e.g., Government Furnished Property, assets, training, key 269 personnel, etc.) 270

• Ensure COR reports are uploaded in JAM monthly 271

• Assist Contracting Officer with CPARs as needed 272

• Elevate issues to the Contracting Officer when issues cannot be resolved at lowest level 273

• Onboard and Off-board WF3 contractors (CACs, badges, etc.); if applicable 274

• Assist with Task Order closeout 275

2.3.4 Contractors (IDIQ level) 277

Shall provide point of contact information for the following: 278

• Contract Specific Issues/Awards/Modifications 279

• Task Order Proposal Request Inquiries 280

• Executive Leadership Engagement/Inquiries 281

• Ask Me Anything Sessions 282

• Adhere to the proposal procedures for WF3 283

• Update POC information with the Government 284

• Report any issues to COR and Contracting Officer (as required) 285

SECTION III 286

3.0 IDIQ-Wide Requirements 288

3.1 Place of performance 290

Virtual work is strongly encouraged; fixed Government facilities will not be available for day-to-day or 291 collaboration work, and fixed or dedicated contractor facilities for day-to-day work are not required, but the 292 contractor may provide physical collaboration space from time-to-time for shared contractor/Government use. 293

3.1.1 Travel 295

The Government strongly encourages virtual work, but when and if the Government and industry partners agree 296 travel will provide value, the Government may, at its discretion, authorize travel consistent with the substantive 297 provisions of the Joint Travel Regulation and the limitation of funds specified in this contract. All travel requires 298 Government approval/authorization and notification to the Contracting Officer Representative (COR). 299

3.2 Recognized Federal holidays 301

WF3 industry partners are not required to perform services on the following holidays: 302 New Year’s Day Labor Day 304 Martin Luther King Jr.’s Birthday Columbus Day 305 President’s Day Veteran’s Day 306 Memorial Day Thanksgiving Day 307 Independence Day Christmas Day 308

3.3 Hours of operation 310

Fixed work hours are not required. The contractor is responsible for assuring that workers are available to support 311 planned activities, respond to emergent urgent requirements, achieve agreed levels of service, and to reach agreed 312 outcomes and deadlines. 313

3.4 Contract Operations Staff 315

Lot 1 contractors shall provide a list of two points of contact that delineates responsibility by function and assure that 316 this staff is available during the Government’s normal working hours and within 1-hour after hours or on holidays. 317

3.5 Personal Conduct 319

Industry partners shall adhere to the same or better standards of conduct required of government employees per 320 direction of the DHA Commander. 321

3.6 Culture 323

Traditional workplace culture is often rooted in hierarchy and relies on authoritative communication styles and strict 324 policies (e.g., set working hours, formal dress code, inflexible work arrangements). The Government believes it is of 325 benefit to replace this model with a new, modern workplace culture. Modern workplace cultures engage employees 326 in open dialogue, inspire them to think creatively, trust them to manage their work schedules with autonomy and 327 empower them to collaborate to reach business decisions. Most importantly, as stated in Section II, "the overarching 328 outcome desired by PEO DHMS of this effort is that the Workforce will have the same capabilities and talent of a 329 leading-edge technology firm." In order to compete for this talent and effectively manage such capability, a modern 330 working culture is required. 331 Industry partners are expected to spearhead organizational and cultural change management efforts across the PEO 333 DHMS enterprise. To this end, the industry partner must not only execute strategic initiatives to achieve this 334 outcome but must also instill and practice the core tenets of modern workplace conduct within its own staff 335 members. Tactically, the Government anticipates the following attributes at a minimum: 336

• Managing employee well-being and actively mitigating burn-out potential and retention risk amongst staff 337 members, 338

• Embracing technology that enables flexible work arrangements to allow employees to get work done from 339 almost anywhere, 340

• Fostering a culture of professional development and personal growth, 341

• Encouraging open two-way communication without negative repercussions for honest feedback, 342

• Discouraging inconsistent treatment of employees based on being physically present versus being digitally 343 present, 344

• Upholding diversity, equity, and inclusiveness as a key strategic priority, 345

• Promoting a badge-less, seamless structure that does not discriminate staff based on their corporate 346 alignment, 347

• Fostering curiosity and the pursuit of innovation in both functional and technical endeavors, 348

The Government believes these attributes are necessary and justified for achieving a successful, enduring digital 350 transformation. Industry partners cannot merely enact such changes amongst Government personnel; these changes 351 must be reflected in the Industry partner’s own organization. When organizations have cultures grounded in holistic 352 wellness, employees perform better and are more resilient in challenging times. When employees can adequately 353 care for their needs, they can handle conflict at work with more clarity, resolve and positivity. 354

3.7 Standards of Practice 356

In lieu of traditional Quality Control (QC) and Quality Assurance, the Government and industry partners will agree 357 to: 1) a set of targeted strategic outcomes and associated objective measures of effectiveness, and; 2) method for 358 verifying and documenting level of achievement, specific to that Task Order. Achievement of minimum agreed 359 targets shall define satisfactory performance. Exceeding minimum targets shall serve as the basis for awarding 360 incentive and/or “gamechanger” compensation in accordance with the Addendum to FAR Clause 52.212-4. These 361 metrics will also be utilized to evaluate past performance and whether the efficiency and effectiveness logical 362 follow-on Fair Opportunity exemption may apply. 363

3.8 Common Access Card (CAC) 365

The CAC is standard identification for eligible DoD industry partners. As required, each WF3 worker shall provide 366 to the Government all information required per the DHA CAC request process, current version 2.1, January 2018, or 367 more recent when updated. See attached instructions. 368

3.9 Training 370

Industry partners shall complete all requirements, training, and forms per the DHA’s Onboarding Checklist for 371 Contractor Employees, current edition February 2018 or more recent when updated. See the form at 372 https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf. 373

3.10 Physical Security 375

Industry partners shall safeguard all Government equipment, information and property provided by Government for 376 their use. 377

3.11 Manpower Reporting 379

WF3 industry partners who receive Task Orders of $3M or more shall report “contractor manpower” (including 380 subcontractor manpower) via the Office of the Secretary of Defense (OSD) Personnel and Readiness (P&R) secure 381 data collection site at http://www.ecmra.mil/. As part of its submission, WF3 industry partners shall provide the 382 estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period shall be the period 383 of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported 384 by 31 October of each calendar year. Report via either Extensible Markup Language (XML) data transfer to the 385 database server, or fill in the fields on the website. Direct questions to the help desk at: http://www.ecmra.mil/. 386

3.12 Non-Disclosure Agreement (NDA) 388

WF3 industry partners who will obtain access to proprietary, classified, or confidential information or any 389 information release of which is protected or governed by law or regulation associated with DHA acquisitions shall 390 complete and sign an NDA prior to beginning work. WF3 partners shall execute an NDA on behalf of their 391 companies, and shall ensure that all staff assigned to, including all subcontractors and consultants execute an NDA 392 protecting the procurement sensitive information of the Government and the proprietary information of other 393 contractors. WF3 industry partners shall execute NDAs not later than first day of employment and renew them upon 394 exercising a contract option period. Assignment of staff who have not executed this statement, or failure to adhere to 395 https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf http://www.ecmra.mil/ http://www.ecmra.mil/ this statement, shall constitute default on the part of the industry partner. Industry partners shall maintain originally 396 signed NDAs of individual employees and provide copies to the COR. 397

3.13 Post award conference/periodic progress meetings 399

When directed by the Government, WF3 industry partners shall attend a post-award conference convened by the 400 contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 401

42.5. These meetings shall be at no additional cost to the Government. 402

3.14 Government furnished, property, equipment and services 404 The Government will not furnish property, equipment or services. 405

3.15 Contractor furnished supplies and services 407

The Contractor shall furnish all supplies, equipment, facilities and services required to execute any awarded Task 408 Order. 409

3.16 General Requirements Overview 411

Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws. This 412 Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of 413 Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in 414 applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the 415 Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The 416 Contractor shall also comply with requirements relating to records management as described herein. 417

3.16.1. DTIC 419

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any 420 authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change 421 procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall 422 first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that 423 matter. DoD issuances are available at http://www.dtic.mil/whs/directives. For purposes of this Section, the 424 following definitions apply. 425

3.16.1.1 427 DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, 428 DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy 429 Program, May 14, 2007. 430

3.16.1.2 432 HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. 433 Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 434 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E 435 (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 436

162) are not addressed in this Section and are not included in the term HIPAA Rules. 437

3.16.1.3 439 DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health 440 System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and 441 Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health 442 Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, 443 March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care 444 Programs, August. 12, 2015. 445

3.16.1.4 447 Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy 448 Office Chief is the HIPAA Privacy and Security Officer for DHA. 449 http://www.dtic.mil/whs/directives

3.17 Records Management. 451

When creating and maintaining official government records, the Contractor shall comply with all federal 452 requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter 453 XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction 454 No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records 455 Management requirements outlined in the current TRICARE Operations Manual (TOM). 456

3.18 Freedom of Information Act (FOIA) 458

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact 459 the DHA FOIA Officer for evaluation/action. 460

3.18.1 DHA FOIA 462

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via 463 the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at 464 DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 465 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired 466 record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by 467 the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA 468 procurement records. Although the administrative time limit to grant or deny a request (ten working days after 469 receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and 470 respond to DHA within ten working days. 471

3.18.2 Requests 473

In response to requests received by the Contractor for the release of information, unclassified information, 474 documents and forms which were previously provided to the public as part of routine services shall continue to be 475 made available in accordance with previously established criteria. All other requests from the public for release of 476 DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, 477 ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, 478 between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by 479 individuals for access to records about themselves in accordance with directions from the DHA Freedom of 480 Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not 481 make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in 482 accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the 483 Contractor shall follow paragraph 3.23, relating to individual rights of access to PHI. 484

3.19 Systems of Records 486

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall 487 identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA 488 where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. 489 Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor 490 shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and 491 publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency 492 Division, and as required by the DoD Privacy Act Issuances. 493

3.19.1 SORN 495

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable 496 system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in 497 coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions 498 set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, 499 Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating 500 systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of 501 changes in systems of records or their use that may require a change in the SORN. 502

3.20 Privacy Impact Assessment (PIA) 504

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor. 505

3.21 Data Sharing Agreement (DSA) 507

Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified 508 data. The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or 509 Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the 510 requirements of this Contract. 511

3.22 DSA/DUA 513

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use 514 and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the 515 Contractor shall comply with the DoD Privacy Act Issuances. 516

3.23 PHI 518

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain 519 approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for 520 additional documentation. 521

3.24 DSA Requests 523

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy 524 Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data 525 involved: 526

• DSA for De-Identified Data • DSA for PHI 528

• DSA for PII Without PHI 529

• DUA for Limited Data Set 530

3.25 DSA Expiration 532

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever 533 comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall 534 submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the 535 Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office. 536

3.26 Privacy Act and HIPAA Training 538

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this 539 Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use 540 disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training 541 appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a 542 Covered Entity, or Business Associate. The Contractor shall ensure all employees and subcontractors supply a 543 certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being 544 assigned and on an annual basis based on the trainee’s birth month thereafter. 545

3.27 HIPAA Business Associate Provisions 547

3.27.1 Business Associate – General Provisions 549

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under 550 the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the 551 Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor 552 shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as 553 the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-554 Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS. 555

3.28 Breach Response 557

Definitions Related to Breach response. 558

3.28.1 Breach 560

Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar 561 occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an 562 authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is 563 based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the 564 following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral 565

PII/PHI). 566

3.28.2 Possible Breach 568

A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) 569 and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially 570 know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, 571 because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility 572 can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned 573 unopened in its original packaging. However, if the intended recipient informs the contractor that an expected 574 package has not been received, then a possible breach exists until and unless the unopened package is returned to the 575 contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the 576 following factors: 577

• How the event was discovered; 579

• Did the information stay within the covered entity’s control; 580

• Was the information accessed/viewed; and 581

• Ability to ensure containment (e.g., recovered, destroyed, or deleted). 582

3.28.3 Confirmed Breach 584

A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a 585 laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor 586 should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the 587 lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the 588 PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files 589 containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the 590 contractor should re-classify the incident as a non-breach incident. 591

3.28.4 HHS Breach 593

A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. 594 The text of the HHS definition states: 595 Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this 597 part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI. 598

3.28.5 HHS Breach Exclusions 600

HHS breach excludes: 601

3.28.5.1 603 Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of 604 a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within 605 the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA 606 Privacy Rule. 607

3.28.5.2 609 Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business 610 associate to another person authorized to access PHI at the same DoD covered entity or business associate, or 611 organized health care arrangement in which the DoD covered entity participates, and the information received as a 612 result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule. 613

3.28.5.3 615 A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized 616 person to whom the disclosure was made would not reasonably have been able to retain such information. Except as 617 provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this 618 issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates 619 that there is a low probability that the PHI has been compromised based on a risk assessment of at least the 620 following factors: 621

• The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-623 identification; 624

• The unauthorized person who used the PHI or to whom the disclosure was made; 625

• Whether the PHI was acquired or viewed; and 626

• The extent to which the risk to the PHI has been mitigated. 627

3.28.6 Cybersecurity Breach 629

A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use 630 policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not 631 involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause 632 unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not 633 confidentiality), then a non-breach cybersecurity incident has occurred. 634

3.28.7 General 636

3.28.7.1 637

The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless 638 of whether the information is PHI or solely PII. 639

3.28.7.2 641 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the 642 Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a 643 possible breach. These procedures focus on the first two steps (breach identification and reporting) of a 644 comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation 645 (which includes individual notification), eradication, recovery, and follow-up. 646

3.28.7.3 648 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes 649 shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and 650 cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such 651 as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the 652 contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach 653

vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay 654 reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline. In conjunction 655 with its initial investigation, the contractor shall immediately take steps to minimize any impact from the 656 occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), 657 and initiate further breach response steps. 658

3.28.7.4 660 In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD 661 cybersecurity and NIST requirements, which include United States Computer Emergency Readiness Team (US-662 CERT) reporting (see paragraph 3.17.12.3) If at any point a contractor finds that a cybersecurity incident involves a 663 PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth 664 below. The contractor shall also continue to follow any required cybersecurity incident response procedures and 665 other applicable DoD cybersecurity requirements. 666

3.28.7.5 668 Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the 669 incident response requirements herein by reporting the incident to the contractor immediately after discovery. The 670 time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours) 671 under paragraph 3.31.2.4. If a cybersecurity incident is involved, the contractor’s deadline for US-CERT reporting 672 (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as 673 necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach 674 response requirements herein.