Attachment 1_Scope and Ordering Guide HT0038-21-R-0001.pdf

HT003821R0001

Workforce 3.0 1

Attachment 1: Scope and Ordering Guide 2

Solicitation Number: HT003821R0001 5

Program Executive Office, Healthcare Management Systems (PEO DHMS) 6

SECTION I 7

1.0 DESCRIPTION OF RELATIONSHIP 9

1.1 Purpose. 11

The purpose of this IDIQ solicitation is to form contractual relationships necessary to deliver workforce components 12 of the “world-class technology firm” that is a core tenet of the PEO 3.0 Strategy. As such, the resulting IDIQ 13 contracts are referred to as “Workforce 3.0” and will be supported by the other PEO 3.0 efforts. 14

Workforce 3.0 is a managed solution that leverages innovative new processes, methods, and/or best-in-class 16 methodologies from the private sector to enable the entire PEO DHMS workforce to deliver world-class technology. 17

Contractor employees shall not perform inherently governmental functions as discussed in FAR Subpart 7.5, 19

“Inherently Governmental Functions” nor personal services as defined in as discussed in FAR 37.104. 20

1.2 Background 22

As a nation, our health is one of our most critical and important resources. Whether in the context of maintaining 23 economic output, the readiness of our military to defend our national security, or paying the debt we owe to those 24 who made sacrifices to do so, a healthy society is the engine for these activities. The Office of the National 25

Coordinator (ONC) recently published its 2020-2025 Federal Health IT Strategic Plan (the “Plan”), laying out the 26

Federal Government’s role in healthcare and how it uses Health Information Technology (Health IT) to fulfill that 27 role. In short, the Government regulates, purchases, and uses healthcare while also regulating, purchasing, 28 developing, and using Health IT. The Plan further lays out some of the biggest challenges facing the healthcare 29 industry and how the Government plans to use technology to address these and improve health outcomes. Among 30 these are cost growth, capacity in the system, and poor health outcomes especially in areas such as obesity, 31 substance abuse, and mental health. 32

PEO DHMS is a key Federal Health IT partner, and is chartered to deliver the single Electronic Health Record 34

(EHR) and other Health IT for the Departments of Defense (DoD), the Department of Veterans Affairs (VA), and 35 the United States Coast Guard (USCG). Sitting at the nexus of healthcare and defense, which together account for 36 approximately 40% of that national budget, PEO DHMS is in a unique position to substantially impact strategic 37 challenges facing the nation. National defense, like healthcare, faces challenges in resources, capacity, and 38 capability that can be addressed through innovative technology strategies. 39

In its official Purpose, Goals, and Strategies (PGS) document, PEO DHMS lays out its vision for maximizing its 41 impact on healthcare and defense. While many tend to equate PEO DHMS with EHR, PEO DHMS and its 42 subordinate/partner offices have a considerably broader and continually expanding mission. According to data 43 collected by ONC, EHR adoption across the country is approaching 100% (Office of the National Coordinator for 44

Health Information Technology, OCT 2020). The Federal Health IT Strategic Plan looks well beyond core EHR 45 capabilities while PEO DHMS missions are pivoting to provide comprehensive health management, advanced data 46 applications, improved usability, reduced provider/patient burden, and other priorities. PEO DHMS recognizes 47 technology will enable these missions to achieve success. 48

PEO DHMS delivers on these missions with a strong workforce comprised of federal civilians from multiple 50

Agencies, military personnel from each Service, support contractors, and Prime mission product contractors. This 51 workforce is organized into major program offices, project teams, coordinating offices, and a back office/corporate 52 team. 53

PEO DHMS’ workforce strives to deliver world-class technologies in the health information field. In order to 55 succeed at one of the Department of Defense’s most important missions, PEO DHMS must, to the greatest extent 56 possible, ensure its technologies and conduct are indistinguishable from those of leading private-sector technology 57 firms. This includes: 58

● Frictionless and seamless solutions and products that create the best possible user experience 59

● Quality products to drive demand from Government and non-Government users 60

● Increased competition and ignited innovation from other Health IT developers in the private sector 61

● Attracting the best people in these fields to join and stay in the PEO DHMS workforce 62

To achieve these lofty and worthy goals, PEO DHMS must undergo a fundamental shift in how it does business. 64

In its continual evolution to achieve these objectives, PEO DHMS has transitioned across three distinct operational 65 paradigms: 66

● (2013 - 2014) The first and previous phase, PEO 1.0, was launched via the 2013 Secretary of Defense 67

(SECDEF) charter to establish an Electronic Health Record (EHR) for use by the Department of Defense 68

(DoD) DoD and the Department of Veterans Affairs (VA). This phase represents the “crawl” of the PEO 69

DHMS organization as operational processes were identified and initially established. 70

● (2014 - Present) The second and current phase, PEO 2.0, is anchored by the successful procurement and 71 ongoing deployment of the MHS GENESIS EHR. This phase represents the “walk” of the PEO DHMS 72 organization as operational processes entered sustainment and flagship products were launched into the 73 market to achieve initial customer value. 74

● (Present - 2026) This third and next phase, PEO 3.0, is characterized by achieving a digitally transformed 75 organization with ambitious year-over-year growth in product portfolio value and customer outcomes. This 76 phase represents the “run” of the PEO DHMS organization as focus shifts from internal organizational 77 deployment to fostering external product development across the portfolio. 78

● PEO DHMS seeks to launch the PEO 3.0 phase in FY21 with a four-pronged strategic effort that mirrors 79 the operational strategies of leading commercial counterparts: Workforce 3.0 (“WF3”) to perform business 80 support services, Workplace 3.0 (“WP3”) to provide business infrastructure, DevMAC to provide software 81 development support services, and Federal XaaS (“XaaS”) to provide software development infrastructure. 82

For communications purposes, this strategy has been distributed through a graphical metaphor outlining 83 parallels to the construction industry. 84

Inherently, the more time passes, the more a given set 86 of circumstances change. Since PEO 2.0 began, there 87 has already been substantial change throughout the 88

PEO portfolio of programs, and more change is 89 certain in the coming years, most likely at an 90 accelerated pace. 91

Notably, on 01 JUL 2017, the Secretary of Veterans 93

Affairs (VA) issued a Determination and Findings 94

(D&F) pursuant to 41 U.S.C. § 3304(a)(7) that it was 95 in the public interest for VA to issue a solicitation 96 directly to Cerner for the acquisition of the EHR 97 system being deployed by the DoD, in order to enable 98 seamless healthcare to Veterans and qualified 99 beneficiaries. Moreover, on 22 MAR 2018, the 100

Deputy Commandant for Mission Support, United 101

States Coast Guard (USCG), formally requested to 102 partner with PEO DHMS to implement MHS 103

GENESIS for the USCG to ensure that every military 104 beneficiary and retiree has access to a single, unified 105

Electronic Health Record. These decisions set off a 106 chain of events that created a need to rethink how 107 health IT products behave across all PEO DHMS 108 programs and at partner agencies. These events 109 ultimately resulted in Congress’ creation of the 110

Federal Electronic Health Record Modernization 111

Program Office (FERHM), chartered in DEC 2019. 112

The FEHRM tightly partners with and works side-by-113 side with PEO DHMS to implement health IT across 114 the Federal ecosystem. This focal point for Federal 115 health IT has already significantly increased the 116 complexity of the PEO DHMS mission and is likely to 117 drive further growth as additional health IT partners are brought into the fold, and additional technology needs are 118 identified. 119

PEO DHMS recognizes that these changes will drive considerable growth in requirements and complexity. 121

Moreover, PEO DHMS is cognizant that the organization is not currently constructed to handle even its current 122 product line efficiently let alone a significantly expanded one. In order to maintain its ability to meet this rapidly 123 growing mission, without requiring substantial additional resources which may not be available, substantial 124 transformation of its operations are required. As a result, PEO DHMS developed a comprehensive strategy to 125 transform into a world-class technology organization. 126

To begin, PEO DHMS engaged in identifying specific and measurable characteristics of a “world class technology 128 organization.” The resultant assessments supported the conclusion that PEO 2.0 was some way off the standard of a 129 mature, let alone a world-class, organization. 130

Perhaps more telling than the roll-up scores are some of the statements from current PEO and Program leadership in 132 the figure below (comments are non-attributional, sources are omitted for privacy reasons): 133

● “[There is] no coherent strategy; everyone has a different answer. We need to know what we want to be, 134

[need to] know where we want to go, and need to have someone who has a voice for the customer.” 135

● “One of key things is we’re all here for the mission - some of us hang on because we believe and are 136 passionate about the mission. But it needs to trickle down to how we do that on a day-to-day basis. You can 137 love the mission but not understand how to satisfy the mission.” 138

● “Some [people] are lazy, some want to be spoon fed, and sometimes people don’t have an understanding of 139 what’s going on. They have blinders on purpose [but] there are times that there’s clarity needed.” 140

● “We want to be more like [industry]. We want good people around; you know it when you see it.” 141

● “We’re not taking advantage of [our] vehicles to get the best and brightest out of Silicon Valley. There are 142 people out there; why can’t they support us?” 143

● “DHMS should have a culture of being inspired. Innovation is the result of being inspired; but right now, 144 we aren’t inspired.” 145

Overwhelmingly, the assessments drive a conclusion that the level of organizational transformation required is 147 substantial and that the PEO DHMS working environment is not currently able to recruit, retain, or leverage the 148 talent required to deliver high quality technology products. World-class technology organizations are incredibly 149 competitive in the talent market. Many best practices and techniques that make organizations attractive to the best 150 talent are traditionally unavailable in Government, especially in the DoD. In many cases, existing policies and 151 standards are significant barriers to performing as a world-class technology organization. This will substantially 152 complicate any effort to transform. 153

Moreover, persistent blockers across the enterprise result in downstream degradation of personnel morale. A recent 155

Defense Health Agency (DHA) staff survey indicated a Net Promoter Score (NPS) of (-20) in employee fulfillment 156

(Defense Health Agency, JAN 2021). This is substantially lower than industry-wide figures ranging from 27 on the 157 lowest end for Healthcare and 71 on the highest end for Education & Training (Retently, 2020). 158

1.3 Outcomes 160

When the transformation efforts are complete, the PEO will: 161

1. Manage a portfolio of product teams and products that prioritize the experience of those using the products 162

2. Have a culture that prioritizes continuous improvement, rapid decision-making, and streamlining business 163 priorities by maximally leveraging policy and regulatory flexibilities to adopt the very best practices in 164 each area of its business. 165

3. Be a center of excellence for dynamic, multifaceted technologies, platforms, applications, and cyber 166 security compliance. 167

4. Adopt effective communications with internal and external stakeholders. 168

5. Employ technology operations that reduce redundancies across the organization to achieve cost savings and 169 improve agility. 170

6. Drive collaboration between the federal government, industry, and academia to improve the nation’s health. 171

7. Expertly manage the portfolio to rapidly deliver capabilities across the organization. 172

8. Recruit high-performing, innovative personnel who are accountable to the organization’s mission by 173 making PEO DHMS an employer and business partner of choice. 174

9. Follow efficient and accountable processes that support corporate operations and audit readiness. 175

SECTION II 176

2.0 IDIQ CONTRACT SCOPE 178

2.1 Scope 180

PEO DHMS defines Workforce 3.0 as a self-driven, high-agency talent pool focused on actively enabling PEO 181

DHMS to achieve its strategic vision and the strategic vision of its subordinate organizations. These ambitions must 182 be achieved while continuously and incrementally transforming PEO DHMS into a high-achieving technology 183 organization that can deliver world-class technology. Workforce 3.0 will be a seamless, badge-less team working in 184 concert to achieve the goals necessary to deliver the PEO DHMS vision. The Workforce will include Government 185 employees and military personnel fulfilling inherently governmental functions, providing strategic direction, 186 performance management, and stakeholder engagement. However, Government personnel cannot deliver all 187 capabilities necessary to operate and transform a high-achieving technology company. This contract will form the 188 relationships with industry necessary to deliver those capabilities; subject matter expertise; and related studies, 189 assessments, plans, and models. 190

The Government considers a managed solution to cover the full breadth of digital workforce capabilities from 192 technical, administrative, and organizational, across its subordinate and full partner organizations (e.g., the Federal 193

Electronic Health Record Modernization (FERHM) office, the United States Coast Guard, DHA Health Informatics, 194 etc.). In this manner, a managed solution will enable one seamless workforce where an individual’s Agency or 195 employment status does not affect the individual’s experience at work and where this condition can easily scale and 196 accommodate fluctuations in demand rapidly. It is an actively managed “stack” of capabilities, where the burden 197 does not fall on the Government to execute tactical actions, perform all critical thinking, or specify labor 198 requirements. Additionally, the managed solution must be capable of rapid evolution as the needs of the workforce 199 or cutting-edge technology and capabilities evolve. The overarching outcome desired by PEO DHMS of this effort is 200 that the Workforce will have the same capabilities and talent of a leading-edge technology firm. PEO DHMS will 201 measure the results of contract performance against the extent to which this outcome is satisfied, considering the 202 strategic goals being pursued by its organizations. It is critically important to emphasize that for PEO DHMS to 203 attract/retain the caliber of workforce it requires; solutions should include the full “stack” of capabilities and 204 innovative teaming arrangements. Workforce solutions should ensure the “stack” contains the most cutting-edge 205 private-sector ideas and methodologies throughout. 206 Contract Types: Task Orders shall be Firm Fixed Price (FFP) 208

2.2 Lot Definitions 210

WF3 consists of two (2) Task Order lots covering differing aspects of the transformation. The SF-1449 specifies to 211 which Lot each awardee is assigned, and each prime awardee is assigned to only one of the two Lots. 212

Awardees cannot propose on Task Order Fair Opportunity competitions in a lot to which they are not assigned. A 214 prime contractor from Lot 1 may not perform as a subcontractor on Lot 2. 215

2.2.1 Lot 1 217

Lot 1 consists of Task Orders necessary to establish one, seamless team accountable for achieving the specified 218 transformation and growth metrics over a specified length of time to be continuously evaluated against the 219 overarching outcomes specified in Paragraph 1.3. This Lot includes the work necessary to ensure that all functions 220 necessary for operation of the “world class technology” organization are performed in accordance with the agreed 221 upon designs. Lot 1 awardees are accountable to the overall delivery of the new workforce paradigm. 222

2.2.2 Lot 2 224

Lot 2 awardees will perform the work necessary to solve finite, specific projects that cover the full spectrum of 225 complexity and difficulty, and may result in the delivery of events, reports, studies, processes, or operations. Rather 226 than focusing on the full breadth of transformation and operation over a specified duration, and on an annual basis 227 like Lot 1, Lot 2 orders will identify one or more specific problems to be solved over flexible durations, when they 228 are identified. Lot 2 orders may independently supplement the functions and transformation activities occurring in 229

Lot 1 from time-to-time. It is expected that more than one Lot 2 order will be active, solving their respective 230 problems, at any given time. 231

2.3 Responsibilities 233

2.3.1 Contracting Officer (CO) 235

The CO is responsible for the award, administration, and management of the IDIQ contract and any solicitations, 236 source selections, Task Orders and Task Order modifications utilizing the Workforce 3.0 IDIQ contract. 237

Proactively partners with, maintains, and manages relationship with contractors, especially on higher-238 vis/prime mission efforts 239

Provides advice and guidance to appointed Contracting Officer Representative (CORs), senior leaders, and 240

WF3 primary contract holders regarding all WF3 related matters 241

Understands execution of WF3 operational and transformational activities and maintain readiness to satisfy 242 business needs 243

Provides direction, oversees changes, and referees all WF3 related issues 244

Product manager for contracting products (e.g., RFPs, Source Selections), including reporting 245 status/risk/schedule for contracting events 246

Provides final decisions on contract matters in coordination with leadership 247

Coordinates/approves public communications about contracting matters 248

Appoints and terminates all CORs utilizing WF3 and provides contract specific training to all appointed 249

CORs 250

Determines if/when Ad-Hoc Task Orders are necessary 251

2.3.2 Government Board of Directors 253

The Government BoD consists of executive leaders to include but not limited to the PEO Director and Director of 254

Contracting. 255

The BoD will meet at the Government discretion no less than quarterly 256

Ensures WF3 transformational activities remain in alignment with overall PEO 3.0 Strategy 257

Approves proposed transformation designs 258

Provides advice, guidance, and assistance to the Contracting Officer 259

Helps with WF3 issue resolution when elevated, especially when an issue involves more than one product 260 team 261

Oversees “Gamechanger” award plan and Incentive evaluation operations 262

2.3.3 Task Order Contracting Officer Representatives (CORs) 264

Monitor and evaluate contractor performance using Quality Assurance Surveillance Plan (QASP) and 265 provide data supporting logical follow-on/Fair Opportunity determinations 266

Monitor contractor adherence to PWS and manage deliverables submitted by contractor (i.e., CDRLs) 267

Gather and provide periodic reporting of performance to Contracting Officer (as requested) 268

Manage and ensure all aspects of compliance (e.g., Government Furnished Property, assets, training, key 269 personnel, etc.) 270

Ensure COR reports are uploaded in JAM monthly 271

Assist Contracting Officer with CPARs as needed 272

Elevate issues to the Contracting Officer when issues cannot be resolved at lowest level 273

Onboard and Off-board WF3 contractors (CACs, badges, etc.); if applicable 274

Assist with Task Order closeout 275

2.3.4 Contractors (IDIQ level) 277

Shall provide point of contact information for the following: 278

Contract Specific Issues/Awards/Modifications 279

Task Order Proposal Request Inquiries 280

Executive Leadership Engagement/Inquiries 281

Ask Me Anything Sessions 282

Adhere to the proposal procedures for WF3 283

Update POC information with the Government 284

Report any issues to COR and Contracting Officer (as required) 285

SECTION III 286

3.0 IDIQ-Wide Requirements 288

3.1 Place of performance 290

Virtual work is strongly encouraged; fixed Government facilities will not be available for day-to-day or 291 collaboration work, and fixed or dedicated contractor facilities for day-to-day work are not required, but the 292 contractor may provide physical collaboration space from time-to-time for shared contractor/Government use. 293

3.1.1 Travel 295

The Government strongly encourages virtual work, but when and if the Government and industry partners agree 296 travel will provide value, the Government may, at its discretion, authorize travel consistent with the substantive 297 provisions of the Joint Travel Regulation and the limitation of funds specified in this contract. All travel requires 298

Government approval/authorization and notification to the Contracting Officer Representative (COR). 299

3.2 Recognized Federal holidays 301

WF3 industry partners are not required to perform services on the following holidays: 302

New Year’s Day Labor Day 304

Martin Luther King Jr.’s Birthday Columbus Day 305

President’s Day Veteran’s Day 306

Memorial Day Thanksgiving Day 307

Independence Day Christmas Day 308

3.3 Hours of operation 310

Fixed work hours are not required. The contractor is responsible for assuring that workers are available to support 311 planned activities, respond to emergent urgent requirements, achieve agreed levels of service, and to reach agreed 312 outcomes and deadlines. 313

3.4 Key Personnel 315

Lot 1contractors shall provide a list of two points of contact that delineates responsibility by function and assure that 316 these key personnel are available during the Government’s normal working hours and within 1-hour after hours or on 317 holidays. 318

3.5 Personal Conduct 320

Industry partners shall adhere to the same or better standards of conduct required of government employees per 321 direction of the DHA Commander. 322

3.6 Culture 324

Traditional workplace culture is often rooted in hierarchy and relies on authoritative communication styles and strict 325 policies (e.g., set working hours, formal dress code, inflexible work arrangements). The Government believes it is of 326 benefit to replace this model with a new, modern workplace culture. Modern workplace cultures engage employees 327 in open dialogue, inspire them to think creatively, trust them to manage their work schedules with autonomy and 328 empower them to collaborate to reach business decisions. Most importantly, as stated in Section II, "the overarching 329 outcome desired by PEO DHMS of this effort is that the Workforce will have the same capabilities and talent of a 330 leading-edge technology firm." In order to compete for this talent and effectively manage such capability, a modern 331 working culture is required. 332

Industry partners are expected to spearhead organizational and cultural change management efforts across the PEO 334

DHMS enterprise. To this end, the industry partner must not only execute strategic initiatives to achieve this 335 outcome but must also instill and practice the core tenets of modern workplace conduct within its own staff 336 members. Tactically, the Government anticipates the following attributes at a minimum: 337

Managing employee well-being and actively mitigating burn-out potential and retention risk amongst staff 338 members, 339

Embracing technology that enables flexible work arrangements to allow employees to get work done from 340 almost anywhere, 341

Fostering a culture of professional development and personal growth, 342

Encouraging open two-way communication without negative repercussions for honest feedback, 343

Discouraging inconsistent treatment of employees based on being physically present versus being digitally 344 present, 345

Upholding diversity, equity, and inclusiveness as a key strategic priority, 346

Promoting a badge-less, seamless structure that does not discriminate staff based on their corporate 347 alignment, 348

Fostering curiosity and the pursuit of innovation in both functional and technical endeavors, 349

The Government believes these attributes are necessary and justified for achieving a successful, enduring digital 351 transformation. Industry partners cannot merely enact such changes amongst Government personnel; these changes 352 must be reflected in the Industry partner’s own organization. When organizations have cultures grounded in holistic 353 wellness, employees perform better and are more resilient in challenging times. When employees can adequately 354 care for their needs, they can handle conflict at work with more clarity, resolve and positivity. 355

3.7 Standards of Practice 357

In lieu of traditional Quality Control (QC) and Quality Assurance, the Government and industry partners will agree 358 to: 1) a set of targeted strategic outcomes and associated objective measures of effectiveness, and; 2) method for 359 verifying and documenting level of achievement, specific to that Task Order. Achievement of minimum agreed 360 targets shall define satisfactory performance. Exceeding minimum targets shall serve as the basis for awarding 361 incentive and/or “gamechanger” compensation in accordance with the Addendum to FAR Clause 52.212-4. These 362 metrics will also be utilized to evaluate past performance and whether the efficiency and effectiveness logical 363 follow-on Fair Opportunity exemption may apply. 364

3.8 Common Access Card (CAC) 366

The CAC is standard identification for eligible DoD industry partners. As required, each WF3 worker shall provide 367 to the Government all information required per the DHA CAC request process, current version 2.1, January 2018, or 368 more recent when updated. See attached instructions. 369

3.9 Training 371

Industry partners shall complete all requirements, training, and forms per the DHA’s Onboarding Checklist for 372

Contractor Employees, current edition February 2018 or more recent when updated. See the form at 373 https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf. 374

3.10 Physical Security 376

Industry partners shall safeguard all Government equipment, information and property provided by Government for 377 their use. 378

3.11 Manpower Reporting 380

WF3 industry partners who receive Task Orders of $3M or more shall report “contractor manpower” (including 381 subcontractor manpower) via the Office of the Secretary of Defense (OSD) Personnel and Readiness (P&R) secure 382 data collection site at http://www.ecmra.mil/. As part of its submission, WF3 industry partners shall provide the 383 estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period shall be the period 384 of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported 385 by 31 October of each calendar year. Report via either Extensible Markup Language (XML) data transfer to the 386 database server, or fill in the fields on the website. Direct questions to the help desk at: http://www.ecmra.mil/. 387

3.12 Non-Disclosure Agreement (NDA) 389

WF3 industry partners who will obtain access to proprietary, classified, or confidential information or any 390 information release of which is protected or governed by law or regulation associated with DHA acquisitions shall 391 complete and sign an NDA prior to beginning work. WF3 partners shall execute an NDA on behalf of their 392 companies, and shall ensure that all staff assigned to, including all subcontractors and consultants execute an NDA 393 protecting the procurement sensitive information of the Government and the proprietary information of other 394 contractors. WF3 industry partners shall execute NDAs not later than first day of employment and renew them upon 395 https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf http://www.ecmra.mil/ http://www.ecmra.mil/ exercising a contract option period. Assignment of staff who have not executed this statement, or failure to adhere to 396 this statement, shall constitute default on the part of the industry partner. Industry partners shall maintain originally 397 signed NDAs of individual employees and provide copies to the COR. 398

3.13 Post award conference/periodic progress meetings 400

When directed by the Government, WF3 industry partners shall attend a post-award conference convened by the 401 contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 402

42.5. These meetings shall be at no additional cost to the Government. 403

3.14 Government furnished, property, equipment and services 405 The Government will not furnish property, equipment or services. 406

3.15 Contractor furnished supplies and services 408

The Contractor shall furnish all supplies, equipment, facilities and services required to execute any awarded Task 409

Order. 410

3.16 General Requirements Overview 412

Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws. This 413

Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of 414

Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in 415 applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the 416

Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The 417

Contractor shall also comply with requirements relating to records management as described herein. 418

3.16.1. DTIC 420

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any 421 authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change 422 procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall 423 first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that 424 matter. DoD issuances are available at http://www.dtic.mil/whs/directives. For purposes of this Section, the 425 following definitions apply. 426

3.16.1.1 428

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, 429

DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy 430

Program, May 14, 2007. 431

3.16.1.2 433

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. 434

Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 435 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E 436

(Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 437

162) are not addressed in this Section and are not included in the term HIPAA Rules. 438

3.16.1.3 440

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health 441

System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and 442

Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health 443

Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, 444

March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care 445

Programs, August. 12, 2015. 446

3.16.1.4 448

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy 449

Office Chief is the HIPAA Privacy and Security Officer for DHA. 450 http://www.dtic.mil/whs/directives

3.17 Records Management. 452

When creating and maintaining official government records, the Contractor shall comply with all federal 453 requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter 454

XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction 455

No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records 456

Management requirements outlined in the current TRICARE Operations Manual (TOM). 457

3.18 Freedom of Information Act (FOIA) 459

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact 460 the DHA FOIA Officer for evaluation/action. 461

3.18.1 DHA FOIA 463

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via 464 the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at 465

DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 466

Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired 467 record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by 468 the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA 469 procurement records. Although the administrative time limit to grant or deny a request (ten working days after 470 receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and 471 respond to DHA within ten working days. 472

3.18.2 Requests 474

In response to requests received by the Contractor for the release of information, unclassified information, 475 documents and forms which were previously provided to the public as part of routine services shall continue to be 476 made available in accordance with previously established criteria. All other requests from the public for release of 477

DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, 478

ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, 479 between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by 480 individuals for access to records about themselves in accordance with directions from the DHA Freedom of 481

Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not 482 make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in 483 accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the 484

Contractor shall follow paragraph 3.23, relating to individual rights of access to PHI. 485

3.19 Systems of Records 487

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall 488 identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA 489 where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. 490

Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor 491 shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and 492 publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency 493

Division, and as required by the DoD Privacy Act Issuances. 494

3.19.1 SORN 496

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable 497 system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in 498 coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions 499 set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, 500

Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating 501 systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of 502 changes in systems of records or their use that may require a change in the SORN. 503

3.20 Privacy Impact Assessment (PIA) 505

If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor. 506

3.21 Data Sharing Agreement (DSA) 508

Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified 509 data. The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or 510

Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the 511 requirements of this Contract. 512

3.22 DSA/DUA 514

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use 515 and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the 516

Contractor shall comply with the DoD Privacy Act Issuances. 517

3.23 PHI 519

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain 520 approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for 521 additional documentation. 522

3.24 DSA Requests 524

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy 525

Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data 526 involved: 527

• DSA for De-Identified Data • DSA for PHI 529

• DSA for PII Without PHI 530

• DUA for Limited Data Set 531

3.25 DSA Expiration 533

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever 534 comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall 535 submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the 536

Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office. 537

3.26 Privacy Act and HIPAA Training 539

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this 540

Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use 541 disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training 542 appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a 543

Covered Entity, or Business Associate. The Contractor shall ensure all employees and subcontractors supply a 544 certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being 545 assigned and on an annual basis based on the trainee’s birth month thereafter. 546

3.27 HIPAA Business Associate Provisions 548

3.27.1 Business Associate – General Provisions 550

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under 551 the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the 552

Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor 553 shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as 554 the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-555

Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS. 556

3.28 Breach Response 558

Definitions Related to Breach response. 559

3.28.1 Breach 561

Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar 562 occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an 563 authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is 564 based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the 565 following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral 566

PII/PHI). 567

3.28.2 Possible Breach 569

A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) 570 and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially 571 know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, 572 because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility 573 can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned 574 unopened in its original packaging. However, if the intended recipient informs the contractor that an expected 575 package has not been received, then a possible breach exists until and unless the unopened package is returned to the 576 contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the 577 following factors: 578

• How the event was discovered; 580

• Did the information stay within the covered entity’s control; 581

• Was the information accessed/viewed; and 582

• Ability to ensure containment (e.g., recovered, destroyed, or deleted). 583

3.28.3 Confirmed Breach 585

A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a 586 laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor 587 should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the 588 lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the 589

PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files 590 containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the 591 contractor should re-classify the incident as a non-breach incident. 592

3.28.4 HHS Breach 594

A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. 595

The text of the HHS definition states: 596

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this 598 part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI. 599

3.28.5 HHS Breach Exclusions 601

HHS breach excludes: 602

3.28.5.1 604

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of 605 a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within 606 the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA 607

Privacy Rule. 608

3.28.5.2 610

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business 611 associate to another person authorized to access PHI at the same DoD covered entity or business associate, or 612 organized health care arrangement in which the DoD covered entity participates, and the information received as a 613 result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule. 614

3.28.5.3 616

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized 617 person to whom the disclosure was made would not reasonably have been able to retain such information. Except as 618 provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this 619 issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates 620 that there is a low probability that the PHI has been compromised based on a risk assessment of at least the 621 following factors: 622

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-624 identification; 625

The unauthorized person who used the PHI or to whom the disclosure was made; 626

Whether the PHI was acquired or viewed; and 627

The extent to which the risk to the PHI has been mitigated. 628

3.28.6 Cybersecurity Breach 630

A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use 631 policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not 632 involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause 633 unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not 634 confidentiality), then a non-breach cybersecurity incident has occurred. 635

3.28.7 General 637

3.28.7.1 638

The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless 639 of whether the information is PHI or solely PII. 640

3.28.7.2 642

Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the 643

Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a 644 possible breach. These procedures focus on the first two steps (breach identification and reporting) of a 645 comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation 646

(which includes individual notification), eradication, recovery, and follow-up. 647

3.28.7.3 649

The contractor shall establish internal processes for carrying out the procedures set forth below. These processes 650 shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and 651 cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such 652 as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the 653 contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach 654

vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay 655 reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline. In conjunction 656 with its initial investigation, the contractor shall immediately take steps to minimize any impact from the 657 occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), 658 and initiate further breach response steps. 659

3.28.7.4 661

In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD 662 cybersecurity and NIST requirements, which include United States Computer Emergency Readiness Team (US-663

CERT) reporting (see paragraph 3.17.12.3) If at any point a contractor finds that a cybersecurity incident involves a 664

PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth 665 below. The contractor shall also continue to follow any required cybersecurity incident response procedures and 666 other applicable DoD cybersecurity requirements. 667

3.28.7.5 669

Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the 670 incident response requirements herein by reporting the incident to the contractor immediately after discovery. The 671 time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours) 672 under paragraph 3.31.2.4. If a cybersecurity incident is involved, the contractor’s deadline for US-CERT reporting 673

(1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as 674 necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach 675 response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall 676 report directly to US-CERT and the DHA Privacy Office, and that the subcontractor shall be responsible for 677 completing the response process, provided that such agreement requires the subcontractor to inform the contractor of 678 the incident and the subsequent response actions. 679

3.28.7.6 681

Contractors shall maintain records…