REVISED_v3_TDP_Detail_Data_Ordering_Instructions.docx

Ordering Instructions for Data Files Notice to Potential Offerors Regarding Detail Level TRICARE Dental Program Data

1. Detail level data includes some data that is considered Protected Health Information and must be safeguarded. For that reason, the data cannot be provided on the TRICARE website. Offerors may submit their requests prior to release of the RFP; however, the data will not be released until the RFP is posted to FEBBIZOPS. Detail level data (in CD-ROM format) will be sent via overnight mail (to U.S. addresses only) free of charge to parties who fulfill the requirements stated below.

2. Parties requesting this data to assist in the development of proposals are required to sign and return the following two attached documents:

a. Non-Disclosure Agreement.

b. HIPAA Business Associate Agreement, Privacy and Security of Protected Health Information.

3. Parties requesting detail level data shall print the Non-Disclosure Agreement and the HIPAA Business Associate Agreement, sign both agreements, and then email or mail the signed agreements, along with the name, address, email and telephone number of a point of contact for the company, to:

jack.r.diemer.civ@mail.mil

Defense Health Agency ATTN: COD – Mr. Jack Diemer 16401 East Centretech Parkway Aurora, CO 80011-9066

4. In the event that the detail level data is updated during the course of the acquisition, updated CD-ROMs will be automatically mailed to all parties who have previously received detail level data in accordance with these instructions. Offerors should contact the Contracting Officer at that time for instructions regarding the destruction or return of the data (see paragraph 4 of the Non-Disclosure Statement).

NON-DISCLOSURE AGREEMENT

The parties to this Non-Disclosure Agreement are the Defense Health Agency (DHA) and _______________________________________________(Name of Entity), an entity that is a potential offeror, a potential subcontractor to a potential offeror, or a partner of a potential offeror to the Department of Defense (DOD), TRICARE Dental Program (TDP) Solicitation HT9402-15-R-0001.

In order to protect certain confidential and protected information ("Confidential and Protected Information") which will be disclosed by reason of _____________________________________'s (Name of Entity) participation as a potential offeror in the above described solicitation, the undersigned ("Recipient"), acting for and in behalf of the entity named above, agrees as follows:

1. Definition of Confidential and Protected Information. The "Confidential and Protected Information" disclosed under this Agreement is described as:

All iterations of Detail Level Data for the TDP of the number of the claims paid from May 2012 to Dec 2014, and geographic and demographic data as of January 15, 2015 on eligibles and enrollees.

2. Use of Protected Confidential and Protected Information.

___________________________________ (Entity Name) shall use the Confidential and Protected Information only for the purposes of participating as a potential offeror in the above described solicitation only. The Confidential and Protected Information will not be used for any other purposes including commercial purposes or government purposes.

___________________________________ (Entity Name) shall maintain the confidentiality of any and all materials, information, or actions as they relate to issues involving the above described solicitation that may be discussed with TRICARE personnel and other TRICARE contractors.

3. Protection of Confidential and Protected Information.

_______________________________________________ (Entity Name) shall protect the Confidential and Protected Information by not divulging, publishing, or revealing by word, conduct, or any other means, any Confidential and Protected Information to any other person, except in accordance with direction from the DHA Contracting Officer responsible for the above described solicitation. _______________________________________ (Entity Name) agrees not to decode/unscramble any data received from the Government pursuant to its participation in the above described solicitation. ____________________________________________ (Entity Name) understands that it must use the same degree of care, but no less than a reasonable degree of care, to prevent the unauthorized use, dissemination or publication of the Confidential and Protected Information to any third party, or to any employee who does not have a need to know such information, except to the Government in response to and in support of ____________________________________'s (Entity Name) participation in the above described solicitation. _________________________________________ (Entity Name) agrees to be responsible for compliance with this agreement by each of its employees, subcontractors, venders, partners, etc. ______________________________________________ (Entity Name) agrees to promptly report any mishandling, loss or unauthorized disclosure of Confidential and Protected Information. _________________________________________ (Entity Name) also understands that an employee's failure to comply with the requirements to protect Confidential and Protected Information may result in penalties that may be imposed by __________________________________________ (Entity Name) as an employer for violation of employment rules and/or penalties that may be imposed for a violation of law.

4. Destruction and/or Return of Data. When the data is no longer necessary for purposes of participating in the above described solicitation, or at the direction of the DHA Contracting Officer, ________________________________________ (Entity Name) agrees to contact the DHA Contracting Officer for instruction regarding the destruction and/or return of the data.

5. Entire Agreement. This Agreement sets forth the entire agreement with respect to the Confidential and Protected Information disclosed herein and supersedes all prior or contemporaneous agreements concerning such Confidential and Protected Information, whether written or oral. All additions or modifications to this Agreement must be made in writing.

6. Governing Law. This Agreement is made under and shall be construed according to the laws of the United States.

Name of Business

Business Phone Number

Name of Representative of Business

REQUEST FOR PROPOSAL HT94002-15-R-0001

BUSINESS ASSOCIATE AGREEMENT

PRIVACY AND SECURITY OF PROTECTED HEALTH INFORMATION

Introduction

IAW DOD 6025.18R “Department of Defense Health Information Privacy Regulation” the Potential Offeror, Subcontractor to a Potential Offeror, or Partner of a Potential Offeror meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. The Business Associate agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this Agreement, and DOD 6025.18R, as amended.

(a) Definitions, as used in this section, generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DOD 6025.18R.

Individual has the same meaning as the term “individual'' in 45 CFR 164.501 and 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 164.501, limited to the information created or received by the Business Associate from or on behalf of The Government.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term “required by law'' in 45 CFR 164.501 and 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart C.

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR 160.103, 164.501 and 164.304.

(b) The Business Associate agrees to not use or further disclose Protected Health Information other than as permitted or required by the Agreement or as required by law.

(c) The Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement.

(d) The Business Associate agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Agreement.

(e) The Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of Protected Health Information in violation of the requirements of this Agreement.

(f) The Business Associate agrees to report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Business Associate agrees to report to the Government any use or disclosure of the Protected Health Information not provided for by this Agreement of which the Business Associate becomes aware.

(h) The Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Business Associate on behalf of the Government agrees to the same restrictions and conditions that apply through this Agreement to the Business Associate with respect to such information.

(i) The Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Business Associate agrees to provide access, at the request of the Government, and in the time and manner designated by the Government, to Protected Health Information in a Designated Record Set. This access shall be provided to the Government, or as directed by the Government, to an individual in order to meet the requirements under 45 CFR 164.524.

(k) At the request of the Government or an individual, the Business Associate agrees to make available any amendment(s) to Protected Health Information in a Designated Record Set, in the time and manner designated by the Government, pursuant to 45 CFR 164.526.

(l) The Business Associate agrees to make available to the Government, in a time and manner designated by the Government or the Secretary, internal practices, books, and records relating to the use and disclosure of Protected Health Information that were received from the Government, or created or received by the Business Associate on behalf of the Government, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

(m) The Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Business Associate agrees to provide to the Government or an individual, in time and manner designated by the Government, information collected in accordance with this Agreement, to permit the Government to respond to a request by an individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

General Use and Disclosure Provisions

(a) The Business Associate agrees to use any Protected Health Information contained in the data provided by the Government only for the purposes of participating as a potential offeror, or assisting or consulting with a potential offeror, in solicitation HT9402-15-R-0001. The Protected Health Information will not be used for any other purposes including commercial purposes or government purposes.

(b) The Business Associate shall disclose Protected Health Information to other persons/entities solely for the purpose of obtaining assistance in data analysis and data forecasting to help the Business Associate develop its proposal in response to solicitation HT9402-15-R-0001. The Business Associate shall obtain reasonable assurances from the entity to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and that the person/entity shall notify the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

Obligations of the Government

Provisions for the Government to Inform the Business Associate of Privacy Practices and Restrictions

(a) Upon request by the Business Associate, the Government will provide the Business Associate with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520, as well as any changes to such notice.

(b) The Government will provide the Business Associate with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Business Associate's permitted or required uses and disclosures.

(c) The Government will notify the Business Associate of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

Termination

(a) Termination. A breach by the Business Associate of this Agreement, may subject the Business Associate to termination of the Business Associate Agreement and will be reported to the cognizant contracting officer for consideration of other appropriate action.

(b) Effect of Termination.

(1) Upon the termination of this Agreement or the conclusion of the acquisition process for RFP HT9402-15-R-0001, whichever comes first, the Business Associate shall return or destroy all Protected Health Information received from the Government, or created or received by the Business Associate on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Business Associate. The Business Associate shall retain no copies of the Protected Health Information.

(2) If the Business Associate determines that returning or destroying the Protected Health Information is infeasible, the Business Associate shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Business Associate that return or destruction of Protected Health Information is infeasible, the Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Business Associate maintains such Protected Health Information.

Miscellaneous

(a) Regulatory References. A reference in this Agreement to a section in DOD 6025.18R, Privacy Rule or Security Rule means the section as in effect or as amended, and for which compliance is required.

(b) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the Government to comply with DOD 6025.18R, Privacy Rule or Security Rule.

Name of Business

Business Phone Number

Name of Representative of Business

HT9402-15-R-0001