ts15_160106.pdf

TRICARE Systems Manual 7950.3-M, April 1, 2015

SUMMARY OF CHANGES

This change includes multiple clerical edits in addition to the changes specified below.

CHAPTER 1

1. Section 1.1.

a. Paragraph 3.4.2. 1) “In accordance with Defense Federal Acquisition Regulation Supplement (DFARS 252.204-7012” was removed following each of the NIST Special Publications; 2) NIST SP 800-7 was removed and replaced with NIST SP 800-30, “Guide for Conducting Risk Assessments;” 3) NIST SP 800-171, “Protecting Controlled Unclassified Information in Non-Federal Information Systems and Organizations,” was added.

b. Paragraph 3.4.3. Compliance with Federal Programs Obsolete information was removed and replaced with NIST SP 800-171, “Protecting Controlled Unclassified Information in Non-Federal Information Systems and Organizations.”

c. Paragraph 3.4.4.1. Clarification was added to state, “The contractor shall self-certify all IS that access, process, reproduce, modify, perform, store, display, release, disclose, or disseminate CUI.”

d. Paragraph 3.4.4.2. A reference to the NIST SP 800-53 was replaced by a reference to

NIST SP 800-171.

e. Paragraph 3.4.7. References were updated to DoDI 8500.1 and NIST SP 800-171.

CHAPTER 2

2. Section 1.1.

a. Deleted paragraph 3.2 as is outdated for T-17 contracts.

b. Clarified language in paragraphs 6.1-6.2.6.2 and updated contract language to refer to T17 instead of T3 contracts.

c. Deleted outdated reference to Section G.

d. Changed language referencing ‘life of the contract’ to ‘until the CLIN is closed for TED data processing’.

e. Updated references to the three T3 regions.

f. Corrected reference for Position 7 of the CLIN type indicator.

g. Changed language regarding two financially underwritten CLINs to reflect the change to one financially underwritten CLIN.

h. Added clarifying language regarding institutional claims.

1 January 6, 2016

CHAPTER 2 (Continued)

3. Section 2.4. Deleted old contract language regarding HCSRs and old contract numbers.Updated references to non-MCSC contracts to spell out which contracts are not applicable.

4. Section 2.6. Deleted outdated contract language regarding override codes.

5. Section 2.7. Updated TOM reference from Chapter 20 to Chapter 19.

6. Section 2.8.

a. Added Region Indicators for 2017 contracts to TED Data Element Definition.

b. Deleted Adjustment to Original HCSR (ATOH) language as it no longer applies.

c. Added Special Processing Code PC - Provisional Coverage for Emerging Services and Supplies

7. Section 2.10. Added place holder for 2017 contract numbers.

8. Section 4.1. Updated TED Header edits.

9. Section 5.1.

a. Deleted references to old contract numbers and associated TED edits.

b. Deleted TED Correction Indicator language and associated TED edits.

10. Section 5.2.

a. Added Region Indicators for 2017 contracts to TED Institutional edits.

b. Deleted TED Correction Indicator language and associated TED edits.

11. Section 5.3.

a. Deleted TED Correction Indicator language.

b. Updated Covered Days TED edit.

12. Section 5.4.

a. Updated TED Correction Indicator Validity edit to enforce BLANKS in this field as it is no longer required.

b. Deleted reference to old contract numbers.

2 January 6, 2016

CHAPTER 2 (Continued)

13. Section 6.1.

a. Deleted references to old contract numbers.

b. Deleted TED Correction Indicator language and associated TED edits.

14. Section 6.2.

a. Deleted references to old contract numbers.

b. Deleted TED Correction Indicator language.

c. Updated Administrative CLIN edit to enforce BLANKS in this field.

d. Updated TED Correction Indicator Validity edit to enforce BLANKS in this field as it is no longer required.

e. Procedure codes were added for the ECHO personal incontinence benefit.

15. Section 6.3. Deleted references to old contracts and associated TED edit.

16. Section 6.4. Added Region Indicators for 2017 contracts to TED Non-Institutional edits.

17. Addendum I.

a. Deleted Addendum I, Contract Area of Responsibility, Figure 2.1-1 as it referenced old contract numbers.

b. Created a new Figure 2.1-1 that references T3 Contract numbers and their areas of responsibility.

c. Created a new Figure 2.1-2 as a placeholder for 2017 contract numbers and their areas of responsibility.

18. Addendum L. Updated description of Valid Value 001 (‘Service Members’ to ‘Active Duty Sponsors’).

CHAPTER 3

19. Section 4.1. Paragraph 4.1.1, updated language to reflect new description in Addendum L (see item 17 above).

20. Section 4.2. Paragraph 10.2.1, clarified what DEERS will do in regard to Enrollment Cards.

21. Section 4.4. Paragraph 1.1.3, added a new reporting requirement for the contractor to submit systems integration test plans in accordance with the CDRL.

3 January 6, 2016

CHAPTER 4

22. Section 1.8. Removed obsolete language concerning Contractor Duplicate Claims Points of Contact.

4 January 6, 2016

HPOS HPOB April 1, 2015

Foreword

Revision:

The TRICARE Systems Manual (TSM), 7950.3-M, defines the contractor’s responsibilities for automated processing of health care information, reporting and transmission of relevant data between the contractor and the Defense Health Agency (DHA). The manual provides the requirements for the contractors to interface with the Defense Enrollment Eligibility Reporting System (DEERS) for obtaining beneficiary eligibility verifications from DEERS and performing TRICARE Prime enrollments onto DEERS, as well as TRICARE Encounter Data reporting requirements.

The Department of Defense (DoD) has a License Agreement with the American Medical Association (AMA) regarding the use of the Physician’s Current Procedural Terminology (CPT), a coding work of medical nomenclature developed by the AMA. In accordance with the terms of that Agreement, the DoD has agreed to:

1. Include a Copyright notice in every section that references CPT codes,

2. Specifically identify procedure codes as CPT procedure codes;

3. Use only short descriptions with CPT codes and delete all long descriptions; and

4. Italicize short descriptions wherever they are used and include a footnote stipulating that they are excerpted from the CPT.

The TRICARE Manuals provide instructions, guidance and responsibilities in addition to the requirements set forth in the incorporated federal statutes and the regulations and may not be interpreted in contradiction thereto.

John L. Arendale, Section Branch Chief Health Plan Operations Sections Branch (HPOSB) Defense Health Agency (DHA)

Definitions are available in the Apr 2015 TRICARE Operations Manual (TOM), Appendix A.

Acronyms and Abbreviations are available at http://www._______________.

1 t2017-chg 1

General Automated Data Processing (ADP) Requirements Chapter 1 Section 1.1

General Automated Data Processing (ADP) Requirements

Revision:

1.0 GENERAL

1.1 The TRICARE Systems Manual (TSM) describes how TRICARE business functions are implemented technically via system-to-system interactions and Government provided applications.

The TSM also describes the technical concept of operations, including the responsibilities associated with various Information Systems (IS) including Defense Enrollment Eligibility Reporting System (DEERS), the contractor systems, and selected Direct Care (DC) IS.

1.2 The contractor shall comply with the Department of Defense (DoD) guidance regarding directed Ports, Protocols, and Services (PPS).

1.3 The contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies. The contractor accessing DoD systems will be provided direction from DoD on connectivity requirements that comply with PPS in accordance with DoD Instructions (DoDIs).

1.4 The contractor shall ensure that laptops, flash drives, and other portable electronic devices do not contain Personally Identifiable Information (PII)/Protected Health Information (PHI) unless the device is fully encrypted and accredited per National Institute of Standards and Technology (NIST) standards.

1.5 Portable electronic devices are often used to transmit reference materials and data of a general nature at meetings and conferences., The contractor shall ensure that their computer systems can accept and load all such information, regardless of the media used to transmit it. All materials provided to contractors at meetings, workgroups, and/or training sessions sponsored by or reimbursed by the Government shall be maintained in accordance with the Records Management requirements in the TRICARE Operations Manual (TOM), Chapter 9.

1.6 This chapter addresses major administrative, functional, and technical requirements related to the flow of health care related Automated Data Processing/Information Technology (ADP/IT) information between the contractor and the DoD/Defense Health Agency (DHA). TRICARE Encounter Data (TED) records as well as provider information shall be submitted to DHA in electronic media. This information is essential to both the accounting and statistical needs of DHA in the management of the TRICARE program and in required reports to DoD, Congress, other governmental entities, and to the public. Technical requirements for the transmission of data between the contractor and DHA are presented in this section. The requirements for submission of TED records and resubmission of records are outlined in the Chapter 2, Section 1.1, and the Government requirements related to submission and updating of provider information are outlined in Chapter 2, Section 1.2.

Chapter 1, Section 1.1

General Automated Data Processing (ADP) Requirements

1.7 DoD/DHA data includes all information (e.g., test or production data) provided to the contractor for the purposes of determining eligibility, enrollment, disenrollment, capitation, fees, claims, Catastrophic Cap And Deductible (CC&D), patient health information, protected as defined by DoD 6025.18-R, or any other information for which the source is the Government. Any information received by a contractor or other functionary or system(s), whether Government owned or contractor owned, in the course of performing Government business is also DoD/DHA data. DoD/DHA data means any information, regardless of form or the media on which it may be recorded.

1.8 The ADP requirements shall incorporate standards mandated by the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Rules, 45 CFR Parts 160 and 164 (collectively, “HIPAA Rules”), and the DoD HIPAA Issuances identified below. Contractor compliance with the HIPAA Rules and DoD HIPAA Issuances and related privacy requirements is addressed in the TOM (Chapter 1, Section 5 and Chapter 19, Section 3) and in paragraph 1.10.

1.9 Management and quality controls specific to the accuracy and timeliness of transactions associated with ADP and financial functions are addressed in the TOM, Chapter 1. In addition to those these requirements, DHA also conducts reviews of ADP and financial functions for data integrity purposes and may identify issues specific to data quality (e.g., catastrophic cap issue). Upon notification of data quality issues by DHA, the contractor shall participate in the development of a resolution for the issue(s) identified as appropriate. If DHA determines corrective actions are required as a result of Government reviews and determinations, the Contracting Officer (CO) will notify the contractor of the actions to be taken by the contractor to resolve the data issues. Corrective actions that must shall be taken by the contractor to correct data integrity issues, resulting from contractor actions, are the responsibility of the contractor.

1.10 The references below relate to the subject matter covered in this section:

• Privacy Act of 1974.

• DoD HIPAA Issuances:

• DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 2003.

• DoD 8580.02-R, “DoD Health Information Security Regulation,” July 2007.

• DoD 5200.2-R, “DoD Personnel Security Program,” January 1987.

• DoD 5400.11-R, “Department of Defense Privacy Program,” May 14, 2007.

• DoD Directive (DoDD) 5015.2, “DoD Records Management Program,” March 6, 2000.

• DoD Instruction (DoDI) 8500.01, “Cybersecurity,” March 14, 2014.

• DoD 5015.02-STD, “Electronic Records Management Software Applications Design Criteria Standard,” April 25, 2007.

• Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” August 27, 2004.

General Automated Data Processing (ADP) Requirements

• Federal Information Processing Standards Publication 201 (FIPS 201-1), “Personal Identify Verification (PIV) of Federal Employees and Contractors,” August 2013.

• Directive Type Memorandum (DTM) 08-006, “DoD Implementation of Homeland Security Presidential Directive-12 (HSPD-12),” November 26, 2008.

• DoDI 8582.01 (Security of Unclassified DoD Information on Non-DoD IS).

The requirements above shall be met by contractors, subcontractors and other individuals who have access to IS containing PII protected by the Privacy Act of 1974 and PHI under HIPAA.

2.0 SYSTEM INTEGRATION, IMPLEMENTATION AND TESTING MEETINGS

2.1 The DHA hosts regularly scheduled meetings, via teleconference, with contractor and Government representatives. Government attendees may include, but are not limited to Defense Manpower Data Center (DMDC), Enterprise Infrastructure (EI), and Defense Information System Agency (DISA). These meetings will:

• Review the status of system connectivity and communications.

• Identify new DEERS applications or modifications to existing applications, e.g., Government furnished web-based enrollment systems/applications.

• Issue software enhancements.

• Implement system changes required for the implementation of new programs and/or benefits.

• Review data correction issues and corrective actions to be taken (e.g., catastrophic cap effort-review, research and adjustments).

• Monitor results of contractor testing efforts.

• Other activities as appropriate.

2.2 DHA provides a standing agenda for the teleconference with the meeting announcement.

Additional subjects for the meetings are identified as appropriate. The contractor shall ensure representatives participating in the calls are subject matter experts for the identified agenda items and are able to provide the current status of activities for their organization. The contractor shall ensure testing activities are completed within the scheduled time frames and any problems experienced during testing are reported via the Government defined application (i.e., TestTrack Pro™) for review and corrective action by DHA or their designee. Upon the provision of a corrective action strategy or implementation of a modification to a software application by DHA (to correct the problem reported by the contractor), the contractor shall retest the scenario to determine if the resolution is successful.

Retesting shall be accomplished within the agreed upon time frame. The contractor shall update the Government defined application (i.e.,TestTrack Pro™) upon completion of retesting activities.

2.3 DHA will also document system issues and deficiencies into the Government defined application (i.e., TestTrack Pro™) related to testing and production analysis of the contractors systems

General Automated Data Processing (ADP) Requirements and processes. Upon the provision of a corrective action strategy or implementation of a modification to a software application by the contractor (to correct the problem reported by DHA), the contractor shall retest the scenario to determine if the resolution is successful. Retesting shall be accomplished within the agreed upon time frames. The contractor shall correct internal system problems that negatively impact their interface with the Business to Business (B2B) Gateway, Military Health System (MHS), DMDC, etc. and/or the transmission of data, at their own expense.

2.4 Each organization identified shall provide two Points of Contact (POCs) to DHA to include telephone numbers and e-mails to be used for call back purposes, notification of planned and unplanned outages and software releases. POCs will be notified via e-mail in the event of an unplanned outage using the POC notification list, so it is incumbent upon the each organizations to notify DHA of changes to the POC list.

3.0 ADP REQUIREMENTS

The contractor shall obtain and maintain adequate hardware, software, personnel, procedures, controls, contingency plans, and documentation to satisfy DHA data processing and reporting requirements. Items requiring special attention are listed below.

3.1 Continuity of Operations Plan (COOP)

The contractor shall develop a single plan, deliverable to the DHA CO on an annual basis that ensures the continuous operation of their Information Technologies (IT) systems and data support of TRICARE. The plan shall provide information specific to all actions that will be taken by the Prime and subcontractors in order to continue operations should an actual disaster be declared for their region.

The COOP shall ensure the availability of the system and associated data in the event of hardware, software and/or communications failures. The COOP shall also include Prime and subcontractor’s plans for relocation/recovery of operations, timeline for recovery, and relocation site information in order to ensure compliance with the TOM, Chapters 1 and 6. Information specific to connection to the B2B Gateway to and from the relocation/recovery site for operations shall also be included in the COOP. For relocation/recovery sites, contractors shall ensure all security requirements are met and appropriate processes are followed for the B2B Gateway connectivity. The contractor’s COOP will enable compliance with all processing standards as defined in the TOM, Chapter 1, and compliance with enrollment processing and Primary Care Manager (PCM) assignment as defined in TOM, Chapter 6. The COOP shall include restoration of critical functions such as claims and enrollment within five days of the disaster. The Government reserves the right to re-prioritize the functions and system interactions proposed in the COOP during the review and approval process for the COOP. See Contract Data Requirements List (CDRL) for information specific to deliverables, milestones, and due dates.

3.2 Security Requirements

The contractor shall ensure security and access requirements are met in accordance with existing contract requirements for all COOP and disaster recovery activities. Waivers of security and access requirements will not be granted for COOP or disaster recovery activities.

3.3 Annual Disaster Recovery Tests

3.3.1 The Prime contractor shall coordinate annual disaster recovery testing of the COOP with its subcontractor(s) and the Government. Coordination with the Government will begin no later than 90

General Automated Data Processing (ADP) Requirements days prior to the requested start date of the disaster recovery test. Each Prime contractor shall ensure all aspects of the COOP are tested and coordinated with all contractors responsible for the transmission of TRICARE data. Each Prime contractor shall ensure major TRICARE functions are tested.

3.3.2 The Prime contractor shall also ensure testing support activities (e.g., DEERS, TED, etc.) are coordinated with the responsible Government POC no later than 90 days prior to the requested start date of the annual disaster recovery test.

3.3.3 Annual disaster recovery tests will evaluate and validate that the COOP sufficiently ensures continuation of operations and the processing of TRICARE data in accordance with the TOM, Chapters 1 and 6. See Contract Data Requirements List (CDRL) for information specific to deliverables, milestones, and due dates. At a minimum, annual disaster recovery testing will include the processing of:

• TRICARE Prime enrollments in the DEERS contractor test region to demonstrate the ability to update records of enrollees and disenrollees using the Government furnished web- based enrollment system/application.

• Referrals.

• Preauthorizations/authorizations.

• Claims.

• Claims and catastrophic cap inquiries will be made against production DEERS and the Catastrophic Cap and Deductible Database (CCDD) from the relocation/recovery site.

Contractors shall test their ability to successfully submit claims inquiries and receive DEERS claim responses and catastrophic cap inquiries and responses. Contractors shall not perform catastrophic cap updates in the CCDD and DEERS production for test claims.

• To successfully demonstrate the ability to perform catastrophic cap updates and the creation of newborn placeholder records on DEERS, the contractor shall process a number of claims using the DEERS contractor test region.

• TED records will be created for every test claim processed during the claims processing portion of the disaster recovery test. The contractor shall demonstrate the ability to process provider, institutional and non-institutional claims. These test claims will be submitted to the DHA TED benchmark landing area.

3.3.4 Contractors shall maintain static B2B Gateway connections or other Government approved connections at relocation/recovery sites that may be activated in the event a disaster is declared for their region.

3.3.5 In all cases, the results of the review and/or test results shall be reported to the DHA Contract Operations Division-Aurora (COD-A) within 10 days of the conclusion of the test. The contractor’s report shall include if any additional testing is required or if corrective actions are required as a result of the disaster recovery test. The notice of additional testing requirements or corrective actions to be taken shall be submitted along with the proposed date for retesting and the completion date for any corrective actions required. Upon completion of the retest, a report of the results of the

General Automated Data Processing (ADP) Requirements actions taken shall be provided to the COD-A within 10 business days of completion. See CDRL for information specific to deliverables, milestones, and due dates.

3.4 Information Security Compliance Programs

The Information Security Compliance under the NIST Program is recognized by the DoD for non- DoD IS (defined as an IS that is not owned, controlled, or operated by the DoD, and is not used or operated by a contractor or other non-DoD entity exclusively on behalf of the DoD) that processes Controlled Unclassified Information (CUI). Contracts governed by this manual are generally considered to be non-DoD IS.

3.4.1 Controlled Unclassified Information (CUI) and DoD Information Contractor IS

CUI is defined as “Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and Government-wide policies.” DoD information is defined as “information that is provided by the DoD to a non-DoD entity, or that is collected, developed, received, transmitted, used, or stored by a non-DoD entity in support of an official DoD activity, where that information has not been cleared for public release.” DoDI 8582.01. See also DoD Directive (DoDD) 5230.09, “Clearance of DoD Information for Public Release,” August 22, 2008.

PII/PHI that is DoD information constitutes CUI because PII/PHI requires safeguarding or dissemination controls unless it has been cleared for public release.

3.4.2 NIST References and Related DoD Issuances

The references below support the IA requirements outlined in the following paragraphs.

• 48 CFR Parts 204, 212, and 252 as amended by 76 FR 69273 - 69282 / Vol. 78, No. 222 / Monday, November 18, 2013.

• NIST Special Publication (SP) 800-53, In Accordance With (IAW) Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, “Security and Privacy Controls for Federal Information Systems and Organizations.”

• NIST SP 800-53A, IAW DFARS 252.204-7012, “Guide for Assessing the Security Controls in Federal Information Systems and Organizations.”

• NIST SP 800-3730, IAW DFARS 252.204-7012, “Guide For Applying The Risk Management Framework To Federal Information Systems “Guide for Conducting Risk Assessments.”

• NIST SP 800-34, IAW DFARS 252.204-7012, “Contingency Planning Guide For Federal Information Systems.”

• NIST SP 800-171, “Protecting Controlled Unclassified Information in Non-Federal Information Systems and Organizations.”

• DoDD 5230.09, “Clearance of DoD Information for Public Release,” August 22, 2008.

• DoDI 8582.01, “Security of Unclassified Department of Defense (DoD) Information on

General Automated Data Processing (ADP) Requirements Non-DoD Information Systems,” June 6, 2012.

• “Health Insurance Portability and Accountability Act (HIPAA), Security Standards, Final Rule,” February 20, 2003.

3.4.3 Compliance with Federal Programs

The NIST-based computer security program leverages a contractor’s compliance with existing Federal Information Security-related measures (i.e., HIPAA, Federal Information Security Management Act (FISMA), etc.) to attest to its readiness to process CUI DoD information on non-DoD IS.

This Information Security program requires participating contractors to document compliance with the security controls that are listed within 48 CFR 252.204-7012, Table 1 and described in detail within the NIST SP 800-171, “Protecting Controlled Unclassified Information in Non-Federal Information Systems and Organizations.” 53, Rev. 4, “Security and Privacy Controls for Federal Information Systems and Organizations, February 19, 2014 including updates” and SP 800-53A, Rev. 1, “Guide for Assessing the Security Controls in Federal Information Systems and Organizations, June 2010.” With respect to HIPAA Security Rule compliance, the contractor shall follow the TOM, Chapter 19, Section 3, including the requirement for contractors to designate a Security Official with specified responsibilities. Those responsibilities involve compliance with HIPAA Security Rule and DHA DoD Information Security Program requirements under this section.

3.4.3.1 Risk Management

Contractors certifying compliance with the NIST-based process accept sole responsibility for the risk(s) associated with developing and maintaining its IA readiness posture.

3.4.3.2 IA Compliance Requirement

The contractor shall provide and maintain its NIST-related compliance as required by the contract, in order to connect to Government systems.

3.4.4 NIST Certification/Recertification Procedures

3.4.4.1 Contractor Self-Certification Process

The contractor shall self-certify all IS that access, process, reproduce, modify, perform, store, display, store release, disclose, or transmit DoD disseminate CUI. Self- certification shall be achieved, as specified in the contract. The organization shall employ, Audit Review, Analysis, and Reporting through proper Integration/Scanning and Continuous Monitoring Capabilities (i.e., continuous monitoring for vulnerabilities) that identify the breadth, depth, and rigor of coverage during the security review process for submission of their self-certification documentation. Security reviews shall describe, at a high level, how the security controls and control enhancements meet those security requirements, also provide detailed, technical descriptions of the specific implementation of the controls and enhancements. The contractor shall ensure that the security controls required by the contract are implemented correctly, operating as intended, and support the security policies of the DHA.

3.4.4.2 The NIST SP 800-17153, Rev. 4 and NIST 800-53A, certification process, as allowed by DoDI

8582.01 and applicable contract clauses, requires compliance by contractors for the protection of DoD information provided to, contained within and/or processed by contractor IS. The following process

General Automated Data Processing (ADP) Requirements applies to the NIST-based Information Security certification process. See the CDRL for information specific to deliverables, milestones, and due dates.

3.4.4.3 The contractor shall submit self-certification documents and will be notified of any identified areas that need additional information. The contractor shall respond within 10 calendar days.

3.4.5 Operation and Connectivity Decisions

3.4.5.1 The contractor shall complete and submit the NIST Certificate of Compliance in accordance with the CDRL for information specific to deliverables.

3.4.5.2 The contractor shall submit a written determination report for any failure to achieve and/or maintain its compliance with the NIST-based IA program.

3.4.6 Documentation

The contractor will be provided with the most current version of the NIST Checklist and Written Determination Report (WDR) within 10 calendar days of contract award. If the contractor changes its compliance status with a vulnerability mitigation plan for any IA control shown on the NIST Checklist, the contractor shall submit an updated WDR statement within 10 calendar days.

3.4.7 Disposing of Electronic Media

Contractors shall follow the DoD standards, procedures and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoDD 5015.2 8500.1 and NIST SP 800-17153.

4.0 HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

The contractor shall be in compliance with the HIPAA Rules, the DoD HIPAA Issuances, the TOM, Chapter 19, Section 3, and any provisions of this manual and DoD cybersecurity guidance addressing security incident response. In particular, the contractor shall be in compliance with HIPAA breach response requirements, which are addressed in conjunction with DoD breach response requirements in the TOM, Chapter 1, Section 5.

4.1 Data Sharing Agreements (DSAs)

Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Defense Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. (DHA contracts may use the term Data Use Agreement (DUA) rather than DSA.) DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the Prime contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data.

After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution. The DSAA template and other DSA guidance and forms are available at the following page on the Privacy Office web site: http://www.tricare.mil/tma/privacy/duas.aspx. Primary contractors and subcontractors requiring access to or use of MHS data shall also complete an Account Authorization Request Form (AARF) and have an ADP / IT-II designation. Refer to ADP/IT Category Guidance below.

http://www.tricare.mil/tma/privacy/duas.aspx

General Automated Data Processing (ADP) Requirements Government-issued picture ID.

6.1.3.8 Retrieval

The CAC is property of the U.S. Government and shall be retrieved and returned to TASS- CACB when the card has expired, or it is damaged, or compromised, or when the applicant is no longer affiliated with the DoD contractor or no longer meets the eligibility requirements for the card.

Defense Health Agency Mission Assurance Division Personnel Security Branch

ATTN: TASS/CACB

7700 Arlington Blvd, Suite 5101 Falls Church, VA 22042-5101

6.1.4 Personal Identification Number (PIN) Resets

Should an individual’s CAC become locked after attempting three times to access it, the PIN will have to be reset at a RAPIDS facility or by designated individuals authorized CAC PIN Reset (CPR) applications. These individuals may be contractor personnel, if approved by the Government representative. PIN resets cannot be done remotely. The Government will provide CPR software licenses; the contractor shall provide all hardware for the workstation (PC, Card Readers, Fingerprint capture device). The CPR workstation shall not be used for other applications, as the Government has not tested the CPR software for compatibility. The CPR software shall run on the desktop and cannot be run from the Local Area Network (LAN). The contractor shall install the CPR hardware and software, and provide the personnel necessary to run the workstation.

6.1.5 E-Mail Address Change

The User Maintenance Portal (UMP) is an available web service that allows current CAC holders to change e-mail signing and e-mail encryption certificates in the event of a change in e-mail addresses. This service is accessible from a local workstation via web services.

6.1.6 Systems Requirements for CAC Authentication

Contractors shall procure, install, and maintain desktop level CAC readers and middleware.

The middleware software must run on the desktop and cannot be run from the LAN. Technical Specifications for CACs and CAC readers may be obtained at http://cac.mil/common-access-card/ developer-resources/.

6.1.6.1 Contractors shall ensure that CACs are only used by the individual to whom the CAC was issued. Individuals must protect their PIN and not allow it to be discovered or allow the use of their CAC by anyone other than him/herself. Contractors shall to ensure access to DoD systems applications and data is only provided to individuals who have been issued a CAC and whose CAC has been validated by the desktop middleware, including use of a card reader. Sharing of CACs, PINs, and other access codes is expressly prohibited.

6.1.6.2 The contractor shall provide locations and approximate number of contractor personnel at each site that will require the issuance of a CAC upon contract award.

http://cac.mil/common-access-card/ developer-resources/ http://cac.mil/common-access-card/ developer-resources/

General Automated Data Processing (ADP) Requirements

6.1.6.3 The contractor shall identify to DHA and DMDC the personnel that require access to the DMDC Contractor Test environment in advance of the initiation of testing activities.

6.2 System Authentication

The contractor shall obtain DoD-acceptable PKI server certificates for identity and authentication of the servers upon direction of the CO. These interfaces include, but are not limited to, the following:

• Contractor systems for inquiries and responses with DEERS.

• Contractor systems and the TED Processing Center.

7.0 TELECOMMUNICATIONS

7.1 MHS Demilitarized Zone (DMZ) Managed Partner Care B2B Gateway

7.1.1 For all non-DMDC web applications, the contractor shall connect to a DISA-established Web DMZ. For all DMDC web applications, the contractor shall connect to DMDC.

7.1.2 In accordance with contract requirements, contractors shall connect to the B2B gateway via a contractor procured Internet Service Provider (ISP) connection. Contractors shall assume all responsibilities for establishing and maintaining their connectivity to the B2B Gateway. This will include acquiring and maintaining the circuit to the B2B Gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

7.1.3 Contractors shall complete a current version of the DISA B2B gateway questionnaire providing information specific to their connectivity requirements, proposed path for the connection and last mile diagram. The completed questionnaire shall be submitted to DISA for review and scheduling of an initial technical specifications meeting.

7.2 Contractor Provided IT Infrastructure

7.2.1 Platforms shall support HyperText Transfer (Transport) Protocol (HTTP), HyperText Transfer (Transport) Protocol Secure (HTTPS), web-derived Java Applets, secure File Transfer Protocol (FTP), and all software that the contractor proposes to use to interconnect with DoD facilities.

7.2.2 Contractors shall configure their networks to support access to Government systems (e.g., configure ports and protocols for access).

7.2.3 Contractors shall provide full time connections to a TIER 1 or TIER 2 ISP. Dial-up ISP connections are not acceptable.

7.3 System Authorization Access Request (SAAR) Defense Department (DD) Form 2875

7.3.1 All contractors that use the DoD gateways to access Government IT systems and/or DoD applications (e.g., DEERS applications, Patient Encounter Processing and Reporting (PEPR), Duplicate Claims System (DCS), MHS Data Repository (MDR), etc.) shall submit the most current version of DD Form 2875 (http://www.dtic.mil/whs/directives/infomgt/forms/eforms/dd2875.pdf) in accordance with CO guidance. A DD Form 2875 is required for each contractor employee who will access any http://www.dtic.mil/whs/directives/infomgt/forms/eforms/dd2875.pdf

General Automated Data Processing (ADP) Requirements system and/or application on a DoD network. The DD Form 2875 shall clearly specify the system and/or application name and justification for access to that system and/or application.

7.3.2 Contractors shall complete and submit the completed DD Form 2875 to the DHA DPCLO for verification of ADP Designation (see paragraph 5.0). The DHA DPCLO will verify that the contractor employee has the appropriate background investigation completed/or a request for background investigation has been submitted to the OPM. Acknowledgment from OPM that the request for a background investigation has been received and that an investigation has been scheduled will be verified by the DHA DPCLO prior to access being approved.

7.3.3 The DHA DPCLO will forward the DD Form 2875 to EI for processing; EI will forward DD Form 2875s to DISA. DISA will notify the user of the ID and password via e-mail upon the establishment of a user account. User accounts will be established for individual use and may not be shared by multiple users or for system generated access to any DoD application. Misuse of user accounts by individuals or contractor entities will result in termination of system access for the individual user account.

7.3.4 The contractor shall conduct a monthly review of all contractor employees who have been granted access to DoD IS’/networks to verify that continued access is required. The contractor shall provide the DHA DPCLO with a report of the findings of their review by the 10th day of the each month following the review. Reports identifying changes to contractor employee access requirements shall include the name, SSN, Company, IS/network for which access is no longer required and the date access should be terminated.

7.4 MHS Systems Telecommunications

7.4.1 The primary communication links shall be via Secure Internet Protocol (IPSEC) VPN tunnels between the contractor’s primary site and the MHS B2B Gateway.

7.4.2 The contractor shall place the VPN appliance device outside the contractor’s firewalls and shall allow full management access to this device (e.g., in router access control lists) to allow Central VPN Management services provided by the DISA or other source of service as designated by the MHS to remotely manage, configure, and support this VPN device as part of the MHS VPN domain.

7.4.3 For backup purposes, an auxiliary VPN device for contractor locations shall also be procured and configured for operation to minimize any downtime associated with problems of the primary VPN.

7.4.4 Devices sent by the contractor to the MHS VPN management authority (e.g., DISA) shall be sent postage paid and include prepaid return shipping arrangements for the devices(s).

7.4.5 The MHS VPN management authority (e.g., DISA) will remotely configure the VPN once installed by the contractor.

7.4.6 Maintenance and repair of contractor procured VPN equipment shall be the responsibility of the contractor. Troubleshooting of VPN equipment will be the responsibility of the Government.

General Automated Data Processing (ADP) Requirements

7.5 Establishment of Telecommunications

7.5.1 Telecommunications shall be established with the MHS through coordination with DHA, EI, and DISA. The contractor shall identify their requirement(s) for the establishment of telecommunications with the MHS, DMDC or other Government entitiesy.

7.5.2 The contractor shall complete the current version of the B2B Gateway Questionnaire (to be provided by DHA) identifying the required telecommunication infrastructure between the contractor and the MHS systems. This includes all Wide Area Network (WAN), LAN, VPN, Web DMZ, and B2B Gateway access requirements. The completed Questionnaire shall be returned to the DHA designated POC for review and approval. Upon Government request, the contractor shall provide technical experts to provide any clarification of information provided in the Questionnaire. DHA will forward the Questionnaire to EI for further review and processing.

7.5.3 EI will coordinate any requirements for additional information with the DHA POC and schedule any meetings required to review the Questionnaire. Upon approval of the Questionnaire, EI will coordinate a testing meeting with DHA. DHA will notify the contractor POC of the meeting schedule. The purpose of the testing meeting is to complete a final review of the telecommunication requirements and establish testing dates.

7.5.4 The contractor shall provide the DHA or the equivalent office with a copy of the approved and signed B2B Questionnaire for all telecommunication efforts.

7.6 Contractors Located On Military Treatment Facilities (MTFs)/Enhanced Multi-Service Markets (eMSMs)

7.6.1 Contractors located on a military installation who require direct access to Government systems shall coordinate/obtain these connections with the local MTF/eMSM and Base/Post/Camp communication personnel. These connections will be furnished by the Government.

7.6.2 Contractors located on military installations that require direct connections to their networks shall provide an isolated IT infrastructure. They shall coordinate with the Base/Post/Camp communications personnel and the MTF/eMSM in order to get approval for a contractor procured circuit to be installed and to ensure the contractor is within compliance with the respective organizational security policies, guidance and protocols.

Note: In some cases, the contractor may not be allowed to establish these connections due to local administrative/security requirements.

7.6.3 The contractor shall be responsible for all security certification documentation as required to support DoD IA requirements for network interconnections. Further, the contractor shall provide, on request, detailed network configuration diagrams to support accreditation requirements. The contractor shall comply with accreditation requirements. All network traffic shall be via TCP/IP using ports and protocols in accordance with current Service security policy. All traffic that traverses MHS, DMDC, and/or military Service Base/Post/Camp security infrastructure is subject to monitoring by security staff using Intrusion Detection Systems.

General Automated Data Processing (ADP) Requirements

7.7 DHA/TED

7.7.1 Primary Site

The TED primary processing site is currently located in Oklahoma City, OK, and operated by the Defense Enterprise Computing Center (DECC), Oklahoma City Detachment of the DISA.

Note: The location of the primary site may be changed. The contractor will be advised should this occur.

7.7.2 General

The common means of administrative communication between Government representatives and the contractor is via telephone and e-mail. An alternate method may be approved by DHA, as validated and authorized by DHA. At the start-up planning meeting, each contractor on the telecommunication network shall provide to DHA at the start-up planning meeting (and update when a change occurs), the name, address, and telephone number of the person who will serve as a technical POC (update when changes occur). Contractors shall also provide a separate computer center (Help Desk) number to DHA which the DHA computer operator can use for resolution of problems related to data transmissions.

7.7.3 TED-Specific Data Communications Technical Requirements

The contractor shall communicate with the Government’s TED Data Center through the MHS B2B Gateway.

7.7.3.1 Communication Protocol Requirements

7.7.3.1.1 File transfer software shall be used to support communications with the TED Data Processing Center. CONNECT:Direct is the current communications software standard for TED transmissions. The contractor shall upgrade/comply with any changes to this software. The contractor shall provide this product and a platform capable of supporting this product with the TCP/IP option included. Details on this product may be obtained from:

Sterling Commerce 4600 Lakehurst Court 4600 Lakehurst Court P.O. Box 8000 Dublin OH 43016-2000 USA http://www-01.ibm.com/software/info/sterling-commerce/index.html Phone: (614) 793-7000 Fax: (614) 793-4040

7.7.3.1.2 For Ports and Protocol support, TCP/IP communications software incorporating the TN3270 emulation shall be provided by the contractor.

7.7.3.1.3 Transmission size is limited to any combination of 400,000 records at one time.

http://www-01.ibm.com/software/info/sterling-commerce/index.html

General Automated Data Processing (ADP) Requirements

7.7.3.1.4 “As Required” Transfers

Ad hoc movement of data files shall be coordinated through and executed by the network administrator or designated representative at the source file site. Generally speaking, the requestor needs only to provide the POC at the remote site, and the source file name. Destination file names shall be obtained from the network administrator at the site receiving the data. Compliance with naming conventions used for recurring automated transfers is not required. Other site specific requirements, such as security constraints and pool names are generally known to the network administrators.

7.7.3.1.5 File Naming Convention

7.7.3.1.5.1 All files received by and sent from the DHA data processing site shall comply with the following standards when using CONNECT:Direct:

POSITION(S) CONTENT

1 - 2 TD

3 - 8 YYMMDD Date of transmission

9 - 10 Contractor number

11 - 12 Sequence number of the file sent on a particular day. Ranges from 01 to 99.

Reset with the first file transmission the next day.

7.7.3.1.5.2 All files sent from the DHA data processing site shall be named after coordination with receiving entities in order to accommodate specific communication requirements for the receivers.

7.7.3.1.6 Timing

7.7.3.1.6.1 Under most circumstances, the source file site shall initiate automated processes to cause transmission to occur. With considerations for timing and frequency, activation of transfers for each application shall be addressed on a case by case basis.

7.7.3.1.6.2 Alternate Transmission

Should the contractor not be able to transmit their files through the normal operating means, the contractor shall notify DHA (EIDS Operations) to discuss alternative delivery methods.

7.8 DHA/MHS Referral And Authorization System

The MHS Referral and Authorization System is to be determined. Interim processes are described in the TOM.

7.9 DHA/TRICARE Duplicate Claims System (DCS)

The DCS is a web application accessible via Microsoft Internet Explorer (MSIE) version 6.0, 7.0 or as directed by the Government. The contractor shall provide internal connectivity to the public Internet and is responsible for all systems and operating system software needed internally to support the DCS.

(See Chapter 4 for DCS Specifications.)

Chapter 2, TRICARE Encounter Data (TED)

Section/Addendum Subject/Addendum Title

8.1 Financial Edit Requirements

A Data Requirements - Country And/Or Islands Codes

B Data Requirements - State Codes Figure 2.B-1 State Codes Figure 2.B-2 Medicare State Codes

C Data Requirements - Provider’s Major Specialty Codes Figure 2.C-1 Provider Major Specialty Codes For Use On Non-Institutional TED

Records For Outpatient Hospital Care

D Data Requirements - Type Of Institution Codes Figure 2.D-1 Type Of Institution

E Data Requirements - Other Special Procedure Codes Figure 2.E-1 Outpatient Procedure Codes Figure 2.E-2 Defense Health Agency (DHA)-Approved Procedure Codes For

Retail And Mail Order Pharmacy (MOP) Only

F Data Requirements - Place Of Service/Type Of Service Allowable Relationships Figure 2.F-1 Place Of Service Codes Figure 2.F-2 Place Of Service Values Figure 2.F-3 Type Of Service Second Position Values

G Data Requirements - Adjustment/Denial Reason Codes Figure 2.G-1 Denial Codes Figure 2.G-2 Denial/Adjustment Codes Figure 2.G-3 Adjustment/Remark Codes

H Data Requirements - Revenue Codes

I Data Requirements - Contract Area Of Responsibility Figure 2.I-1 Contract Areas Of Responsibility Awarded Prior To TBD1 Before

January 2016 Figure 2.I-2 Contract Areas Of Responsibility Awarded After TBD1 January 2016

J Data Requirements - Pay Plan Code Valid Values

K Data Requirements - Dependent Elements And Values For Rank Code, Sponsor Pay Category

L Data Requirements - Health Care Delivery Program (HCDP) Plan Coverage Code Values

M Data Requirements - Default Values For Complete Claims Denials Figure 2.M-1 Common Elements Figure 2.M-2 Institutional-Specific Elements Figure 2.M-3 Non-Institutional-Specific elements

N UB-04/UB-92 Conversion Table - To Be Used For Reporting Non-Institutional TRICARE Encounter Data (TED) Records

Chapter 2, Section 1.1

Data Reporting - TRICARE Encounter Data (TED) Record Submission

2.0 INITIAL SUBMISSION OF TED RECORDS

Initial submission applies only to the first submission of a new TED record. Initial submissions are identified by TYPE OF SUBMISSION codes I, D, and O on the TED record.

2.1 All data indicated as “required” in the data element definition must be reported. If not received in the treatment encounter data, this data must be developed.

2.2 All signed numeric data elements on the initial submission must be reported as positive values.

2.3 When institutional TED records are reported for other than the complete inpatient hospital stay, the TED records must be reported to DHA in the sequence that the care was provided (FREQUENCY CODES, 2-Initial, 3-Interim or 4-Final). Refer to paragraph 7.0 for requirements on submitting interim bills for institutional claims.

3.0 SUBMISSION OF ADJUSTMENT/CANCELLATION TED RECORDS

3.1 Adjustment and cancellation TED records correct records with claims processing errors, or update prior data…