TS15C-0AOComposite.pdf

TRICARE Systems Manual 7950.3-M, April 1, 2015

D R A F T

Revision:

For Definitions, see the TRICARE Operations Manual (TOM), Appendix A.

Chapter 1 - General Automated Data Processing (ADP) Requirements

Chapter 2 - TRICARE Encounter Data (TED)

Chapter 3 - Defense Enrollment Eligibility Reporting System (DEERS)

Index

D R A F T

Chapter 1

General Automated Data Processing (ADP) Requirements

Revision:

Section/Addendum Subject/Addendum Title

1.1 General Automated Data Processing/Information Technology (ADP/IT) Requirements

1.2 Beneficiary Authentication Requirements

A Figures Figure 1.A-1 Standard Form (SF) 85P Sample Figure 1.A-2 SF 85P Cover Sheet Instructions Figure 1.A-3 Cover Letter For Facility Security Officer/Public Trust Official

B Defense Finance And Accounting Service (DFAS) Allotment Record Layouts For TRICARE Management Activity (TMA) Contracts

General Automated Data Processing (ADP) Requirements

D R A F T

Chapter 1 Section 1.1

General Automated Data Processing/Information Technology (ADP/IT) Requirements

Revision:

1.0 GENERAL

1.1 The TRICARE Systems Manual (TSM) describes how TRICARE business functions are implemented technically via system-to-system interactions and Government provided applications. The TSM also describes the technical concept of operations, including the responsibilities associated with various Information Systems (IS) including Defense Enrollment Eligibility Reporting System (DEERS), the contractor systems, and selected Direct Care (DC) IS.

1.2 Contractors shall comply with TRICARE Management Activity (TMA) guidance regarding access to Department of Defense (DoD), TMA directed ports, protocols and software and web applications. TMA guidance will be issued based on requirements identified by the Office of the Secretary of Defense (OSD), Office of Homeland Security (OHS) or Interagency or Service or Installation and/or Functional Proponency agreements. If multiple requirements exist among the aforementioned entities, contractors shall comply with the most stringent of the requirements.

1.2.1 Contractors shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies. Contractors accessing DoD systems shall be provided direction from DoD on connectivity requirements that comply with Ports, Protocols and Services (PPS) in accordance with DoD Instructions (DoDIs). Contractors shall review all DoD, TMA, and United States Cyber Command (USCYBERCOM) Notifications provided by TMA for potential or actual impact on their current system infrastructure and business processes within the designated time frame on the notification. All impacts are to be reported to the Contracting Officer (CO) upon identification, but no later than (NLT) the due date indicated on the notice.

1.2.2 Contractors shall ensure that laptops, flash drives, and other portable electronic devices do not contain Personally Identifiable Information (PII)/Protected Health Information (PHI) unless the device is fully encrypted and accredited per DoD/National Institute of Standards and Technology (NIST) standards.

1.2.3 As portable electronic devices are often used to transmit reference materials and data of a general nature at meetings and conferences, contractors shall ensure that their computer systems can accept and load all such information, regardless of the media used to transmit it. All materials provided to contractors at meetings, workgroups, and/or training sessions sponsored by or reimbursed by the Government shall be maintained in accordance with the Records Management requirements in the TRICARE Operations Manual (TOM), Chapter 2.

Chapter 1, Section 1.1

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

1.3 This chapter addresses major administrative, functional and technical requirements related to the flow of health care related Automated Data Processing/Information Technology (ADP/IT) information between the contractor and the DoD/TMA. TRICARE Encounter Data (TED) records as well as provider information shall be submitted to TMA in electronic media. This information is essential to both the accounting and statistical needs of TMA in management of the TRICARE program and in required reports to DoD, Congress, other governmental entities, and to the public. Technical requirements for the transmission of data between the contractor and TMA are presented in this section. The requirements for submission of TED records and resubmission of records are outlined in the Chapter 2, Section 1.1, and the government requirements related to submission and updating of provider information are outlined in Chapter 2, Section 1.2.

1.4 For the purposes of this contract, DoD/TMA data includes all information (e.g., test or production data) provided to the contractor for the purposes of determining eligibility, enrollment, disenrollment, capitation, fees, claims, Catastrophic Cap And Deductible (CC&D), patient health information, protected as defined by DoD 6025.18-R, or any other information for which the source is the government. Any information received by a contractor or other functionary or system(s), whether government owned or contractor owned, in the course of performing government business is also DoD/TMA data. DoD/TMA data means any information, regardless of form or the media on which it may be recorded.

1.5 The ADP requirements shall incorporate standards mandated by the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Rules, 45 CFR Parts 160 and 164 (collectively, “HIPAA Rules”), and the DoD HIPAA Issuances identified below. Contractor compliance with the HIPAA Rules and DoD HIPAA Issuances and related privacy requirements is addressed in the TOM (Chapter 1, Section 5 and Chapter 19, Section 3) and in paragraph 1.7.

1.6 Management and quality controls specific to the accuracy and timeliness of transactions associated with ADP and financial functions are addressed in the TOM, Chapter 1. In addition to those requirements, TMA also conducts reviews of ADP and financial functions for data integrity purposes and may identify issues specific to data quality (e.g., catastrophic cap issue). Upon notification of data quality issues by TMA, contractors are required to participate in the development of a resolution for the issue(s) identified as appropriate. If TMA determines corrective actions are required as a result of government reviews and determinations, the CO will notify the contractor of the actions to be taken by the contractor to resolve the data issues. Corrective actions that must be taken by the contractor to correct data integrity issues, resulting from contractor actions, are the responsibility of the contractor.

1.7 The references below relate to the subject matter covered in this section:

• Privacy Act of 1974

• DoD HIPAA Issuances:

• DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 2003

• DoD 8580.02-R, “DoD Health Information Security Regulation,” July 2007

• DoD 5200.2-R, “DoD Personnel Security Program,” January 1987 (http://www.dtic.mil/whs/ directives/corres/pdf/520002r.pdf )

• DoD 5400.11-R, “Department of Defense Privacy Program,” May 14, 2007 http://www.dtic.mil/whs/directives/corres/pdf/520002r.pdf http://www.dtic.mil/whs/directives/corres/pdf/520002r.pdf

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

• DoD Instruction (DoDI) 8500.01, “Cybersecurity,” March 14, 2014

• DoDI 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT),” March 12, 2014

• DoD 5015.2-D, “Records Management Program,” March 6, 2000

• DoD 5015.02-STD, “Electronic Records Management Software Applications Design Criteria Standard,” April 25, 2007

• DoD 5200.08-R, “Physical Security Program,” May 27, 2009

• Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” August 27, 2004

• Federal Information Processing Standards Publication 201 (FIPS 201-1), “Personal Identify Verification (PIV) of federal Employees and Contractors,” March 2006

• Directive Type Memorandum (DTM) 08-006, “DoD Implementation of Homeland Security Presidential Directive-12 (HSPD-12),” November 26, 2008.

• DoDI 8582.01 (Security of Unclassified DoD Information on Non-DoD Information Systems)

The requirements above must be met by contractors, subcontractors and other individuals who have access to IS containing PII protected by the Privacy Act of 1974 and PHI under HIPAA.

2.0 SYSTEM INTEGRATION, IMPLEMENTATION AND TESTING MEETINGS

2.1 The TMA hosts regularly scheduled meetings, via teleconference, with contractor and Government representatives. Government attendees may include, but are not limited to Defense Manpower Data Center (DMDC), Enterprise Infrastructure (EI), and Defense Information System Agency (DISA). The purpose of these meetings is to:

• Review the status of system connectivity and communications.

• Identify new DEERS applications or modifications to existing applications, e.g., DEERS On-line Enrollment System (DOES).

• Issue software enhancements.

• Implement system changes required for the implementation of new programs and/or benefits.

• Review data correction issues and corrective actions to be taken (e.g., catastrophic cap effort- -review, research and adjustments).

• Monitor results of contractor testing efforts.

• Other activities as appropriate.

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

2.2 TMA provides a standing agenda for the teleconference with the meeting announcement.

Additional subjects for the meetings are identified as appropriate. Contractors are required to ensure representatives participating in the calls are subject matter experts for the identified agenda items and are able to provide the current status of activities for their organization. It is also the responsibility of the contractor to ensure testing activities are completed within the scheduled time frames and any problems experienced during testing are reported via the Government defined application (i.e., TestTrack Pro) for review and corrective action by TMA or their designee. Upon the provision of a corrective action strategy or implementation of a modification to a software application by TMA (to correct the problem reported by the contractor), the contractor is responsible for retesting the scenario to determine if the resolution is successful. Retesting shall be accomplished within the agreed upon time frame. Contractors are required to update the Government defined application (i.e.,TestTrack Pro) upon completion of retesting activities.

2.3 TMA will also document system issues and deficiencies into the Government defined application (i.e., TestTrack Pro) related to testing and production analysis of the contractors systems and processes.

Upon the provision of a corrective action strategy or implementation of a modification to a software application by the contractor (to correct the problem reported by TMA), the contractor is responsible for retesting the scenario to determine if the resolution is successful. Retesting shall be accomplished within the agreed upon time frame. The contractor shall correct internal system problems that negatively impact their interface with the Business to Business (B2B) Gateway, Military Health System (MHS), DMDC, etc. and or the transmission of data, at their own expense.

2.4 Each organization identified shall provide two Point of Contacts (POCs) to TMA to include telephone and e-mail contact and will be used for call back purposes, notification of planned and unplanned outages and software releases. POCs will be notified via e-mail in the event of an unplanned outage using the POC notification list, so it is incumbent upon the organizations to notify TMA of changes to the POC list.

3.0 ADP REQUIREMENTS

It is the responsibility of the contractor to employ adequate hardware, software, personnel, procedures, controls, contingency plans, and documentation to satisfy TMA data processing and reporting requirements. Items requiring special attention are listed below.

3.1 Continuity of Operations Plan (COOP)

3.1.1 The contractor shall develop a single plan, deliverable to the TMA CO on an annual basis that ensures the continuous operation of their Information Technologies (IT) systems and data support of TRICARE. The plan shall provide information specific to all actions that will be taken by the prime and subcontractors in order to continue operations should an actual disaster be declared for their region.

The COOP shall ensure the availability of the system and associated data in the event of hardware, software and/or communications failures. The COOP shall also include prime and subcontractor’s plans for relocation/recovery of operations, timeline for recovery, and relocation site information in order to ensure compliance with the TOM, Chapters 1 and 6. Information specific to connection to the B2B Gateway to and from the relocation/recovery site for operations shall also be included in the COOP. For relocation/recovery sites, contractors must ensure all security requirements are met and appropriate processes are followed for B2B Gateway connectivity. The contractor’s COOP will enable compliance with all processing standards as defined in the TOM, Chapter 1, and compliance with enrollment processing and Primary Care Manager (PCM) assignment as defined in TOM, Chapter 6. The COOP

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T should include restoration of critical functions such as claims and enrollment within five days of the disaster. The government reserves the right to re-prioritize the functions and system interactions proposed in the COOP during the review and approval process for the COOP.

3.2 Security Requirements

3.2.1 The contractor shall ensure security and access requirements are met in accordance with existing contract requirements for all COOP and disaster recovery activities. Waivers of security and access requirements will not be granted for COOP or disaster recovery activities.

3.3 Annual Disaster Recovery Tests

3.3.1 The prime contractor will coordinate annual disaster recovery testing of the COOP with its subcontractor(s) and the Government. Coordination with the Government will begin NLT 90 days prior to the requested start date of the disaster recovery test. Each prime contractor will ensure all aspects of the COOP are tested and coordinated with any contractors responsible for the transmission of TRICARE data. Each prime contractor must ensure major TRICARE functions are tested.

3.3.2 The prime contractor shall also ensure testing support activities (e.g., DEERS, TED, etc.) are coordinated with the responsible Government POC NLT 90 days prior to the requested start date of the annual disaster recovery test.

3.3.3 Annual disaster recovery tests will evaluate and validate that the COOP sufficiently ensures continuation of operations and the processing of TRICARE data in accordance with the TOM, Chapters 1 and 6. At a minimum, annual disaster recovery testing will include the processing of:

• TRICARE Prime enrollments in the DEERS contractor test region to demonstrate the ability to update records of enrollees and disenrollees using the Government furnished system application, DOES.

• Referrals

• Preauthorizations/authorizations

• Claims

• Claims and catastrophic cap inquiries will be made against production DEERS and the Catastrophic Cap and Deductible Database (CCDD) from the relocation/recovery site.

Contractors will test their ability to successfully submit claims inquiries and receive DEERS claim responses and catastrophic cap inquiries and responses. Contractors shall not perform catastrophic cap updates in the CCDD and DEERS production for test claims.

• To successfully demonstrate the ability to perform catastrophic cap updates and the creation of newborn placeholder records on DEERS, the contractor shall process a number of claims using the DEERS contractor test region.

• TED records will be created for every test claims processed during the claims processing portion of the disaster recovery test. The contractor will demonstrate the ability to process provider, institutional and non-institutional claims. These test claims will be

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T submitted to the TMA TED benchmark area.

3.3.4 Contractors shall maintain static B2B Gateway connections or other Government approved connections at relocation/recovery sites that can be activated in the event a disaster is declared for their region.

3.3.5 In all cases, the results of the review and/or test results shall be reported to the TMA Contract Management Division within 10 days of the conclusion of the test. The contractor’s report shall include if any additional testing is required or if corrective actions are required as a result of the disaster recovery test. The notice of additional testing requirements or corrective actions to be taken should be submitted along with the proposed date for retesting and the completion date for any corrective actions required. Upon completion of the retest, a report of the results of the actions taken should be provided to the CO within 10 business days of completion.

3.4 Information Security Compliance Programs

The Information Security Compliance under the NIST Program recognized by the DoD for non- DoD IS (defined as an IS that is not owned, controlled, or operated by the DoD, and is not used or operated by a contractor or other non-DoD entity exclusively on behalf of the DoD) that process Controlled Unclassified Information (CUI). Contracts governed by this manual are generally considered to be non-DoD IS. The contract shall state the governing Information Security Compliance Program to be utilized by the contractor.

3.4.1 Controlled Unclassified Information (CUI) and DoD Information Contractor IS

CUI is defined as “Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and Government-wide policies.” DoD information is defined as “information that is provided by the DoD to a non-DoD entity, or that is collected, developed, received, transmitted, used, or stored by a non-DoD entity in support of an official DoD activity, where that information has not been cleared for public release.” DoDI 8582.01. See also DoD Directive (DoDD) 5230.09, “Clearance of DoD Information for Public Release,” August 22, 2008. PII/PHI that is DoD information constitutues CUI because PII/PHI required safeguarding or dissemination controls unless it hass been cleared for public release.

3.4.2 NIST References and Related DoD Issuances

The references below support the IA requirements outlined in the following paragraphs.

• 48 CFR Parts 204, 212, and 252 as amended by 76 FR 69273 - 69282 / Vol. 78, No. 222 / Monday, November 18, 2013

• DoDD 5230.09, “Clearance of DoD Information for Public Release,” August 22, 2008

• DoDI 8582.01, “Security of Unclassified Department of Defense (DoD) Information on Non-DoD Information Systems,” June 6, 2012

• NIST Special Publication (SP) 800-53, Revision (Rev.) 4, “Security and Privacy Controls for Federal Information Systems and Organizations,” February 2014

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

• NIST SP 800-53A, Rev. 1, “Guide for Assessing the Security Controls in Federal Information Systems and Organizations,” June 2010

Note: Refer to DoDI 8510.01, “Risk Management Frameork (RMF) for DoD Information Technology (IT),” March 12, 2014 for RMF specific guidance.

3.4.3 Compliance with Federal Programs

The NIST-based IA program leverages a contractor’s compliance with existing Federal IA-related measures (i.e., HIPAA, Federal Information Security Management Act (FISMA), etc.) to attest to its readiness to process CUI DoD information on non-DoD IS. This IA program requires participating contractors to document compliance with the IA controls that are listed within 48 CFR 252.204-7012, Table 1 and described in detail within the NIST SP 800-53, Rev. 4, “Security and Privacy Controls for Federal Information Systems and Organizations, February 19, 2014 including updates” and SP 800-53A, Rev. 1, “Guide for Assessing the Security Controls in Federal Information Systems and Organizations, June 2010.” With respect to HIPAA Security Rule compliance, the contractor will follow the TOM, Chapter 19, Section 3, including TOM, Chapter 19, Section 3, paragraph 2.1.2.2 which requires contractor designation of a Security Official with specified responsibilities. Those responsibilities involve compliance with HIPAA Security Rule and TMA DoD Information Security Program requirements under this section.

3.4.3.1 Risk Management

Contractors certifying compliance with the NIST-based process accept sole responsibility for the risk(s) associated with developing and maintaining its IA readiness posture.

3.4.3.2 IA Compliance Requirement

The contractor shall provide and maintain its NIST-related compliance as required by the contract, in order to connect to government systems.

3.4.4 NIST Certification/Recertification Procedures

3.4.4.1 The NIST 800-53, Rev. 4 and NIST 800-53A, Rev. 1 certification process, as allowed by DoDI

8582.01 and applicable contract clauses, requires compliance by contractors for the protection of DoD information provided to, contained within and/or processed by contractor IS. The following process applies to the NIST-based IA certification process. See Contract Data Requirements List (CDRL) for information specific to deliverables, milestones, and due dates.

3.4.4.2 The contractor will be notified of the completion of the Government’s review and/or identifying areas that need additional information. The contractor shall respond within 10 calendar days.

3.4.5 Operation and Connectivity Decisions

3.4.5.1 The contractor shall complete and submit the NIST Certificate of Compliance in accordance with the CDRL.

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

3.4.5.2 The contractor shall submit a corrective action plan for any failure to achieve and/or maintain its compliance with the NIST-based IA program.

3.4.6 Documentation

The contractor will be provided with the most current version of the NIST Checklist and Written Determination Report (WDR) within 10 calendar days of contract award. If the contractor changes its compliance status with a vulnerability mitigation plan for any IA control shown on the NIST Checklist, the contractor shall submit an updated WDR statement within 10 calendar days.

3.4.7 Disposing of Electronic Media

Contractors shall follow the DoD standards, procedures and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoDI

8500.1 and NIST SP 800-53, Rev 4.

4.0 HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

The contractor shall be in compliance with the HIPAA Rules, the DoD HIPAA Issuances, the TOM, Chapter 19, Section 3, and any provisions of this manual and DoD cybersecurity guidance addressing security incident response. In particular, the contractor shall be in compliance with HIPAA breach response requirements, which are addressed in conjunction with DoD breach response requirements in the TOM, Chapter 1, Section 5.

4.1 Data Sharing Agreements (DSAs)

Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the TMA Privacy and Civil Liberties Office (Privacy Office) Data Sharing Program. This program requires TMA to enter into DSAs with parties outside the MHS who use or create MHS data. (TMA contracts may use the term Data Use Agreement (DUA) rather than DSA.) DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the prime contractor submits a Data Sharing Agreement Application (DSAA) to the TMA Privacy Office.

The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution. The DSAA template and other DSA guidance and forms are available at the following page on the Privacy Office web site: http://www.tricare.mil/tma/privacy/duas.aspx. Primary contractors and subcontractors requiring access to or use of MHS data must also complete an Account Authorization Request Form (AARF) and have an ADP / IT-II designation. Refer to ADP/IT Category Guidance below.

4.2 Disclosure Tracking and Accounting and Other System Capabilities for Privacy Act and HIPAA Privacy Compliance

Contractors shall maintain systems (or utilize MHS systems) with the capabilities to track and report on disclosure requests, disclosure restrictions, accounting for disclosure requests, authorizations, PII/PHI amendments, Notice of Privacy Practices (NoPP) distribution management, confidential communications requests, and complaint management. Situation reports may be required to address complaints, inquiries, or unique events related to the foregoing responsibilities.

http://www.tricare.mil/tma/privacy/duas.aspx http://www.tricare.mil/tma/privacy/duas.aspx http://www.tricare.mil/tma/privacy/duas.aspx

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

5.0 PRIVACY IMPACT ASSESSMENT (PIA)

5.1 Contractors are responsible for the employment of practices that satisfy the requirements and regulations of the E-Government Act of 2002 (Public Law 107-347); DoD 5400.16-R, “DoD Privacy Impact Assessment (PIA) Guidance,” February 12, 2009; and Office of Management and Budget Memorandum M-03-22, “OMB Guidance for Implementing the Privacy Provisions of the E-Government Memorandum Act of 2002,” September 26, 2003, at http://www.tricare.mil/tma/privacy/PIA-regulatory.aspx. When completing a PIA, the contractor is responsible for using the DoD-approved PIA Template, DoD Standard Form DD 2930.

5.2 The PIA is an analysis of how information is handled: (1) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy, (2) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic IS, and (3) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy and security risks. The PIA is a due diligence exercise in which organizations identify and address potential privacy risks that may occur during the various stages of a system’s lifecycle. Completion of the PIA process complements the privacy compliance requirements of the TOM, Chapter 1, Section 5 and Chapter 19, Section 3.

5.3 Contractors and their subcontractors shall follow the guidance outlined within the TMA PIA policy and the TMA PIA page located on the TMA Privacy web site: http://www.tricare.osd.mil/tma/ privacy/process-overview.aspx.

5.4 For new contracts and/or systems, contractors shall complete Section 1(a) of DD Form 2930 and review Section 1(b) and (c) to determine if a PIA is required. Following the instructions in the TMA PIA Guide, the contractor shall submit the completed DD Form 2930 to the TMA Privacy Office within 10 days of the development, or procurement of IT systems or projects that collect, maintain, or disseminate information in identifiable form from or about members of the public totaling at least 10 individuals. Systems that do not require a PIA must be routinely evaluated for changes that impact the requirements of the information collection. In the event of such a change, a completed DD Form 2930 must be submitted to the TMA Privacy Office.

5.5 For existing systems, contractors shall identify systems and submit a completed DD Form 2930 to the TMA Privacy Office. If a PIA was previously completed, the contractor shall review and update existing PIAs within three years of PIA approval date or when a change in privacy or security posture occurs. If a previously used system is to be retired, the contractor shall notify the TMA Privacy Office of the retirement date within 30 days of determining that status, and submit a completed DD Form 2930 for any new systems.

5.6 Contractors shall use the results of the PIA to identify and mitigate any risks associated with the collection of personal information from the public. Contractors shall submit the PIA using DD Form 2930 and the TMA PIA Guide to the TMA Privacy Office within 10 days of completion.

5.7 Upon completion of review by the TMA Privacy Office, contractors will be notified of any required corrections. Upon approval, the PIA summary submitted by the contractor will be made available to the public upon request via the TMA Privacy Office web site. The TMA Privacy Office will not publish any PIA summaries that would raise security issues, other concerns or reveal information of a proprietary or sensitive nature for the contractors. Corrective actions are to be provided within time frame designated in notification. The contractors are to review and update PIAs, in coordination with the TMA Privacy http://www.tricare.osd.mil/tma/privacy/process-overview.aspx http://www.tricare.osd.mil/tma/privacy/process-overview.aspx http://www.tricare.mil/tma/privacy/PIA-regulatory.aspx http://www.tricare.mil/tma/privacy/PIA-regulatory.aspx

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

Office, if there are system modifications or changes in the way information is handled that increase privacy risk.

6.0 PHYSICAL SECURITY REQUIREMENTS

The contractor shall employ physical security safeguards for IS/networks involved in the operation of its systems of records to prevent the unauthorized access, disclosure, modification, destruction, use, etc., of DoD SI and to otherwise protect the confidentiality and ensure the authorized use of SI. In addition, the contractor shall support a Physical Security Assessment performed by the government of its internal information management infrastructure using the criteria from the Physical Security Assessment Matrix. The contractor shall correct any deficiencies of its physical security posture required by the government. The Physical Security Audit Matrix can be accessed via the Policy and Guidance/Security Matrices section at http://www.tricare.osd.mil/tmis_new/ia.htm.

7.0 PERSONNEL SECURITY ADP/IT REQUIREMENTS

Personnel to be assigned to positions that require an ADP/IT-I or ADP/IT-II designation shall undergo a successful security screening before being granted access to DoD IT systems and/or any DoD/TMA data contained on any systems.

7.1 Formal Designations Required

In accordance with DoD Regulations, contractor personnel in positions requiring access to the following must be designated as ADP/IT-I or ADP/IT-II:

• Access to a secure DoD facility;

• Access to a DoD IS or a DoD Common Access Card (CAC)-enabled network;

• Access to DEERS or the B2B Gateway.

7.1.1 Employee Prescreening

7.1.1.1 Contractors shall conduct thorough reviews of information submitted on an individual’s application for employment in a position that requires either an ADP/IT background check or involves access via a contractor system to data protected by either the Privacy Act of 1974, as amended, or the HHS HIPAA Privacy and Security Final Rule. For contractors working in the United States and the District of Columbia, this prescreening shall include reviews that:

• Verify United States citizenship;

• Verify education (degrees and certifications) required for the position in question;

• Screen for negative criminal history at all levels (federal, state, and local);

• Screen for egregious financial history; for example, where adverse actions by creditors over time indicate a pattern of financial irresponsibility or where the applicant has taken on excessive debt or is involved in multiple disputes with creditors.

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

7.1.1.2 For contractors working outside the United States and District of Columbia, this prescreening shall include reviews that:

• Verify citizenship;

• Verify education (degrees and certifications) required for the position in question;

• Screen for negative criminal history, to the maximum extent possible as permitted by local laws of the host government;

• Screen for egregious financial history, to the maximum extent possible as permitted by local laws of the host government.

7.1.1.3 The prescreening shall be conducted as part of the preemployment screening and can be performed by the contractor’s personnel security specialists, human resource manager, hiring manager, or similar individual.

7.2 Interim Access to DoD IT Network/Systems

7.2.1 The Mission Assurance Division (MAD) Personnel Security Branch (PSB) will grant an applicant interim eligibility to access DoD IT network/systems upon confirmation of the following actions:

• Scheduling of background investigation by the Office of Personnel Management (OPM);

• Favorable results from the advance National Agency Check (NAC); and

• A favorable Federal Bureau of Investigation (FBI) fingerprint check.

7.2.2 MAD PSB will notify the Facility Security Officer (FSO) on the status of each applicant’s request for interim access. PSB will notify the FSO via e-mail regarding final adjudication.

7.3 ADP/IT Category Guidance

The guidance below shall be used when determining an individual’s specific ADP/IT level:

7.3.1 ADP/IT-I

7.3.1.1 Those positions in which the individual is responsible for the planning, direction and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. The required investigation for ADP/IT is a Single-Scope Background Investigation (SSBI) and the request format is the Standard Form (SF) 86, Questionnaire for National Security Positions.

7.3.1.2 The Periodic Reinvestigation (PR) requirement for ADP/IT-I requires the individual to submit a new SF 86 every five years from the date the last investigation was closed. The FSO shall track this information and initiate new investigations, as required by DoD regulations.

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

7.3.2 ADP/IT-II

7.3.2.1 Those positions in which an individual is responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the ADP/IT-I category to ensure the integrity of the system. The required investigation is equivalent to a National Agency Check with Law and Credit Check (NACLC). A request for a NACLC shall be submitted to MAD PSB on an SF 86.

7.3.2.2 The PR requirement for ADP/IT-II requires the individuals submit a new SF 86 every 10 years from the date the last investigation was closed. Updated fingerprints (electronic or FBI FD258 Fingerprint card) are not required for any type of periodic reinvestigation unless specifically requested.

The FSO shall track this information and initiate new investigations, as required by DoD regulations.

7.4 Additional ADP/IT Level I Designation Guidance

7.4.1 Contractors requiring ADP/IT-I Trustworthiness Determinations shall have their FSOs coordinate and submit a written request for final approval to the Contracting Officer’s Representative (COR) for endorsement and forwarding to MAD PSB via e-mail.

7.4.2 The request letter to the COR shall be signed by, at a minimum, the FSO or other appropriate executive. It shall include contact information for the security officer or other appropriate executive, and a detailed job description which justifies the need for the ADP/IT-I Trustworthiness Determination.

7.5 Transfers Between Contractor Organizations

7.5.1 When contractor employees transfer employment from one TMA contract to another TMA contract while their investigation is in process, the scheduled investigation may be applied to the new employing company. It shall be the new employing company’s responsibility to provide notification to MAD PSB when a current employee has transferred from another TMA contract . The notification must contain the following:

• Name of employee

• Name of new employing contractor company

• Effective date of the transfer/current employment

• Name of the former employing contractor company

• ADP/IT level applied for

• Effective date of termination from former company

7.5.2 Information can be sent by e-mail as a password protected attachment with the password sent in a separate e-mail, a PKI encrypted email or through the OPMIS Secure Portal to the MAD PSB

POC.

7.6 Process For Submitting Electronic Application For Positions of Trust

7.6.1 Responsibilities (Contractor) - Applicant

The applicant must satisfy the following requirements:

• Complete e-QIP

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

• Complete the required security documents to include, e-QIP signature pages, and the electronic fingerprints (e-fingerprints) through the FSO.

7.6.2 Responsibilities (Contractor) - FSO

7.6.2.1 The FSO must satisfy the following requirements:

• Be a contractor with a minimum NACLC investigation or equivalent

• Verify that applicant is an U.S. Citizen

• Serve as the applicant’s main POC

• Complete the required e-QIP training course given by MAD PSB

• Complete the TMA e-QIP Access User Form

• Initiate an e-QIP request for the applicant

• Select the appropriate Agency Use Block (AUB) template in e-QIP and coordinate with

COR

• Inform applicant(s) to begin e-QIP process

• Monitor the e-QIP request

• Cancel investigation requests and/or delete applicant(s)

• Receive signature pages from applicant and upload in e-QIP as an attachment.

• Submit applicant’s fingerprints electronically. The FSO can meet this requirement by either scanning the hardcopy fingerprint cards or through the use of LiveScan machine.

The electronic fingerprints will be submitted to OPM via Secure Web Fingerprint Transmission (SWFT).

• Non-cleared companies will e-mail the electronic fingerprint files through the OPMIS Secure Messaging portal to their MAD PSB reviewer. The MAD PSB reviewer will then submit the files via SWFT.

• After submission of the e-fingerprints, provide MAD PSB with the transaction number, date of transmission to OPM, and the e-QIP request number for the applicant.

7.6.2.2 Process For The COR

7.6.2.2.1 Complete the required e-QIP training course given by MAD PSB.

7.6.2.2.2 Once contacted by the FSO via e-mail, the COR will review and approve the AUB in e-QIP.

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

7.6.2.2.3 Process For a New FSO Without an Investigation

The minimum investigation required by OPM to obtain an e-QIP account is a favorably adjudicated NACLC or an equivalent investigation. If the contractor company FSO does not currently meet this investigation requirement, MAD PSB will initiate an investigation in e-QIP for completion by the FSO. The FSO will complete the required SF 86 in e-QIP and upload the following as attachments in e-QIP:

• Provide a copy of the electronic fingerprint transmittal number

• Signed Authorization to Release Information

• Signed Authorization to Release Medical Information

• Signed Certification Page

• Signed Fair Credit Reporting Disclosure and Authorization

7.7 New Contractor Personnel With Prior Investigation

7.7.1 A new contractor employee who has had a favorably adjudicated investigation with less than two years break in service does not need to complete the electronic questionnaire for ADP/IT requirements. The contractor’s FSO shall verify prior investigations, then notify MAD PSB of new contractor employees who have an acceptable investigation by sending a letter containing the individual’s full name, Social Security Number (SSN), date of birth, place of birth, and the closed date of the investigation.

7.7.2 This information should be sent to the MAD PSB point of contact by e-mail as a password protected attachment with the password sent in a separate e-mail, a PKI encrypted e-mail or through the OPMIS Secure Portal.

7.7.3 MAD PSB will verify the information provided in the e-mail and notify the FSO if the investigation is reciprocal to the required investigation, based on the contractor employee’s position or required access.

7.8 Requests For Additional Information

MAD PSB may require additional information from the contractor employee submitted for an ADP/IT-I or ADP/IT-II, while the investigation is in progress. The company FSO shall be notified to provide the requested information in the designated timeframe or the investigation may be rejected or returned unacceptable.

7.9 Notification Of Submittal And Termination, and Denial

7.9.1 The contractor company FSO shall notify the COR when an applicant’s e-QIP action is submitted so the AUB can be reviewed and approved in the designated timeframe.

7.9.2 If a contractor company moves a contractor employee to another of its TMA contracts, MAD PSB should be notified immediately. This notification is important particularly when a contractor employee is being moved from an unclassified contract to a classified contract.

7.9.3 When a contractor employee is terminated from the TRICARE contract, contractor companies shall notify the MAD PSB immediately. The contractor company FSO shall provide the MAD PSB the

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T following information on the employee. This information should be sent as a password protected attachment with the password sent in a separate e-mail, a PKI encrypted e-mail or through the OPMIS Secure Portal to the MAD PSB point of contact.

• Name

• SSN

• Name of the contracting company

• Termination date

7.9.4 MAD PSB shall notify FSOs when their contractor employee is denied access to TMA/DoD network/systems. Upon receipt of a denial letter from the MAD PSB, the FSO will immediately terminate the contractor’s direct access to all MHS IS, and if the employee was issued a CAC, confiscate and secure the CAC from the employee. The return receipt letter issued with the denial letter by the MAD PSB will be returned to show termination has been completed. The FSO shall confirm to the MAD PSB in writing not later than one week of the date of the letter that actions were taken to include the CAC being returned to the MAD PSB.

7.9.5 The contractor company FSO shall return CACs issued to terminated or denied contractor employees to the following address:

TRICARE Management Activity Mission Assurance Division ATTN: Personnel Security Branch 7700 Arlington Boulevard, Suite 5101 Falls Church, VA 22042-5101

8.0 PROCESS FOR SUBMITTING SF 86, “QUESTIONNAIRE FOR NATIONAL SECURITY POSITIONS,”

FOR CONTRACTOR PERSONNEL WORKING IN POSITION OF TRUST POSITIONS

8.1 Contractor personnel who do not have the appropriate level of investigation to obtain access to TMA/DoD IT systems or networks must complete the SF 86 located in e-QIP. Completed SF 86s will be submitted for processing through e-QIP to the MAD PSB. The requirement to use the SF 86 when requesting ADP/IT level investigations for contractors is implemented in accordance with OUSD(I) memo dated November 4, 2010, subject: Aligning OPM Investigative Levels with Reform Concepts.

8.1.1 MAD PSB will review, approve, and release the investigation form to OPM through the e-QIP system. If MAD PSB notices any discrepancies or the form is incomplete, it is returned to the FSO. The FSO notifies the MAD PSB when the form is corrected so it can be released by MAD PSB to the OPM.

Once the investigation is scheduled at OPM, the status will be posted in the Joint Personnel Adjudication System (JPAS) usually within three to five business days. For contractor companies that do not have JPAS access, MAD PSB will notify the FSO via e-mail, within three to five days of the scheduled date of investigation by OPM.

8.1.2 If the FSO does not receive e-mail notification of a scheduled investigation during the designated timeframe, the FSO shall contact the MAD PSB and request the status of the investigation.

Inquiries shall include the employee’s name, SSN and nature of the inquiry and sent by e-mail as a password protected attachment with the password sent in a separate e-mail, a PKI encrypted e-mail or through the OPMIS Secure Portal to the MAD PSB point of contact or by calling 703-681-6777.

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

8.1.3 In the event the contractor employee is no longer with the contracting company or no longer requires the ADP/IT level access, the contractor company FSO shall immediately notify the MAD PSB in writing via e-mail.

8.2 Electronic Questionnaires for Investigations Processing (e-QIP)

8.2.1 All contractor applications for ADP trustworthiness positions shall be submitted through the e-QIP system. e-QIP is a secure OPM web-based automated system that facilitates the processing of the following Standard Forms (SFs): SF 85 “Questionnaire for Non-Sensitive Positions,” SF 85P, “Questionnaire for Public Trust Positions,” and SF 86, “Questionnaire for National Security Positions.”

Only the SF 86 shall be used when processing contractor investigations in e-QIP.

8.2.2 In order to access the e-QIP System, all FSOs shall:

• Complete the required e-QIP training course given by MAD PSB; and

• Complete the TMA e-QIP Access User Form to the MAD PSB.

8.2.3 The MAD PSB Agency Administrator will assist the FSO with assigned and unassigned applicants in e-QIP. The e-QIP role of Program Manager is the responsibility of the agency.

9.0 PUBLIC KEY INFRASTRUCTURE (PKI)

The DoD has initiated a PKI policy to support enhanced risk mitigation strategies in support of the protection of DoD’s system infrastructure and data. DoD’s implementation of PKI requirements are specific to the identification and authentication of users and systems within DoD (DoDD 8190.3 and DoDI 8520.2). The following paragraphs provide current DoD PKI requirements.

9.1 User Authentication

All contractor personnel accessing DoD applications; and networks are required to obtain PKI enabled and Personal Identity Verification (PIV) compliant Government accepted credentials.

Contractor personnel with access limited to internal contractor systems and applications are not required to obtain PKI enabled and PIV compliant credentials. Such credentials must follow the PIV trust model (FIPS 201) and be acceptable to the government. Currently, to meet this requirement, contractors shall obtain Government-issued CACs. PIV compliant credentials are required for access to DoD systems, networks and data. Alternate sign on access will not be granted. They also allow encryption and digital signatures for information transmitted electronically that includes DoD/TMA data covered by the Privacy Act, HIPAA and SI and network requirements.

9.1.1 Process to Obtain a CAC

9.1.1.1 Verification Process for Contractor Employees Requiring CACs

Contractors must identify all contractor employees who will require a CAC to MAD PSB for verification prior to authorization for access to any TMA/DoD IS. CAC issuance is limited to contractor employees with job requirements for access to TMA/DoD Information Systems, or applications not available in the public domain (e.g., via web site to Public users). The following actions shall be taken upon identification of employees who will require a CAC:

General Automated Data Processing/Information Technology (ADP/IT) Requirements

D R A F T

9.1.1.2 For current TRICARE contracts, on official company letterhead, the FSO will shall submit a list containing the names and SSN for each employee requiring a CAC to the COR for review and approval before forwarding to MAD PSB.

9.1.1.3 For new contractor employees, on official company letterhead, the FSO shall submit a list containing the names and SSN for each employee requiring a CAC to the COR for review and approval before forwarding to MAD PSB.

9.1.1.4 The COR will e-mail an encrypted employee list (in accordance with TMA specified protocols) to the MAD PSB for verification of ADP/IT eligibility.

9.1.2 MAD PSB shall return the verified employee list to the COR providing notification that the CAC issuance process may continue for the eligible employee(s).

9.1.2.1 MAD PSB must receive the following information from OPM before granting interim access to TMA/DoD IS network and allowing a CAC to be issued:

• A background investigation must be scheduled by OPM, and

• The results of a favorable Advance NAC report.

9.1.2.2 In order to obtain a CAC, contractor personnel must first be sponsored by an authorized government representative (sponsor). This representative must be either an active military Service member or a federal civilian employee.

9.1.2.3 These requests shall include necessary personal and employment documentation for all personnel requiring CACs. The FSO shall submit this information to the COR and the COR will submit to MAD PSB for approval on the TMA form 33 by e-mail to MAD PSB:dhatass@dha.mil. The e-mail submission must be protected with a TMA-approved encryption method, and the information provided as a file attachment in XML (eXtensible Markup Language) format for initial startup.

9.1.2.4 The Trusted Agent (TA) will provide a user ID and password to each individual contractor employee (hereinafter “individual”) in order to access the Trusted Associate Sponsorship System (TASS) a web-based application. The TA will provide a unique user ID and password to each individual in a secure manner, e.g., directly provided to user in a written or verbal format.

9.1.2.5 The individual will use the user ID and password to log into TASS to complete and submit…