N0018320Q0094.docx

N0018320Q0094

Section A - Solicitation/Contract Form

THIS IS A SOLE SOURCE POSTING ONLY – A SOLE SOURCE AWARD WILL BE MADE FROM THIS NOTIFICATION AFTER POSTING PERIOD CLOSES. The purpose of this posting is to notify the public of the Government’s intention to make a Sole Source Award to Bayer Healthcare Systems for Medrad Contrast Injector Maintenance. See Section B for the requirements and Section C for the Performance Work Statement.

VENDOR TO COMPLETE THE FOLLOWING:

COMPANY NAME: ______________________

Vendor POC: ____________________

Vendor email: _________________________________

Naval Medical Center Portsmouth, VA Acquisition Office

Product/Services for: Naval Medical Center Portsmouth VA Biomedical Division

54 Lewis Minor Street Portsmouth VA 23708-2197

Vendor to reference RFQ Number: N00183-20-Q-0094 on all inquiries.

PAYMENT INFORMATION; Make Selection for Invoicing Purposes if Awarded Payment in Arrears (Check One): Monthly Quarterly _ Semi-Annually Annually *Please ensure that quoted price matches and is equally divisible by the choice above chosen

PROMPT PAYMENT

For Prompt Payment Act Purposes, this contract is:

Subject to the 7-calender day constructive acceptance period.

Note: Vendor will be required to provide billing electronically via the WAWF Electronic Invoicing Method. For additional information, a review of the following web sites may be required: websites: https://wawf.eb.mil or http://wawftraining Email: usn.detrick.navmedlogcomftdmd.list.nmlc-wawf@mail.mil

DISCOUNTS

The vendor's initial response to this RFQ should reflect the Vendors' best price including all allowable discounts that are available to the Federal Government. Please identify all discounts that are being offered as part of the vendor's quote submission. The government does not intend to go out for a best and final offer.

“AVAILABILITY OF FUNDS. Pursuant to Section I, Availability of Funds (FAR 52.232-18), of the contract, funds are not presently available for this contract. The Government’s obligation under this contract is contingent upon the availability of appropriated funds from which payment for contract purposes can be made. No legal liability on the part of the Government for any payment may arise until funds are made available to the Contracting Officer for this contract and until the Contractor receives notice of such availability, to be confirmed in writing to the Contracting Officer.”

Section B - Supplies or Services and Prices

Contrast Media Injector Maintenance

FFP

Bayer Medrad Contrast Media Injectors; See Equipment List and PWS for maintenance requirements and details of requested Injectors requiring maintenance.

Provide pricing breakdown of each requested serial number FOB: Destination

PURCHASE REQUEST NUMBER: N0018321RCMR066

PSC CD: J065

NET AMT

FFP

Bayer Medrad Contrast Media Injectors; See Equipment List and PWS for maintenance requirements and details of requested Injectors requiring maintenance.

Provide pricing breakdown of each requested serial number FOB: Destination

NET AMT

FFP

Bayer Medrad Contrast Media Injectors; See Equipment List and PWS for maintenance requirements and details of requested Injectors requiring maintenance.

Provide pricing breakdown of each requested serial number FOB: Destination

NET AMT

FFP

Bayer Medrad Contrast Media Injectors; See Equipment List and PWS for maintenance requirements and details of requested Injectors requiring maintenance.

Provide pricing breakdown of each requested serial number FOB: Destination

NET AMT

FFP

Bayer Medrad Contrast Media Injectors; See Equipment List and PWS for maintenance requirements and details of requested Injectors requiring maintenance.

Provide pricing breakdown of each requested serial number FOB: Destination

NET AMT

Section C - Descriptions and Specifications

BASE YEAR (01-OCT-2020 to 30-SEP-2021)

PERFORMANCE WORK STATEMENT (PWS)

Maintenance Services for Biomed Dept.-Naval Medical Center Portsmouth

PART 1

SCOPE OF WORK

1. GENERAL: This is a non-personal services contract to provide full contract support immediately upon award of a resulting order. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide full maintenance support for the items listed in Section B and all support items / components as defined in this PWS except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The Contractor shall be qualified / authorized by the OEM (IE: Certified Agent of the OEM) in the repair of all equipment listed within this contract. Certification of the OEM must be current (within 2 years) at all times prior to contract award and throughout contract period. Contractor and its employees shall maintain qualifications throughout entire contract period. In the event that a sub-contractor is used for this requirement, the sub-contractor must be a Certified Agent of the OEM. Qualification includes but not limited to the certification of all repair persons and repair facilities by the OEM as being trained / qualified to perform required repairs. The Government shall maintain the right to seek proof of qualification prior to award and anytime during contract period of performance. Additionally contractor must have ready access to parts inventory of OEM replacement parts.

1.3 Objectives: Equipment listed in this contract will be maintained to meet the original equipment manufacturer’s (OEM) specifications.

1.4 Scope: This contract shall provide for maintenance services which include on-site corrective repairs, normal working hour coverage (8:00 A.M. to 4:30 P.M. Monday through Friday excluding Federal holidays); emergency service and routine preventive maintenance services to Department of Defense owned equipment, as listed on the: DD Form 1449 “Order for Supplies or Services”. It shall include all systems, subsystem components, and assemblies, (i.e.: contractor responsible for total maintenance of entire system). All maintenance provisions shall apply to hardware, firmware, and software, as appropriate, unless otherwise stated.

1.5 Period of Performance: The period of performance shall be for one (1) base year plus four (4) option years.

GENERAL INFORMATION

1.6 Quality Control : The contractor shall develop and maintain an effective QCP to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which the contractor assures that the work performance complies with the contract requirements of the contract. [The QCP is to be delivered, within 30 days after contract award or with the contractor’s proposal if it is an evaluation factor, three copies of a comprehensive written QCP shall be submitted to the Contracting Officer (KO) and Contracting Officer Representative (COR) within 5 working days when changes are made thereafter.] After acceptance of the QSP the contractor shall receive the KO’s acceptance in writing of any proposed change to the QC system.

1.7 Quality Assurance : The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.8 Recognized Holidays:

1.9 Hours of Operation: The contractor is responsible for conducting business, between the hours of 8:00 A.M. to 4:30 P.M., Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.10 Place of Performance: The work to be performed under this contract will be at a government facility.

1.11 Type of Contract: The government will award a FFP Contract.

1.12 PHYSICAL Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.13 Key Control. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the KO.

1.13.01 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.13.02 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.13.02.1 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s QCP

1.14 Special Qualifications: The contractor is responsible for ensuring all employees possess and maintain current Information Assurance Technician (IAT) Level I professional certification during the execution of this contract.

1.14.01 The Contractor shall provide trained, experienced, English speaking personnel, labor, tools, diagnostic equipment, software, test phantoms, material, supplies, transportation, parts and equipment necessary to perform Preventive Maintenance (PM), Calibration (CAL), Safety testing (ST) and corrective maintenance.

1.14.02 The Contractor shall provide telephonic communications with the Government to discuss technical matters relating to the performance of this contract. A systems operator will be made available to answer technical questions regarding system operations and applications.

1.14.03 The Contractor Point of Contact (POC). Service calls shall be placed 24 hours a day, 7 days a week by calling a vendor supplied toll free response center. Qualified service reps are required to make a “best effort” to call back within 4-hours during normal business hours (8am – 5pm CST / Monday – Friday excluding Federal Holidays) to schedule service visit.

1.15 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.15.01 Contractors shall wear identifying badges at all times when conducting business inside a government facility.

1.15.02 To obtain a gate pass, refer to http://dbids.dmdc.mil/#!/register

1.16 Data Rights : The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.17 Organizational Conflict of Interest: It is the contractor’s responsibility to notify the KO of any potential Organizational Conflict of Interest (OCI). In the event that an OCI exist the contractor shall propose a Mitigation plan that shall be reviewed and accepted by the KO prior to continuance of the work that presents an OCI. Should the proposed Mitigation Plan is not accepted by the KO, the Government may terminate this contract, disqualify the Contractor from subsequent contractual efforts, and pursue any remedies as may be permitted by the law or this contract.

PART 2

DEFINITIONS & ACRONYMS

DEFINITIONS AND ACRONYMS:

DEFINITIONS

CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the government. This is the only individual who can legally bind the government.

CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service meet contract requirements.

SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

WORK WEEK. Monday through Friday, unless specified otherwise.

ACRONYMS:

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

GOVERNMENT FURNISHED ITEMS AND SERVICES:

The government will be responsible for maintaining the proper environment, including utilities and site requirements necessary for the system to function properly as specified by the OEM.

The Government will operate the system in accordance with the instruction manual provided by the OEM.

PART 4.0

4 CONTRACTOR FURNISHED ITEMS AND SPECIFIC TASKS

4.1 Government furnished property, Materials and Services.

The Contractor representative(s) at each site is encouraged to request a pre-maintenance inspection prior to the onset of the contract. As all apparent discrepancies must be identified upon submittal of quote, any and all claims must be received within 30 days of contract award or prior to contract start whichever occurs first. All non-apparent / hidden discrepancies must be identified no later than the first scheduled preventative maintenance. Any claims resulting from hidden defects must be received within 30 days of first scheduled preventative maintenance. Any equipment found to be inoperable during this pre-maintenance inspection would be repaired using a separate purchase order. The cost of repairs shall not exceed contractor’s normal retail rate for required repairs. The government certifies that the equipment to be maintained under this contract will be in good operating condition on the effective date of this contract. For the purpose of this contract, the clause, “good operating condition” means the conditions necessary for the equipment to function as intended without corrective maintenance. The Contractor agrees to leave the equipment in good operating condition at the expiration of this contract. During the final week of this contract, the Government will make final inspection of the equipment. Any correction of deficiencies noted during this inspection shall be resolved prior to contract end. The Government reserves the right to request the repair (at no additional cost to the Government) of items identified with latten defects after contract termination, when it has been determined that defects either are a result of contractor’s performance or should have been discovered during normal performance of work under this contract.

4.1.1 The Government will not be responsible for the damage or loss due to fire, theft, accident, or other disaster of Contractor supplies, materials, or for the personal belongings brought onto Government property by Contractor’s personnel.

4.2 Contractor Furnished Property and Material.

The Contractor shall provide all service literature, reference publications, laptop computers and diagnostic software to be used by the contractor service technicians and as required for the completion of the services in accordance with this contract.

4.3 Replacement Parts.

The Contractor shall have ready access to unique and/or high mortality replacement parts. All parts supplied shall be compatible with the existing system. In the event that replacements parts are required to be shipped. Shipping shall be performed in the fastest reasonable means possible (i.e., next day air) at no additional cost to the Government.

4.3.1 The Contractor shall at their expense, replace all worn or defective parts necessary to restore the equipment to 100% operational condition as specified by the OEM. Vendor is not responsible for consumable items.

4.3.2 Contractor installed replacement parts shall become the property of the Government and the replaced malfunctioning part shall become the property of the Contractor. Replaced items shall be properly disposed of at no additional cost to the Government (contractor to pay all “environmental fees” where required).

4.3.3 Freight, postage, and storage charges associated with shipment and receipt of replacement parts, and the return of parts shall be the responsibility of the Contractor.

4.3.4 All replacement parts shall be new and certified as OEM replacement parts. In the event that new parts are not available, rebuilt parts and sub-assemblies are allowed provided that they are warranted to be free of defects for a period of time that meets or exceeds warranties of similar replacement parts. The contractor shall specifically annotate on the final Field Service report the use and identification of rebuilt parts and the period of warranty. When discrepancies occur, the Government will make the final determination on whether a replacement part is of equal or better quality. Replacement parts must maintain the integrity of system / equipment certification to include compliance with any UL, AMA, JACHO, Manufacturer’s Certifications or any other certifications as they apply.

4.3.5 The Contractor must include software revisions and updates (field service changes), which are required due to FDA, or manufacturer announced safety-hazard recall, to include FDA Year 2000 Compliance Directive, as part of the contract at no additional cost to the Government. Updates shall be performed as soon as possible after release, but no later than the first scheduled Preventative Maintenance Inspection after release. For any updates that have been identified as critical, or required for the proper operation of equipment by the OEM, contractor shall provide installation within 30 days of release regardless of Preventative Maintenance Schedules. All supplied software is to be warranted current and free of defects such as viruses.

4.4 Contractor Report Requirements.

During normal duty hours, Contracted Field Service Engineer (FSE) personnel shall check-in with the Biomedical Engineering Division upon arrival at the Government site and again prior to departure. (Biomedical Engineering located in Build-250 1st floor; 757-953-5336). The Contractor FSEs shall personally notify Biomedical Engineering (BME) of problems that result in the equipment being left disabled upon their departure. After normal duty hours, Contractor FSE’s shall notify the Officer of the Day Desk (Bldg 2, 2nd Floor) and the systems operator designated by BME.

4.4.1 The Contractor shall provide to BME a full service report within two (2) days after completion of all service performed. The service report shall include, but not be limited to: contract number, equipment description (model, serial number, equipment control number) contractor’s log number, detailed description of the service(s) performed, replacement part(s) information (part number, part value, nomenclature, unit price, manufacturer, if not OEM, and whether the part is new/used/reconditioned), the completion date and time, man-hours expended, model and serial numbers, and the name of the FSE performing the service. In the event that agents / sub-contractors are used in the performance of repairs, said agent shall be identified on the service report by company name and contact information (i.e., telephone number). Additionally contractor will be required to affix a tag on equipment upon the completion of a preventative maintenance inspection. Tag may either be a “sticker” or “hanging tag”. As a minimum the tag shall contain: the name of the contractor, technician performing inspection and date of inspection legibly printed.

4.5 Contractor’s Responsibility.

4.5.1 The Contractor shall be responsible for the repair/replacement of damaged Government owned equipment and property due to the negligence of the Contractor or his representatives. All such replacement or repair shall be at the Contractor’s expense and shall be inspected to the satisfaction of the KO or appointed representative.

4.6 Preventive Maintenance Services.

4.6.1 In accordance with Naval Medical Logistics Command (NAVMEDLOGCOM) Risk Assessment Criteria, preventive maintenance shall be performed once a year in accordance with the Original Equipment Manufacturers (OEM) recommendations.

4.6.2 (The Government Fiscal Year runs: October through September). The Contractor shall make a best effort to schedule and complete preventive maintenance services prior to the 15th of the selected month, but no later than the last day of the month.

AS REQUESTED BY BIOMED

4.6.3 All test equipment used in the performance of this contract must be calibrated (if required / as required by manufacture of test equipment) and shall be in compliance with Joint Commission on Accreditation of Healthcare Organizations (JCAHO), Original Equipment Manufacturer (OEM) and Federal Drug Administration (FDA) standards as required.

4.7 Corrective Maintenance.

4.7.1 Normal working hour maintenance coverage will be Monday through Friday, between 8:00 A.M. to 4:30 P.M. A contractor Service Tech shall respond via telephone within 4 hours after receipt of trouble call, and make a best effort to provide on-site service no later than the close of business (4:30 pm) on the next business day. Vendor is to make a best effort to have all equipment operational within 72 hours of initial on-site response.

4.7.2 In the event that emergency service outside the normal working hours are required by the Government, additional work shall be billable to the Government at published commercial rates, and negotiated and approved by a Contracting Officer prior to services rendered.

4.7.3 Government request for corrective maintenance will be placed by BME, to the Contractor’s POC. Corrective Maintenance shall be completed during the hours specified in the contract.

4.7.4 The Contractor shall assign a unique Log/Reference Number to each Government request for corrective Maintenance.

4.7.5 Contractor’s response to requests for service may include telephone consultation with the equipment user/operator and a Contractor FSE. Telephone consultation shall: 1) provide instruction in determining operator error; 2) to determine the most likely cause of the problem; 3) to determine if resolution of the problem requires the dispatch of a FSE; and 4) to identify replacement parts likely to be required in order to return the equipment to 100% operational condition as specified by the OEM.

4.7.6 Contractor’s pricing shall be inclusive of all cost including parts, labor, travel and shipping, unless otherwise indicated. Any/all exclusions are listed as follows:

No Exclusions

4.7.7 The Contractor shall have his/her own service manuals, specifications, schematic diagrams, and parts lists to assist in the evaluation/repair of all equipment included in this contract.

4.8 Removal of Government Property.

4.8.1 Whenever the repair of equipment cannot be performed at the Government site as determined by the Contractor, the Contractor shall notify BME who will make arrangements for the Contractor to remove the item to the Contractor’s designated site. The Contractor may be required to sign a Government form accepting responsibility for the Government equipment. The Contractor shall provide a detailed description of removed items. For associated items / accessories, contractor to provide a detailed description and quantities of items to be removed. Description to include as a minimum manufacturers serial numbers and equipment control number (ECN) of all equipment / items removed. In the event that items / sub-assemblies / accessories are repaired via “Repair by Replacement” a detailed description of replaced items is to be included upon return of repaired components.

4.8.2 All charges resulting from a Contractor determined requirement to transport Government owned property, covered by this contract, to and from an alternate repair location shall be the responsibility of the Contractor.

4.9 Equipment Modification Upgrades.

4.9.1 The Contractor shall only incorporate OEM specified modifications, alterations and upgrades. Approval shall be obtained from BME prior to the Contractor installation of any modification, alteration, or upgrades.

4.9.2 The Contractor shall maintain contact with the OEM to determine the requirement for field modifications and to ensure accomplishment of these modifications in accordance with the time schedule set forth by the OEM.

4.9.3 The Government shall not alter the system without prior notification to the Contractor.

4.9.4 The contractor at no additional cost shall provide software updates to the Government. Installation of updates will be left to the discretion of the Government.

4.10 Service beyond the Scope of the Contract.

4.10.1 The Contractor shall immediately, but not later than 24 consecutive hours after discovery, notify BME, in writing, of the existence or the development of any defects in, or repair required to the scheduled equipment, which the Contractor considers they are not responsible for under the terms of this contract.

4.10.2 At the same time of the notification, the Contractor shall furnish BME with written estimate of the cost to make the necessary repairs. Repairs considered by the Contracting Officer to be outside the scope of this contract shall not be covered under this contract, but shall be ordered under a separate purchase order.

PART 5

APPLICABLE PUBLICATIONS

5 APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

5.4 The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

PART 6

ATTACHMENT/TECHNICAL EXHIBIT LISTING

6 Attachment List:

6.4 Attachment 1– Quality Assurance Surveillance Plan (QASP

6.5 Attachment 2– Deliverables Schedule

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLAUSES INCORPORATED BY REFERENCE

Section F - Deliveries or Performance

DELIVERY INFORMATION

30-SEP-2021

RECEIVING OFFICER

54 LEWIS MINOR STREET

BLDG. 250

PORTSMOUTH VA 23708-2297

757-953-5770 FOB: Destination N00183

30-SEP-2022

N00183

30-SEP-2023

N00183

30-SEP-2024

N00183

30-SEP-2025

N00183

Section G - Contract Administration Data

Section H - Special Contract Requirements

NMCARS-5237.102-90 ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION (ECMRA)

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for Naval Medical Center, Portsmouth via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) D, Automatic Data Processing and Telecommunications, IT and Telecom- Telecommunications Transmission (D304) and Internet (D322) ONLY;

(5) S, Utilities ONLY;

(6) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address https://www.ecmra.mil

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://www.ecmra.mil.

(End of Text)

BUSINESS ASSOCIATE AGREEMENT

Privacy, Access, Use, and Disclosure of Protected Health Information

1. Introduction. In accordance with 45 C.F.R. §§ 164.502(e)(2) and 164.504(e), and DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, this document serves as a Business Associate Agreement (BAA) between the signatory Parties for purposes of the HIPAA and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA issuances (both defined below). The Parties are (1) a DoD Military Health System (MHS) component command such as a Navy Medicine Medical Treatment Facility (MTF) (Naval Medical center or Naval hospital), or special mission command (research, public health, other), acting as a HIPAA covered entity, and (2) another Federal or Government organization, civilian academic institution, or other civilian entity, acting as a HIPAA Business Associate (BA). The HIPAA Rules require BAAs between covered entities and BAs. Implementing this BAA requirement, the applicable DoD HIPAA issuances (DoDM 6025.18) provides that requirements applicable to BAs must be incorporated (or incorporated by reference) into the contract or agreement between the Parties.

2. Definitions:

a. Terms. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules (DoDM6025.18-): Data aggregation, designated record set, disclosure, health care operations, individual, minimum necessary, notice of privacy practices, protected health information (PHI), required by law, secretary, security incident, subcontractor, unsecured PHI, and use.

b. Breach. means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other Personally Identifiable Information (PII) (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of “Breach” in DoD Privacy Act issuances as defined herein.

c. BA. shall generally have the same meaning as the term “BA” in the DoD HIPAA issuances, and in reference to this BAA, shall mean the entity (another Government organization, civilian academic institution, or other civilian organization), entering into agreement with a Navy Medicine MTF or special mission command.

d. Agreement. means this BAA together with the documents or other arrangements under which the BA signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

e. Covered Entity. shall generally have the same meaning as the term “covered entity” in the DoD HIPAA issuances, and in reference to this BAA, shall mean a Navy Medicine MTF or special mission command under the Bureau of Medicine and Surgery.

f. DHA Privacy Office. means the Defense Health Agency (DHA) Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate.

g. DoD HIPAA Issuances. means the DoD issuances implementing the HIPAA Rules in the DoD MHS. These issuances are DoDM 6025.18 Implementation of the HIPAA Privacy Rule in DoD Health Care Programs,” March 13, 2019; DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs of December 2009, and DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs of August 2015.

h. DoD Privacy Act Issuances. means the DoD issuances implementing the Privacy Act, which are DoD Directive 5400.11, DoD Privacy Program of 29 October 2014, and DoD 5400.11-R, Department of Defense Privacy Program of 8 May 2007.

i. HIPAA Rules. means, collectively, the HIPAA privacy, security, breach and enforcement rules, issued by the United States (US) Department of Health and Human Services (HHS) and codified at 45 C.F.R. §§ 160 and 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and 45 C.F.R. § 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules which implemented the “HITECH Act” provisions of Publication L. 111-5. See 78 Federal Regulation 5566-5702 of 25 January 2013 (with corrections at 78 Federal Regulation 32464 of 7 June 2013. Additional HIPAA rules regarding electronic transactions and code sets (45 C.F.R. § 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

j. HHS Breach. means a breach that satisfies the HIPAA Breach Rule definition of “Breach” in 45 C.F.R. § 164.402.

k. Service-Level Privacy Office. means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

3. Obligations and Activities of BA:

a. The BA shall not access, use, or disclose PHI other than as permitted or required by this Agreement, the controlling Memorandum of Understanding (MOU) or training affiliation agreement, or as required by law.

b. The BA shall use appropriate safeguards and comply with the DoD HIPAA Rules with respect to electronic PHI to prevent use or disclosure of PHI other than as provided for by this Agreement, the controlling MOU, or law.

c. The BA shall report to the covered entity any Breach of which it becomes aware and shall proceed with breach response steps required by paragraph 7 (Breach Response) of this BAA. With respect to electronic PHI, the BA shall also respond to any security incident of which it becomes aware in accordance with any information assurance provisions of the Understanding. If at any point the BA becomes aware that a security incident involves a breach, the BA shall immediately initiate breach response as required by paragraph 7 (Breach Response) of this BAA.

d. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii)) and 164.308(b)(2), respectively, as applicable, the BA shall ensure that any entities that create, receive, maintain, or transmit PHI on behalf of the BA agree to the same restrictions, conditions, and requirements that apply to the BA with respect to such PHI.

e. The BA shall make available PHI in a designated record set, to the covered entity or, as directed by the covered entity, to an Individual, as necessary to satisfy the covered entity obligations under 45 C.F.R. § 164.524.

f. The BA shall make any amendment(s) to PHI in a designated record set as directed or agreed to by the covered entity pursuant to 45 C.F.R. § 164.526, or take other measures as necessary to satisfy covered entity’s obligations under 45 C.F.R. § 164.526.

g. The BA shall maintain and make available the information required to provide an accounting of disclosures to the covered entity or an individual as necessary to satisfy the covered entity’s obligations under 45 C.F.R. § 164.528.

h. To the extent the BA is to carry out one or more of the covered entity’s obligation(s) under the HIPAA privacy rule, the BA shall comply with the requirements of HIPAA privacy rule that apply to the covered entity in the performance of such obligation(s).

i. The BA shall make its internal practices, books, and records available to the Secretary and the covered entity for purposes of audit and in determining compliance with the HIPAA Rules.

4. Permitted Uses and Disclosures by BA:

a. The BA may only use or disclose PHI as necessary to perform the services set forth in the Understanding or as required by law. The BA is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 C.F.R. § 164.514(a) through (c), nor is it permitted to use or disclose de-identified PHI except as provided by the Understanding or directed by the covered entity.

b. The BA agrees to use, disclose, and request PHI only in accordance with the HIPAA privacy rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA issuances.

c. The BA shall not use or disclose PHI in a manner that would violate the DoD HIPAA issuances or HIPAA privacy rules if done by the covered entity, except uses and disclosures for the BA’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs:

(1) Except as otherwise limited in the understanding, the BA may use PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(2) Except as otherwise limited in the Understanding, the BA may disclose PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA, provided that disclosures are required by law, or the BA obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the BA of any instances of which it is aware in which the confidentiality of the information has been breached.

(3) Except as otherwise limited in the Understanding, the BA may use PHI to provide Data Aggregation services relating to the covered entity’s health care operations.

5. Provisions for Covered Entity to Inform BA of Privacy Practices and Restrictions:

a. The covered entity shall provide the BA with the notice of privacy practices that the covered entity produces in accordance with 45 C.F.R.§ 164.520 and the corresponding provision of the DoD HIPAA issuances (DoDM 6025.18).

b. The covered entity shall notify the BA of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the BA’s use or disclosure of PHI.

c. The covered entity shall notify the BA of any restriction on the use or disclosure of PHI that the covered entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such changes may affect the BA’s use or disclosure of PHI.

6. Permissible Requests by Covered Entity. The covered entity shall not request the BA to use or disclose PHI in any manner that would not be permissible under the HIPAA privacy rule or any applicable Government regulations (including without limitation, DoD HIPAA issuances) if done by the covered entity, except for providing Data Aggregation services to the covered entity and for management and administrative activities of the BA as otherwise permitted by this BAA.

7. Breach Response:

a. General. Breach Response is designed to satisfy the DoD Privacy Act issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA issuances. In general, the BA shall report the breach to the covered entity, assess the breach incident, notify affected individuals, and take mitigating actions, as applicable. Because DoD defines “Breach” to include possible (suspected) as well as actual (confirmed) breaches, the BA shall implement these breach response requirements immediately upon the BA’s discovery of a possible breach. The following provisions set forth the BA’s Privacy Act and HIPAA breach response requirements for all breaches, including but not limited to HHS breaches (defined below). In the event of a breach of PII or PHI held by the BA, the BA shall follow the breach response requirements set forth under paragraphs 7, 8, and 9 of this BAA, which are designed to satisfy both the Privacy Act and HIPAA, as applicable.

(1) If a breach involves PII without PHI, then the BA shall comply with DoD Privacy Act issuance breach response requirements only.

(2) If a breach involves PHI (a subset of PII), then the BA shall comply with both Privacy Act and HIPAA breach response requirements.

(3) If a breach involves PHI, it may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the BA has no HIPAA breach response obligations. In such cases, the BA must still comply with breach response requirements under the DoD Privacy Act issuances.

b. HHS Breach. If the DHA Privacy Office determines that a breach is an HHS Breach, then the BA shall comply with both the HIPAA Breach Rule and DoD Privacy Act issuances, as directed by the DHA Privacy Office, regardless of where the breach occurs.

c. Non-HHS Breach. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the BA shall comply with DoD Privacy Act issuances, as directed by the applicable Service-Level Privacy Office.

d. Service-Level Privacy Office Point of Contact (POC). Brian Martin, who may be reached at Comm: 904-542-3559, DSN: 312-942-3559, or via E-mail: brian.k.martin4.civ@mail.mil, or usn.ncr.bumedfchava.list.bumed-pii-rpt@mail.mil.

8. Breach Reporting Provisions:

a. The BA shall report the breach within 1 business day of discovery to the US Computer Emergency Readiness Team (US-CERT) and within 24 hours of discovery to the DHA Privacy Office and the other Parties set forth below. The BA is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer, or other agent of the BA.

b. The BA shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report. Before submission to US-CERT, the BA shall save a copy of the on-line report. After submission, the BA shall record the US-CERT Reporting Number.