N0018924RZ112 Combined Synopsis-Solicitation.pdf

This is a COMBINED SYNOPSIS/SOLICITATION for commercial services prepared in accordance with the information in FAR Subpart 13 in conjunction with 15, as supplemented with the additional information included in this notice. This announcement constitutes the only solicitation; a written solicitation will not be issued. Paper copies of this solicitation will not be available. This combined synopsis/solicitation will be posted on both Contract Opportunities (https://sam.gov) and NECO

(https://www.neco.navy.mil).

The reference number is N0018924RZ112. The proposed contract action is for commercial services, in accordance with the Performance Work Statement. The NAICS code is 541690 Other Scientific and

Technology Consulting Services. and the Small Business Standard is $19 million. It is the responsibility of the contractor to be familiar with the applicable clauses and provisions. The clauses may be accessed in full text at these addresses: https://www.acquisition.gov/browse/index/far and http://www.acq.osd.mil/dpap/dfars/index.htm.

The Naval Supply Systems Command (NAVSUP) Fleet Logistics Center Norfolk (FLCN) BUMED/FMC

Directorate intends to solicit for Knowledge Based Services in accordance with the Performance Work

Statement (PWS) via 100% Full and Open Competition.

THIS SOLICITATION IS BEING ISSUED USING PROCEDURES, IN ACCORDANCE WITH FAR

PART 13 and 15.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 9 Months Psychological Health Outreach Program

FFP

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 September 2024 - 19 June 2025

FOB: Destination

PSC CD: R499

NET AMT

https://www.acquisition.gov/browse/index/far http://www.acq.osd.mil/dpap/dfars/index.htm

0002 Lot Travel

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 September 2024 - 19 June 2025

ESTIMATED COST

0003 Lot Marketing Materials

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 September 2024 - 19 June 2025

1001 12 Months OPTION Psychological Health Outreach Program

FFP

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2025 - 19 June 2026

1002 Lot OPTION Travel

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2025 - 19 June 2026

1003 Lot OPTION Marketing Materials

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2025 - 19 June 2026

2001 12 Months OPTION Psychological Health Outreach Program

FFP

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2026 - 19 June 2027

2002 Lot OPTION Travel

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2026 - 19 June 2027

2003 Lot OPTION Marketing Materials

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2026 - 19 June 2027

3001 12 Months OPTION Psychological Health Outreach Support

FFP

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2027 - 19 June 2028

3002 Lot OPTION Travel

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2027 - 19 June 2028

3003 Lot OPTION Marketing Materials

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2027 - 19 June 2028

4001 12 Months OPTION Psychological Health Outreach Support

FFP

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2028 - 19 June 2029

4002 Lot OPTION Travel

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2028 - 19 June 2029

4003 Lot OPTION Marketing Materials

COST

In accordance with the Performance Work Statement (PWS).

Period of Performance: 20 June 2028 - 19 June 2029

PERFORMANCE WORK STATEMENT

Performance-Based Work Statement for

Navy and Marine Corps Reserve Psychological Health Outreach Program and Returning Warrior Workshop

Support Services

In support of Chief, Bureau of Medicine and Surgery (BUMED)

29 March 2024

1. Introduction

The Navy Bureau of Medicine and Surgery (BUMED) is the headquarters for the Navy Medicine enterprise. Under the leadership the Navy surgeon general and chief, BUMED, Navy Medicine ensures Sailors, Marines and their families and retirees are healthy, ready and on the job – be it on land or sea. The Mental Health (N10C3) mission is to sustain and support the psychological readiness of an integrated American Naval Power through a robust continuum of high-quality mental health care programs and resources accessible to Sailors and Marines from accession to retirement or separation. The BUMED Psychological Health Outreach Program (PHOP) is an all encompassing program dedicated to providing Reservists full access to appropriate psychological health care services, increasing resiliency, and facilitating recovery, which is essential to maintaining a ready military force.

2. Background

PHOP directly supports approximately 128 Navy Reserve Centers (NRC) & 180 Home Training Centers (HTC) as well as the six(6) Marine Force Reserve HTCs. PHOP is required for Readiness as Reservists returning from deployments face unique challenges that can cause increased stress in their lives and exacerbate deployment stress injuries such as Post Traumatic Stress Disorder (PTSD) or Traumatic Brain Injury (TBI). Reservists face access to care challenges, since their eligibility and access to military or Veteran Affairs (VA) health care is dependent on many factors. BUMED uniquely designed PHOP to serve the needs of Reservists and their families and to address long-term needs for support identified by Congress, multiple Task Forces and reports and studies without creating a new entitlement.

3. Scope

BUMED requires services to provide Psychological Health (PH) Outreach support for both individual Reservists and command units within Navy Reserve Force Commands (NAVRESFOR or NR) and Marine Forces Reserve

(MARFORRES or MFR) as part of BUMED’s PH Reserve Program. The goals of the PHOP are: 1) to create a PH

“safety net” for Reservists and their families, who are at risk for not having stress injuries identified and treated in an expeditious manner; 2) to improve the overall PH of Reservists and their families; and 3) to identify long-term strategies to improve PH support services for Reservists and their families.

BUMED also requires facilitation support for each of approximately six (6) annual Navy Returning Warrior

Workshops conducted across the continental United States and its territories. The 2-day weekend workshop is designed to support re-integration of deployed service members and their family using a program that: 1) assists members and their families to identify immediate and potential PH issues during post-deployment reintegration; 2) provides resources to assist with PH-related issue resolution; 3) encourages members to share common experiences in a nonthreatening safe environment; 4) honors members and families for sacrifices endured; and 5) engages members and families in process improvement.

Historically, the average case load is approximately 300 per staff member annually, but some staff screen/manage up to 600-700 cases per year. There are approximately 160 Marine HTCs and 127 Navy NRCs. The number of HTCs, NRCs, and Reservists and their families will fluctuate.

4. Tasks

4.1. Client Outreach Support

4.1.1. Assess the stressors and needs of approximately 15,000 Reservists annually who are referred to them from a Deployment Health Assessment or PHA screening, Medical Department Representatives, unit

Commanding Officer, the NRC/HTCs staff, self-referral, family members or friends, or by other means.

4.1.1.1. Shall make initial contact with the referred Service member within 24 hours of receipt of the referral and determine any PH issues that may require mental health care services or other psychosocial intervention.

4.1.1.2. All data is to be input on Qualtrics.

4.1.1.3. Assessment forms are available on Qualtrics.

4.1.1.4. Referral and Case Management data maintained on DoD CMS and requires CAC to access.

4.1.2. Assist the Reservist with Line of Duty (LOD) determination processing, if the reason for referral is suspected to be service connected, and help the Reservist to receive required care through the

Military Health System, Veterans Health Administration, or other Federal and State or local civilian assets, following the proper Navy Reserve administrative protocols provided by the Government.

4.1.3. If the psychological health issue is not service connected, the contractor shall assist the Reservist with obtaining needed services either from the Veterans Health Administration (if eligible), TRICARE Reserve Select providers (if enrolled), civilian mental health care providers, or other local community services (chaplain, support groups, etc.), as appropriate.

4.1.4. Coordinate with the Reserve Force Surgeon, Medical Department Representatives, or Reserve

PostDeployment Health Assessment (PDHA) program manager to identify those reservists who were provided referrals to mental health and medical care as a result of the PDHRA or other assessments

(e.g., PHA), and contact these reservists with follow-up phone calls or other means of contact to encourage them to keep their appointments.

4.1.4.1. The government estimates there to be approximately 36,000 follow-ups completed across the program annually.

4.1.4.2 May be appointed Installation DPH by the Commanding Officer of the NRC/HTC to provide

Psychological Health outreach support for reservist and commands.

4.1.5. Follow each referred Reservist through to the resolution of that member’s case. For seriously injured

Reservists with PH issues that are referred, follow-up may continue through rehabilitation, recovery and reintegration, whether it is return to active reserve status, or resolution through the Disability

Evaluation System.

4.1.5.1. The contractor shall document all cases as to reason for referral, services provided (e.g., assistance with LOD, assistance with appointments at MTF, VA, civilian health care provider, chaplain, other), follow up with member on status, resolution of psychological health issues.

4.1.5.2. Follow up is based on a level of risk assessment - more frequent follow up on higher risk, based on the Operational Stress Continuum (OSC) rating scale, which has four categories:

Green/Ready, Yellow/Reacting, Orange/Injured, and Red/Ill:

4.1.5.2.1. The following timeline for outreach is utilized:

4.1.5.2.2. Green/Ready: Initial outreach within 72 hours and biweekly thereafter.

4.1.5.2.3. Yellow/Reacting: Initial outreach within 72 hours and biweekly thereafter.

4.1.5.2.4. Orange/Injured: Initial outreach within 48 hours and weekly thereafter.

4.1.5.2.5. Red/Ill: Initial outreach within 24 hours and 2 times per week thereafter.

4.1.6. Provide approximately 750 monthly outreach telephone calls across the program to all Reservists identified as having returned from deployment within the past six months to determine whether they require additional assessment for any possible psychological health issues.

4.1.7. Facilitate access to PH/resilience and family support resources for Reserve family members.

4.1.8. Provide a minimum of one brief at each NRC/ HTC visit and in response to incidents at Navy and

Marine Corps Mobilization Processing Sites and NRC/HTC sites to demobilizing Reservists on the identification of signs and symptoms of stress related issues, suicide prevention, other psychological health/resilience topics requested or identified as appropriate and on the Reserve Psychological

Health Outreach Program.

4.1.8.1. For FY 23, approximately 13,272 referrals were processed, 656 on-site visits were conducted, and 1,007 briefs were conducted.

4.1.9. Support deployment cycle (pre and post) command activities for reservists and their families, including providing screening, briefings and education/training (e.g. RWWs, DRTs or other Yellow

Ribbon Reintegration Program events, etc.).

4.1.9.1. FY 23 support was provided for 35 virtual events, 27 in-person events, and 351 other visits/meetings.

4.1.10. Maintain and publicize an after-hours telephone watch bill to accept and respond to communications from clients and commands.

4.1.10.1. Currently, the telephone system offers simultaneous ring to all staff members in a geographic region during regular business hours. After business hours, the system offers ring to staff members that are on-call at any given time. “After hours” refers to the time outside normal business hours as defined by PWS section 5.3.

4.1.10.2. FY 23 average calls 1,200

4.2. Command Outreach Support

4.2.1. Provide outreach visits to every NRC/HTC location, by at least one team member, at least twice per year of contract performance. During these visits, the contractor shall provide psychological health outreach and educational/training services, including Operational Stress Control Awareness and

Suicide Prevention to Medical Department Representatives (MDRs), Reserve Unit Leadership and

Reserve service members and families, assess unit members to detect possible stress injuries using

BUMED-approved PH screening tools, and assist members identified as needing referrals to get the necessary follow-up care with an expected reach of 40,000 Reservists and their family members.

4.2.1.1. 256 On-Site NRC/HTC visits made in FY 23

4.2.1.2. 359 On-Site Visits to HTCs

4.2.2. Refer any reservist identified as needing follow-up PH care to the Client Outreach Support Team for continued assistance and follow up. On average, the contractor could provide 3 referrals/resources to each of the 15,000 persons attempted to assess.

4.2.3. Provide support to an afterhours telephone watch to accept and respond to communications from clients via a toll-free number. The contractor will assume responsibility of the existing phone number.

4.2.3.1. All marketing materials and messaging related to the contractor clearly states that they are not a crisis program and do not provide emergency services.

4.2.3.2. The contractor must have an automated message set up on the toll-free line to redirect callers to the appropriate agency if they are currently in crisis or experiencing an emergency. All other non-emergency calls or emails can be responded to within 24 hours.

4.2.4. The contractor shall support the Resiliency Check-in process including creation of the After Action

Reports (AAR), creating cases, uploading behavioral health screenings, etc. The contractor shall also assist with the tracking and dissemination of referrals from sources such as PDHRAs, SAIL, MIP, SITREPs, etc. to ensure timely follow-up and follow through to case completion. The DoD Case

Management System is a referral database that may be used by the contractor. PHOP is designed with a tiered approach to care. A reservist may self-refer or be referred by another source such as the

Command, Sailor Assistance and Intercept for Life (SAIL), Marine Intercept Program (MIP), serial

Deployment Health Assessments, Returning Warrior Workshop, Deployment Readiness Training events, Force Surgeons, Family Days, Chaplains, a family member, or peer.

4.2.5. Provide psychological support, assessment or training using BUMED-approved tools (e.g. Combat

Operational Stress First Aid) of Reservists and their family members in the aftermath of a natural disaster (such as a Hurricane), terrorist attack or other crisis/emergency (e.g. command request for support or assistance after a suicide or other death in the unit). The PHOP project manager will review with the contractor any requirements from the Command or Navy or Marine Reserve leadership or BUMED that is received.

4.2.6. When other local services are not immediately available, and when determined to be an emergency, the contractor personnel shall provide crisis counseling and emergent PH interventions.

4.3. Returning Warrior Workshop Facilitation Support

4.3.1. All contractor personnel supporting this direct task shall attend 1-day facilitator training on the

Friday prior to the scheduled Workshop. Historically, there are approximately 6 workshops per year.

The government will conduct facilitator training.

4.3.2. Monitor and assess attendees for any psychological health issues that may arise during the Workshop and refer if necessary to Chaplains in attendance or elsewhere if required.

4.3.3. Notify PHOP of any service member identified as needing further evaluation for mental health services.

4.3.4. At Awards Banquet, the contractor shall facilitate conversations and assist with awards.

4.3.5. Observe, analyze, and make recommendations for improvements to the facilitating process.

4.4. Program Management

4.4.1. The contractor shall ensure attendance at other meetings a minimum of once a month to support the

BUMED Program Manager, which has historically be done via teleconference, or as part of Outreach

Coordinators serving in the role of the Regional Reserve Director of Psychological Health to support reservists and their families PH/resilience (e.g., State Meetings for Guard and Reserve PH, Family

Readiness Coordinating Committees, Force Preservation Councils/Committees, Command Resilience

Team Meetings, Department Head Meetings, etc.

4.4.2. Site Visits

4.4.2.1. Within 90 days after the contract award, the contractor must complete site visits to meet command leadership.

4.4.2.2. Conduct site visits to each Reserve CO on an annual basis for onsite review of the program deliverables and progress to date.

4.4.3. Data Analysis/Statistics: The contractor shall organize and analyze the program data from Qualtrics.

The data shall be provided in a monthly progress report that both enumerates and provides qualitative data on the number of outreach services, to include virtual, the contractor provides at each of the sites. The monthly report shall include the following information:

4.4.3.1. For Client Outreach Support:

4.4.3.1.1. Number of reservists referred to PHOP, broken out by source of referral: PDHRA screening; referred by Commanding Officer; self-referral; referred by family member; or other; date of referral; and date of initial contact.

4.4.3.1.2. Number of recently returned Reservists provided to PHOP for outreach services and follow up.

4.4.3.1.3. Number of client contacts made by phone calls, actual visits.

4.4.3.1.4. Status of each case being tracked - referred to mental health services in military facilities, VA facilities, civilian providers, Military One Source, chaplains, etc.

4.4.3.1.5. When available, the number and status of Reservists being processed for an LOD, determinations by their parent Reserve activity, and the status of those LODs.

4.4.3.1.6. Number of family support requests.

4.4.3.1.7. Site visits or other approved Travel: locations, dates, team members who made the visit, activities performed.

4.4.3.1.8. Number/type of outreach services provided by PHOP to demobilizing Reserve units, number of unit members assessed during visits, and the number of reservists requiring referrals and follow care.

4.4.3.1.9. Number/type of outreach services provided by Team members to Reservists and their family members who experience psychological trauma as a result of a natural disaster

(such as Hurricane) or terrorist attack, or other full crisis/emergency (e.g., post suicide event).

4.4.3.1.10. Number of RWW Facilitators provided for each Workshop that was held.

4.4.3.1.11. Number of referrals made to PHOP by RWW Facilitators.

4.4.3.1.12. Referral outcomes and analysis on Reservists to include suicide/high risk behaviors.

4.4.3.2. For Command Outreach Support

4.4.3.2.1. Client satisfaction with PHOP services (pre and post screening and referral) using a web-based survey mechanism and/or point of service outcome measure—coordinate with COR

4.4.3.2.2. Command Satisfaction

4.4.3.2.3. Perception of change and impact (pre and post screening and referral) coordinate with

COR

4.4.3.2.4. Psychological Impact --pre and post screening and referral

4.4.3.2.5. Assessment of level of risk as it relates to clients presenting with suicidal or homicidal ideation, suicide attempts, and completions.

4.4.3.2.6. Client satisfaction post psycho-educational education briefs (ex. OSC Awareness brief, Suicide Prevention Brief, other PH/resilience training).

4.4.3.2.7. Demographics and data collected via Behavioral Healthcare Screenings or other any other assessment tools approved by BUMED or required for Program Evaluation by the government. Creation and updating of Standard Operating Procedures (SOPs).

4.4.4. On an annual basis, the contractor shall submit a written report on the successes and challenges with the program. The report should also address gaps in services, and recommendations to address the needs of the target population both short term and long term. The COR shall receive the report 30 days after completion of each Fiscal Year within the current contract year.

4.4.5. Training/Quality Assurance: The contractor shall support Quality Assurance checks of Client and

Command Outreach Support Team member proficiency, skills, documentation, and knowledge as well as ongoing training needed to ensure the highest quality of outreach and case management services.

4.5. Advertising Support

4.5.1. The contractor shall advertise services available under this contract through the provision of marketing material, including printed informational items and marketing material supporting the program goals and PH/resilience.

4.5.2. The contractor shall develop and distribute printed material (brochures and additional marketing materials), approved by COR, to advertise PHOP, providing a description of the services and contact information for each PHOP team. These brochures will be distributed during site visits and other opportunities (RWWs, DRT, demobilization briefs, etc.).

4.5.2.1. Marketing materials may include:

4.5.2.1.1. Glossy trifold PHOP brochures.

4.5.2.1.2. 2-sided 8 X11 glossy PHOP fliers.

4.5.2.1.3. Closed back PHOP table throws with carrying case for 6-foot draped tabletop displays.

4.5.2.1.4. Retractable PHOP banner displays with carry case for travel to the PHOP teams.

4.5.3. Contractor shall maintain supply of brochures, information materials and fliers needed to meet the demand of clients and commands assigned.

4.5.4. Provide informational marketing materials subject to Government approval on psychological health/resilience topics (e.g. PTSD, Reintegration, Sleep, etc.) shall be obtained/developed and distributed during NRC/HTC site visits and other opportunities (DRT, RWW, family events, demobilization briefs, etc.) or mailed to provide awareness information to commands, service members or their families. Printed marketing items include:

4.5.4.1. 250 Complete Unit Engagement/Visit Package with Program Printed Marketing items (e.g.

stress balls, journals, tissues, folders, note pads, etc.) supporting visit topics such as Resilience, PTSD, TBI, Psychological Health, Stress, etc.

4.5.4.2. Client Engagement Items with Program Printed Marketing (e.g. stress balls, journals, tissues, folders, note pads, etc.) supporting visit topics such as Resilience, PTSD, TBI, Psychological

Health, Stress, etc.

4.6. Training Support

4.6.1. The contractor shall provide their staff with an annual training course of approximately 24 hours (3 days) duration on the Reservist healthcare benefits and systems. The agenda will be approved by the

COR and the government will assist with planning as needed to ensure that all relevant information is covered. VTC is not an acceptable method of training. The initial training would be scheduled within

90 days after the start of contract and one course will be conducted annually during all option years thereafter, to be attended by all contractor staff. Additional attendance to specific psychological health/resilience/suicide prevention conferences and training seminars focusing on issues impacting

Reservists may be authorized by the COR in response to incidents or needs of the unit.

5. Other Pertinent Information

5.1. Acronyms

Abbreviation Definition AAR After Action Report

ACOR Alternative Contracting Officer Representative BUMED The Bureau of Medicine and Surgery

CAC Common Access Card CO Commanding Officer

COR Contracting Officer Representative DRT Deployment Readiness Training DoD Department of Defense CMS Case Management System DPH Director of Psychological Health eBHS Electronic Behavioral Health Screening

HIPAA Health Insurance Portability and Accountability Act HTC Home Training Center

IA Individual Augmentee IMR Individual Medical Readiness LOD Line of Duty

MARFORRES Marine Forces Reserve MDR Medical Department Representatives MIP Marine Intercept Program MS Microsoft

MTF Military Treatment Facilities NAVRESFOR Navy Reserve Force Commands

NRC Navy Reserve Center OSC Operational Stress Continuum ODC Other Direct Costs PTSD Post Traumatic Stress disorder PDHA Reserve Post-Deployment Health Assessment

PDHRA Post Deployment Health Reassessment PII Personally Identifiable Information

PHA Periodic Health Assessment PHI Protected Health Information PH Psychological Health

PHOP Psychological Health Outreach Program POC Points of Contact PWS Performance-Based Work Statement RWW Returning Warrior Workshop SAIL Sailor Assistance and Intercept for Life

SITREP Situation Report SM Service Member

SOP Standard Operating Procedure TBI Traumatic Brain Injury

VA Veterans Affairs VTC Video Teleconferencing

5.2. Period of Performance—The base period of performance for this requirement is 20 September 2024 through 19 June 2025. The resultant contract will feature four (4) one-year option periods consecutively following the base period.

5.3. Place of Performance: Majority, approximately 60%, of work will be done in the contractor’s office, by phone or teleconference. Approximately 40% of work will be onsite at the NRCs and HTCs located across the country.

5.3.1. A complete list of NRCs may be found at: https://www.mynrh.navy.mil/#/map

5.3.2. A complete list of HTCs may be found at: https://www.marforres.marines.mil/

5.3.3. Normal operating hours are 0700-1700 Monday through Friday, excluding Federal Holidays.

5.4. Estimated Staffing Requirements— The following information represents the estimated staffing requirements the contractor is obligated to provide in performing the services required in the PWS; vendor can increase or decrease the number of FTE or part-time employees accordingly to meet all requirements defined. FTE is based on a 1,912 hour work year. All monthly invoices shall be based on a calendar month.

5.4.1. It is anticipated this effort will require fifty-three (53) Full time outreach support members embedded across 30 sites across the Continental United States and two (2) part-time on-call outreach support members.

5.5. Minimum Qualifications— Personnel assigned to or utilized by the Contractor in the performance of this contract shall, as a minimum, meet the experience, educational, or other background requirements set forth below and shall be fully capable of performing in an efficient, reliable, and professional manner. If the quoter does not identify the labor categories listed below by the same specific title, then a cross-reference list should be provided in the quoter’s non-price quote identifying the different naming convention.

Additionally, any deviations below the minimum qualification requirements of this section shall be addressed by the quoter in its offer.

If the Contracting Officer questions the qualifications or competence of any person performing under the contract, the burden of proof to sustain that the person is qualified as prescribed herein shall be upon the

Contractor.

The Contractor must have the personnel, organization, and administrative control necessary to ensure that the services performed meet all requirements. The work history of each Contractor employee shall contain experience directly related to the tasks and functions to be assigned. The Contracting Officer reserves the right to determine if a given work history contains necessary and sufficiently detailed, related experience to reasonably ensure the ability for effective and efficient performance.

The contractor shall be proficient in MS Office including MS Word, MS PowerPoint, MS Excel, MS

Project, MS Access and Adobe Acrobat. The contractor shall be proficient in eBHS, DoD CMS and

Qualtrics. The contractor shall have forms necessary for intake, tracking and management of clients as necessary for obtaining and transferring information to the approved and available government electronic data and referral management systems. The contractor shall produce briefing slides, metric charts, program schedules, and organizational charts, as necessary.

5.6. Government Furnished Equipment/Property/Information— The Government will provide access to office, workspace and furnishings at a Government site. The Government will furnish local, Defense Switched

Network (DSN), and long-distance telephone service on-site for direct performance of the contract. The

Government will also provide access to computers, terminals, common use software, communications networks, and other resources owned or leased and operated by the Government.

5.7. Security Requirements—See Addendums to PWS NAVSUP SUPTXT204-9400(8-22) Prescription and

Alternative Language & NAVSUP SUPTXT204-9400 (4-22).

https://mcas-proxyweb.mcas-gov.us/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.mynrh.navy.mil.mcas-gov.us%2F%3FMcasTsid%3D15600%23%2Fmap&McasCSRF=b37ff66b702f8317cd62d0de7209bbb0c5c69c8bccb130b23011a5bb2421ec63&McasTsid=15600 https://mcas-proxyweb.mcas-gov.us/certificate-checker?login=false&originalUrl=https%3A%2F%2Fwww.mynrh.navy.mil.mcas-gov.us%2F%3FMcasTsid%3D15600%23%2Fmap&McasCSRF=b37ff66b702f8317cd62d0de7209bbb0c5c69c8bccb130b23011a5bb2421ec63&McasTsid=15600

5.8. Travel— Travel may be required if the tasks and deliverables warrant those expenses. All travel shall be in accordance with the Government’s Joint Travel Regulations (JTR) or Federal Travel Regulations (FTR).

A trip report shall be submitted no later than 10 working days following the completion of required travel.

The ceiling for travel per year is $654,500.00.

5.9. Other Direct Costs (ODCs)— ODCs are anticipated in each contract period for the necessary marketing materials required for contract performance. The estimated ODCs per period of performance is not-to-exceed $58,500. All ODCs shall be reviewed and approved by the COR prior to production and subsequent invoicing.

5.10. Other Information— ****RESERVED****

6. List of Deliverables

PWS

Section:

Deliverable Recipient Level of Inspection

Frequency

All Kick-off meeting & minutes COR 100% 14 days after award All Project management plan COR 100% 30 days after award

4.4.1 BUMED Program Manager

meeting COR/Program

Manager 100% Monthly

All Monthly status reports (task progress and accomplishments summary)

COR 100% NLT the 10th of each month following the month reported All Mid-term review COR 100% 6 months in during base

CLIN and then yearly All Final review and report COR 100% Annually, 30 days after the end of each Fiscal Year

6.1. Deliverable Detail— All reports shall be submitted in Microsoft Office Suite compatible files. The contractor shall coordinate with the COR to develop a standardized reporting format and/or tool.

7. Performance Standards

7.1. The Contractor is responsible for reviewing all work for proper accuracy and content. The Contractor shall document progress and produce required status reports that itemize and explain applicable deliverables.

The COR/ACOR and/or TA will review contractor deliverables and reports to validate end products were delivered IAW specifications stated in the PWS. The COR/ACOR who have sole authority to inspect and accept or reject contractor deliverables. The acceptance of deliverables and satisfactory work performance required herein shall be based on the timeliness and accuracy of the products received.

Performance

Element Performance

Requirement Surveillance Method Frequency Acceptable

Quality Level Contract Deliverables

Contract deliverables furnished as prescribed in the

PWS, attachments, CDRLs, Task Orders, etc., as applicable.

100% inspection by the recipient, or TA/COR 100% inspection of all contract deliverables.

>95% of deliverables submitted timely and without rework required.

Overall Contract

Performance Overall contract performance of sufficient quality to earn a Satisfactory

(or higher) rating in the

COR’s annual report on Contractor Performance

100% inspection by the recipient, TA/COR Annual All performance elements rated

Satisfactory (or higher)

Invoicing Monthly invoices per contract procedures are timely and accurate.

Review & acceptance of the invoice Monthly 100% accuracy

Contractor Quality Control Plan

QC activities, inspections, and corrective actions completed as required by the plan

Inspection by the

COR

Quarterly for overall

QC

activities; as required for corrective actions

100% compliance with the contractor plan

8. Points of Contact

COR

Chai H. Wu, MD

CDR MC USN

O: (703) 681-5578 C:

(571) 309-6151 chai.h.wu.mil@health.mil

Contracting Office POC:

Michael Magazzu (215)

697-9721 michael.p.magazzu.civ@us.navy.mil

Contracting Office POC:

Vincent Conicelli (215)

697-5029 vincent.conicelli@navy.mil

9. Health insurance portability and accountability act (HIPAA): privacy and security of protected health information

General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and

Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of

Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the

Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The

Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD

Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy

Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S.

Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E

(Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this

Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health

System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and

Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health

Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care

Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy

Office Chief is the HIPAA Privacy and Security Officer for DHA.

Individual has the same meaning as the term ``individual'' in 45 CFR 164.501 and 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term ``protected health information'' in 45 CFR 164.501, limited to the information created or received by The Contractor from or on behalf of The Government.

Required by Law has the same meaning as the term ``required by law'' in 45 CFR 164.501 and 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart

C.

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR

160.103, 164.501 and 164.304.

HIPAA Business Associate Provisions

Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the

Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-

Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS. b.i. and

(3)b.ii

Breach Response

[This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference]

Definitions Related to Breach response

Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or

(2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

• How the event was discovered;

• Did the information stay within the covered entity’s control;

• Was the information actually accessed/viewed; and

• Ability to ensure containment (e.g., recovered, destroyed, or deleted).

A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach

Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA

Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information. Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;

The unauthorized person who used the PHI or to whom the disclosure was made; Whether the PHI was actually acquired or viewed; and the extent to which the risk to the PHI has been mitigated.

A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

General

The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the

Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps:

containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline.. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency

Readiness Team (US-CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below. The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirements.

Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery. The time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours). If a cybersecurity incident is involved, the contractor’s deadline for

USCERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall report directly to US-CERT and the DHA Privacy

Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

Contractors shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome. Investigations identifying unauthorized disclosures must be logged for HIPAA and Privacy Act disclosure accounting purposes, whether or not individual notification is required under the HIPAA Breach

Rule.

Contractors, when acting as HIPAA-covered entities, and not as business associates, are not subject to the breach response requirements herein. However, such contractors are subject to both the HIPAA Breach

Rule (applicable to them in their capacity as covered entities) and DoD cybersecurity requirements

(applicable to them in their capacity as DoD contractors).

Reporting Provisions

Immediately upon discovery of a possible or confirmed breach or cybersecurity incident, the contractor shall initiate an investigation. If the incident involves electronic PII/PHI, and if the investigation finds a confirmed breach or cybersecurity incident, the contractor shall report it, within 1 hour of confirmation, to the US-CERT Incident Reporting System at https://forms.us- cert.gov/report/, as required by the

Department of Homeland Security (DHS).

Note: DHS no longer requires US-CERT reporting of non-cyber breaches or unconfirmed electronic breaches.

However, DHS permits US-CERT reporting of unconfirmed cyber-related incidents on a voluntary basis. Thus, if a contractor is uncertain whether a possible cyber-related incident should be treated as confirmed and thus reportable, the contractor may voluntarily report the incident.

Before submission to US-CERT, the contractor shall save a copy of the on-line report. After submitting the report, the contractor shall record the US-CERT incident reporting number, which shall be included in the initial report to the DHA Privacy Office as described in paragraph 9.3.2.

Note: Regardless of whether or not an incident is confirmed as a breach, the contractor must also investigate whether or not the incident impacts data integrity or availability of PII/PHI. If such impact is confirmed, then the incident is reportable to US-CERT as a cybersecurity incident. For guidance on investigating the impact on data integrity and availability, refer to DoD cybersecurity and NIST guidance.

The contractor shall provide any updates to the initial US-CERT report by email to soc@us- cert.gov, with the

Reporting Number in the subject line. The contractor shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office if requested. Contractor questions about US-CERT reporting shall be directed to the

DHA Privacy Office, not the US-CERT office.

In addition to US-CERT reporting, the contractor shall report to the DHA Privacy Office by submitting the form specified below within 24 hours of discovery of a breach (possible or confirmed), unless the breach falls within a category that the Privacy Office has determined to be not reportable. This 24-hour period runs from the time of discovery, unlike the 1 hour US- CERT reporting period, which runs from the time a cybersecurity incident is confirmed. Thus, depending on the time period needed to confirm, the report to the DHA Privacy Office may be due either before or after the US-CERT report.

The breach report form required within the 24-hour deadline shall be sent by e-mail to:

DHA.PrivacyOfficer@mail.mil. The contractor shall also e-mail the report to the CO, the COR and its usual point of contact at the applicable Program Office.