N6264521Q0007 Amendment 01.docx

N6264521Q0007

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SUPPLIES OR SERVICES AND PRICES

CLIN 0001

The IDC type has changed from Indefinite Quantity to N/A.

The CLIN description has changed from Blood Products and Services to Blanket Purchase Agreement (BPA).

The CLIN extended description has changed from:

The Contractor shall provide blood products and services as described in the Statement of Work.This is an indefinite delivery requirement. The number of blood products and services to be ordered cannot be determined in advance. Delivery orders will be issued for a not to exceed amount. The total for this Contract Line Item Number (CLIN) reflects the contract maximum, see below. The Contractor shall invoice at the agreed upon prices using the attached price list. The Contractor shall only be paid for the products and services provided.The minimum contract value for all orders issued against this contract shall not be less $2,500.00. The maximum contract value for all orders issued against this contract shall not exceed $2,100,000.00.

To:

As noted in the first amendment, the resultant award will be a BPA. As BPAs do not contain line items, this CLIN is not applicable; however, due to contracting system constraints it cannot be removed from the solicitation.

The pricing detail quantity has decreased by 1.00 from 1.00 to 0.00.

The unit of issue Job has been deleted.

The cost constraint NTE has been deleted.

DELIVERIES AND PERFORMANCE

The following Delivery Schedule item for CLIN 0001 has been changed from:

POP 01-OCT-2021 TO

30-SEP-2026

620 JOHN PAUL JONES CIRCLE

PORTSMOUTH VA 23708-2197

FOB: Destination

HT0242

To:

POP 01-OCT-2021 TO

30-SEP-2026

620 JOHN PAUL JONES CIRCLE

PORTSMOUTH VA 23708-2197

FOB: Destination

HT0242

The following have been added by reference:

The following have been added by full text:

TERMS AND CONDITIONS

Terms and Conditions for use of the Blanket Purchase Agreement (BPA):

(1) Description of agreement. The BPA holder, herein referred to as the Contractor, shall furnish blood, blood products, and reference laboratory testing services for the Naval Medical Center Portsmouth, VA in accordance with the attached Statement of Work, if and when requested by the Contracting Officer (or the authorized representative of the Contracting Officer) during the specified period and within a stipulated aggregate amount: 01 October 2021 through 30 September 2024 in the aggregate amount of $1,500,000.00.

(2) Extent of obligation. The Government is obligated only to the extent of authorized purchases actually made under the BPA.

(3) Purchase limitation. The dollar limitation for each individual purchase under the BPA is $500,000.00.

(4) Individuals authorized to purchase under the BPA.

BPA orders may be placed by any warranted contracting officer serving at the Naval Medical Logistics Command.

BPA orders will be issued for a not to exceed amount. Requests for blood, blood products and testing services will be made as described in the SOW. Any staff member working at Naval Medical Center Portsmouth’s Blood Services which includes Blood Donor Center, Transfusion Services and Apheresis Department is authorized to place requests for items/services covered by the BPA. Pricing for individual items/services will be based on the agreed upon price list, which is incorporated into the BPA and attached.

Orders issued against this BPA will be placed through electronic commerce including email in accordance with the terms and conditions of the BPA. BPA orders will be issued on a DD Form 1155 or a SF 1449.

(5) Delivery tickets. All shipments under the agreement shall be accompanied by delivery tickets or sales slips that shall contain the following minimum information:

(i) Name of supplier.

(ii) BPA number.

(iii) Date of purchase.

(iv) Purchase number.

(v) Itemized list of supplies or services furnished.

(vi) Quantity, unit price, and extension of each item, less applicable discounts (unit prices and extensions need not be shown when incompatible with the use of automated systems, provided that the invoice is itemized to show this information).

(vii) Date of delivery or shipment.

(6) Invoices. One of the following statements shall be included (except that the statement in paragraph (a)(6)(iii) of this subsection should not be used if the accumulation of the individual invoices by the Government materially increases the administrative costs of this purchase method):

(i) A summary invoice shall be submitted at least monthly or upon expiration of this BPA, whichever occurs first, for all deliveries made during a billing period, identifying the delivery tickets covered therein, stating their total dollar value, and supported by receipt copies of the delivery tickets.

(7) Pricing. The attached price list (Attachment 1) shall apply to all orders placed against this agreement. Prices quoted by the American National Red Cross (herein referred to as ARC) for blood products are effective 01 October 2021 through 30 September 2022, with agreed upon pricing for the period 01 October 2022 through 30 September 2023 and 01 October 2023 through 30 September 2024. Prices quoted by the Contractor for reference laboratory testing services are effective 01 October 2021 through 30 June 2022.

Annual price list updates, for reference laboratory testing services only, may be allowed if negotiated and determined to be within scope of the BPA. The price list updates will be to offset increased costs of production including staffing, reagents and supplies and shall be in accordance with FAR 13.303-6(b)(2), which requires annual review to maintain awareness of changes in the market conditions, sources of supply, and other pertinent factors that may warrant making new arrangements with different supplies or modifying existing arrangements. The price list updates shall be submitted in writing to the Contracting Office by the dates noted below for review by the Contracting Officer:

Pricing for the period 01 July 2022 through 30 June 2023 shall be submitted by 01 May 2022 Pricing for the period 01 July 2023 through 30 June 2024 shall be submitted by 01 May 2023 Pricing for the period 01 July 2024 through 30 September 2024 shall be submitted by 01 May 2024

Non-annual price list updates for both blood products and reference laboratory testing services may be allowed to accommodate new required testing recommended and/or mandated by the Food and Drug Administration, as well as compliance with all regulatory agencies and the Code of Federal Regulations (CFR) series of sections on biologics and blood products, AABB standards and Clinical Laboratory Improvements Amendments (CLIA). Non-annual price list updates shall be submitted at least 60 calendar days prior to the proposed effective date.

The proposed price list updates, if accepted by the Government, will be incorporated into this agreement by a modification. The ARC shall not bill at the new prices unless they are incorporated into this agreement via a modification.

The ARC shall not furnish and the Government will not provide payment for any items or services that are not on the attached price list.

(8) Contractor’s Quote. The Contractor’s quote is herein incorporated into the BPA, see Attachment 2.

The following have been modified:

GENERAL CONTRACT INFORMATION

CONTRACTING OFFICER’S REPRESENTATIVE

The Contracting Officer's duly authorized representative will perform inspection and acceptance of services to be provided.

For the purposes of this clause, LT Matthew Brooks, 757-953-1674, email: matthew.a.brooks22.mil@mail.mil is the authorized representative of the Contracting Officer.

Inspection and acceptance will be performed at the assigned location according to the Statement of Work.

CONTRACTOR SUPPORT

Notice: Navy Use Of Support Contractor For Contract Closeout Functions

Naval Medical Logistics Command (NMLC) uses two private contractors in support of the contract closeout process. Those companies are Contracting Resources Group (CRG) of Federal Hill, MD, doing business under the authority of the Small Business Administration’s 8(a) program and the Ability One Program, doing business under the authority of the Javits-Wagner O’Day Act (41 U.S.C. § 47).

The contract closeout process includes activities such as processing deobligation modifications, obtaining contractor and requiring activity concurrence, preparing the DD-Form 1594 (Contract Completion Statement), and preparing closed files for archiving. Support contractors may perform additional administrative duties, including filing and processing simple administrative modifications. Performing these functions require the contractor employees to have access to the contract file. Therefore, information the Contractor provides to the Government or information already in the possession of the Government may be viewed by these support contractors in the course of performing contract close-out functions. The information that may be made available to the contractor may include pricing and technical responses and performance information.

NMLC has signed Non-Disclosure Agreements with each support contractor employee and has required both contractors to provide a Conflict of interest Mitigation Plan to ensure these employees are firewalled from all business development activity.

By signature of this contract, the contractor consents to access of their business sensitive/confidential or proprietary data by the Government’s support contractor personnel in order to perform close out services.

STATEMENT OF WORK

Statement of Work (SOW) for Blood, Blood Products and Reference Laboratory Testing for the Naval Medical Center Portsmouth, VA (NMCP)

1. Scope of Work

The Contractor shall provide patient specimen testing for the specific range of referral testing within its capability in accordance with all applicable federal, state, and local regulations, laws, and ordinances, and in accordance with the specifications outlined for accreditation certification, if applicable.

Services shall include the performance of analytical testing and transfer of blood products as defined by the Contractor’s Reference Testing Manual the reporting of analytical test results, and consultative services as required to assimilate the full scope of its laboratory operations to NMCP’s Laboratory Medicine Services. NMCP is located at 620 John Paul Jones Circle, Portsmouth, VA 23708. This is a supply requirement with the need for some services, as outlined below.

2. Reference Laboratory Testing Services

The Contractor shall provide laboratory services to include preanalytic processing as defined in its laboratory manual, analysis, reporting of analytic results, and interpretation. Services will be ordered by the Government via telephone and/or electronic computer system using the website prescribed by the Contractor. Services will not be placed by contractor personnel. The Government shall reference a customer code when placing an order, and the Contractor shall keep a log with the name of the individual placing each order. The Government may only order when a BPA order has been issued with sufficient quantity, see General Contract Information for more information on the issuance of BPA orders. The Contractor shall provide the following services:

a. The Contractor shall be responsible for providing requisition forms, special instructions, and a current list of tests with reference ranges and specimen requirements.

b. The Contractor shall provide services during its normal working hours (specified in the Contractor’s Reference Testing Manual) unless otherwise specified according to special services provided by the Contractor (specified in the Contractor’s Reference Testing Manual).

c. If applicable, the Contractor shall transport samples in such a manner as to ensure the integrity of the specimen. Specimen transport requirements shall be determined by the Contractor.

d. Analyze samples. The Contractor shall report test results within the specified time frame in accordance with the nature of the testing and following all regulatory requirements for reporting of patient results. Test results shall be reported within the following time frames:

STAT: One (1) hour ASAP: Two (2) hours Routine: Eight (8) hours Critical value test results shall be reported by the Contractor immediately by telephone. Hard copy results shall be faxed, mailed or sent via a secure internet report by the Contractor, with fax being the preferred method. The Contractor will not be provided with access to the Government’s information systems.

e. The Contractor shall consult with the Government on test results by telephone as needed. Hours for consultation services are 24 hours per day seven (7) days a week. Consultations shall be included in the test price and shall not be separately priced.

f. The Contractor shall provide NMCP’s Laboratory Medicine Services laboratories with a means of communication to permit immediate inquiry regarding the status of pending tests.

g. The Contractor shall receive customer generated work documents* to order tests in lieu of individual requisition per request, if applicable.

*The customer generated work order/document is typically generated in the electronic computer system used to place the request. If the electronic computer system is not working, the Government will submit a paper request with the specimen.

3. Blood and Blood Products

The Contractor shall provide blood and blood products to the transfusion services (TS) of NMCP. Blood and blood products will be requested by the Government via telephone and/or electronic computer system using the website prescribed by the Contractor twenty four (24) hours a day, seven (7) days a week, including Federal holidays. Blood products will not be requested by contractor personnel. The Government shall reference a customer code when placing a request, and the Contractor shall keep a log with the name of the individual placing each request. The Government may only submit requests when a BPA order has been issued with sufficient quantity, see General Contract Information for more information on the issuance of BPA orders.

The Contractor shall be registered with the Food and Drug Administration (FDA), accredited by the AABB, and comply with continuous Current Good Manufacturing Practices (CGMP) as outlined by the International Society for Pharmaceutical Engineering (ISPE).

Blood and blood products from the Contractor shall be delivered/made available for pick-up timely and products shall be free of defects in accordance with federal and industry standards. All blood and blood products shall be delivered with maximum possible expiration dates (if the expiration date is less than 24 hours, the schedule price shall be reduced) based on the Contractor’s inventory and timeliness of delivery upon request in direct support of patient care. The Contractor shall comply with the following:

a. The Contractor shall maintain an inventory of blood and blood products including red blood cells, frozen plasma products (FFP), pre-pooled cryoprecipitate and platelet products for all ages of life and for varying medical conditions. Apheresis platelets will be supplied as pathogen-reduced and/or Large Volume Delayed Sampling (LVDS) as requested and when appropriate.

b. The Contractor shall provide blood and blood products to NMCP Monday through Sunday, twenty four (24) hours a day, including all Federal holidays. Delivery time frames are as follows: within two (2) hours of the request for routine and products with special requirements, and within one (1) hour of the request for emergent products and no special requirements.

i. The Government will pick-up and transport the items to NMCP; however, there are occasions when the Contractor will be required to transport the items to NMCP.

c. The Contractor shall allow the return (for credit and/or exchange) of unused blood and blood products that have not expired and that can reasonably be used by other facilities to maximize the use of the blood inventory at no additional charge to NMCP. Exchanges/returns in a different fiscal year shall be prohibited, i.e., the Contractor shall not accept return of a product delivered in one fiscal year in the following fiscal year. The fiscal year begins in October and ends in September.

d. The Contractor shall pick-up patient specimens for reference laboratory testing and provide a final report for antibody and antigen testing used for identifying compatible blood and blood products and managing transfusion medicine requirements necessary for the care and treatment of the patient. The Contractor shall provide a final report within one (1) hour of finalized test results.

e. The Contractor shall provide monthly (by fifth (5th) day of next month) utilization reports for blood and blood products broken down by product type and ABO/Rh.

SUPTXT204-9400(3-19) CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, INFORMATION TECHNOLOGY SYSTEMS OR PROTECTED HEALTH INFORMATION The security text does not apply in cases where the contractor/vendor does not have access to Navy Marine Corps Intranet (NMCI) computers, is not issued a Common Access Card (CAC) and is involved in training or other short term duties of less than 30 days duration that allow for the use of a visitor request. In these cases, the government employee must submit a Visitor Access Request (VAR) to the main gate or applicable processing entity for your facility and assume responsibility to escort those without CAC Credentials.

This clause does not apply to non-United States (U.S.) Nationals (foreign nationals) who are contactor employees performing work overseas. The clause is applicable to the U.S. Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation (FBI) criminal history database, an FBI investigations file (name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim.

Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, IT SYSTEMS OR PROTECTED HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC. Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of "productive":

a. Visit Authorization Request (VAR)

b. Contractor Information Sheet (CIS)

c. FD-258 Fingerprint Card

d. Completed Electronic Investigation (EQIP)

e. All contractor resource(s) must have an active Joint Personnel Adjudication System (JPAS) profile

f. Common Access Card(CAC) Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In Accordance With (IAW) Secretary of the Navy (SECNAV) M-5510.30, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include PHI. All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check (NAC) with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System (OS) or Computing Environment (CE) they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR-N as the supervisor.

The SAAR-N shall be forwarded to the CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and PHI, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

· SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product)

· Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission

· Original Signed Release Statements Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) years) throughout the contract performance period. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy command's ISSM/IAM. Completion and approval of a SAAR-N form is required for all individuals accessing Navy IT resources. The SAAR-N shall be forwarded to the Navy CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the CSM. The CSM will review the submitted documentation for completeness prior to submitting it to the OPM; Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The CSM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a VAR via the JPAS or a hard copy VAR directly from the contractor's security representative. Although the contractor will take JPAS owning role over the contractor employee, the Navy command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT position category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

· Must be either a U.S. citizen or a U.S. permanent resident with a minimum of 3 years of legal residency in the U.S. (as required by the Deputy Secretary of Defense DTM 08-006 or its subsequent DoD Instruction (INST)) and

· Must have a favorably completed NACI or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

· SF-85 Questionnaire for Non-Sensitive Positions

· Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

· Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed NACI or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM.

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

* Consult with your CSM and ISSM/IAM for local policy when IT-III (non-sensitive) access is required for non-U.S. citizens outside the U.S..*

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (BAA) incorporates HIPAA/HITECH Act requirements under the HHS Final Omnibus Rule (78 FR 5566, published 25 Jan 2013), effective 23 Sep 2013. This BAA is for use by MHS components outside of DHA.

Business Associate Agreement

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where 12 Nov 2013 Page 2 of 10 persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the contractor.

Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the Government facility(s) and office(s) that are supported under this contract.

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by the Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of the Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively), as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in the Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in the Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in the Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in the Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall provide the Business Associate with the notice of privacy practices that the Covered Entity produces in accordance with 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

If the DHA Privacy Office determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the DHA Privacy Office, regardless of whether the breach occurs at DHA or at one of the Service components. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office. The following provisions of Part V set forth the Business Associate’s Privacy Act and HIPAA breach response requirements for all breaches, including but not limited to HHS breaches.

This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response, the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals, and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business Associate shall implement these breach response requirements immediately upon the Business Associate’s discovery of a possible breach.

(b) Government Reporting Provisions

The Business Associate shall report the breach within one hour of discovery to the US Computer Emergency Readiness Team (US CERT), and, within 24 hours of discovery, to the DHA Privacy Office and the other parties set forth below. The Business Associate is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer or other agent of the Business Associate.

The Business Associate shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report/. Before submission to US-CERT, the Business Associate shall save a copy of the on-line report. After submission, the Business Associate shall record the US-CERT Reporting Number. Although only limited information about the breach may be available as of the one hour deadline for submission, the Business Associate shall submit the US-CERT report by the deadline. The Business Associate shall e-mail updated information as it is obtained, following the instructions at http://www.us-cert.gov/pgp/email.html. The Business Associate shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office and the applicable Service-Level Privacy Office, if requested by either. Business Associate questions about US-CERT reporting shall be directed to the DHA or Service-Level Privacy Office, not the US-CERT office.

The Business Associate report due within 24 hours shall be submitted by completing the New Breach Reporting Form DD 2959 at the Breach Response page on the DHA Privacy Office web site and emailing that form to, as applicable, the DHA Privacy Office, the Service-Level Privacy Office, the Contracting Officer (CO) and Contracting Officer’s Representative (COR) and the Business Associate’s DoD point of contact (POC) unless the POC specifies another addressee for breach reporting. Encryption is not required, because Breach Report Forms should not contain PII/PHI. The email address for notices to the DHA Privacy Office is provided at the Privacy Office website breach response page. If electronic mail is not available, telephone notification is also acceptable, but all notifications and reports delivered telephonically must be confirmed by email as soon as technically feasible.

If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances. The Business Associate shall inform the DHA Privacy Office as soon as possible if it believes that “single event” breach response is appropriate; the DHA Privacy Office will determine how the Business Associate shall proceed and, if appropriate, consolidate separately reported breaches for purposes of Business Associate report updates, beneficiary notification, and mitigation.

When a Breach Report Form initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the Business Associate shall submit a revised form or forms, stating the updated status and previous report date(s) and showing any revisions or additions in red text. Examples of updated information the Business Associate shall report include, but are not limited to: confirmation on the exact data elements involved, the root cause of the incident, and any mitigation actions to include, sanctions, training, incident containment, follow-up, etc. The Business Associate shall submit these report updates promptly after the new information becomes available. Prompt reporting of updates is required to allow the DHA Privacy Office to make timely final determinations on any subsequent notifications or reports. The Business Associate shall provide updates to the same parties as required for the initial Breach Reporting Form. The Business Associate is responsible for reporting all information needed by the DHA Privacy Office to make timely and accurate determinations on reports to HHS as required by the HHS Breach Rule and reports to the Defense Privacy and Civil Liberties Office as required by DoD Privacy Act Issuances.

In the event the Business Associate is uncertain on how to apply the above requirements, the Business Associate shall consult with the DHA Privacy Office (or the Service-Level Privacy…