MRD_SOW_Transcription-2014.pdf

Attachment 1 National Institutes of Health Clinical Center, Medical Record Department Statement of Work Transcription of Medical Reports, Letters, and Pathology Reports

STATEMENT OF WORK

NATIONAL INSTITUTES OF HEALTH, CLINICAL CENTER

MEDICAL RECORD DEPARTMENT

TRANSCRIPTION OF MEDICAL REPORTS, LETTERS, AND PATHOLOGY REPORTS

TASK ONE

Transcription of Medical Reports, Letters, and Pathology Reports 2

Project Title: Transcription of Medical Reports, Letters, and Pathology Reports

1. General Information

1.1 Background Information

The NIH Clinical Center (CC) is a 240-bed federally funded, biomedical research hospital located on the NIH campus in Bethesda, Maryland. The Clinical Center is the delivery setting for all NIH intramural clinical research protocols. The Clinical Center accounts for about one-half of all NIH-funded clinical research beds in the United States and accommodates about 7,000 inpatient and 70,000 outpatient visits a year. Patients are admitted to the NIH Clinical Center from all over the world for the sole purpose of participating in a clinical research protocol. The Clinical Center’s Medical Record Department (MRD) is responsible for providing dictation and transcription services for a variety of specialized medical reports related to patients’ inpatient hospital admissions, day hospital visits, outpatient clinic visits, ambulatory surgery and other complex diagnostic medical studies. Such reports may be categorized into three groups including medical reports, pathology reports, and letters to outside physicians. Dictated reports and letters include information consisting of technical terminology and phraseology from all medical and scientific disciplines, which the NIH allied health professionals involved in the care of the patient wish to document in the patient’s medical record regarding diagnosis, past or present treatment, future care and research protocol findings.

1.2 Clinical Center Medical Record Department Information Systems Overview

The Clinical Center, Medical Record Department (MRD) relies on several integrated and interfaced information systems to support dictation and transcription services across all of the NIH institutes. These systems all support the dictation, back end speech recognition, and transcription processes including the following related functions: acceptance of dictated reports and letters and related information; the transmittal of pertinent patient demographic information; training of the back end speech recognition system for new clinicians; editing and correcting reports presented in the transcription system by the speech recognition system; direct transcription of dictated reports and letters when necessary; quality review of completed reports and the distribution of transcribed and edited reports and letters to members of the medical staff. To support all of these processes, the MRD utilizes the following health information systems software applications:

Eclipsys Sunrise Clinical Manager (SCM) – the CC’s hospital information system (HIS) providing patient information retrieval, medical order entry, and clinical results retrieval. SCM includes Admission, Discharge, and Transfer (ADT) functionality and is utilized by prescribers and health care providers to enter medical orders, enter medication administrations, enter clinical documentation, and review results/clinical documentation. The system is also referred to as the Clinical Center’s Clinical Research Information System (CRIS).

3M™ ChartLinc – facilitates the flow of Admission, Discharge, Transfer (ADT) Information between the CC’s hospital information system and the MRD’s transcription software applications.

ChartLinc also facilitates the upload of transcribed, edited, and completed medical and diagnostic reports to the CC’s hospital information system.

Transcription of Medical Reports, Letters, and Pathology Reports 3

3M™ ChartScript.net - full-featured, browser-based transcription platform utilized for transcription of dictated medical and diagnostic reports and letters as well as editing of transcribed documents.

Soft Computer Corporation (SCC) – the Laboratory Information System (LIS) application which includes the SoftPath module for Anatomic Pathology result reporting. Anatomic Pathology reports will be transcribed directly into the SCC, SoftPath application.

3M™ SyncStream – back end speech recognition service hosted at the 3M data center. Dictated reports and letters pass through this system and convert dictated speech into an editable text document in the ChartScript.net application. Edits made to these presented documents are utilized by the system to enhance and improve the accuracy of the speech recognition service in subsequent dictations completed by each individual clinician.

3M™ VoiceScript – intermediary voice file storage system. Voice files along with pertinent dictation information (clinician identification, date, time, etc.) are passed from the central dictation system, through a voice file exporting system to the VoiceScript server. VoiceScript then passes files on to 3M™ back-end speech recognition service.

Citrix – software application utilized throughout the NIH, Clinical Center to provide remote access to clinical applications over the NIH network and the Internet. The contractor is required to access the SoftPath transcription platform via the NIH/CC’s Citrix application.

Virtual Private Network (VPN) – such accounts are required for each contractor working remotely from the Clinical Center and accessing applications related to providing services under this contract.

Two-factor authentication – method of logging onto NIH IT resources which requires two forms of identification. For NIH purposes, this identification can come in the form of VPN authentication with an NIH domain account and either an RSA soft token client or RSA hardware token.

1.3 Project Scope.

The Government is seeking services to provide acceptance of dictation, editing of speech recognition documents, transcription, quality review of documents, and onsite management functions to support these services. The contractor shall provide all personnel, supervision, and other items identified by the government in this statement of work necessary to promptly and accurately support dictation services and the transcription and editing of all transcribed reports/letters. The contractor shall perform to the standards of this contract. The estimated quantities of work are listed in Section 10 of this Statement of Work. This contract shall cover an initial 12-month period of performance, with 4 additional successive 12-month option periods.

Transcription of Medical Reports, Letters, and Pathology Reports 4

All work performed under this contract must be based out of and completed from United States based office environments with no overseas dictation services/transcription/editing/report completion permissible.

1.3.1 Dictation Services.

Dictation service is provided through the MRD for dictation of pertinent medical and diagnostic reports and letters to outside physicians for CC registered patients. The service is coordinated and controlled by the MRD and is limited to use by those professionals directly involved in patient care activities for the dictation of approved types of reports as identified by the MRD.

Each authorized user of the telephone dictation system is required to receive system orientation from the MRD prior to utilization. Strict adherence to the rules and procedures, specified by the MRD, is required of the user in order to assure timely and accurate transcription of dictated material.

Dictated reports include information consisting of technical terminology and phraseology from all medical and scientific disciplines, which the NIH medical staff member wishes to document in the patient’s medical record regarding diagnosis, present or past treatment, and future plans of care.

(Refer to Section 2 for specific dictation services requirements).

1.3.2 Transcription Services.

The contractor will be responsible for ensuring the completion of all dictated jobs in accordance with the specific requirements outlined in Section 3 of this statement of work. The expeditious and accurate completion of dictated reports and letters is mandatory for the continued effectiveness of clinical and follow-up patient care at the CC. To this end, the contractor must ensure compliance with the turnaround schedule established by the MRD, and must subject each transcribed report to a rigorous quality review.

All medical reports and letters are to be completed and presented in the MRD’s transcription platform software (3M™ ChartScript.net) by the contractor. All pathology reports are to be transcribed directly into the SCC SoftPath application. Final inspection and acceptance of transcribed reports provided by the contractor shall be the responsibility of the Project Officer(s) of the MRD. Reports must be completed according to the format established by the MRD. Any report or letter that does not meet specified quality standards shall be retyped/re-edited by the responsible contractor at no cost to the MRD.

The MRD anticipates that the majority of work performed by the contractor will relate to medical editing and report review. However, the MRD anticipates that there will be occasions for direct transcription of reports by the contractor. There shall be no direct transcription of reports without permission and consultation with the CC, MRD, Project Officer. (Refer to Section 3 for specific transcription services requirements).

1.3.3 Report Editing/Review Services.

The contractor is to provide medical editing services as specified in this statement of work for medical reports, letters, and pathology reports. The MRD utilizes 3M’s back end speech recognition solution, SyncStream. All dictated reports and letters, with the exception of pathology reports will flow through that application and be presented in the ChartScript.net application for

Transcription of Medical Reports, Letters, and Pathology Reports 5 review and editing by a Medical Language Specialist. This editing process is an integral part of the success of the speech recognition process. (Refer to Section 4 for specific report editing/review services requirements).

1.3.4 Onsite Management Services.

Work performed according to the requirements specified in this statement, is to be accomplished remotely from the NIH in space provided by the contractor. All work space must be based out of and completed from United States’ based office environments with no overseas transcription/editing permissible. Additionally, in order to provide dictation and transcription patient care support services and secure patient safety, the MRD requires that the vendor provide a full-time on-site staff person located within the MRD office environment to assist with the medical staff liaison responsibilities. The individual assigned to this position shall have a minimum of three years of direct experience working in the health information management field.

Additionally, a management representative shall be onsite regularly to communicate with the MRD Project Officer(s) regarding services as well as coordinate activities through the initial contract initiation and initial architecture transition period. (Refer to Section 5 for specific duties and responsibilities).

1.3.5 Transition from Incumbent Contractor to New Contractor.

In the event that the incumbent contractor is not awarded the new contract, there must be a smooth transition of work between the two entities while maintaining the amount of transcription that must be performed under the contract. During this six month transition phase, each contractor will be responsible for 50% of the total incoming dictations. Within this six month window the new contractor will be responsible for the setup of their dictation system in the Clinical Center Data Center and any mandatory training required for staff members to become familiar with NIH and Clinical Center information systems required to perform contract duties. Once this six month period is over the new contractor shall be fully prepared to perform the full amount of work required.

1.4 Personnel.

1.4.1 The contractor shall provide a contract manager who shall be responsible for the oversight and supervision of the contractor staff responsible for the performance of work. The name of this person, and an alternate or alternates who shall act for the contractor when the manager is absent shall be designated in writing to the CC, MRD, Project Officer or their designee.

1.4.2 The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

1.4.3 The contract manager or alternate shall be available during normal duty hours within 60 minutes of notification by the Government to meet in the MRD with government personnel (designated by the CC, MRD, Project Officer or their designee). After normal business hours, the manager or alternate shall be available within 90 minutes of notification by the Government.

1.4.3.1 Key personnel shall be identified by the contractor and may not be replaced without prior notification and approval of the CC, MRD, Project Officer or his/her designee. These key

Transcription of Medical Reports, Letters, and Pathology Reports 6 personnel include the onsite manager and information technology personnel. All key personnel must be in place and fully qualified prior to award of this contract.

1.4.4 The onsite manager shall have a minimum of three years experience working in the health information management field including experience in the electronic medical transcription service field. Identification of qualifications and experience must be submitted with this proposal.

1.4.5 The information technology personnel shall have a minimum of five years experience working in the health information management field including experience handling security measures and information systems infrastructure specified in this contract. Identification of qualifications and experience must be submitted with this proposal.

1.4.6 All employees working under this contract must be direct employees of the contractor submitting the response to this proposal. Upon request, the contractor must be able to furnish copies of personnel and/or payroll records which would identify them as current and direct employees. 75% of all personnel working on this contract must be in place and fully qualified prior to award of this contract. Identification of qualifications and experience must be submitted with this proposal.

1.4.7 Sufficient personnel shall be provided to ensure the provision of services as identified in the terms of this contract. The contractor must provide backup personnel fully trained to perform the duties and responsibilities of the key personnel identified above.

1.4.7.1 These personnel (other management staff, medical language specialists (transcriptionists), speech analysts, medical editors, quality assurance personnel, and other clerical support staff) shall be identified by number of personnel, number of hours per week, and tour of duty.

1.4.8 Contractors must adhere to the Department of Labor Wage Determination as issued for their

County and State. Contractors will be required to pay their medical transcriptionists at the Occupation Code – Title of 01612 Word Processor II hourly rate plus all fringe benefits.

Contractors are required to provide a statement in their evaluation information indicating their compliance with their appropriate Department of Labor Wage Determination. Failure to provide this statement will result in the quote being deemed non-responsive to the solicitation.

Contractor will be required to show that the employees working on the NIH contract are considered their direct employees and that they are paid the appropriate wage rate as determined by the Department of Labor.

1.4.9 The contractor shall provide the CC, MRD, Project Officer or their designee with a 24-hour emergency telephone number where representatives of the contractor can be contacted by the Government in the event of an emergency or a need for a stat dictated report or letter or in the event of extraordinary or unforeseen circumstances that require communication between the Government and the contractor after hours, on holidays, and on weekends.

1.4.10 The contract manager as well as alternate or alternates and staff assigned to work onsite in the

MRD must be able to read, write, speak and understand English.

1.4.11 The contractor shall not employ persons for work on this contract if such employee is identified to the CC, MRD, Project Officer or their designee as a potential threat to the health, safety, security, Transcription of Medical Reports, Letters, and Pathology Reports 7 general well-being or operational mission of the National Institutes of Health, Clinical Center and Medical Record Department or its staff and customers.

1.4.12 Immediately upon hiring new employees, the contractor must provide key demographic and position responsibility information to the CC, MRD in order to enter the employee in the NIH Enterprise Directory (NED) database. Upon completion of NED processing activities, the CC, MRD, Project Officer shall coordinate establishment of necessary database application and network accounts for said employees.

1.4.13 Contractor employees working onsite in the CC shall obtain a NIH identification badge.

Contractor employees working onsite shall wear the badge on their outer garments at all times. In addition contract employees are required to turn in their NIH identification badge and parking permits, as applicable, on their final day of employment. The contractor shall return these items to the Government.

1.4.14 As contractor employees terminate their employment with the contractor, the MRD, CC, Project

Officer must be notified immediately so that appropriate action may be taken to deactivate network and database accounts.

1.4.15 The contractor shall not employ any person who is an employee of the US Government if employing that person would create a conflict of interest.

1.4.16 Security Requirements. All personnel employed by the contractor in the performance of this contract, or any representative of the contractor entering the NIH properties, shall abide by all security regulations of the NIH. The government reserves the right to direct the removal of an employee for misconduct or security reasons. This action does not relieve the contractor from total performance of the contract tasks specified herein.

1.4.17 The contractor shall instruct employees working onsite to register their vehicles for use and parking on the NIH campus during the duration of the contract, and shall instruct terminated employees to turn their parking validation device in on their last day of employment.

1.4.18 The contractor shall instruct employees driving on NIH property to have a valid automobile driver’s license.

1.4.19 The contractor shall instruct employees parking on NIH property to park vehicles in designated

NIH parking spaces.

1.4.20 All contractor employees working onsite in the Clinical Center must attend NIH Clinical Center orientation prior to commencing work in the MRD. Such training shall be arranged through coordination with the CC, MRD, Project Officer. Those missing this training shall not be permitted to work on behalf of the contractor on the NIH premises until such training is completed.

1.4.21 All contractor employees working onsite in the Clinical Center must attend a Fire Safety Inservice administered by the government within one year of their date of hire by the contractor. Those missing this training shall not be permitted to work on behalf of the contractor on the NIH

Transcription of Medical Reports, Letters, and Pathology Reports 8 premises until such training is completed. Contractor employees must subsequently attend such a training session on an annual basis. Arrangements for such training will be coordinated by the government.

1.4.22 All contractor employees shall complete a web-based training module on Computer Security, HIPAA (Health Insurance Portability and Accountability Act) General Awareness, and Privacy Awareness prior to performing duties associated with this contract. This training must subsequently be completed on an annual basis.

1.4.23 Initial training for contractor staff on all applications to be utilized during the transcription and medical editing processes of medical reports and letters (Citrix, 3M™, and SCM) will be provided by the MRD. Initial training for contractor staff on all applications to be utilized during the transcription and editing processes of pathology reports (SCC and Citrix) will be coordinated by the MRD and the Laboratory of Pathology staff. Any additional training requirements for newly hired staff or retraining of existing staff will be the responsibility of the contractor.

1.4.24 Contractor staff employed by the contractor at the commencement of this requirement without prior experience utilizing the transcription platforms/applications described in this requirement, will be trained to utilize the Citrix, 3M™, SCM, and SCC systems through MRD staff. General application functionality and basic transcription and report editing procedures will be reviewed.

Any required training will be conducted in the MRD facilities and/or remotely via a web-based training module. Intensive training will be provided lasting approximately 20 hours and will be conducted Monday through Friday between the hours of 7:00 am and 4:00 pm. Training will be coordinated by the MRD staff; however, it may be conducted by application experts from the MRD, Laboratory of Pathology, and/or the Department of Clinical Research Informatics.

1.4.25 Contractor employees shall utilize and exhaust all reference material to resolve problems independently prior to returning work to the CC, MRD, Project Officer, unless otherwise directed in the contract.

1.4.26 Contractor employees shall sign an E-mail and Computer Use Statement prior to their first day of work and annually each year thereafter. Such statements requiring signature are to be obtained from the CC, MRD, Project Officer. The contractor shall submit the completed original E-mail and Computer Use Statement to the CC, MRD, Project Officer or their designee within 10 business days of completion of each Statement.

1.4.27 All Contractor staff that have access to and use of NIH electronic mail (e-mail) must identify themselves as contractors on all outgoing e-mail messages, including those that are sent in reply or are forwarded to another user. To best comply with this requirement, the contractor staff shall set up an e-mail signature ("AutoSignature") or an electronic business card ("V-card") on each contractor employee's computer system and/or Personal Digital Assistant (PDA) that will automatically display "Contractor" in the signature area of all e-mails sent.

1.4.28 Transition-In Planning/Staffing. The Contractor shall submit a transition-in plan with their proposal that is in sufficient detail to identify all transition-in actions, documentation, and staffing proposed to prepare the workforce to assume 50% operation on the first full operational performance day of contract performance. The other 50% will be performed by the incumbent

Transcription of Medical Reports, Letters, and Pathology Reports 9 contractor for a period of 6 months to assure continuity of current production standards. During the Transition-In period the contractor will receive training on all information systems to be utilized as part of this contract.

1.4.29 Transition-Out. During the 30 calendar day period immediately prior to the end of the contract (if the contractor is not awarded the subsequent contract for this service), the contractor shall permit the successor contractor and the successor contractor’s employees to observe and become familiar with any and all operations under the contract. The contractor shall fully cooperate with the successor contractor and the government so as not to interfere with their work duties. The contractor shall ensure that government furnished equipment and files are in a condition equal to or better than when the contractor began this contract.

1.5 Quality Control.

1.5.1 The contractor shall provide a Quality Control Plan for review by the CC, MRD, Project Officer or their designee for acceptance no later than the post-award conference which shall be conducted within five business days following contract execution. The CC, MRD, Project Officer or their designee will notify the contractor of acceptance or required modifications to the plan within 5 business days after its receipt. The contractor shall make appropriate modifications and obtain acceptance of the plan by the CC, MRD, Project Officer or their designee within 5 business days after resubmission of the plan to the government.

1.5.2 The person(s) on the contractor's staff responsible for quality review must be thoroughly familiar with the contract specifications and requirements regarding the use of the dictation and transcription equipment and applications.

1.6 NIH Information and Physical Access Security

Information Security is applicable to this solicitation and the following information is provided to assist in proposal preparation and shall be addressed in a separate section of the Technical Proposal entitled “Information Security”.

This acquisition requires the Contractor to:

• develop, have the ability to access, or host and/or maintain Federal information and/or Federal Information system(s).

• access, or use, Personally Identifiable Information (PII), including instances of remote access to or physical removal of such information beyond agency premises or control.

• have regular or prolonged physical access to a “Federal-controlled facility”, as defined in FAR subpart 2.1.

Transcription of Medical Reports, Letters, and Pathology Reports 10

The Contractor performing under this acquisition shall comply with the following requirements:

(a) The safeguarded agency information that the successful offeror will develop or access is categorized as Mission Based Information, specifically Health Care Research and Practitioner Information. Health Care Research and Practitioner Education fosters advancement in health discovery and knowledge. This includes developing new strategies to handle diseases; promoting health knowledge advancement; identifying new means for delivery of services, methods, decision models and practices; making strides in quality improvement; managing clinical trials and research quality; and providing for practitioner education.

Information Type

(b) Confidentiality Level: [ ] Low [ X ] Moderate [ ] High

Security Categories and Levels

Integrity Level: [ ] Low [ ] Moderate [ X ] High Availability Level: [ X ] Low [ ] Moderate [ ] High Overall Level: [ ] Low [ ] Moderate [ X ] High

(c) The following sensitivity level(s), clearance type(s), and investigation requirements apply to the contract:

Position Sensitivity Designations

[ ] Level 6: Public Trust -High Risk. Contractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (BI).

[ X ] Level 5: Public Trust - Moderate Risk. Contractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level 1: Non Sensitive. Contractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Agency Check and Inquiry Investigation (NACI).

The Contractor shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Project Officer, with a copy to the Contracting Officer, within 14 calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at

Transcription of Medical Reports, Letters, and Pathology Reports 11 https://ocio.nih.gov/InfoSecurity/public/acquisition/Documents/SuitabilityRoster_10-15- 12.xlsx

Suitability Investigations are required for contractors who will need access to NIH information systems and/or to NIH physical space. However, contractors who do not need access to NIH physical space will not need an NIH ID Badge. Each contract employee needing a suitability investigation will be contacted via email by the NIH Office of Personnel Security and Access Control (DPSAC) within 30 days. The DPSAC email message will contain instructions regarding fingerprinting as well as links to the electronic forms contract employees must complete.

Additional information can be found at the following website:

http://idbadge.nih.gov/background/index.asp

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

(d)

Information Security Training

1. Mandatory Training

All employees having access to (1) Federal information or a Federal information system or

(2) personally identifiable information, shall complete the NIH Information Security Awareness Training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, employees having access to the information identified above shall complete an annual NIH-specified refresher course during the life of this contract. The Contractor shall also ensure subcontractor compliance with this training requirement.

2. Role-based Training

HHS requires role-based training when responsibilities associated with a given role or position, could, upon execution, have the potential to adversely impact the security posture of one or more HHS systems. Read further guidance at: Secure One HHS Memorandum on Role-Based Training Requirement“

For additional information see the following:

http://prod.ocio.nih.gov/InfoSecurity/training/MandatoryInfoSecTraining/Pages/RoleBased Training.aspx

The Contractor shall maintain a list of all information security training completed by each contractor/subcontractor employee working under this contract. The list shall be provided to the Project Officer and/or Contracting Officer upon request.

https://ocio.nih.gov/InfoSecurity/public/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx� https://ocio.nih.gov/InfoSecurity/public/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx� http://idbadge.nih.gov/background/index.asp� http://irtsectraining.nih.gov/� http://intranet.hhs.gov/infosec/docs/policies_guides/RBT/Definition_of_SSR_Security_RBT_Implementation_FINAL_(3).html� http://intranet.hhs.gov/infosec/docs/policies_guides/RBT/Definition_of_SSR_Security_RBT_Implementation_FINAL_(3).html� http://prod.ocio.nih.gov/InfoSecurity/training/MandatoryInfoSecTraining/Pages/RoleBasedTraining.aspx� http://prod.ocio.nih.gov/InfoSecurity/training/MandatoryInfoSecTraining/Pages/RoleBasedTraining.aspx�

Transcription of Medical Reports, Letters, and Pathology Reports 12

(e)

Rules of Behavior

The Contractor shall ensure that all employees, including subcontractor employees, comply with the NIH Information Technology General Rules of Behavior, which are available at http://prod.ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx .

(f)

Personnel Security Responsibilities

1. The Contractor shall notify the Contracting Officer, Project Officer, and I/C ISSO within five working days before a new employee assumes a position that requires a suitability determination or when an employee with a suitability determination or security clearance stops working under this contract. The Government will initiate a background investigation on new employees requiring suitability determination and will stop pending background investigations for employees that no longer work under this acquisition.

2. The Contractor shall provide the Project Officer with the name, position title, e-mail address, and phone number of all new contract employees working under the contract and provide the name, position title and suitability determination level held by the former incumbent. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

3. The Contractor shall provide the Project Officer with the name, position title, and suitability determination level held by or pending for departing employees.

Perform and document the actions identified in the Contractor Employee Separation Checklist (attached) when a Contractor/subcontractor employee terminates work under this contract. All documentation shall be made available to the Project Officer and/or Contracting Officer upon request.

(g)

Commitment to Protect Non-Public Departmental Information and Data

1. Contractor Agreement

The Contractor, and any subcontractors performing under this contract, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information) http://prod.ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx�

Transcription of Medical Reports, Letters, and Pathology Reports 13

- Public Law 96-511 (Paperwork Reduction Act)

2. Contractor Employee Non-Disclosure Agreement

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the Commitment to Protect Non- Public Information – Contractor Employee Agreement A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under this acquisition.

(h)

Loss and/or Disclosure of Personally Identifiable Information (PII) – Notification of Data Breach

The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident Response Team via email (IRT@mail.nih.gov) within one hour of discovering the incident. The Contractor shall follow-up with IRT by completing and submitting one of the following two forms within three (3) work days:

NIH PII Spillage Report [ http://ocio.nih.gov/docs/public/PII_Spillage_Report.doc ]

NIH Lost or Stolen Assets Report [ http://ocio.nih.gov/docs/public/Lost_or_Stolen.doc

(i)

Data Encryption

The following encryption requirements apply to all laptop computers containing HHS data at rest and/or HHS data in transit. The date by which the Contractor shall be in compliance will be set by the Project Officer, however, device encryption shall occur before any sensitive data is stored on the laptop computer/mobile device, or within 45 days of the start of the contract, whichever occurs first.

1. The Contractor shall secure all laptop computers used on behalf of the government using a Federal Information Processing Standard (FIPS) 140-2 compliant whole-disk encryption solution. The cryptographic module used by an encryption or other cryptographic product must be tested and validated under the Cryptographic Module Validation Program to confirm compliance with the requirements of FIPS PUB 140-2 (as amended). For additional information, refer to http://csrc.nist.gov/cryptval.

2. The Contractor shall secure all mobile devices, including non-HHS laptops and portable media that contain sensitive HHS information by using a FIPS 140-2 compliant product. Data at rest includes all HHS data regardless of where it is stored.

3. The Contractor shall use a FIPS 140-2 compliant key recovery mechanism so that encrypted information can be decrypted and accessed by authorized personnel. Use http://ocio.nih.gov/public/Nondisclosure.pdf� http://ocio.nih.gov/public/Nondisclosure.pdf� mailto:IRT@mail.nih.gov� http://ocio.nih.gov/docs/public/PII_Spillage_Report.doc� http://ocio.nih.gov/docs/public/Lost_or_Stolen.doc� http://csrc.nist.gov/cryptval�

Transcription of Medical Reports, Letters, and Pathology Reports 14 of encryption keys which are not recoverable by authorized personnel is prohibited.

Key recovery is required by “OMB Guidance to Federal Agencies on Data Availability and Encryption”, November 26, 2001, http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf.

Encryption key management shall comply with all HHS and NIH policies (http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf) and shall provide adequate protection to prevent unauthorized decryption of the information.

All media used to store information shall be encrypted until it is sanitized or destroyed in accordance with NIH procedures. Contact the NIH Center for Information Technology for assistance.

(http://cit.nih.gov/ServiceCatalog/Services.htm?Service=Media+Sanitization+Servi ce).

(j)

Physical Access Security

In accordance with OMB Memorandum M-05-24, the Contractor shall ensure that background investigations are conducted for all contractor/subcontractor personnel who have (1) access to sensitive information, (2) access to Federal information systems, (3) regular or prolonged physical access to Federally-controlled facilities, or (4) any combination thereof. OMB Memorandum M-05-24 is available at http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf. Agency personal identification verification policy and procedures are identified below:

HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook (02- 01-05): http://www.hhs.gov/oamp/policies/personnel_security_suitability_handbook.html

(k) Using Secure Computers to Access Federal Information

1. The Contractor shall use an USGCB compliant computer when processing information on behalf of the Federal government.

2. The Contractor shall install computer virus detection software on all computers used to access information on behalf of the Federal government. Virus detection software and virus detection signatures shall be kept current.

(l)

Personally Identifiable Information (PII) Security Plan

The Offeror shall submit a PII Security Plan with its technical proposal that addresses each of the following items:

1. Verify the information categorization to ensure the identification of the PII requiring protection.

http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf� http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf� http://cit.nih.gov/ServiceCatalog/Services.htm?Service=Media+Sanitization+Service� http://cit.nih.gov/ServiceCatalog/Services.htm?Service=Media+Sanitization+Service� http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf� http://www.hhs.gov/oamp/policies/personnel_security_suitability_handbook.html�

Transcription of Medical Reports, Letters, and Pathology Reports 15

2. Verify the existing risk assessment.

3. Identify the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

4. Verify the adequacy of the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

5. Identify any revisions, or development, of an internal corporate policy to adequately address the information protection requirements of the SOW.

6. For PII to be physically transported to or stored at a remote site, verify that the security controls of NIST Special Publication 800-53 involving the encryption of transported information will be implemented.

http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf

7. When applicable, verify how the NIST Special Publication 800-53 security controls requiring authentication, virtual private network (VPN) connections will be implemented.

8. When applicable, verify how the NIST Special Publication 800-53 security controls enforcing allowed downloading of PII will be implemented.

9. Identify measures to ensure subcontractor compliance with safeguarding

PII.

The details contained in the Offeror’s PII Security Plan must be commensurate with the size and complexity of the contract requirements based on the System Categorization specified above in the subparagraph entitled Security Categories and Levels. The Offeror’s PII Security Plan will be evaluated by the Government for appropriateness and adequacy.

(m) The following documents are electronically accessible regarding:

References

(1) Federal Information and Information Systems Security:

a. HHS Information Security Program Policy at:

http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_ Policy.pdf

b. HHS Contractor Oversight Guide:

http://intranet.hhs.gov/infosec/docs/policies_guides/COG/Contractor_Oversight_Guide.pdf

(2) Personally Identifiable Information (PII):

a. OMB Memorandum M-06-15, Safeguarding Personally Identifiable Information (05-22-06): http://www.whitehouse.gov/omb/memoranda/fy2006/m-06- 15.pdf

b. OMB Memorandum M-06-16, Protection of Sensitive Agency

Information (06-23-06): http://www.whitehouse.gov/OMB/memoranda/fy2006/m06-16.pdf

c. OMB Memorandum M-06-19, Safeguarding Against and Responding to the Breach of Personally Identifiable Information:

http://www.whitehouse.gov/omb/memoranda/fy2006/m06-19.pdf http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf� http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf� http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.pdf� http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.pdf� http://intranet.hhs.gov/infosec/docs/policies_guides/COG/Contractor_Oversight_Guide.pdf� http://www.whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf� http://www.whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf� http://www.whitehouse.gov/OMB/memoranda/fy2006/m06-16.pdf� http://www.whitehouse.gov/omb/memoranda/fy2006/m06-19.pdf�

Transcription of Medical Reports, Letters, and Pathology Reports 16

d. Guide for Identifying Sensitive Information, including Information in Identifiable Form, at the NIH: http://ocio.nih.gov/security/NIH_Sensitive_Info_Guide.pdf

(3) Physical Access to a Federally-Controlled Facility:

a. Homeland Security Presidential Directive/HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors (08-27-04):

http://www.whitehouse.gov/news/releases/2004/08/print/20040827-8.html

b. OMB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors (08-05-05):

http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf

c. Federal Information Processing Standards Publication (FIPS PUB) 201-1 (Updated June 26, 2006): http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf

1.7 Connectivity / Virtual Private Networks (VPNs).

1.7.1 The contractor shall employ encryption that meets federal security standards. When remotely accessing sensitive NIH IT resources (except for publicly available websites), all electronic communications over the Internet between authorized users and NIH shall be encrypted as defined by the NIH Remote Access Policy. VPNs shall be encrypted based on the Advanced Encryption Standard (AES) or the Triple Data Encryption Standard (3DES) in accordance with Federal Information Processing Standard (FIPS)-197, AES (http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf) and FIPS 46-3, DES (http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdf).

1.7.2 Offeror agrees to follow NIH Remote Access Policies and utilize remote access technologies approved by NIH when accessing the NIH network, NIH servers and NIH applications. A Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA) documenting all remote connections (attachments 4a and 4b), rules of behavior and data protection responsibilities will be written in collaboration with NIH CC Security team after the contract is awarded.

1.7.3 The contractor shall propose options to address the event of an emergent situation when access to the Internet is not possible.

1.7.4 When connecting to NIH IT resources, all end users must log in utilizing two-factor authentication. The initial authentication will be via VPN with the user’s NIH domain account.

The second authentication will be via either an RSA soft token client or RSA hardware token.

NIH will determine if a soft token client or hardware token will be utilized and supported. All RSA hardware tokens will be provided by NIH if applicable.

1.8 Turnaround Time.

1.8.1 The contractor is responsible for maintaining an established turnaround schedule for the completion of transcribed medical reports, letters and pathology reports.

http://ocio.nih.gov/security/NIH_Sensitive_Info_Guide.pdf� http://www.whitehouse.gov/news/releases/2004/08/print/20040827-8.html� http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf� http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf� http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf� http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdf�

Transcription of Medical Reports, Letters, and Pathology Reports 17

1.8.2 The contractor shall comply with the turnaround schedules specified in 1.9.5 to account for a minimum of 150 incoming dictations of medical reports and letters per day and 50 pathology reports per day. This does not imply that the contractor shall receive an average of 150 incoming dictations of medical reports/letters and 50 pathology reports per day, but, rather, that the contractor must plan and staff in order to assure a turnaround of that volume of dictation for any given day.

1.8.3 If the contractor receives in excess of 300 incoming dictations (medical reports and letters), within a two consecutive day period, the contractor may request the Project Officer(s) to extend the turnaround time period of those dictations in excess of 300.

1.8.4 The actual amount of daily incoming dictation will vary daily during the course of a year. The schedule described below identifies the required turnaround for all types of medical reports, letters and pathology reports. In all cases, with the exception of emergency requests for transcription, the prompt turnaround of History and Physical Examinations, Consultation Reports, and Operation Reports is to be given priority over all other types of medical reports.

1.8.5 The turnaround requirements are report specific. The contractor will comply with the following turnaround schedule for dictation received on any given day, Monday through Friday, between the hours of 6:00 am and 11:00 pm and on Saturdays and Sundays between the hours of 6:00 am and 6:00 pm.

Report Type Turnaround Time

Emergency/STAT Reports 2 hours

History and Physical Examinations, Radiation Oncology History & Physical Examinations, Consultation Reports, Outpatient Operations, Inpatient Operations, Anatomic Pathology, Surgical Pathology

6 hours

EEG, EMG, Rehabilitation Medicine, Speech Pathology, Occupational Therapy, Physical Therapy

12 hours

All Other 24 hours

1.8.6 The cutoff time for completion of incoming reports requiring 6-hour turnaround that must be returned the day of dictation is 5:00 pm, Monday through Friday and 12:00 pm, Saturday and Sunday. New dictation received after those hours will be considered received at 6:00 am the following day.

Transcription of Medical Reports, Letters, and Pathology Reports 18

1.8.7 Turnaround time and the report completion process must account for time for speech recognition, transcription, editing, proofing, quality assurance activities, messages attached as appropriate, and presentation/availability for review and signature by the dictating clinician.

1.8.8 The contractor must comply with the established turnaround schedules for a minimum of 50 incoming dictations occurring on any of the following legal holidays: New Year’s Day; Martin Luther King, Jr’s Birthday; Presidents’ Day; Memorial Day; Independence Day; Labor Day;

Columbus Day; Veterans’ Day; Thanksgiving Day; and Christmas Day.

1.8.9 On any of the legal holidays, incoming dictations in excess of 50 shall be given an additional 12 hours for turnaround. This is to be upon written request by the contractor and agreement by the MRD Project Officer(s).

1.8.10 The turnaround schedule shall not be routinely adjusted or waived to account for weekends, holidays or normal periods of absence by the transcription contractor’s staff.

1.8.11 Any contractor employees working onsite in the MRD shall not use cellular telephones in MRD work areas if working during normal MRD business hours. The MRD’s normal business hours are 6:30 am to 5:00 pm Monday through Friday.

1.8.12 The contractor shall always maintain the ability to locate and produce individual dictation or transcription prior to delivery of the finished product to the MRD.

2. Dictation Services Requirements.

2.1. Recording/Electronic Logging Equipment Requirements

2.1.1. The contractor shall be responsible for the provision of all of the following equipment and related equipment maintenance necessary in the performance of services specified.

2.1.1.1. NIH dedicated…