P09 - PWS_CPAC Billing Services_Revised_9-4-2020_FINAL.pdf

Consolidated Patient Account Center (CPAC) Revenue Operations (RO) Performance Work Statement – 9-4-2020

Title of Project: Consolidated Patient Accounts Center (CPAC) – Third Party Outpatient Health Care Revenue Billing Services

Requiring Activity Name: Revenue Operations Consolidated Patient Accounts Center

1.0 SCOPE

The Contractor shall provide vendor contract services for generation of outpatient claims to third party healthcare insurance carriers for CPAC sites nationwide.

1.0.1 Background

The Department of Veterans Affairs (VA) has historically relied on contract services to improve collections through timely and accurate billing of third-party claims. The VA’s Consolidated Patient Accounts Centers (CPACs) are responsible for billing to and collecting from insurance companies for medical treatment provided to veterans for non-service-connected conditions. There are 7 regional CPACs located as follows:

Station 730, Asheville, NC – Mid-Atlantic CPAC (MACPAC) Station 731, Smyrna, TN – Mid-South CPAC (MSCPAC) Station 732, Middleton, WI – North Central CPAC (NCCPAC) Station 733, Orlando, FL - Florida Caribbean CPAC (FCCPAC) Station 734, Lebanon, PA – North East CPAC (NECPAC Station 735, Leavenworth, KS – Central Plains CPAC (CPCPAC) Station 736, Las Vegas, NV- West CPAC (WCPAC)

Public Law 99-272 gave VA authority to seek reimbursement from third party health insurers for the cost of medical care furnished to an insured non-service connected (NSC) veteran. Public Law 101-508 expanded VA’s recovery program by providing authority to seek reimbursement from third party payers for the cost of medical care provided to ensure service-connected veterans treated for their non-service connected (NSC) conditions.

1.0.2 Objectives

The primary objective of this Performance Work Statement (PWS) is to acquire vendor services to generate accurate and timely third-party claims for CPAC sites nationwide.

1.1 Non-Personal Services

This award identifies services that are strictly non-personal in nature.

1.2 Severable / Non-Severable Services

This award identifies services that are severable in nature.

1.3 Inherently Governmental Functions

This requirement has been reviewed and contains no services that are inherently governmental functions.

2.0 PERFORMANCE WORK STATEMENT (PWS)

2.0.1 Medical Billing Services – Deliverable 1

Within 60 days or less of contract award, and for the duration of the Ordering Period, Contractor shall provide services to authorize and release outpatient medical claims to third party insurance carriers in the VA Veterans Health Information Systems and Technology Architecture (VistA) information system in accordance with VA established guidelines, and as further described in this Performance Work Statement.

2.0.2 Monthly Itemized Statement – Deliverable 2

The Contractor shall ensure that an itemized statement is submitted monthly outlining the expenditures, billings, and any access problems/issues encountered in the performance of this task.

Monthly reports on the billing activity shall include, but are not limited to:

• Summary of each facility for the reporting period (every four weeks) and cumulative to date

• i-FAM

• Number of claims authorized and released

• Total dollar value of claims authorized and released

• Number of claims canceled

• Total dollar value of claims canceled

• Percentage of claims filed within two days of Contractor’s receipt from VA facility

• Itemized summary for each transaction for the reporting period (every 4 weeks) and cumulative to date

• Number of transactions broken out by CPAC facility

In addition to the minimum report content/format requirements identified herein, individual CPACs may also require additional information that is specific to their facilities/localities.

2.0.3 Contingency Operations Plan - Deliverable 3

The Contractor shall on a one-time basis develop and submit a Contingency Operations Plan to the Government. The Contingency Operations Plan shall document Contractor plans and procedures to maintain CPAC support during an emergency. The Contingency Operations Plan shall include the following:

• A description of the Contractor’s emergency management procedures and policy

• A description of how the Contractor plans to account for their employees during an emergency

• Planned temporary work locations or alternate facilities

• How the Contractor plans to communicate with the CPAC during emergencies

• A list of primary and alternate Contractor points of contact, each with primary and alternate:

• Telephone numbers

• E-mail addresses

• Procedures for safeguarding sensitive and/or classified Government information (such as PHI/PII)

Individual contingency operation plans shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve

(12) hours of activation, and shall be sustainable until the emergency is resolved, and normal conditions are restored, or the contract is terminated, whichever comes first. When any disruption of normal, daily operations occurs, the Contractor Task Manager shall promptly open an effective means of communication and verify:

• Key points of contact (Government and Contractor)

• Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

• Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.)

• Essential work products expected to continue production by priority

The Contractor Task Manager, in coordination with the COR, shall make use of the resources and tools available to continue CPAC contracted functions to the maximum extent possible under emergency circumstances. The Contractor shall obtain approval from the COR and Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract.

3.0 QUALITY STANDARDS FOR DELIVERABLES

3.1 Coordination

Direct communication regarding billing issues should be addressed to the Billing Manager or Supervisor. Names and contact information will be provided after award.

3.1.0 Medical Billing Services.

3.1.1 Monthly Itemized Statement.

3.1.3 Contingency Operations Plan.

3.2 Errors

Contractor shall be responsible for correcting any errors made by its employees at no charge to the VA.

3.2.0 Medical Billing Services. reference section 6.5.2 - Task #4

3.2.1 Monthly Itemized Statement. reference section 6.5.2 – Task #4

3.2.3 Contingency Operations Plan. reference section 6.5.2 – Task #4

3.3 Timely Performance Requirements

Contractor shall complete outpatient medical billing within two business days of receipt of information from CPAC no less than 97% of the time.

3.3.0 Medical Billing Services.

3.3.1 Monthly Itemized Statement.

3.3.3 Contingency Operations Plan.

3.4 Delivery

Electronic copies shall be delivered using Microsoft Office suite of tools (for example, MS WORD, MS EXCEL, MS POWERPOINT, MS PROJECT, or MS ACCESS format), unless otherwise specified by the COR. Electronic submission shall be made via email, unless otherwise agreed to by the COR.

If for any reason any deliverable cannot be delivered within the scheduled timeframe, the Contractor is required to explain why in writing to the COR by the delivery due date, including a firm commitment of when work shall be completed.

This notice to the COR shall cite the reasons for the delay, and the impact on the overall project. The COR will forward the notice and reasons for the delay to the CO with comments. The CO will then review the facts and issue a response, in accordance with applicable regulations.

3.4.0 Medical Billing Services.

3.4.1 Monthly Itemized Statement

3.4.2 Contingency Operations Plan

3.5 Shipping

The Contractor shall use the U.S. Postal Service standard delivery for delivery of materials, equipment, or required hardcopy documents. The COR must approve all exceptions to this requirement.

3.5.0 Medical Billing Services.

3.5.1 Monthly Itemized Statement

3.5.2 Contingency Operations Plan

4.0 INSPECTION AND ACCEPTANCE

The Contracting Officer’s Representative (COR) for the Task Order is a Government official who has been delegated specific technical, functional and oversight responsibilities for this task order. The COR is designated in the COR appointment letter, issued by the Contracting Officer, and is responsible for inspection and acceptance of all services, documents, and services.

4.1 Acceptance Criteria

Certification by the Government of satisfactory services provided is contingent upon the Contractor performing in accordance with the performance standards contained in the Performance Requirements Summary Matrix (Section 6.5.2) and all terms and conditions of this contract including all modifications.

4.2 Invoicing and Receiving Report Instructions

The Contractor is responsible for properly preparing and forwarding to the appropriate Government official, the invoice and monthly itemized statement for payment.

The Contractor shall submit invoices related to this effort in the OB10 Invoicing system.

All invoices submitted shall contain the following information:

Purchase Order/Task Order Number:

Contractor Name:

Invoicing Period:

Itemized Services Provided:

The above information shall be listed on the invoices, provided VHA has identified the appropriate numbers on its Purchase Order and indicated on the Purchase Order that the above references need to be referenced on the invoice. The Contractor shall submit invoices to VA on a basis commensurate with length of the project. For completed projects shorter than a month, submit an invoice at the end of that month. For projects which take longer than a month, submit an invoice at the end of each month for all completed project tasks accomplished during that month.

4.3 Government Acceptance Period

The COR will have ten (10) business days to review draft deliverables and make comments. The Contractor shall have five (5) business days to make corrections. Upon receipt of the final deliverables, the COR will have two (2) business days for final review prior to acceptance or providing documented reasons for non-acceptance. Should the Government fail to complete the review within the review period the deliverable will become acceptable by default, unless prior to the expiration of the ten (10) business days the Government notifies the Contractor in writing to the contrary. The final submission should be deemed approved if the Government has not rejected it in thirty (30) calendar days.

4.4 PWS Abbreviations and Definitions

The following abbreviations and Definitions are used in the PWS:

Abbreviation Definition CO Contracting Officer COR Contracting Officer's Representative for the Task order CS Contract Specialist DA Days after DACA Days after contract award (award of this order) DAEOM Days after the end of the month

Days Calendar Days unless otherwise specified DID Data Item Description E Electronic Copy H Hard Copy Key Personnel Manager/Supervisor position NLT Not Later Than PWS Ref Performance Work Statement Reference (paragraph number) Emergency Any event/declaration that would create work stoppage or interrupt operations.

Transaction Under HIPAA, this is the exchange of information between two parties to carry out financial or administrative activities related to health care

4.5 Deliverable / Delivery Schedule

Schedules for Government and Contractor Deliverables: Table of Mandatory Deliverables

DELIVERABLE DUE DATE

Deliverable 1: Medical Billing Services Within 60 days or less of contract award Deliverable 2: Monthly Itemized Statement Monthly Deliverable 3: Contingency of Operations Plan Within 30 calendar days of contract award

4.6 Formal Acceptance or Rejection of Deliverables

All written deliverables shall be phrased in layperson language. Statistical and other technical terminology shall not be used without providing a glossary of terms. The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted quote. In the event of a rejected deliverable, the Contractor shall be notified in writing by the COR of the specific reasons for rejection. The Contractor shall have five (5) workdays to correct the rejected deliverable and return it per delivery instructions.

5.0 PERFORMANCE DETAILS

5.1 Period of Performance Sixty (60) month Ordering Period

The period of performance for this contract is:

There are ten (10) Federal holidays set by law (U.S.C. Title 5 Section 6103):

Under current definitions, four are set by date:

New Year’s Day January 1 Independence Day July 4

Veteran’s Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King Day Third Monday in January Washington’s Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

5.2 Place of Performance

The physical location of performance of work activity will be the responsibility of the Contractor. No space will be provided by the CPAC. Contractor shall provide a remote and secure business setting for healthcare billing. Patient confidentiality and database security must be maintained at all times.

5.3 Hours of Operation

The normal operating hours for the Federal Government are Monday – Friday, 8:00am – 4:30pm local area time. Considerations must be given for the ability of the requesting CPAC to communicate with the Contractor’s key personnel during the Federal Government’s normal hours of each CPAC.

6.0 OTHER TERMS, CONDITIONS, AND PROVISIONS

6.1 Non-billable

If an outpatient medical care encounter is determined to be not billable the Contractor shall cancel the claim and/or enter a reason not billable (RNB) in the VistA Integrated Billing Software Package at no charge to the VA. VA estimates 10% of daily workload will be determined not billable.

6.2 Non-Disclosure / Non-Use Agreement

The Contractor shall ensure that a Non-Disclosure Statement is signed before performing any work. The Non-Disclosure / Non-Use statement shall be cosigned by a corporate official (Contractor Task Manager or higher).

6.3 Information Assurance

General Security Requirements.

The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of government data. As a minimum, this shall include provisions for personnel security, electronic security, and physical security as listed in the sections that follow.

Health Insurance Portability and Accountability Act (HIPAA).

The Contractor shall comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (P.L. 104-191) requirements, specifically the administrative simplification provisions of the law and the associated rules and regulations published by the Secretary, Health and Human Services (HHS). This includes the Standards for Electronic Transactions, the Standards for Privacy of Individually Identifiable Health Information and the Security Standards. It is expected that the contractor shall comply with all HIPAA-related rules and regulations as they are published (including identifiers for providers, employers, health plans, and individuals, and standards for claims attachment transactions).

6.4 Protection of Information

6.4.1 Dissemination of Information/Publishing

There shall be no dissemination or publication, except within and between the Contractor and any subcontractors.VA approval for publication will require provisions which protect the intellectual property and patent rights of both VA and the Contractor.

6.4.2 Contractor Employees

6.4.2.1 Key Personnel.

Skilled experience in managing insurance billing office with similar volumes and work projected in this PWS. These “Key personnel”, are the individuals whose resumes were submitted and marked by the vendor as “Key Personnel”. The Contracting Officer may notify the Contractor and request immediate removal of any personnel assigned to the task order by the Contractor that are deemed to have a conflict of interest with the government or if the performance is deemed to be unsatisfactory. The reason for removal will be documented and replacement personnel shall be identified within three business days of the notification. Employment and staffing difficulties shall not be justification for failure to meet established schedules.

6.4.2.2 Substitution of Key Personnel.

All Contractor requests for approval of substitutions hereunder shall be submitted in writing to the COR and the Contracting Officer at least thirty

(30) calendar days in advance of the effective date, whenever possible, and shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume for the proposed substitute, and any other information requested by the Contracting Officer necessary to approve or disapprove the proposed substitution. New personnel shall not commence work until all necessary security requirements, as defined in Section , have been fulfilled and resumes provided and accepted. The COR and the Contracting Officer will evaluate such requests and promptly notify the Contractor of approval or disapproval in writing.

6.4.2.3 Management and Oversight.

The Contractor shall be responsible for managing and overseeing the activities of all Contractor and subcontractor personnel, used in performance of this effort. The Contractor’s management responsibilities shall include all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained in the performance work statement.

6.4.2.4 Domain Knowledge.

The Contractors shall present domain knowledge of outpatient healthcare third party billing. Domain knowledge criteria are specified below:

Contractor Personnel Requirements: Personnel proposed shall have an in-depth knowledge of health care revenue third party billing in the following areas:

1. Knowledge and experience in authorizing and releasing claims to third party carriers for outpatient services.

2. Knowledge of and ability to apply third party insurance and Medicare guidelines to claims.

6.4.2.5 Staff Qualifications

• Manager

Comprehensive knowledge of the principles, practices, laws, rules and regulations related to billing for healthcare services and the submission of healthcare claims. Provides management oversight, guidance, corrective measures, and direction for monitoring activities designed to ensure the integrity and accuracy of healthcare claims. The Incumbent serves as the CPAC's expert technical authority on matters relating to VHA’s Consolidated Billing departments and the interface with process drivers at the medical centers for which the individual CPAC supports. Exercises management responsibility for complex billing activities for all the facilities assigned to the CPAC. Implements and manages all aspects of billing activities for CPAC clients and a wide range of stakeholders.

• Supervisor

Incumbent serves as Billing Supervisor responsible for the timely and accurate preparation and submission of claims for healthcare services, equipment, and/or medication. The Supervisor makes assignments based on complexity of healthcare services, procedures, equipment, etc., provided, stabling deadlines and quality requirements. Comprehensive knowledge of framework of regulatory material regarding healthcare billing such as Medicare, TRICARE, and CHAMPVA guidelines, Sharing Agreements, Worker’s Compensation, appropriate Public Laws, HIPPA rules and regulations. Knowledge of coding of diseases and procedures using ICD-9, CPT, and HCPCS coding systems.

6.4.2.6 General experience.

Contractor personnel assigned to this contract shall have expertise in performing outpatient medical billing.

6.3.3 Personally Identifiable Information (PII) and Protected Health Information (PHI) Contractors collecting, storing, or disseminating personal identifiable information (PII) or protected health information (PHI) data must conform to all pertinent regulations, laws, and VA directives related to privacy. Contractors must provide access for VA privacy reviews and assessments and provide appropriate documentation as directed.

6.5 Quality Assurance

The Government will review Monthly Itemized Statements and will attend regular task performance review meetings with the Contractor to survey quality of products and services.

6.5.1 Quality Assurance Surveillance Plan (QASP)

The Government intends to utilize a Quality Assurance Surveillance Plan (QASP) to monitor the quality of the Contractor’s performance. The oversight provided for in the QASP will help to ensure that service levels reach and maintain the required levels throughout the contract term. Further, the QASP provides the COR with a proactive way to avoid unacceptable or deficient performance and provides verifiable input for the required Past Performance Information Assessments. The QASP will be finalized immediately following award and a copy provided to the Contractor after award. The QASP is a living document and may be updated by the Government as necessary.

6.5.2 Performance Requirements Summary Matrix

By monitoring the Contractor, the COR will determine whether the performance levels set forth in the order have been attained. Performance standards are specified in the following Performance Requirements Summary Matrix in the Standard and Acceptable Quality Level columns.

Task Indicator Standard Acceptable Quality Level

Method of Surveillanc e Incentive

1.

Authorization and release of outpatient medical claims

Timely completion of medical billing

Medical claims are generated within 2 business days of receipt of information from CPAC

Billing workload is completed within 2 days of receipt no less than 97% of the time

A – Periodic Inspection Written confirmatio n from Contractor that billing has been completed within 2 business days or explanation for any delays

Positive past performance rating.

2.

Authorization and release of outpatient medical claims

Billing accuracy Medical claims are authorized and released in accordance with CPAC guidebooks and VA policy and directives

No more than 2% of encounters rejecting as the result of biller error;

Individual biller quality review does not fall below 95%

A- Periodic Inspection & B – Random Sampling -including monthly quality reviews, daily reviews of CSA and

MRW

rejections, and written or oral complaints

Positive past performance rating

3. Authorization and release of outpatient medical claims

Resolving claim rejections

Rejected claims will be resolved within 5 business days

98% of claim rejections are addressed within 5 business days

A- Periodic Inspection of CSA and

MRW

Positive past performance rating

Quality Level

Method of Surveillanc e Incentive

4. Authorization and release of outpatient medical claims

Accurate canceling claims and assigning correct RNBs

Claims are appropriately canceled in VistA and correct RNB is assigned in Claims Tracking

No more than 2% of claims are inappropriately canceled

B – Random Sampling

Positive past performance rating

5.

Authorization and release of outpatient medical claims

Individual biller productivity

Each contract employee shall generate a minimum of 120 medical claims per day for a facility within the

CPAC.

Productivity standard is met at least 98% of the time

A- Periodic Inspection & B – Random Sampling of Clerk Productivity Report

Positive past performance rating

6. Communicati on

Resolving billing-related questions and concerns

Open lines of communicati on are maintained between Contractor and CPAC at all times.

No more than two exceptions per rating period

C – Validated User Complaints

Positive past performance rating

7. Training for and associated with the authorization and release of outpatient medical claims

Conference call participation

Contractor participates on conference calls, as needed, to improve billing performance.

No more than two exceptions per rating period

C – Validated User Complaints

Positive past performance rating

Quality Level

Method of Surveillanc e Incentive

8. System Access for authorization and release of outpatient medical claims

Maintain VistA access

Contractor shall log onto the VistA system for each CPAC Medical Center at least once every 30 days to maintain this access

No more than two exceptions per rating period

C – Validated User Complaints

Positive past performance rating

9. Authorization and release of outpatient medical claims

Compliance with VA specific requirements related to confidentiality of drug abuse, alcoholism and alcohol abuse, human immunodeficien cy virus (HIV) infection and sickle cell anemia medical records.

Contractor shall ensure all claims are released in compliance with VA specific requirements.

No exceptions B – Random Sampling C – Validated User Complaints

Positive Past Performance Rating

6.5.3 Performance Evaluation Process

The Contractor Performance Assessment Reporting System (CPARS) has been adopted by VA to electronically capture assessment data and manage the evaluation process. CPARS is used to assesses a Contractor’s performance and provide a record, both positive and negative, on a given contract during a specific period. The CPARS process is designed with a series of checks and balances to facilitate the objective and consistent evaluation of Contractor performance. Both Government and Contractor program management perspectives are captured on the CPAR form and together make a complete CPAR. Once the Assessing Official completes the quoted assessment for the period of performance, the CPAR is released to the appropriate Government Contractor Representative for their review and comments. User ID and Password will be provided to the designated Government Contractor Representative upon issuance of a task order.

The Contractor has 30 days after the Government's evaluation is completed to comment on the evaluation. The Government Contractor Representative must either concur or non-concur to each CPAR. If the Contractor concurs with the quoted assessment and the Reviewing Official does not wish to see the CPAR, the Assessing Official may close out the CPAR. Otherwise, they must forward the CPAR to the Reviewing Official for them to review, enter comments if appropriate, and close out. The Reviewing Official may at their option direct the Assessing Official to forward every CPAR to them for review.

6.6 Section 508 Requirement

The Contractor shall comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board), pursuant to Section 508(2) (A) of the Rehabilitation Act Amendments of 1998, established Information Technology accessibility standards for the Federal Government. Section 508(a)(1) requires that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. The Section 508 requirement also applies to members of the public seeking information or services from a Federal department or agency.

6.7 Other Special Considerations

6.7.1 Security – Security Privacy Requirements

General - All Contractors and Contractor personnel shall be subject to the same Federal laws, regulations, standards, and VA policies as VA, and VA personnel, regarding information and information system security. Contractors must follow policies and procedures outlined in VA Directive 6500, Information Security Program and its handbooks to ensure appropriate security controls are in place.

6.7.1.1 VA Information Custodial Requirements

Information made available to the Contractor by VA for the performance or administration of this contract or information developed by the Contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the contracting officer. This clause expressly limits the Contractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d)(1).

Information generated by a Contractor as a part of the Contractor’s normal business operations, such as medical records created in the course of providing treatment, is subject to a review by the Office of General

Counsel (OGC) to determine if the information is the property of VA and subject to VA policy. If the information is determined by OGC to not be the property of VA, the restrictions required for VA information will not apply.

VA information will not be co-mingled with any other data on the Contractors/subcontractor’s information systems/media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. VA also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization procedures to ensure they follow VA policy requirements.

Prior to termination or completion of this contract, Contractor will not destroy information received from VA or gathered or created by the contractor in the course of performing this contract without prior written approval by the VA contracting officer. Any data destruction done on behalf of VA by a Contractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, and applicable VA Records Control Schedules.

The Contractor shall receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. Applicable Federal information security regulations include all Federal Information Processing Standards (FIPS) and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST). If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies, including FIPS or SP, in this contract.

Contractors collecting, storing, or disseminating personal identifiable information (PII) or protected health information (PHI) data must conform to all pertinent regulations, laws, and VA directives related to privacy.

Contractors must provide access for VA privacy reviews and assessments and provide appropriate documentation as directed.

The Contractor shall not make copies of VA information except as necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to terminate the contract for default or terminate for cause under Federal Acquisition Regulation (“FAR”) part 12.

If a VHA contract is terminated for cause, the associated business associate agreement (BAA) will also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01 Business Associates.

Contractor will store, transport, or transmit VA sensitive information in an encrypted form, using a VA-approved encryption application that meets the requirements of NIST’s FIPS 140-2 standard.

The Contractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA directives are available on the VA directives Web site at http://www1.va.gov/vapubs/.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The Contractor will refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the Contractor shall not release medical quality assurance records protected by 38 U.S.C. 5705 or records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus protected under 38 U.S.C. 7332 under any circumstances, including in response to a court order, and shall immediately refer such court orders or other inquiries to the VA contracting officer for response.

The Contractor will not use technologies banned in VA in meeting the requirements of the contract (e.g., Bluetooth enabled devices).

6.7.1.2 Information System Design and Development

Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA policies developed in accordance with Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), NIST, and http://www1.va.gov/vapubs/ related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program).

During the development cycle, a privacy impact assessment will be completed, provided to the COTR, and approved by the VA Privacy Service in accordance with VA Privacy Impact Assessment Handbook 6500.3.

The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37 and VA Handbook 6500.

The Contractor shall be required to design, develop, or operate a System of Records on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

The Contractor agrees to -

Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies --

• The systems of records; and

• The design, development, or operation work that the Contractor is to perform;

Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and, Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is an employee of the agency.

Operation of a system of records” means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

“Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

“System of records on individuals” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

6.7.1.3 Information System Hosting, Operation, Maintenance or Use For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, Contractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. The Contractor security control procedures must be identical, not equivalent, to those procedures used to secure VA systems. A privacy impact assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections involving VA information must be reviewed and approved by VA prior to implementation.

Adequate security controls for collecting, processing, transmitting, and storing of personally identifiable information, as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls need to be stated within the PIA and supported by a risk assessment. If these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

Outsourcing (contractor facility/contractor equipment/contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (C&A) of the contractor’s systems in accordance with NIST Special Publication 800-37 and VA Handbook 6500 and a privacy impact assessment of the contractor’s systems prior to operation of the systems. Government-owned (government facility/government equipment) contractor-operated systems, third party or business partner networks require a system interconnection agreement and a memorandum of understanding (MOU) which detail what data types will be shared, who will have access, and the appropriate level of security controls for all systems connected to VA networks.

The Contractor must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the information security officer (ISO) for entry into VA’s Plan of Action and Milestone (POA&M) management process. The Contractor will use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the Government. Contractor procedures will be subject to periodic, unannounced assessments by VA officials. The physical security aspects associated with Contractor activities will also be subject to such assessments. As updates to the system occur, an updated PIA must be submitted to the VA Privacy Service through the COTR for approval.

All electronic storage media used on non-VA leased or owned IT equipment that is used to store, process, or access VA sensitive information must have all VA sensitive information removed, cleared, sanitized, or destroyed in accordance with VA policies and procedures upon: (1) completion or termination of the contract or (2) disposal or return of the IT equipment by the contractor or any person acting on behalf of the Contractor, whichever is earlier.

6.7.2 Information System Security

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard contract language, conditions laws, and regulations. The Contractor’s firewall and web server shall meet or exceed the government minimum requirements for security. All government data shall be protected behind an approved firewall.

Any security violations or attempted violations shall be reported to the VA project manager and the VBA Headquarters Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation. See VAAR clause 852.273-75 included in this contract.

6.7.2.1 Security Incident Investigation

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures.

The Contractor shall immediately notify the Contracting Officer Representative (COR) and Contracting Officer (CO) simultaneously, the designated ISO/Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor has access.

To the extent known by the Contractor, the Contractor’s notice to VA will identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information/assets were placed at risk or compromised), and any other information that the Contractor considers relevant.

The Contractor will simultaneously report the incident to the appropriate law enforcement entity(is) of jurisdiction, including the VA Offices of the Inspector General and Security and Law Enforcement, in instances of theft or break-in or other criminal activity. The Contractor, its employees, and its subcontractors and their employees will cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor will cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

To the extent practicable, the Contractor shall mitigate any harmful effects on individuals whose VA information was accessed or disclosed in a security incident. In the event of a data breach with respect to any VA Sensitive Information processed or maintained by the Contractor or subcontractor under the contract, the Contractor is responsible for liquidated damages to be paid to VA.

6.7.2.2 Security Controls Compliance Testing

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the Contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the Government, the Contractor will fully cooperate and assist in a Government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The Government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by VA in the event of a security incident or at any other time.

6.7.2.3 Security Training

All Contractor employees and Sub-Contractor employees requiring access to VA sensitive information and/or VA information systems shall complete the following before being granted access to VA networks or sensitive information:

• Sign and acknowledge understanding of and responsibilities for compliance with the Contractor Rules of Behavior relating to access to VA information and information systems;

• Successfully complete Privacy and HIPAA Training and annual refresher training as required;

• Successfully complete VA Privacy and Information Security Awareness and Rules of Behavior and annual refresher training as required; and

• Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

The Contractor shall provide to the Contracting Officer a copy of the training certificates for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required. These online courses are located at the following web site:

https://www.tms.va.gov/SecureAuth35/

Failure to complete this mandatory training within the timeframe required will be grounds for suspension or termination of all physical and/or electronic access privileges and removal from work on the contract until such time as the training is completed.

6.7.3 Contractor Personnel Security

All Contractor employees who require access to the Department of Veterans Affairs' computer systems shall be the subject of a background investigation and https://www.tms.va.gov/SecureAuth35/ must receive a favorable adjudication from the VA Security and Investigations Center (07C). The level of background security investigation shall be in accordance with VA Directive 0710 dated September 10, 2004 and is available at:http://www.va.gov/pubs/asp/edsdirec.asp (VA Handbook 0710, Appendix A, Tables 1 - 3). Appropriate Background Investigation (BI) forms shall be provided upon contract (or task order) award and are to be completed and returned to the VA Security and Investigations Center (07C) within 3 days for processing.

Contractors shall be notified by 07C when the BI has been completed and adjudicated. These requirements are applicable to all Sub-Contractor personnel requiring the same access. If the security clearance investigation is not completed prior to the start date of the contract, the employee shall not work on the contract while the security clearance is being processed. Work will commence as soon as the Contractor and Contractor employee receives and email message that states the following: We show that background investigation request on the individual listed below has been completed and the case has been initiated by the Security Investigations Center. When the case is completed, all adjudicative paperwork will be returned to the requesting office. You can provide this email to the Station ISO as proof the investigation has been initiated and access can be granted. This notice does not ensure completion of VetPro or other required security training. Those individuals that require VetPro Credentialing or additional security training must receive those completion notifications from the proper authority prior to start date.

The investigative history for Contractor personnel working under this contract must be maintained in the databases of either the Office of Personnel Management (OPM) or the Defense Industrial Security Clearance Organization (DISCO). Should the Contractor use a vendor other than OPM or Defense Security Service (DSS) to conduct investigations, the investigative company must be certified by OPM/DSS to conduct Contractor investigations.

6.7.3.1 Background Investigation.

The position sensitivity impact for this effort has been designated as low risk and the level of background investigation is NACI.

6.7.3.2 Contractor Responsibilities.

The Contractor shall ensure staff is available to attend VA specific training on the dates and times specified by the CPAC.

The Contractor shall request other VA documentation deemed pertinent to the work accomplishment directly from the COR. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

The Contractor shall submit claims to payers electronically via a clearinghouse.

The Contractor shall provide automated secondary billing services provided the electronic (835) Medicare Remittenace Advise (MRA) or Remittenace Advise (RA) is supplied.

The Contractor shall ensure no paper claims are printed or mailed from any location other than a CPAC. Contractor will be provided printing instructions post award.

The Contractor shall make no decision(s) regarding a veterans’ service-connected status.