W81K0020Q01240001.pdf

W40M USA HLTH CONTRACTING ACT

REGIONAL HEALTH CONTRACT OFF CENTRAL

POC: TROY LOGE

1650 COCHRANE CIRCLE, BLDG 7500

FORT CARSON CO 80913-4604

0011453216

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

A. The purpose of this modification is to remove contracting officer responsiblity for the quality control plan at Purchase Desecription 1.2, update HIPAA provision, change the definition of unacceptable in and remove sub-contracting plan language from 52.212-2 Addendum, and incorporate LEIE provision (Exclusion from Participation in Federal Health Care Progams).

B. Reference purchase request 0011453216.

C. All other terms and conditions remain the same.

See SUMMARY OF CHANGES

1. CONTRACT ID CODE PAGE OF PAGES

J 1 53

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 25-Aug-2020

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street , County, State and Zip Code) X W81K0020Q0124

X 9B. DATED (SEE ITEM 11)

19-Aug-2020

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

21-Aug-2020

CODE

W40M USA HLTH CONTRACTING ACT

REGIONAL HEALTH CONTRACT OFF CENTRAL

2539 GARDEN AVENUE

FT SAM HOUSTON TX 78234-0000

W81K00 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE W81K00

FACILITY CODECODE

EMAIL:TEL:

W81K0020Q0124

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been added by full text:

LEIE

Exclusion from Participation in Federal Health Care Programs (October 2015)

1. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at http://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and- Safety/Quality-And-Safety-of- Healthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

2. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the Lists and no such names appear on either of the Lists.

3. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

4. The Contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of contractor personnel working in the MTF against the Lists, as specified in OTSG/MEDCOM Policy Memo 15-037. The Government will notify the Contractor in the event any contractor personnel working in the MTF appear on either of the Lists.

5. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

6. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

7. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a-7a):

a. There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

b. Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person.

8. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at http://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

(End of LEIE)

PII/PHI

PERSONALLY IDENTIFIABLE INFORMATION, PROTECTED HEALTH INFORMATION, AND

FEDERAL INFORMATION REQUIREMENTS (REVISED MAY 23, 2017)

1. General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (October 29, 2014) and DoD 5400.11-R (May 14, 2007).

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S.

Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part

162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (January 24, 2003), Department of Defense Instruction (DoDI)

6025.18 (December 2, 2009), and DoDI 8580.02 (August 12, 2015).

Defense Health Agency (DHA) Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

2. Records Management

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042- 5101 (or email requests addressed to DHA.FOIA@mail.mil), and that the request shall describe the desired record as completely as possible (ideally with Contract or modification number) to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier.

Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances. Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, and OMB Circular A-130. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA)

Contractors are not required to submit PIAs to DHA.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

• DSA for De-Identified Data

• DSA for PHI

• DSA for PII Without PHI

• DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (Applies if contract requirements may include human subject research)

This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

7. Privacy Act and HIPAA Training

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of alcohol and drug abuse patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

8. HIPAA Business Associate Provisions

8.1 Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. This paragraph 8 serves as the required BAA. As a Business Associate, the Contractor shall comply with the HIPAA Rules and the DoD HIPAA Issuances applicable to a business associate performing under this Contract.

8.1.1 Catch-All Definition

The following terms used, but not otherwise defined in paragraph 8.1, shall have the same meaning as those terms have in the DoD HIPAA Issuances: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information (Unsecured PHI), and Use.

8.1.2 The Contractor shall not use or further disclose PHI other than as permitted or required by the Contract or as Required by Law.

8.1.3 The Contractor shall use appropriate safeguards, and comply with the HIPAA Security Rule with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Contract.

8.1.4 The Contractor shall report to DHA any breach of which it becomes aware, and shall proceed with breach response steps as required by paragraph 9 (if this Contract incorporates by reference the TOM, then all references to paragraph 9 shall be deemed to refer to the breach response provisions of the TOM, Ch. 1, Sec. 5, paragraphs 2.1- 2.2). With respect to electronic PHI, the Contractor shall also respond to any security incident of which it becomes aware in accordance with any applicable DoD cybersecurity and National Institute of Standards and Technology (NIST) requirements. If at any point the Contractor becomes aware that a security incident involves a breach, the contractor shall immediately initiate breach response as required by paragraph 9.

8.1.5 In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), respectively, as applicable, the Contractor shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Contractor agree to the same restrictions, conditions, and requirements that apply to the Contractor with respect to such PHI.

8.1.6 With respect to individual rights of access to PHI, the Contractor shall make available PHI in a designated record set to the individual or the individual’s designee as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.524. If the Contractor intends to deny the individual’s request, the Contractor shall forward it (within seven working days of receipt) to the CO. The CO shall make a determination within 20 calendar days (50 calendar days for justified delays) of the request. The CO shall notify the individual, with a copy to the Contractor, of any approved or denied access determinations and the reason for any denial. The individual may appeal the denial determination to the DHA Privacy Office.

8.1.7 The Contractor shall make any amendment(s) to PHI in a designated record set as directed or agreed to by DHA, or take other measures as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.526.

8.1.8 The Contractor shall maintain and make available to the Government the information required to provide an accounting of disclosures to the MHS or to the individual as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.528.

8.1.9 To the extent the Contractor is to carry out one or more of DHA’s obligation(s) under the HIPAA Rules, the Contractor shall comply with the requirements of the HIPAA Rules.

8.1.10 The Contractor shall make its internal practices, books, and records available to the HHS Secretary for purposes of determining compliance with the HIPAA Rules.

Permitted Uses and Disclosures

8.2 General Use and Disclosure Provisions

The Contractor may only use or disclose PHI as necessary to perform the services set forth in this Contract or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA Issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Contract or directed by DHA. The Contractor agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances. The Contractor shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the covered entity, except uses and disclosures for the Contractor’s own management and administration and legal responsibilities or for data aggregation services as set forth in paragraphs 8.3.1 – 8.3.3.

8.3 Specific Use and Disclosure Provisions

8.3.1 Except as otherwise limited in this Section, the Contractor may use PHI for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

8.3.2 Except as otherwise limited in paragraph 8.3, the Contractor may disclose PHI for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

8.3.3 Except as otherwise limited in this Section, the Contractor may use PHI to provide Data Aggregation services relating to DHA’s health care operations.

8.4 Contractor Compliance with DHA Notices and Restrictions

8.4.1 DHA will provide the Contractor with the notice of privacy practices that DHA produces in accordance with the DoD HIPAA Issuances and the corresponding 45 CFR 164.520.

8.4.2 Upon notification by DHA of any changes in, or revocation of, permission by an individual to use or disclose his or her PHI, the Contractor shall comply to the extent that such changes may affect the Contractor’s use or disclosure of PHI.

8.4.3 Upon notification by DHA, the Contractor shall comply with any restriction on the use or disclosure of PHI that the Government has agreed to or is required to abide by under the DoD HIPAA Issuances or the corresponding 45 CFR 164.522, to the extent that such restriction may affect Contractor’s use or disclosure of PHI.

8.5 Permissible Requests by DHA

The Government will not request the Contractor to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this Contract.

8.6 Termination

8.6.1 Effect of Noncompliance

Noncompliance by the Contractor (or any of its staff, agents, or subcontractors) with any requirement in these HIPAA Business Associate Provisions (paragraph 8) may subject the Contractor to termination under any applicable default or other termination provision of this Contract.

8.6.2 Effect of Termination

8.6.2.1 If this Contract has records management requirements, the Contractor shall handle such records in accordance with the records management requirements. If this Contract does not have records management requirements, the Contractor shall handle such records in accordance with paragraphs 8.6.2.2 and 8.6.2.3 below. If this Contract has provisions for transfer of records and PII/PHI to a successor contractor, or if DHA gives directions for such transfer, the Contractor shall handle such records and information in accordance with such Contract provisions or DHA direction.

8.6.2.2 If this Contract does not have records management requirements, except as provided in paragraph 8.6.2.3 below, upon termination of the Contract, for any reason, the Contractor shall return or destroy all PHI received from the Government, or created or received by the Contractor on behalf of the Government that the Contractor still maintains in any form. This provision shall apply to PHI that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the PHI.

8.6.2.3 If this Contract does not have records management provisions and the Contractor determines that returning or destroying the PHI is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of PHI is infeasible, the Contractor shall extend the protections of the Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such PHI.

8.6.3 Miscellaneous

• Survival

The obligations of the Contractor under the “Effect of Termination” provision of Paragraph 9 shall survive the termination of this Contract.

• Interpretation

Any ambiguity in this Contract shall be interpreted in a manner to permit compliance with the HIPAA Rules and the DoD HIPAA Issuances.

9. Breach Response

[This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference. See paragraph 8.1.4 above]

9.1 Definitions Related to Breach Response

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for other than an authorized purpose have access or potential access to PII, whether physical or electronic. The foregoing definition is based on the definition of breach in DoDD 5400.11. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral

PII/PHI).

9.1.3 A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

How the event was discovered;

Did the information stay within the covered entity’s control;

Was the information actually accessed/viewed; and

Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4 A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

9.1.5 A HIPAA breach is an incident that satisfies the definition of breach in 45 CFR 164.402.

9.1.6 A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

9.2 General

9.2.1 The breach response requirements set forth in this paragraph 9 are designed to satisfy both the DoD Privacy Act Issuances and the HIPAA Breach Rule, 45 CFR Part 164, Subpart D, as applicable. The definition of breach above is based on the definition of breach in the DoD Privacy Act Issuances. This Privacy Act definition is broader than a HIPAA breach as defined above. Thus, a Privacy Act breach would not constitute a HIPAA breach if the PII involved does not include PHI or if it involves PHI but is excluded from the definition of HIPAA breach. If a breach is not a HIPAA breach, then the Contractor has no HIPAA breach response obligations. In such cases, the Contractor must still comply with breach response requirements under the DoD Privacy Act Issuances, as stated in this paragraph 9.

9.2.2 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach

vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline (see paragraph 9.3.2) while waiting for the DHA Privacy Office guidance or while investigating the incident. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

9.2.4 In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency Readiness Team (US-CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below. The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirements.

9.2.5 Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery. The time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours) under paragraph 9.3.2. If a cybersecurity incident is involved, the contractor’s deadline for US-CERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall report directly to US-CERT and the DHA Privacy Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

9.2.6 Contractors shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome. Investigations identifying unauthorized disclosures must be logged for HIPAA and Privacy Act disclosure accounting purposes, whether or not individual notification is required under the HIPAA Breach Rule.

9.2.7 Contractors, when acting as HIPAA-covered entities (rather than as business associates), are not subject to the breach response requirements herein. However, such contractors are subject to both the HIPAA Breach Rule (applicable to them in their capacity as covered entities) and DoD cybersecurity requirements (applicable to them in their capacity as DoD contractors).

9.3 Reporting Provisions

9.3.1 Immediately upon discovery of a possible or confirmed breach or cybersecurity incident, the contractor shall initiate an investigation. If the incident involves electronic PII/PHI, and if the investigation finds a confirmed breach or cybersecurity incident, the contractor shall report it, within 1 hour of confirmation, to the US-CERT Incident Reporting System at https://forms.uscert.gov/report/ as required by the Department of Homeland Security (DHS).

Note: DHS no longer requires US-CERT reporting of non-cyber breaches or unconfirmed electronic breaches.

However, DHS permits US-CERT reporting of unconfirmed cyber-related incidents on a voluntary basis. Thus, if a contractor is uncertain whether a possible cyber-related incident should be treated as confirmed and thus reportable, the contractor may voluntarily report the incident.

Before submission to US-CERT, the contractor shall save a copy of the on-line report. After submitting the report, the contractor shall record the US-CERT incident reporting number, which shall be included in the initial report to the DHA Privacy Office as described in paragraph 9.3.2.

Note: Regardless of whether or not an incident is confirmed as a breach, the contractor must also investigate whether or not the incident impacts data integrity or availability of PII/PHI. If such impact is confirmed, then the incident is reportable to US-CERT as a cybersecurity incident. For guidance on investigating the impact on data integrity and availability, refer to DoD cybersecurity and NIST guidance.

The contractor shall provide any updates to the initial US-CERT report by email to soc@uscert.gov with the Reporting Number in the subject line. The contractor shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office if requested. Contractor questions about US-CERT reporting shall be directed to the DHA Privacy Office, not the US- CERT office.

9.3.2 In addition to US-CERT reporting, the contractor shall report to the DHA Privacy Office by submitting the form specified below within 24 hours of discovery of a breach (possible or confirmed), unless the breach falls within a category that the Privacy Office has determined to be not reportable. This 24-hour period runs from the time of discovery, unlike the 1 hour US- CERT reporting period, which runs from the time a cybersecurity incident is confirmed. Thus, depending on the time period needed to confirm, the report to the DHA Privacy Office may be due either before or after the US-CERT report.

The breach report form required within the 24-hour deadline shall be sent by e-mail to:

DHA.PrivacyOfficer@mail.mil. The contractor shall also e-mail the report to the CO, the COR and its usual point of contact at the applicable Program Office. Encryption is not required, because reports and notices shall not contain PII/PHI. If electronic mail is not available, telephone notification is also acceptable (at 703-275-6363), but all notifications and reports delivered telephonically must be confirmed in writing as soon as technically feasible.

Contractors shall prepare the breach reports required within the 24-hour deadline by completing the Breach Reporting Department of Defense (DD) Form DD 2959 (Breach of PII Report), available at the Breach Response link on the DHA Privacy Office web site, http://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Breaches-of-PII-and-PHI . For non-cyber incidents without a US-CERT number, the contractor shall assign an internal tracking number and include that number in Box 1.e of the DD Form 2959. The contractor shall coordinate with the DHA Privacy Office for subsequent action, such as beneficiary notification, and mitigation. The contractor must promptly update the DD Form 2959 as new information becomes available.

When a Breach Report Form initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the Contractor shall submit a revised form or forms promptly after the new information becomes available, stating the updated status and previous report date(s) and showing any revisions or additions in red text. The Contractor shall provide updates to the same parties as required for the initial Breach Report Form.

9.4 Individual Notification Provisions

9.4.1 If the DHA Privacy Office determines that individual notification is required, the Contractor shall provide written notification to beneficiaries affected by the breach as soon as possible, but no later than 10 working days after the breach is discovered and the identities of the beneficiaries are ascertained. The 10-day period begins when the Contractor is able to determine the identities (including addresses) of the beneficiaries whose records were impacted. If notification cannot be accomplished within 10 working days, the contractor shall notify the DHA Privacy Office.

9.4.2 The Contractor’s proposed notification to be issued to the affected beneficiaries shall be submitted to the DHA Privacy Office for approval. The notification to beneficiaries shall include, at a minimum, the following:

• Specific data elements,

• Basic facts and circumstances,

• Recommended precautions the beneficiary can take,

• Federal Trade Commission (FTC) identity theft hotline information, and

• Any mitigation support services offered, such as credit monitoring.

Contractors shall ensure any envelope containing written notifications to affected individuals are clearly labeled to alert the recipient to the importance of its contents, e.g., “Data Breach Information Enclosed,” and that the envelope is marked with the identity of the Contractor and/or subcontractor organization that suffered the breach.

If media notice is required, the contractor will submit a proposed notice and suggested media outlets for the DHA Privacy Office review (which will include coordination with the DHA Communications Division) and approval.

9.5 In the event the Contractor is uncertain on how to apply the above requirements, the Contractor shall consult with the CO, who will consult with the Privacy Office as appropriate when determinations on applying the above requirements are needed.

The Contractor shall, at no cost to the government, bear any costs associated with a breach of PII/PHI that the Contractor has caused or is otherwise responsible for addressing.

(End of PII/PHI)

The following have been modified:

52.212-2 ADDENDUM

Award will be made using the lowest-priced, technically acceptable (LPTA) source selection process.

Award will be made to the responsible offeror on the basis of the lowest evaluated price of offers meeting or exceeding the acceptability standards for non-cost factors. Award may be made without discussions with offerors (except communications conducted for the purpose of minor clarification). Therefore, each initial offer should contain the offeror's best terms from a technical and price standpoint. However, the government reserves the right to conduct discussions if it is later determined by the contracting officer to be necessary. Award will be made on an all or none basis.

Paragraph (a) is hereby replaced with the following:

1. Technical Capability. The following adjectival ratings will be used in evaluating the offeror’s technical capability:

Acceptable – An Acceptable rating will be assessed on any offeror whose quote clearly meets each aspect of the Purchase Description and other requirements listed in the solicitation.

Unacceptable – An Unacceptable rating will be assessed on any offeror quote clearly does not meet each aspect of the Purchase Description and other requireemnts listed in the soliciation.

Particular attention is drawn to the following Purchase Description reqquirements:

6.2.2. Contractor shall only offer items which already have an Authorization to Operate (ATO) or Authorization to Operate – Conditional (ATO-C). Contractors with an ATO-C shall complete the full ATO process within 6-months of award of the contract.

6.2.3. Any offered system shall meet DoD Cybersecurity/Risk Management Framework (RMF) and the attached Service Information Assurance (IA) requirements. Contractors are required to provide a statement with their quote that they agree to the Service Cybersecurity/IA Requirements, HIPAA requirements and B2B requirements that are attached to this solicitation.

6.2.4. Contractors are required to provide a completed Joint Medical Device Risk Assessment

Questionnaire (v1.1) for the offered system along with their offer. These shall be provided by DHA Cyber Logistics or local IMD.

2. Price. Pricing must be determined to be fair and reasonable prior to award.

(End of 52.212-2 addendum)

PURCHASE DESCRIPTION

PURCHASE DESCRIPTION

BLOOD COAGULATION TESTS

1. GENERAL REQUIREMENTS:

1.1. SCOPE OF WORK: The Contractor shall provide two (2) fully automated benchtop coagulation analyzer systems to include reagents in support of William Beaumont Army Medical Center (WBAMC), Fort Bliss, TX (inclusive of instruments, ancillary equipment, maintenance, services, repairs, support, and parts as required in order to maintain the systems in optimal operating condition, and any installation and removal). The Contractor shall perform to the standards of this Purchase Description (PD).

1.2. QUALITY CONTROL (QC) and QUALITY ASSURANCE (QA):

1.2.1. The Contractor shall provide a Quality Control (QC) Plan (QCP) that contains, as a minimum, the items listed below to the contracting officer’s representative (COR) for acceptance not later than 21 calendar days after the start of the contract (see Para 8, Exhibit 1). The COR will notify the Contractor of acceptance or required modifications to the plan. The Contractor shall make appropriate modifications and obtain acceptance of the plan by the COR.

1.2.1.1. The QCP shall include:

1.2.1.1.1. A description of the inspection system to cover all incidental support and maintenance services listed on the Performance Requirements Summary (PRS) listed in Exhibit 1 at Para 8. Description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title and organizational placement of the inspectors. Additionally, control procedures for any government-provided keys or lock combinations shall be included.

1.2.1.1.2. A description of the methods to be used for identifying and preventing equipment failure and/or defects.

1.2.1.1.3. A description of the records to be kept to document inspections and corrective or preventive actions taken.

NOTE: The records of inspections shall be kept and made available to the government throughout the contract performance period and for the period after contract completion until final settlement of any claims, if any, under this contract.

1.2.2. Quality Assurance (QA). For those tasks listed in the PRS (Para 8, Exhibit 1), the COR will follow the methods of surveillance specified in this contract. Government personnel will record surveillance observations, as needed, and provide to the Contractor. The receipt of the observation does not necessarily constitute concurrence with the observation, only acknowledgment that the Contractor has been made aware of the defective performance.

Government surveillance may include observations/tasks not listed in the PRS. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the KO as a result of surveillance will be according to the terms of this contract.

1.2.3. Equipment Troubleshooting. When the government performs troubleshooting with the Contractor, the Contractor shall replace all reagents, calibrators, controls and any other materials used at no additional cost to the government IAW Paragraphs 5.4.2.1 and 5.4.2.2.

1.2.4. Performance Evaluation Meetings.

1.2.4.1. The KO may require the Contractor to meet with the KO and/or COR, as deemed necessary.

1.2.4.2. The Contractor may request a meeting with the KO when the Contractor believes such a meeting is necessary. If required, written minutes of any such meetings shall be recorded in the contract and signed by the Contractor and KO. If the Contractor does not concur with any portion of the minutes, such non-concurrence shall be provided in writing to the KO within 10 calendar days following receipt of the minutes.

1.2.4.3. During the installation and validation of the equipment and tests to be performed, the Contractor shall schedule meetings with technical experts of the Laboratory to discuss milestones and to provide updates on completion date. Following the completion of the installation of the new equipment and validation of the tests to be performed, the Contractor shall meet with technical experts from the Laboratory at times mutually agreeable to discuss areas of interest to the Laboratory or hospital staff.

1.2.4.3.1. The Contractor shall provide, at no additional cost to the government, the ability to request visits from medical and/or scientific advisors/specialists to discuss with the Laboratory and/or hospital staff areas of interest, to include, but not limited to, application of current tests in specific specialty areas (e.g., Cardiology, Endocrinology, Nephrology, etc.).

1.3. HOURS OF OPERATION:

1.3.1. Normal Hours of Operation. 24/7 Sunday-Saturday for WBAMC Main Hospital Center.

1.3.1.1. Holidays. Routine equipment servicing and reagent delivery will not be required on standard federal holidays. If an emergency arises, equipment servicing and reagent delivery will be provided in accordance with (IAW) Section 5.4.3 of this PD.

1.3.2. The Contractor shall provide equipment maintenance service/direct customer service and support, 24…