Performance Work Statement.docx

DPG/TEAD Cardiology Services

PERFORMANCE WORK STATEMENT

CARDIOLOGY TESTING SERVICES

1. GENERAL

1.1. DESCRIPTION OF WORK. The contractor shall provide specialized Cardiology Testing services (treadmill and nuclear stress testing) for the Utah Army Health Clinics at Dugway Proving Ground and Tooele Army Depot.

1.1.1. This contract is a non-personal services contract as defined in Federal Acquisition Regulation (FAR) 37.101, under which the professional services rendered by the Contractor are rendered in its capacity as an independent contractor. The Government may evaluate the quality of professional and administrative services provided, but retains no control over professional aspects of the services rendered including for example, the Contractor’s professional medical judgment, diagnosis, or specific medical treatments. Contract personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

1.1.2. Performance Measurements Requirement Summary. The following performance objectives and measures will be used to evaluate Contractor performance and compliance under the contract. This information will be used to prepare annual past performance evaluations. See attachment 1, Quality Assurance Surveillance Plan (QASP), for additional details.

PERFORMANCE

MEASUREMENT

OBJECTIVE

QUALITY LEVEL

METHOD OF

ASSESSMENT

1.1.3. The inspection and acceptance point for all services rendered under this contract will be by the department where the services are being provided. The performance by the contract personnel, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance and review for acceptance by the Contracting Officer’s Representative (COR) or designated representative. Any services rendered by the contract personnel to patients or interaction with civilian personnel deemed unprofessional/threatening/dangerous by the Department Chief will be considered grounds for immediate removal of CP and termination under clause 52.212-4 (m) Termination for Cause.

1.2. REQUIREMENTS

1.2.1. The Contractor shall perform Cardiac Stress Testing Services, including exercise, Echo 2D Stress Dobutamine and nuclear in accordance with (IAW) the American College of Cardiology guidelines. For example, Full Bruce Protocol Exercise Treadmill stress tests (CPT code 93015), and Lexiscan Cardiolite SPECT stress, Echo 2D Stress Dobutamine (CPT code 93351) and REST myocardial perfusion scan with left ventricular ejection fraction and wall motion assessment (CPT code 78451).

1.2.2. The attending Cardiologist providing services under this Performance Work Statement shall be licensed in the state of Utah and be either Board Eligible or Board Certified in Cardiology. Contractor shall provide certifications and licenses upon request by the Government.

1.2.3. Contractor testing facilities shall be located within 100 miles of Dugway Proving Ground and Tooele Army Depot, Utah.

1.3. ADMINISTRATIVE.

1.3.1. Contracting Officer’s Representative (COR). The COR will be appointed in writing by the Contracting Officer (KO) after the contract is awarded. The KO will provide a copy of this designation and COR contact information to the Contractor.

1.3.2. Billing. The Government will only pay for tests actually provided. The Contractor shall only submit payment request for tests with evaluation and interpretive reports that are actually provided. Submitting a payment request for more than the amount due based on the number of tests actually provided may constitute fraud or a false claim and may result in administrative or criminal action or both.

1.3.2.1. Payment will be made by the Defense Finance and Accounting Service (DFAS), Indianapolis, IN. Contractor submits their 2-n-1 invoice online in the Invoicing, Receipt, Acceptance, and Property Transfer (iRAPT) program of the Wide Area Workflow (WAWF) e-Business Suite. The Contracting Officer’s Representative (COR) shall verify invoice accuracy for acceptance and submittal to DFAS Indianapolis.

1.4. HOURS OF PERFORMANCE

1.4.1. Testing shall be available Monday through Friday, 52 weeks per year except for Federal holidays.

1.4.2. Holidays.

1.4.2.1. The following is a list of legal federal holidays as referred to elsewhere in the contract.

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

1.5. CONDUCT.

1.5.1. Inquiries. Contractor shall ensure that its personnel do not respond to any media inquiries. Any inquiries from the medial shall be immediately relayed to the COR, who will relay them to the KO. There shall be no interview, comments, or any other response without the knowledge and approval of the KO. Other than routine inquiries from external agencies, all other inquiries and complaints shall be brought to the attention of the COR.

1.5.2. Complaints. Complaints will be validated by the COR and be reported in writing to the KO and to the Contractor for action, if it constitutes a failure to perform, as determined by the Government. Patients may also be a source of legitimate complaints that constitute a failure to perform. The Contractor shall have no more than two substantiated complaints per 12-month period.

1.6. CONDIDENTIALITY OF INFORMATION. Unless otherwise specified, all financial, statistical, personnel, and/or technical data which are furnished, produced or otherwise available to the Contractor during the performance of this contract are considered confidential business information and shall not be used for purposes other than performance of work under this contract. The Contractor shall not release any of the above information without prior written consent of the KO.

2. DEFINITION/ACRONYMS.

2.1. Definitions. Following is a list of basic definitions.

2.1.1. Contracting Officer (KO). A Government contracting professional with the authority to enter into, administer, and/or terminate contracts/task orders and make related determinations and findings.

2.1.2. Contracting Officer’s Representative (COR). A Government employee selected and designated in writing by the KO to act as his/her designated representative in administering the contract. A COR has not authority to change or modify the contract.

2.1.3. Military time is on a 24-hour clock, e.g.

2.1.4. Military dates are written by placing the day of the month, followed by the first three letters of the month, followed by the last two digits of the year, e.g.

2.1.5. Quality Assessment and Improvement. Those actions taken by the Government to check services to determine if they meet the requirements of the Joint Commission, US Army Medical Command, quality assurance and risk management program, and ensure that the Contractor and its health care providers comply with the terms and conditions of the contract.

2.1.6. Quality Control. Those actions taken by a Contractor to control the performance of services to ensure that they meet the requirements of the contract.

2.2. Acronyms/Abbreviations. Following is a list of basic acronyms/abbreviations used in this contract.

3. GOVERNMENT PROPERTY

3.1. The Government will not provide facilities and support services, materials, publications and forms, equipment, and specialty clothing required for contract performance (except as designated in the contract).

4. SPECIFIC TASKS. The Contractor shall provide specialized Cardiology Testing services (treadmill and nuclear stress testing) for the Utah Army Health Clinics at Dugway Proving Ground and Tooele Army Depot. Testing will be performed at the Contract facility. The contractor shall evaluate test data/imaging and provide a detailed evaluation report. The resulting report will be completed and faxed within three working days to the referring physician, US Army Health Clinic, Tooele Army Depot or Dugway Proving Ground.

5. APPLICABLE TECHNICAL ORDERS, SPECIFICATIONS, REGULATIONS, AND MANUALS.

5.1. Following is a list of basic publications applicable to this contract. Current issues of many DA publications can be accessed at http://www.apd.army.mil. Current issues of many forms can be accessed at http://www.apd.army.mil. Publications and forms not on the internet can be obtained from the Army Clinics.

5.1.1. The publications have been coded as mandatory or advisory. The Contractor is obligated to follow those coded as mandatory only to the extent that they apply to this contract. Supplements, amendments, or changes to these mandatory publications may be issued during the life of the contract. Advisory publications may be used for information and guidance but are not binding for compliance.

5.2. Publications.

5.2.1. Mandatory.

Services

Applicable Army Clinic Standard Operating Procedures (SOPs) and Policies:

Department

Relationships

5.2.2. Advisory.

5.3. The following is a listing of forms that may be required, and may customarily be used by a HCP performing services. A complete list of forms can be accessed at http://apd.army.mil/AdminPubs/ProductMap.asp.

5.3.1. Standard Forms.

5.3.2. Department of Army.

5.3.3. Department of Defense.

5.3.4. Other Forms.

FD Form 258 - FBI US Department of Justice Fingerprint Card

6. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (6 MAY 10)

6.1. In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation,” January 24, 2003, the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as the agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and in DoD HIPPA Privacy and Security requirements regarding health information as defined in this clause, and in DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

6.1.2. Definitions. As used in this clause generally refers to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DoD 6025.18-R or DoD 8580.02-R.

6.1.2.1. Individual has the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

6.1.2.2. Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

6.1.2.3. Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created or received by the Contractor from or on behalf of the Government pursuant to the Contract.

6.1.2.4. Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

6.1.2.5. Required by Law has the same meaning as the term “required by law” in 45 CFR 160.103.

6.1.2.6. Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

6.1.2.7. Security Rule means the Health Insurance Reform: Security Standards at 45 CFR 160, part 162 and part 164, subpart C.

6.1.2.8. Terms used, but not otherwise defined in this Clause shall have the same meaning as those terms in 45 CFR 160.103, 160.502, 164.103, 164.304, and 164.501.

6.1.3. The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

6.1.4. The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for this Contract

6.1.5. The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

6.1.6. The Contractor shall, at their own expense, take action to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Clause. These mitigation actions will include as a minimum those listed in the TMA Breach Notification Standard Operating Procedure (SOP), which is available at: http://www.tricare.mil/tmaprivacy/breach.cfm.

6.1.7. The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

6.1.8. The Contractor shall report to the Government any use or disclosure of the Protected Health Information not provided for by this Contract of which the Contractor becomes aware.

6.1.9. The Contractor shall ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

6.1.10. The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

6.1.11. The Contractor shall provide access, at the request of the Government, and in the time and manner reasonably designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

6.1.12. The Contractor shall make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government, and in the time and manner reasonably designated by the Government.

6.1.13. The Contractor shall make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, designated by the Government or the Secretary, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

6.1.14. The Contractor shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

6.1.15. The Contractor shall provide to the Government or an Individual, in time and manner reasonably designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

6.2. General Use and Disclosure Provisions.

Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, the HIPAA Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

6.2.1 Specific Use and Disclosure Provisions.

(a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(l).

6.3. Obligations of the Government.

Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions.

6.3.1. The Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520.

6.3.2. The Government shall provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor’s permitted or required uses and disclosures.

6.3.3. The Government shall notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

6.4. Permissible Requests By The Government.

The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under HIPPA Privacy Rule, the HIPAA Security Rule, or any applicable Government regulations (including without limitation, DoD 6025.18-R and DoD 8580.02-R) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

6.5. Termination.

6.5.1. Termination. A breach by the Contractor of this clause, may subject the Contractor to termination under any applicable default or termination provision of this Contract.

6.5.2. Effect of Termination.

6.5.2.1. If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with paragraphs (2) and (3) below.

6.5.2.2. If this contract does not have records management requirements, except as provided in paragraph (3) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government, or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health Information.

6.5.2.3. If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the Government notification of the conditions that make return of destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

6.6. Miscellaneous.

6.6.1. Regulatory Reference. A reference in this Clause to a section in DoD 6025.18-R, DoD 8580.02-R, Privacy Rule or Security Rule means the section currently in effect or as amended, and for which compliance is required.

6.6.2. Survival. The respective rights and obligations of Business Associate under the “Effects of Termination” provision of this Clause shall survive the termination of this Contract.

6.6.3. Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DoD 6035.18-R, DoD8580.02-R, the HIPAA Privacy Rule or the HIPAA Security Rule.

7. CONTRACT MANPOWER REPORTS (Accounting for Contract Services) (Jul 2007).

7.1. The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor will report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract.

7.2. The Contractor is required to completely fill in all the information in the format using the following web address https://cmra.army.mil. The required information includes:

(1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative

(2) Contract number, including task and delivery order number

(3) Beginning and ending dates covered by reporting period

(4) Contractor name, address, phone number, e-mail address, identity of Contractor employee entering data (5) Estimated direct labor hours (including subcontractor)

(6) Estimated direct labor dollars paid this reporting period (including subcontractor)

(7) Total payments (including subcontractor)

(8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each subcontractor if different)

(9) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information)

(10) Locations where Contractor and subcontractors perform the work (specified by zip code in the United States and nearest City, Country, when in an overseas location, using standardized nomenclature provided on website)

(11) Presence of deployment or contingency contract language, and,

(12) Number of Contractor and subcontractor employees deployed in theater this reporting period (by country)

(13) As part of its submission, the Contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement.

7.3. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each Government fiscal year and must be reported by 31 October of each calendar year. The Contractor shall notify the Contracting Officer’s Representative (COR) by the 5th of November whether or not they have completed this report. If the COR is unavailable, the Contractor will notify the Contracting Officer.

7.3.1. Report Schedules are based on the Government’s Fiscal Year cycle, regardless of the contract period of performance cycle. If this order requires a final CMR report which does NOT align to the Fiscal Year; the final CMR report shall be due NLT 30 days after the performance period ends.

7.4. The following information is provided for the Contractor’s use in completing the above report:

Predominant Federal Service Code: Q403 – Evaluation and Screening

Unit Identification Code for the Army Requiring Activity: W2P1AA

8. NOTICE OF CONFERENCE.

The Contractor, or authorized representative, may be required to attend a conference prior to commencement of any work performed under this contract. A representative of the Contracting Office will notify the Contractor after entering into the contract as to the specific time and location of the conference. Such conferences will normally occur telephonically, however, the Government reserves the right to require the personal presence of the Contractor.

9. SECURITY REQUIREMENTS

The following paragraphs provide information on security requirements associated with this contract.

9.1. Physical Security. The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities shall be secured. The Contractor shall ensure that its employees entering Army-controlled installations or facilities have obtained access badges and passes IAW facility regulations and that these badges and passes are obtained in advance so as not to delay the accomplishment of contracted services (see paragraph 1.6.7.3.11 Security Badge Requirements for additional information). Delay caused by contractor failure to obtain badges and passes in advance will not be a basis for claim by the Contractor. The Contractor shall return all issued US Government Common Access Cards (CAC), Installation badges, and/or access passes to the COR when the contract is completed or when a Contractor employee no longer requires access to the Installation or facility. The Contractor shall demonstrate compliance with all personnel identity verification procedures. If the COR determines that the Contractor is not ensuring all access cards, badges, etc., are being returned as required under this section, the KO may take action against the Contractor to the extent allowed under the FAR and applicable supplements. Actions taken against the Contractor for their failure to comply with this requirement shall not relieve them of their duties associated with this contract. Force Protection Condition (FPCON) impact on work levels: During FPCONs Charlie and Delta, services are discontinued. Services shall resume when the FPCON level is reduced to level Bravo or lower. Procedures for complying with requirements addressed herein shall be included in the CQCP.

9.2 Key Control / Lock Combinations. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the CQCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the KO. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor's employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons.

9.3 Anti-Terrorism (AT) and Operations Security (OPSEC). The following sections provide applicable AT / OPSEC requirements, unless otherwise noted.

9.3.1. AT Level I Training. All Contractor employees, to include subcontractor employees, requiring access to Army Installations, facilities, and controlled access areas shall complete AT Level I Training within 14 days after contract start date. Employees hired after contract start date have 14 days from hire date to complete the training. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee to the COR within 14 days after completion of training by all employees and subcontractor personnel. AT Level I Training is available at the following website: CAC Holders; https://jkodirect.jten.mil/ NON-CAC Holders; http://jko.jten.mil/courses/atl1/launch.html. Refer to paragraph 6.4 for deliverable guidance.

9.3.2. Access and General Protection / Security Policy and Procedures. Contractor and all associated sub-contractor employees shall comply with applicable installation, facility, and area commander Installation/facility access and local security policies and procedures (provided by Government representative). The Contractor shall also provide all information required for background checks to meet Installation access requirements to be accomplished by Director of Emergency Services (DES), and/or Security Office (SO). Contractor workforce must comply with all personal identity verification requirements (FAR Clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, Headquarters Department of the Army (HQDA), and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the FPCON at any individual facility or Installation change, the Government may require changes in Contractor security matters or processes.

9.3.3. Contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

9.3.4. Contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

9.3.5. iWatch Training. The Contractor and all associated sub-contractors shall brief all employees on the local iWatch program (training standards provided by the requiring activity Anti-terrorism Officer (ATO)). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 14 days of contract award and within 14 days of new employees commencing performance on this contract. Results shall be reported to the COR NLT 14 days after completion of the training required as stated above. Refer to paragraph 6.5 for deliverable guidance.

9.3.6. Contractor Employees Who Require Access to Government Information Systems (IS). All Contractor employees with access to a Government information system must be registered in the Army Training Certification Tracking System (ATCTS) ((https://atc.us.army.mil/iastar/index.php)) at the commencement of services, and must successfully complete the DoD Information Assurance Awareness training (https://atc.us.army.mil/iastar/cyber_awareness.php) prior to access to the information systems and annually thereafter.

9.3.7. OPSEC Standing Operating Procedure (SOP) / Plan. The Contractor shall develop an OPSEC SOP/Plan and submit for review and approval to the Government prior to end of the Phase-In period per Army Regulation (AR) 530-1 Operations Security. In addition, the Contractor shall identify an individual who shall be an OPSEC Coordinator. The Contractor shall ensure this individual becomes OPSEC Level II certified per AR 530-1 NLT the end of the Phase-In period. Refer to paragraph 6.6 for deliverable guidance.

9.3.8. OPSEC Training. All contractor employees shall complete Level I OPSEC training per AR 530-1 within 30 days of the approved OPSEC SOP/Plan. Thereafter, new Contractor employees must complete Level I OPSEC training within 30 days of their reporting for duty. All Contractor employees must complete annual OPSEC training. OPSEC Training is available at: https://www.iad.gov/ioss/ The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee to the COR within 14 days after completion of training. Refer to paragraph 6.7 for deliverable guidance.

9.3.9. Information Assurance (IA) / Information Technology (IT) Training. All Contractor employees and associated subcontractor employees must complete the DoD IA Awareness training before issuance of network access and annually thereafter. All Contractor employees working IA/IT functions must comply with DoD and Army training requirements in Department of Defense Directive (DoDD) 8570.01 Information Assurance (IA) Training, Certification, and Workforce Management, DoD 8570.01-M Information Assurance Workforce Improvement Program, and AR 25-2 Information Assurance within six months of employment.

9.3.10. IA / IT Certification. Per DoD 8570.01-M, Defense Federal Acquisition Regulations Supplement (DFARS) 252.239.7001, and AR 25-2, Contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

9.3.11. Contractor Access to DPG. Access to DPG requires that Contractor employees voluntarily submit personal data (e.g. Name, Driver License Number, Date of birth, [Active CAC; Y or N], Email address, Company Name, and Citizenship) when applying for a DPG Identification Card. When applying for a Temporary Access Pass (contractor shall submit the personal data a minimum of 72 hours in advance) the following personal data is required (same as above plus date of arrival, date of departure, reason for visit, and areas to be visited). This information is routinely used by DPG Law Enforcement and Security personnel to conduct driver's license and criminal history/background checks. Adverse information revealed by such checks (e.g. outstanding criminal warrants, criminal history indicating a potential risk to DPG Installation security, or similar negative information indicating a potential security and/or law enforcement risk to DPG) may result in denial of access and/or re-entry to DPG. Delays caused by any adverse employee information do not constitute a basis for claim by the Contractor. It is the Contractor's responsibility to assure all personnel scheduled to work on the installation have acceptable backgrounds.

9.3.12. Personnel Security.

9.3.12.1. The Contractor shall appoint a Facility Security Officer (FSO). The FSO shall provide employees with training required by DoD 5220.22-M Industrial Security Manual, DoD 5220.22-R, Army security directives and local security directives.

9.3.12.2. Some of the work required by this contract may require access to restricted areas. Occasional delays in obtaining authorization for access to these areas or escort to a work site may be anticipated. The Contractor's personnel requiring unescorted entry to restricted or other sensitive areas designated by the Installation Commander shall comply with AR 25-2 and AR 380-67 Personnel Security Program.

9.3.12.3. The Contractor shall have a Government Facility Security Clearance at the level indicated on DD 254 DoD Contract Security Classification Specification [refer to Technical Exhibit (TE) 1] and a cleared facility for the storage of classified materials. Safeguarding of classified information and clearance procedures for the Contractors personnel shall be accomplished in accordance with DoD 5220.22-M and all other current relevant regulatory/guidance materials.

9.3.12.4. The Contractor shall request from the Defense Industrial Security Clearance Office (DISCO), P.O. Box 2499, Columbus, OH 43216-5006, security clearances (e.g., locksmiths, alarm technicians) for personnel requiring access to classified information within 15 days after contract award.

9.3.12.5. The Contractor shall provide the security information to the DPG Intelligence Office prior to the end of the phase-in period and when any changes occur during the term of the contract.

9.3.12.6. The Counter Intelligence Office (CIO) processes National Agency Checks (NAC) for Contractor employees who require access to restricted areas or have access to sensitive information or equipment. The Contractor shall request a waiver through the servicing CIO to process employees for an NAC that requires access to restricted areas and who do not already have a security background investigation. In DPG cleared facilities, Performing Activities shall comply with the National Industrial Security Program (NISPOM) controlled area requirements. The CIO shall approve the establishment, the construction, and the modification of all designated controlled areas before they may be used for the storage of classified materials.

9.3.13. Security Badge Requirements. The Contractor is responsible for security badges issued to their employees and/or employees of their subcontractors. A designated representative (being an officer or supervisor of the Contractor) shall co-sign for each individual when obtaining the required item(s). Additionally, the Contractor shall provide to the KO a list of employees needing badges under the awarded contract prior to initiation of work. The Contractor shall submit, to the KO with his monthly billing, a "certificate of return for all badges from the cognizant office(s) before approval for payment will be considered. The replacement cost badges are as follows.

a) Non-Proximity DPG ID Card $2.97

b) Proximity DPG ID Card $6.91

The above indicated replacement cost for lost items will be deducted from the Contractor's monthly billing (during the month of discovery) for item(s) not returned or lost, or the Contractor will be billed in cases where the replacement cost of lost items exceeds the amount due the Contractor. The Contractor shall be required to have security badges issued to their personnel by DPG Visitor Control Center Bldg. 5910. DPG IDs shall be visible at all times while West of Access Control Point 2. The Government will be responsible for the issuance of security badges required by DoD 5220.22-R Industrial Security Regulation. Additionally, all Contractor employees shall obtain and maintain a Government issued Common Access Card. Refer to paragraph 6.8 for deliverable guidance.

9.3.14. Entry Procedures to Controlled / Restricted Areas. The Contractor shall coordinate with Range Control at phone number 435-831-5141 for access to DPG Range Areas. Access to Buildings 4153, 4156, 4165, and 8027 shall be initiated via use of the phone located at the turnstile at each buildings entry location. The Contractors personnel requiring unescorted entry to restricted or other sensitive areas designated by the Installation Commander shall comply with AR 380-67 and AR 25-2.

9.3.15. Contractor Sponsored Foreign Nationals. All foreign national personnel (including guests) that need access past Access Control Point 2 will require a DPG affiliated U.S. citizen escort. If a sensitive test or visit is scheduled during the dates provided, the COR will inform the Contractor whether the work/visit may take place. The COR will forward the list to the DPG Foreign Disclosure Officer within the Counterintelligence Office for verification. Foreign nationals will not be allowed on DPG until verification process is complete. Once verification has been received, the COR is responsible to provide the Protocol Office the following information for badge preparation:

a) Name

b) Company Name

c) Point of Contact (POC)

The COR is also responsible to pick up the badges and badge holders, issue them to the visitor, and return them at the end of the visit. If the visit is only schedule to take place in the English Village area, the Visitor Control Center will issue a Foreign National Visitor Pass. Refer to paragraphs 9.3.11 and 9.3.13 for issuance, return, and cost associated with badges.

9.3.16. Reporting Requirements. The Contractor shall immediately report any known or suspected breaks or violations of security to the proper authorities, the KO, and the COR and remain at the scene until authorities arrive. Additional or other conditions or situations are reportable under DoD 5220.22-M National Industrial Security Program Operating Manual Supplement. The Contractors personnel shall report to an appropriate authority any information or circumstances that they are aware that may pose a threat to the security of US Government, DoD, DoD personnel, Contractor personnel, resources, and classified or unclassified defense information. The Contractor shall brief their employees of reporting requirements upon arrival to the site.

9.3.17. Drivers. Drivers must be appropriately licensed by the State of Utah or other appropriate jurisdiction to operate vehicles used in the performance of this contract on Federal, State of Utah, and local highway systems. Violations of law off post may result in the employee being barred from driving on the Installation or barred from the Installation. These incidents shall not relieve the Contractor from performing the functions in this contract.

9.3.18. Additional Security Requirements. IAW DoDM 5200.01 Information Security Program (Volumes 1 through 4), the Contractor shall comply with Army Systems Security Instruction (ASI) requirements such as Communications Security (COMSEC); Computer Security (COMPUSEC) for Operational Systems; Security Awareness, Training, and Education…