Performance-Based Work Statement for Service Treatment Records (STR) Processing Support Services

In support of Chief, Bureau of Medicine and Surgery (BUMED)

1. Introduction

Navy Medicine Records Activity (NMRA) ensures timely transfer of Service Treatment Records (STRs) to the Department of Veterans Affairs (VA) within 45 calendar days in support of Navy veterans filing a VA claim.

Following separation or retirement, these records become a component of their healthcare documentation.

2. Background

Department of Defense Instruction (DoDI) 6040.45, DoD Health Record Life Cycle Management (April 11, 2017) and Defense Health Agency (DHA) Procedure Manual (PM) 6040.45, Volume 2, directs military Services to ensure timely and accurate disposition of Service Treatment Records (STRs) to the Department of Veterans Affairs (VA).

To better support Veterans with claims processing and to enable rapid access to information, Navy’s Bureau of Medicine and Surgery (BUMED) is digitizing Navy members’ paper-based Service Treatment Records (STR) into the Healthcare Artifact and Information Management Solution (HAIMS). These efforts will enable access to medical and dental documentation that are not currently available electronically for VA claims and adjudication.

3. Scope

BUMED requires services for STR processing and programmatic support. This work entails receiving, inventory, processing, tracking, and final disposition of STRs, including the dental records, and all loose late flowing (LLF) medical documentation, for Navy Service Members (SMs) who have separated or retired from the Total Force (i.e., Active Duty, Reserve, and separating members with a remaining Inactive Service Obligation).

The contractor shall provide conversion services of paper STRs, Electronic Health Record (EHR) documents, generation of DD 2963s, and conversion of LLF documents to electronic images; document preparation to include validation of scanning, indexing, reassembly of folders; and delivery confirmation of images in a searchable electronic format to the HAIMS repository system.

The Contractor shall hold a current International Standards Organization (ISO) 9001:2015 Certification for the digitization of government records from an accredited ISO certification organization. The contractor’s system shall be National Institute of Standards and Technology (NIST) certified, which is the certification and accreditation process for Federal Information Systems, and shall comply with the below references and standards:

• DoDI 5400.11, DoD Privacy and Civil Liberties Programs, Change 1 effective December 8, 2020

(https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/540011p.pdf)

• DoDM 6025.18, "Implementation of the Health Insurance Portability and Accountability Act (HIPAA)

Privacy Rule in DoD Health Care Programs," March 13, 2019 (https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/602518m.pdf?ver=2019-03-13- 123513-717)

• DoDI 8500.01, Cybersecurity, Incorporating Change 1, effective October 7, 2019 (https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/850001_2014.pdf )

• DoDI 8582.01, “Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information”, December 9, 2019 (https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/858002_2015_dodi.pdf)

• DoDI 8582.01 Security of Unclassified DoD Information on Non-DoD Information Systems (http://www.dtic.mil/whs/directives/corres/pdf/858201p.pdf)

• National Institutes of Standards and Technology (NIST) 800-122 (http://www.nist.gov/manuscript-publication- search.cfm?pub_id=904990)

• Office of Management and Budget (OMB) Circular A130 Office of Management and Budget (OMB) Circular A130

• HIPAA Public Law 104-191 Part 160 and Part 164, Subpart D and Subpart E of Title 45, Code of Federal Regulations (CFR) (https://aspe.hhs.gov/reports/health-insurance-portability-accountability-https://aspe.hhs.gov/reports/health-insurance-portability-accountability-act-1996 act-1996)

The contractor is responsible for complying with all stated requirements and standards contained in the directives, acts, and policy guidance listed above. The contractor shall provide all necessary DoDM 6025. 18, DoDI 8582.01, and DoDI 5400.11 (as amended) documentation, or copies of documentation, to demonstrate compliance with all applicable requirements and standards and shall maintain compliance throughout the entire contract period of performance. Additionally, the contractor shall ensure that the scanning and digitization of all medical and dental documentation are 100% legible, 99.5% accurate and with zero misfiles as defined in section 7.2.

4. Tasks

4.1. STR Processing Support

4.1.1. Ensure all loose documentation, medical and dental records received, stored, and processed in any form or format shall be treated as privileged and confidential information and properly safeguarded in accordance with (IAW) the requirement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Privacy Act of 1974 (PA) and ensure

4.1.2. It is estimated the contractor will receive 55,000 Navy service members Medical and Dental records per year for digital conversion. These include STRs from the Navy Single Point of Entry (SPoE) and/or VA HAIMS claim requests identified by the government’s contracting officer representative (COR) onsite as priority items.

4.1.2.1. The contractor shall deliver an estimated 8 million images per year.

4.1.2.2. Each document processed during the STR conversion shall result in one PDF image per page, excluding blank pages and back pages without content, using a resolution of 300 dpi.

4.1.2.3. The contractor shall make legible 100% of all documents received and scan with 99.5% accuracy and shall ensure there are zero (0) misfiled pages in the STR.

4.1.2.4. The contractor shall scan and upload all received records and LLF medical documentation

(except for items identified as exclusions in accordance with DHA PM 6040.45, Volume 2 no later than 15 calendar days after receipt.

4.1.2.5. BUMED Program Management Office (PMO) St Louis shall provide to the contractor a monthly Separation Roster of all known separation/retirements via DoD Secure Access File Exchange (Safe) or encrypted email.

4.1.3. Receive and process incoming STRs for members who have separated or retired from Active Duty and separating members with a remaining Inactive Service Obligation.

4.1.3.1. Reconcile paper records against EHR (e.g. ALHTA and MHS GENESIS) and remove the duplicate in hard copy paper record.

4.1.3.2. Scan and upload all received records (except for items identified for exclusion in accordance with DHA PM 6040.45, Volume 2) no later than fifteen (15) calendar days after receipt.

4.1.3.3. BUMED PMO St Louis shall provide to the contractor a weekly Departure/Loss Roster of all known separation/retirements on a weekly basis via DoD Safe or encrypted email.

4.1.3.4. Contractor will use the DoD Paper Heath Record Tracking system (PRT) (or current Paper

Record System) to track and receive STRs to log current physical location of STRs for accountability and tracking purposes.

4.1.3.5. Research missing records or incomplete records using the DoD Heath Record Tracking system (e.g. PRT application) or by other means (e.g. calling military medical treatment facilities (MTFs), searching Personnel Systems, etc.) prior to certification.

4.1.4. Enter all records received and all loose flowing documents into a database for tracking purposes within one (1) business day of receipt. The minimum information placed in the database shall consist of the DoD Identification Number, Social Security Number, name, date received, UIC, and sending facility. This is to include identification of parts received.

4.1.4.1. If only loose documents are received, the contractor shall enter the form number of the documents into the database.

https://aspe.hhs.gov/reports/health-insurance-portability-accountability-act-1996

4.1.5. Sort, identify, and properly disposition erroneously received medical/dental records or loose medical documents on Service Members (SMs) not retiring or separating; dependents and DoD civilians; and contractor records and other services records received from theater, units or MTFs.

4.1.5.1. The contractor shall coordinate with the BUMED PMO St Louis to ensure proper disposition of these records.

4.1.6. Query various systems (e.g. NARA, DEERS, SPORTS, Joint Longitudinal Viewer (JLV), MHS

GENESIS, AHLTA and PRT) to determine status of the service member or record.

4.1.7. Process the 37 Day List provided by NMRA. The contractor shall upload the EHR and a DD-2963 to close out the case.

4.1.8. Processing STR scanning requires the following documentation:

4.1.8.1. All volumes of the patient’s medical and dental records.

4.1.8.2. The EHR shall be downloaded and archived by the contractor via HAIMS for each unique patient (SSN) received.

4.1.8.3. A DD Form 2963 (to be completed by the contractor), based on what is received/scanned for the unique patient (SSN). The DD2963 shall be uploaded as the last document, after the medical/dental and EHR have been uploaded in HAIMS.

4.1.8.4. The contractor shall contact the NMRA PMO Office within one (1) business day by phone or email concerning incomplete and/or records with no identification information. Contractor shall maintain an electronic communication log of commands/individuals contacted, to include, but not limited to: phone number and name of individual contacted; the subject of communication; and the method of contact (phone, email, written, etc.). Once the missing component/document is received, the contractor shall stage the record for scanning within two

(2) business days. If the missing item has not been received in ten (10) calendar days, the documents and actions outlined above will be accomplished with what is available at that time and designated due diligence processing.

4.1.8.5. STRs, records, and loose documentation where the disposition is unable to be determined shall be sent by the contractor in hard copy to the NMRA PMO for review/resolution and further guidance.

4.1.8.6. The contractor shall perform research/status of any specified record requested by NMRA PMO. Research/status results shall be provided by email or in person to the requestor by close of the business day.

4.1.9. Upon completion of the conversion process, the contractor shall return the paper documents to their original STR folder, bound together the entire STR, and return it to its original shipping box.

4.1.9.1. The STRs shall be packed in box NSN 8115-00-117-8249 for temporary storage (not to exceed ninety (90) days at the contractor’s facility) except for STRs being held for the DHA quarterly audit.

4.1.9.1.1. STRs held for the DHA quarterly audit shall be shipped to temporary storage no later than forty-five (45) days after the audit is completed. Original manifests, with markups and comments associated with issue folders, shall also be returned with the boxes.

4.1.9.1.2. Records storage facilities shall satisfy the National Archives Records Administration (NARA) standards included in 36 CFR Part 1234.

4.1.9.1.3. The government will arrange for pick up and shipping of these STRs from the contractor’s facility.

4.1.10. After the completion of the DHA quarterly audit, STRs shall be repackaged in box NSN 8115-00- 117-8249 by the contactor and prepared for shipping or shredding by BUMED resources. The BUMED Program Manager will coordinate the logistics associated with outbound shipments from the contractor’s scanning facility.

4.1.11. The contractor shall immediately correct any identified STR errors. Following the correction of the error, the contractor shall verify that all images and metadata transmitted from the contractor have been received completely and correctly for each STR.

4.2. STR Scanning and Digitization Support

4.2.1. Provide an acceptable scanning environment compliant with DoD guidance, instructions, and directives that are aligned within this Performance Work Statement. This includes creating a secure database structure to facilitate reporting of scanning utilization volume by UIC.

4.2.2. The contractor will receive bulk shipments of paper STRs and ensure each STR is accounted for via the PRT (or current DoD records system) for tracking purposes at the contractor’s site of business.

Upon receipt, the contractor shall ensure all STRs are accounted for, scan, and upload the paper records into HAIMS.

4.2.2.1. The contractor shall comply with DHA PM 6040.45, Volume 2, and the Navy BUMED

Service Treatment Records Digitization Business Rules in its entirety.

4.2.3. The contractor shall make legible 100% of all documents received and scan with 99.5% accuracy as a PDF and indexed into the proper section of HAIMS as defined in section 7.2.

4.2.3.1. Every document found in a hard-copy STR shall be scanned and delivered unless the contractor has specific instructions from BUMED/COR not to do so. Any misfiled images shall be inserted into the correct record. The Contractor shall ensure there are zero misfiles throughout the scanning, indexing, and uploading processes. For folders that do not meet the specified accuracy rate for metadata, all indexing errors that are identified (e.g., form name, form type, unitization, delivery side) shall be corrected without additional cost to BUMED.

4.2.3.2. Any misfiled images shall be inserted into the correct record. For folders that do not meet the specified accuracy rate for metadata, all indexing errors that are identified (e.g., form name, form type, unitization, delivery side) shall be corrected without additional cost to BUMED.

4.2.4. Develop and provide a notification system that maintains audit trail of all communications and produce weekly reports regarding compliance by location/Command and provide them to BUMED Program Manager.

4.2.5. Contractor shall ensure there are no (0) misfiled documents in another service member’s STR.

4.2.5.1. If a misfile is discovered, the contractor shall remove the misfile page(s) from the STR and delete the misfiled image (s) from HAIMS. The misfiled page(s) that were removed will be processed as loose late flowing pages and uploaded to HAIMS for the correct service member.

4.2.6. Scan all records/documents using the approved Navy methodology for STR Scanning processes IAW the HAIMS User Guide and/or service specific instructions.

4.2.6.1. Create daily reports identifying incomplete STRs and perform follow up communications with

NMRA PMO to obtain missing records.

4.2.6.2. Create HAIMS record when no record exists for service member when attempting upload to

HAIMS.

4.2.7. When loose documents are received from Medical Treatment Facilities (MTF), the contractor shall scan and upload the information into HAIMS within fifteen (15) calendar days.

4.2.8. Scan/upload all STRs/records received on separated, retired, or deceased Service members (except for items identified as exclusions in accordance with DHA PM 6040.45 into HAIMS within fifteen

(15) calendar days of receipt.

4.2.8.1. Each document processed during the STR conversion effort shall result in one PDF image per page, excluding blank pages and back page, using a resolution of 300 dpi.

4.2.8.2. The contractor shall make legible 100% of all documents received and scan with 99.5% accuracy and (0) misfiles. The “Best Copy” stamp shall be used only for images deemed illegible.

4.2.8.3. The metadata shall accompany an image in a format that complies with the ingestion file format specifications for HAIMS.

4.2.9. When an STR received is complete, the contractor shall complete the DD2963 and scan/upload the

STR received into HAIMS IAW with DHA PM 6040.45, Volume 2.

4.2.10. When a portion of the STR has already been provided/sent to the VA, and another piece is received which completes the STR, a DD2963 shall be scanned/uploaded into HAIMS by the Contractor with the portion of the STR received IAW DHA PM 6040.45 Vol. 2.

4.2.11. Coordinate with NMRA on all incomplete records to determine if the VA possesses the missing record or part of the record. If the VA possesses the record, the contractor shall fill out and attach the DD 2963 indicating the VA has the STR and scan/upload the form into HAIMS within fifteen (15) calendar days.

4.2.12. When an STR received is incomplete, the contractor shall contact the NMRA PMO within one (1) business day by phone or email concerning incomplete and/or records with no identification information.

4.2.12.1. Contractor shall maintain an electronic communication log of individuals contacted, to include, but not limited to: phone number and name of individual contacted; the subject of communication; and the method of contact (phone, email, written, etc.)

4.2.12.2. If the contractor does not receive the missing record or the necessary documentation within five (5) business days, the STR will be considered incomplete, and the contractor shall scan and upload into HAIMS the available information within fifteen (15) calendar days. The contractor shall not await the arrival of the missing records to scan the available information.

4.2.12.3. Research missing records or incomplete records using the Paper Record Tracking (PRT) application or by other means.

4.2.13. When a patient has multiple medical record volumes, the contractor shall combine the contents of each Section (i.e., both Section 1s will be combined, both Section 2s will be combined, etc.) to ensure the medical record is complete and can be accomplished in one scan.

4.2.13.1. The same will apply in the event the patient has multiple volumes of dental records. Note:

dental record images (x-rays) will not be scanned/uploaded into HAIMS.

4.2.14. Access the EHR (e.g. AHLTA, MHS GENESIS) and generate a PDF report for the member’s dates of service IAW the service specific instructions provided as an attachment to this PWS. Once generated, the contractor shall upload the EHR report into HAIMS IAW service provided instructions.

4.2.14.1. The government will provide training and EHR access.

4.2.14.2. The contractor shall ensure the EHR report and STR are digitized and uploaded IAW

DHA PM 6040.45 Vol. 2.

4.2.15. The contractor shall export the data from the weekly Loss Reports into the contractor’s chain of custody tracking system.

4.2.15.1. Weekly Loss Reports will be received from NMRA PMO via encrypted email or via DoD Safe projecting upcoming potential separations and actual separations.

4.2.16. Monitor the Business Consolidation System (BCS) system for the listing of Navy service members using the Benefits Delivery at Discharge (BDD) program to apply for VA benefits. Navy projects approximately 20,000 BCS notice of intents a year.

4.2.16.1. Download the electronic medical record, EHR (AHLTA, MHS GENESIS), for the service member(s) and HRS or current EHR system, if a profile exists.

4.2.16.2. Upload the EHR with the completed interim SHA Pre-Separation Record Statement to HAIMS. The SHA Pre-Separation Record Statement is attached as Attachment 1.

4.2.16.2.1. The SHA record upload processing shall be completed within 15 calendar days from the entry into BCS. Navy projects approximately 20,000 SHA record uploads a year.

4.3. Shipment Preparation and Tracking Support

4.3.1. The contractor shall utilize the PRT system or current DoD system that enables shipping/tracking of

STRs.

4.3.1.1. The contractor shall have instructions and contact information for assistance in tracking STRs available on the NMRA website or published as the PMO will direct.

4.3.1.2. Folders listed in the shipping/tracking system shall serve as the list of manifested and received folders for the chain of custody.

4.3.1.3. PRT training materials are available via the Joint Knowledge Online (JKO) learning portal. All employees will complete the applicable training as required.

4.3.2. The contractor shall provide and support all software required to operate the central cell conversion center and any additional upgrades, updates, and patches as required, including operating systems, scanning software, database, and local networking. The contractor shall also provide software to maintain internal chain of custody tracking and production management of the operations.

4.3.3. The contractor shall provide a production management tracking system with the following features:

4.3.3.1. Tightly integrated with chain of custody tracking system from receipt at the central cell.

4.3.3.2. Integrated with scanner and capture software.

4.3.3.3. Ability to track complete audit trail history of each STR during the conversion process to uploading into HAIMS.

4.3.3.4. Capture all information in standard database exportable format to facilitate reporting.

4.3.3.5. Provide mechanism for identifying Navy Service Members’ records which do not arrive as complete record in a single shipment.

4.3.3.6. Provide mechanism for identifying and tracking issues through to resolution.

4.3.3.7. Shall provide daily production reports.

4.3.4. The contractor shall provide an internal chain of custody tracking system with the following features:

4.3.4.1. Integrated with contractor production management tracking system at the central cell

4.3.4.2. Queries on status of particular STR

4.3.4.3. Track STRs by quarter

4.3.4.4. Segregate STRs by quarter for DHA quarterly audit.

4.3.5. The contractor shall review, reconcile, and correct the electronic records transmittal to assure that the physical shipping manifest matches the contents of each box. The contractor shall provide a weekly report electronically to the BUMED Project Manager that identifies the:

4.3.5.1. Number of BUMED STRs received based on unique SSN’s.

4.3.5.2. Number of STRs added to the electronic transmittal.

4.3.5.3. Number of STRs removed from the electronic transmittal.

4.3.5.4. Accounting for non-received records. If an STR that is not received within five business days after shipment date, a notice shall be sent electronically to the sending location to request STR status.

4.3.6. Receive and process daily STR Government deliveries and pickups.

4.3.6.1. Deliveries and pickups will include the drop off of STRs manifested at NMRA and the pickup of STRs needing corrected or more research from the contractor.

4.3.7. Provide packing materials, including shipping containers (boxes) using NSN 8115-00-117-8249, bags, ties, and adhesive box label sleeves to each BUMED shipping location located in the Continental United States (CONUS).

4.3.7.1. The tracking slip/manifest identifying contents of the box shall be placed inside each box by military command personnel.

4.3.7.2. The barcode box label shall be attached to the outside of each box by facility personnel.

4.3.7.3. The contractor shall perform tracking for each STR using the PRT system.

4.3.7.4. The STRs shall be trackable to their individual shipping boxes.

4.3.8. When the contractor receives the inbound shipment of boxes of STRs at its facility, the contractor shall immediately and electronically acknowledge the receipt of the boxes and provide any discrepancies to the COR, and NMRA PMO.

4.3.8.1. When receiving records directly the contractor shall manifest the incoming records to initiate chain of custody tracking and placed in the inventory.

4.3.9. Receive and reconcile the inbound inventory of STRs against the shipping manifests included in the boxes of STRs.

4.3.9.1. The contractor shall use the Service Member’s Social Security Number (SSN) for each record on the manifest to track the STRs within each box throughout the conversion process. The SSN is the unique identifying characteristic for each member’s STR.

4.3.10. Verify that all manifested STRs are received at the scanning facility.

4.3.10.1. Shall scan the barcode of each box received and record each STR contained in the box.

4.3.10.2. Shall reconcile the boxes of STRs against the manifest in each box as soon as the boxes are delivered at the scanning facility.

4.3.10.3. Shall report daily the following reconciliation categories for the STRs:

4.3.10.3.1. STRs manifested and received.

4.3.10.3.2. STRs manifested, but NOT received.

4.3.10.3.3. STRs NOT manifested but received.

4.3.10.3.4. SSNs mistyped on the manifest.

4.4. Programmatic Support Services

4.4.1. Develop and provide a notification system that maintains audit trail of all communications and produce weekly reports regarding compliance by location/Command and provide them to NMRA

PMO.

4.4.1.1. The notification system shall contain the following information encrypted: Name, SSN, separation date, status (active duty, reserve), branch of service, and UIC.

4.4.2. The contractor shall prepare and send notifications to each Command for individual service member separation.

4.4.3. The contractor shall provide professional staff to maintain and update all software systems, perform database updates, generate reports, and perform analysis of Navy and contractor performance.

4.4.4. Support all software and technology utilized within the STR conversion process scope of services.

4.4.5. All contractor personnel shall be trained on indexing of Navy STRs, DD 2963 and all forms prior to production, IAW the business rules and provide any updated training as necessary as those business rules are changed/modified.

4.4.6. Maintain records that identify the volumes of delivered images and is subject to BUMED Project

Managers review. At the end of each month,

4.4.6.1. A monthly report will be compiled that reflects and summarizes the same data provided in the weekly reports. All invoices shall match exactly with the metrics reported in the daily and monthly reports.

4.4.7. Develop and update training/lesson plans for end users located at MTF/ Dental Treatment Facility (DTF) for packing and shipping records.

4.4.7.1. Provide a POC for questions on the material.

4.4.7.2. participate in Monthly STR Working Group sessions and MTF training sessions as scheduled via NMRA PMO.

4.4.8. The contractor shall attend weekly meeting to discuss metrics and deliverables of STRs, which may include teleconferences or meetings with NMRA PMO, BUMED staff, and/or DoD Service leadership in the local area.

4.4.8.1. Contract shall provide reports on STR processing to include timeliness, monitoring of STRs processed, PRT workload and upload timeframes into HAIMS.

5. Other Pertinent Information

5.1. Acronyms—

Abbreviation Definition ACOR Alternative Contracting Officer Representative

AI Artificial Intelligence ATO Authority to Operate AWP ALHTA Web Print BAA Business Associate Agreement B2B Business to Business BCS Business Consolidation System BDD Benefits Delivered at Discharge

BUMED The Bureau of Medicine and Surgery CAC Common Access Card CDD Certification of Data Disposition

CDRL Contract Data Requirement List CFRC Chicago Federal Records Center

CONUS Continental United States COR Contracting Officer Representative DHA Defense Health Agency DHS Department of Homeland Security

DMDC Defense Manpower Data Center DoD Department of Defense DSA Data Sharing Agreement

DSAA Data Sharing Agreement Application DTF Dental Treatment Facility EHR Electronic Health Record FOIA Freedom of Information Act FTC Federal Trade Commission FTE Full Time Equivalent HA Health Affairs

HAIMS Healthcare Artifact and Information Management Solution HHS Health and Human Services

HIPAA Health Insurance Portability and Accountability Act HRS SPORTS Health Record Snapshot IAW In Accordance With ISO International Standards Organization LLF Loose Late Flowing documents MHS Military Health System MTF Medical Treatment Facilities

NMRA Navy Medicine Records Activity NIST National Institute of Standards and Technology NPI National Provider Identifier

ODC Other Direct Costs OPFORCES Navy Operational Forces

PCLO Privacy and Civil Liberties Office

PHI Protected Health Information PII Personally Identifiable Information

POC Points of Contact PMO Project Management Office PRT Paper Record Tracking PWS Performance Work Statement QC Quality Control

RUC Reporting Unit Code SM Service Members

SPORTS STR Processing Operations Reporting Tracking Solution STR Service Treatment Records TA Technical Advisor UIC Unit Identification Code

US-CERT United States- Computer Emergency Readiness Team VA Department of Veterans Affairs

VPN Virtual Private Network

5.2. Period of Performance: The base period of performance for this requirement is 01 March 2026 through 28 February 2027. The resultant contract will include four (4) 12-month option periods pursuant to FAR 52.217-9 consecutively following the base period.

5.3. Place of Performance: All services shall be performed at a contractor operator facility within the local commuting area (50 miles) of the BUMED Project Management Office (PMO), BUMED detachment, 1222 Spruce Street, Room 9.308, St. Louis, MO 63103. Neither the contractor nor any of its contract staff will disclose or disseminate any information concerning operations of military activities. Such action (s) could result in violation of the contract and possible legal action.

5.3.1. The warehouse space required is based on the projected incoming records each month, and storage of completed records. The contractor shall retain records until DHA has performed Quality Assurance on the records under quarterly audit and approves the records to be shipped to long term storage at the Chicago Federal Records Center (FRC), and eventual destruction. There is an estimated six-month record retention period, allowing sixty days for the audit after conclusion of the quarter and another thirty days post-audit to arrange for transportation to the FRC.

5.3.2. Following are the calculations to determine the required square footage for the warehouse:

• 667 boxes per month based on average of 1,500 images/box (Navy ships records as soon as possible after Service Member separation so majority of boxes are partially filled.)

• 17 pallets per month based on 40 boxes per pallet

• 600 square feet required for incoming work based on space requirement 36 square feet/pallet to include pallet floor space and access around pallet perimeter

• 3,600 square feet required for six months of record storage based on 600 square feet per month of production records

• 300 square feet required for Warehouse staff, receiving and shipping

• Total estimated warehouse requirement: 4,500 square feet

5.4. Historical STR and Image Processing—

Fiscal Year October-November

Fiscal Year Fiscal Qtr STR Uploads 2025 Total 79,787

Qtr 1 15,015 Qtr 2 20,269 Qtr 3 21,406 Qtr 4 23,097 2024 Total 74,027

Qtr 1 19,148 Qtr 2 16,148 Qtr 3 20,447 Qtr 4 18,284

2023 Total 79,710 Qtr 1 17,829 Qtr 2 20,438 Qtr 3 18,772 Qtr 4 22,671

2022 Total 81,994 Qtr 1 19,350 Qtr 2 18,156 Qtr 3 20,327 Qtr 4 24,161

2021 Total 76,088 Qtr 1 19,262 Qtr 2 16,751 Qtr 3 19,695 Qtr 4 20,380

2020 Total 80,303 Qtr 1 22,721 Qtr 2 18,912 Qtr 3 17,776 Qtr 4 20,894

Fiscal Year Fiscal Qtr Total Images

Total 7,567,313

Qtr 1 1,377,834 Qtr 2 1,819,312 Qtr 3 2,112,259 Qtr 4 2,257,908 2024 Total 7,189,501

Qtr 1 1,829,295 Qtr 2 1,611,134 Qtr 3 2,043,752 Qtr 4 1,705,320

2023 Total 7,972,046 Qtr 1 1,666,697 Qtr 2 2,008,896 Qtr 3 2,025,352 Qtr 4 2,271,101

2022 Total 8,090,095 Qtr 1 1,925,130 Qtr 2 1,808,502 Qtr 3 1,947,077 Qtr 4 2,409,386

2021 Total 7,111,127 Qtr 1 1,729,532 Qtr 2 1,529,378 Qtr 3 1,869,556 Qtr 4 1,982,661

2020 Total 7,295,350 Qtr 1 2,089,681 Qtr 2 1,600,585 Qtr 3 1,651,479 Qtr 4 1,953,605

5.5. Government Furnished Equipment/Property/Information— The Government will provide an approved network connection and up to a maximum of eight (8) Government furnished laptop computers which will allow the contractor Virtual Private Network (VPN) client access into the Department of Defense Military Health System .mil network. This Government furnished network connection will provide the contractor the capability to access HAIMS for the uploading and transfer of digitized Navy STRs. HAIMS access and permission will be granted by the BUMED COR.

5.6. Security Requirements— See Addendums to PWS NAVSUP SUPTXT204-9400(8-22) Prescription and Alternative Language & NAVSUP SUPTXT204-9400 (4-22).

5.7. Travel— There is no travel for this requirement.

5.8. Other Direct Costs (ODCs)— There are no other direct costs for this requirement.

5.9. Other Information—

5.9.1. Identification of Contractor Employees: All Contractor personnel attending meetings, answering

Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They shall also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. Further, it is a Defense Health Agency (DHA) requirement that all Contractors indicate their contracting company in addition to the government client supported in the signature block of all email communication while conducting business for the command. Contractor personnel shall be required to obtain and wear badges in the performance of this service.

5.9.2. The Navy will provide the Contractor the required systems access to include AHLTA, MHS GENESIS HAIMS, PRT, and SPORTS to perform the task stated above. Permissions to the clinical systems will be provided once the contractor employees are approved by the hosting facility of the described clinical systems. To obtain permission, employees shall successfully complete system security and training to include HIPAA, PII and DON IA and the System Authorization Access Request Form. Employees shall also complete system specific training as required.

5.9.3. All inquiries, comments, or complaints arising from any matter observed, experienced, or learned as a result of or in connection with the performance of this requirement, the resolution of which may require the dissemination of official documentation, shall be directed to the contracting officer’s representative (COR).

5.9.4. The contractor shall only conduct business with designated government organizations as listed in this PWS or provided by the COR at the time of the contract award and updated as necessary. Any calls requesting information about specific record from other than designated individuals shall be referred to the COR.

5.9.5. U.S. Government records, copies of original results and reposts, verified original data, corrected data, and corrected supporting final reports are maintained by the Contractor but remain the property of the U.S. Government. These files/results shall be surrendered to the COR upon request and at the conclusion of the contract. Paper files shall be provided to the COR within 48 hours following request. Electronic files shall be provided within 8 hours following request.

5.9.6. BUMED Project Management Office (PMO) St Louis will provide the following to the contractor to complete the set-up process after award of contract.

5.9.6.1. Any updates to the DoD/BUMED Master Forms List

5.9.6.2. Samples of specific forms

5.9.6.3. Training. The BUMED PMO/NMRA will provide the contractor training on: (a) government applications to include AHLTA, AHLTA Web Print, HAIMS, MHS GENESIS and DEERS;

(b) record assembly and record retirement procedures; and (c) web-based training to ensure contractor compliance with HIPAA and DoD Information Security requirements. Government provided training will consist of 5 to 7 working days. This training will be conducted at the contractor's facility when feasible or at NMRA PMO during the 60-day transition period and not later than 30 days prior to the official commencement of services. The contractor shall coordinate and schedule the timing of the training with the BUMED COR. The Government will provide the initial training to all contract employees prior to the commencement of services. The contractor shall identify within 5 business days after the commencement of contract services a Training Officer who will be responsible for providing subsequent training to newly hired contractor employees.

5.9.6.4. Facility shipping location(s) and point of contact (POC) information for STR supplies (i.e., packing materials)

5.9.6.5. BUMED logo

5.9.6.6. Facility shipping account number, if applicable, and the appropriate shipping method

5.9.6.7. MTF UIC information (when applicable)

5.9.7. HAIMS-External Artifact Ingest XDR Interface: HAIMS provides the functionality for an external source system to ingest artifacts into HAIMS via an XDR interface. This functionality is implemented by HAIMS exposing the XDR standard's single transaction called "ProvideAndRegisterDocumentSet". This interface will allow the Contractor to bulk upload the STR vice record by record transaction. The rationale for this technology is to minimize the error rate of data loaded into HAIMS. The XDR format will establish data to field entry to consistently load the correct data elements. The Contractor shall implement all necessary steps to support the XDR interface for bulk uploading after establishment and approval of the B2B gateway. The reference IHE_ITI_TF_Supplement_XDR documentation shall be used to configure and implement this capability. The Contractor shall furnish all documentation pertaining to the XDR Interface to the BUMED COR who will facilitate the approval process through DHA.

5.9.8. Business to Business (B2B) Gateway Connection: The Contractor shall have and maintain all approvals for a Business to Business (B2B) gateway connection into the DoD Military Health System using a Contractor provided network environment inclusive of VPN encryption device, network appliance, switches, servers, workstations, etc. IAW DODINST 8582.01. The Contractor’s internal network shall not be included in the B2B design unless this internal network has physical connections to and is associated to the B2B environment and equipment.

This B2B gateway solution will terminate at a DMZ and then be re-directed to its destination. This is the recommended long-term solution to ensure data and system resource security and confidentiality.

The Defense Health Affair Operations and Sustainment Branch manages the MHS B2B Gateway Program and serves as the liaison between DISA and BUMED for B2B Gateway implementation and sustainment activities. For this contract DHA will be the supporting agency with Navy “BUMED” serving as the sponsor.

To establish the required B2B connection the Contractor shall in coordination with the BUMED

COR:

• Provide all network information to include network diagram, hardware, and connection points as required by Attachment 2 entitled Business to Business Gateway Questionnaire.

• Procure and install B2B Gateway-compatible VPN/encryption device that is approved on the DISA Approved Products List (APL).

• Procure Tier I/II Internet Service Provider for connectivity to process STR transactions into HAIMS.lot

• Provide qualified Information Technology support staff to build, operate, and maintain all network components.

• Help resolve telecommunications and supports routine maintenance activities.

• Ensure contractor staff complete annual DOD Information Assurance Training

• Submit DD Form 2875 for contractor staff that will be working on or with PII (IT Level II

Clearance)

• Obtain Certification and Accreditation (C&A) documentation from DHA.

• Reports all problems to the DHA Global Service Center that may be related to B2B

Network connection issues or accessing HAIMS o Call DHA GSC at 1-800-600-9332.

o Email dha.jbsa.j-6.mbx.mhs-service-desk@health.mil o Homepage: https://gsc.health.mil

• Provide 24x7 on-call technical points of contact to assist in problem resolution.

The B2B connection and all supporting documentation are required to be completed and approval granted by DHA for the Authority To Operate (ATO) and the connection to the B2B by DISA no later than the performance start date of the contract. Upon the establishment of the B2B and obtainment of ATO, Government provided approved network connection will be discontinued.

5.9.9. Scanners – The Contractor’s scanners shall meet the following minimum functionality:

5.9.9.1. Scanner shall meet 508 compliance standards.

5.9.9.2. Scanner shall be a flat open track design.

5.9.9.3. Scanner shall be able to detect folded corners or "dog-ears" on all four corners of a document and stop the scanner for correction.

5.9.9.4. The scanner shall have a rated speed of at least 286 pages per minute at 300dpi capturing duplex 24-bit color Joint Photographic Experts Group (JPEG) and bitonal Tagged Image File Format (TIFF) images.

5.9.9.5. The scanner shall have continuous feeder capable of loading the feed tray while actively scanning documents.

5.9.9.6. The camera technology shall perform auto-white balancing without running additional documents.

5.9.9.7. The scanner shall have the ability to enhance TIFF images at scan time, dynamically adjusting contrast and brightness settings to provide the best possible TIFF image.

5.9.9.8. The scanner shall utilize both hardware double-feed detection and/or ultrasonic doubles detection, giving it the ability to scan envelopes while still providing a layer of doubles detection technology.

5.9.9.9. The scanner shall have built-in jam recovery assistance that shall include hand feed capability.

5.9.9.10. Data shall be stored in a non-proprietary database for reporting and data retrieval purposes.

5.9.9.11. The application software shall have the ability to drive the proposed scanner along with other TWAIN devices.

5.9.9.12. The scanner software solution shall provide image enhancement such as hole punch fill in, border clean up, corner clean up, auto orientation, blank page detection/deletion, De-skew, and De-speckle.

5.9.9.13. The software solution shall provide the ability to output color images based on the presence of color on the document.

5.9.9.14. Scanner host computer shall have redundant power supplies and hard drives.

5.9.9.15. Camera color accuracy shall for Delta E of 7 or less

5.9.9.16. Scanner camera system shall be enclosed so no dust or debris shall enter the camera housing.

5.9.9.17. Shall have the ability to print 1.5" of data (Barcode, ASCII, and graphics)

5.9.10. Data Sharing Agreement: Access to certain health information will require initiating a Data Use

Agreement that requires the contractor to certify the handling of certain information. Completion of a Prerequisite Checklist and Data Sharing Agreement Application (DSAA) are required to request a Defense Health Agency (DHA) Data Sharing Agreement (DSA). Consider each item listed below before submitting the checklist and application to the DHA Privacy and Civil Liberties Office (PCLO) DSA Team via e-mail at DHA.DataSharing@mail.mil.

Program details are provided at the DHA DSAA webpage: https://www.health.mil/Military-Health- Topics/Privacy-and-Civil-Liberties/Submit-a-Data-Sharing-Application for the latest version of the DSAA Checklist.

The Applicant is the individual, usually a contractor, who will have primary oversight and responsibility for the data.

1. For projects involving subcontractors the Applicant on the Data Sharing Agreement Application

(DSAA) shall be an employee of the prime contractor.

mailto:DHA.DataSharing@mail.mil

2. For projects with more than one prime contractor, a DSAA shall be completed for each contracting organization that requires data for the project.

The Applicant is referred to as the Recipient in the approved DSA. Responsibilities:

1. Agree to and sign a DSA once the DSAA is approved by the DHA Privacy Office.

2. Ensure the project abides by the stipulations stated in the DSA.

3. Request data and assume physical or contractual liability for preserving the data integrity.

4. Provide and maintain accurate and complete responses to the DSAA.

5. Notify the DHA Privacy Office of any changes to the data use, storage or disclosure as given in the DSAA.

6. Ensure that Business Associate Agreement (BAA) requirements, if applicable, are fulfilled.

7. Confirm that DHA breach notification and response procedures are followed in the event of potential or actual loss, theft, or compromise of data as outlined in DoD 5400.11-R, Defense Policy Memorandum (dated June 5, 2009), titled: Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII), as well as DHA Administrative Instruction Number 71, Defense Health Agency Response Team and Breach Response Requirements (June

6, 2014) (DHA AI 71).

8. Submit a completed Certification of Data Disposition (CDD) to the DHA Privacy Office no later than 30 days after the expiration of the DSA.

6. List of Deliverables

PWS Section: Deliverable Recipient Level of Inspection Frequency All Kick-off meeting & minutes COR 100% 14 days after award All Project management plan COR 100% 30 days after award All Weekly Progress Report COR 100% Weekly All Financial Status Report COR 100% Monthly, NLT 20th All Program Review COR 100% Quarterly

6.1. Deliverable Detail— All reports shall be submitted in Microsoft Office Suite compatible files.

7. Performance Standards

7.1. The Contractor is responsible for reviewing all work for proper accuracy and content. The Contractor shall document progress and produce required status reports that itemize and explain applicable deliverables. The COR /ACOR and/or Technical Advisor (TA) will review contractor deliverables and reports to validate end products were delivered IAW specifications stated in the PWS. The COR/ACOR who has sole authority to inspect and accept or reject contractor deliverables. The acceptance of deliverables and satisfactory work performance required herein shall be based on the timeliness and accuracy of the products received.

Performance Element

Performance Requirement

Surveillance Method Frequency Acceptable Quality Level

Contract Deliverables

Contract deliverables furnished as prescribed in the PWS, attachments, CDRLs, Task Orders, etc., as applicable.

100% inspection by the recipient or COR

100% inspection of all contract deliverables.

>95% of deliverables submitted timely and without rework required.

Overall Contract Performance

Overall contract performance of sufficient quality to earn a Satisfactory (or higher) rating in the

100% inspection by the recipient or COR

Annual All performance elements rated

Performance Element

Performance Requirement

Surveillance Method Frequency Acceptable Quality Level

COR’s annual report on Contractor Performance

Satisfactory (or higher)

Invoicing Monthly invoices per contract procedures are timely and accurate.

Review & acceptance of the invoice

Monthly 100% accuracy

Contractor Quality Control Plan

QC activities, inspections, and corrective actions completed as required by the plan

Inspection by the

COR

Quarterly for overall QC activities as required for corrective actions

100% compliance with the contractor plan

7.2 Terms used in the performance standards.

Term Definition

Legibility Legibility is the clarity and readability of text and images within a scanned document. A legible scanned document is one in which all characters, numbers, and visual elements are sharp, properly contrasted, and easy to recognize without strain or confusion. Legibility requires that the document be free from blurring, distortion, shadows, cut-off edges, or other defects that interfere with accurate interpretation. Characteristics of a Legible Scanned Document: 1. Text is clear and sharp — characters can be easily identified. 2. Contrast is appropriate — text stands out from the background. 3. The page is properly aligned — not skewed or cropped. 4. All content is visible — no missing edges or sections. 5. Free of obstructions — no stains, folds, shadows, or marks. 6. Sufficient resolution. 7.Consistent quality — uniform clarity and brightness across all pages.

Accuracy Accuracy is the proper assembly, sequencing, and placement of each scanned document into the correct four parts of the Service Member’s medical record. Each page must be properly oriented, legible, and accurately represent the source document. Records that are not correctly assembled into the appropriate four-part structure will be considered inaccurate.

Misfile A misfile is the inclusion or placement of any portion of another Service Member’s information within a different Service Member’s record.

8. Points of Contact

COR

David Lott

(202) 213-9264 david.a.lott.civ@health.mil

Contracting Office POC:

William Stevenson (Wills)

(215) 697-9731 william.p.stevenson28.civ@us.navy.mil

Contracting Office POC:

Vincent Conicelli

(215) 697-5029 vincent.conicelli@navy.mil

9. Privacy Office Standard Contract Language Incorporating Navy Medicine Specific Regulations for

Protection of Personal Information

Personally Identifiable Information, Protected Health Information, and Federal Information Requirements

(Revised 10 October 2024) Overview mailto:%20david.a.lott.civ@health.mil mailto:william.p.stevenson28.civ@us.navy.mil mailto:vincent.conicelli@navy.mil

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act) as amended, The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD…