PWS Physics Survey Service.pdf

PERFORMANCE WORK STATEMENT

Performance Work Statement Medical physics survey

Carl R. Darnall Army Medical Center Fort Cavazos, TX

GENERAL.

1. DESCRIPTION OF WORK: Carl R. Darnall Army Medical Center (CRDAMC), Fort Cavazos, Texas has a requirement for an Annual Medical Physics Survey Service. The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items necessary to perform radiological equipment safety surveys and radiation use evaluations for all medical systems utilizing diagnostic radiography equipment and operation procedures as defined in this Performance Work Statement. The Contractor shall complete annual radiation safety and compliance surveys of all (medical) X-ray equipment at CRDAMC to identify diagnostic x-ray systems that fail to comply with applicable performance standard requirements and to protect the public from unnecessary radiation hazard. The contractor shall complete required re-surveys of all (medical) X-ray equipment after said equipment undergoes repairs.

1.1. This contract is a NON-PERSONAL SERVICES contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees.

1.2. The inspection and acceptance point for all services rendered under this contract will be by the Government Point of Contact (G-POC), Health Physics Office. The performance by the contractor technician, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance and review for acceptance by the G-POC or designated representative. Other performance evaluation factors will be monitored that are not quantified by numerical measurements, Contractor technician relationship with hospital staff/Government contracting personnel and compliance with hospital policy and procedures.

2. Contractor Requirements.

2.1. Contractor shall ensure that all services provided under the terms of this contract are performed by trained and certified Medical Physicists to provide Annual Physics Surveys by the American Board of Radiology or the American Board of Medical Physics and all services meets The Joint Commission Standard.

2.2. Contractor represents and warrants that all personnel provided by Contractor to do work on Carl R. Darnall Army Medical Center (CRDAMC) equipment are legally eligible to work in the United States of America; and that Contractor complies with all applicable federal and state wage and employment laws, and with all other applicable laws and regulations pertaining to the services provided to the Government.

2.3. The Contractor shall not hire off-duty Government employees who serve as inspector or G-POC’s in their Government position, or any other persons whose employment would result in a conflict of interest.

3. Administrative.

3.1. Reports. The Contractor shall submit reports to the G-POC as requested for use in monitoring Contractor performance. Such reports may include, but are not limited to, a service report as identified in paragraph 8.8.

3.2. Safety. The Contractor shall ensure its personnel comply with all installation and MTF safety regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal. Copies of these regulations are on file in the medical activity safety office or may be obtained through the G-POC.

3.3. Security.

3.3.1. The Contractor shall ensure its personnel comply with installation and MTF personnel identification and access requirements. The Contractor is responsible for absences due to expired identification and access documents.

3.4. Antiterrorism/Operations Security (AT/OPSEC) Requirements.

3.4.1 AT Level I Training. This standard language is for contractor employees with an area of performance within as Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I Awareness training within 5 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 10 calendar days after completion of training by all employees and subcontractor personnel. AT level I Awareness training is available at the following website: http://jko.jten.mil.Access and general protection/security policy and procedures. Training is required to be updated annually. In person training is available for groups through the CRDAMC Antiterrorism Office at 553-1278.

3.4.2 Access. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated sub-contractors’ employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation’s Provost Marshal Office, Director of Emergency Services or CRDAMC Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative).

3.4.3 iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program. All personnel on CRDAMC property must understand to contact 288-COPS (288-2677) or the CRDAMC Provost Marshal Office at 553-9832 if any suspicious activity is observed. This training shall be completed within 5 calendar days of contract award and within 5 calendar days of new employees commencing performance with the results reported to the COR NLT 10 calendar days after contract award.

3.4.4 Access to Treatment Areas by Non-Clinical personnel. All non-clinical contractor employees, to include subcontractor employees that require access to treatment areas including visual access from the outside must receive the following briefing: The privacy of our patients is an important concern. You must limit time in treatment areas and wards to the absolute minimum possible to perform your required tasks. Always contact nursing staff when entering a ward or treatment area as soon as possible and let them know about your presence and purpose. Do not go inside patients’ rooms without checking with the nursing staff first. NEVER conduct work outside patient windows without coordinating that work with the nursing staff immediately beforehand.

3.4.5 HIPAA Training. All contractor employees, to include subcontractor employees, working inside a CRDAMC facilities providing healthcare services or with access to any patient data shall complete DOD Approved HIPAA awareness training before being allowed access to the patient environment or information. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the CRDAMC COR, within 5 calendar days after completion of training. Training is available at http://jko.jten.mil/courses/atl1/launch.html.

3.5. Hours of Operation/Place of Performance. Department of Radiology, CRDAMC, office hours 6:00 a.m. through 8:00 p.m., Monday thru Friday except Federal holidays or when the Government facility is closed. Overtime hours are not allowed, in accordance with the contract. Thus, the contractor is not allowed to work overtime hours, if service is required, after normal business hours. There may be instances that radiographic or medical equipment located on off -site clinics will need to be surveyed.

3.6. Software upgrades. All software upgrades, corrective in nature, or which enhance equipment features shall be at no-cost to the government.

3.7. Contractor shall provide all documentation required to meet all regulatory compliance testing procedures.

3.8. Surveyor will be responsible for providing his/her own transportation to and from this location.

4. Contractor Conduct.

4.1. The Contractor is responsible for the conduct of his/her employees. All services shall be provided in accordance with established standards, principles, and ethics of the profession and applicable professional specialty organizations and shall ensure the highest regard to patient dignity.

4.2. The Contractor shall ensure that its personnel comply with MTF policies regarding personal appearance and conduct.

4.3. Inquiries. Contractor shall ensure that its personnel do not respond to any media inquiries. Any inquiries from the media shall be immediately relayed to the G-POC, who will relay them to the MTF Commander. There shall be no interviews, comments, or any other response without the knowledge and approval of the MTF Commander. Other than routine inquiries from external agencies, all other inquiries and complaints shall be brought to the attention of the Government.

4.4. Smoking. The Contractor shall ensure its personnel shall comply with the MTF smoking policy.

4.5. Complaints. Complaints will be validated by the G-POC and be reported in writing to the Contracting Officer and the Contractor for action, if it constitutes a failure to perform, as determined by the Government. The Contractor shall have no more than one substantiated complaint for each period of performance.

4.6. Contractor Representation. The Contractor shall designate a Point of Contact (POC) for the contract. The Contractor’s POC shall be the only authorized representative of contractor authorized to discuss with the G-POC, any and all maintenance services required by the contract and ensure response to requests for performance of the contract. The POC shall have the authority to make decision for the Contractor. The Contracting Officer or the GPOC shall be notified promptly whenever the POC changes. Contractor’s POC shall be submitted no later than 10 days after award of contract, and shall include as a minimum name, title, and telephone number.

5. Government /Contractor Furnished Property.

5.1. Government.

5.1.1. The Government will provide the contractor access to the equipment covered under the contract.

5.1.2. The Government will provide an Equipment Management Branch representative to provide access and assist in operating the equipment being tested and surveyed as well as performance monitoring, on-site review and other assistance as needed.

5.1.3. The Government will provide the necessary workspace for the contractor to include access to fax machines, printers, and lighting that as needed.

5.2. Contractor.

5.2.1. The Contractor shall provide each employee an identification badge which shall be always displayed on their outer garment when responding to a service call at the MTF. The badge shall include, as a minimum, the employee’s name, current picture, the Contractor’s name, and title identification.

5.2.2. All materials, test equipment, and phantoms necessary for testing, other than those materials specified as Government furnished, required in the performance of this contract shall be furnished by the contractor or the contractor employee.

5.2.3. The Government will not be responsible for any damage to or loss of Contractor supplies, materials, or equipment nor is the Government responsible for any damage to or loss of the Contractor employees’ personal belongings, due to fire, theft, accidents or any other causes.

5.2.7. The contractor shall report immediately to the Primary Point of Contact or the Chief of Equipment Management Branch, all accidents which may arise out of or in connection with the performance of services required within the scope of this contract.

5.2.4. The contractor employee will provide calibration certification documentation of test equipment used.

6. Scope of Work.

6.1. The Contractor employee is required to check-in with the Health Physics Office (254-553-1219).

6.2. Persons Authorized to Make Calls. Only those people listed in Table Two are authorized to give the Contractor instructions, place service calls, or request updates status. The Government representative will call and leave their name and number. The Contractor will return the call or come directly to the Medical Maintenance Branch to verify instructions prior to initiating any action. The G-POC will provide a list of individuals authorized to make service calls.

TABLE TWO –Positions Authorized to Make Service Calls Position Phone Number Primary G-POC, Radiation Safety Officer 254-553-1219 Alternate G-POC, Assistant Radiation Safety Officer 254-553-8024 Medical Maintenance 254-553-0603 Non-Commission Officer in Charge 254-553-8024

6.3. Any service performed without the prior approval of one of the individuals above shall be at no cost to the Government.

6.4. The Government agrees to pay the Contractor for each repair actually performed by Contractor at the price for said repair specified in the List of Repairs attached and hereby incorporated into this contract by reference.

7. Services Required and Specific Tasks.

7.1. Scheduled Services.

7.1.1. The contractor shall provide an annual physics survey on the following radiology imaging machines.

Computed Tomography (CT) Cone Beam CT Systems Mammography (FFDM) Unit Magnetic Resonance Imaging (MRI) Units Nuclear Medicine SPECT/CT, SPECT Planar Systems Fluoroscopic C-arm X-ray Systems

8. Survey Documentation.

8.1. Upon completion of survey, the contractor employee shall provide a written report that follows the format list at http://www.aapm.org/pubs/reports/rpt. The report shall include:

8.1.1. Site Visited

8.1.2. Modality Tested

8.1.3. Date of Test

8.1.4. Test Performed

8.1.5. Test Results

8.1.6. Evaluation of Findings

8.2. The contractor will label all equipment with the date of test, test results, date of retest (if applicable), and initials of the surveyor.

8.3. Deliver the Physics Survey Inspection Report and the Medical Equipment Status Reports within 30 days of completion of the Survey. The contractor shall provide an original and two copies of both reports. Additionally, the Physics Survey may be written in MS Word or as a PDF. Signed and official electronic copy may be sent to the G- POC or mail the reports to:

Carl R. Darnall Army Medical Center Attn: Radiation Safety Officer 590 Medical Center Road Fort Cavazos, TX 76544

9. Other Required Tasks.

9.1. Delays caused by Government will not be counted as contractor “down time” for the purpose of this contract

9.2. When CVC services are complete, the Contractor shall affix a DD Form 2163 to the equipment, update the current form, when appropriate, as specified 750-1. The G-POC shall determine where on the equipment the DD Form will be affixed.

9.3. The Contractor shall comply with applicable federal, state, and local laws and regulations.

9.4. Contractor personnel shall leave job site in the same condition as found upon arrival.

10. APPLICABLE FORMS AND PUBLICATIONS: Publications documents and forms applicable to this PWS are listed below. The Contractor shall use reasonable efforts to comply with these directives. Supplements or amendments may be issued during the life of the contract and will be considered to be in full force and effective immediately upon receipt by the Contractor. If compliance with such supplements and amendments changes the contract cost, scope or purpose, it shall be a change within the meaning of the “Changes” clauses of the contract.

10.1. PUBLICATIONS. Publications shall be made available to the Contractor during the period of the contract. The non-Army publications establish guidelines for administering adequate healthcare services. When a conflict between the non-Army publications and Army publications arises, the publication which is more restrictive will be followed.

These publications are located and will remain in the Medical Maintenance Branch, CRDAMC.

PUBLICATION NUMBER PUBLICATION TITLE

FDA Title 21 (21 CFR1020.30) Diagnostic X-Ray Systems and Their Major Components.

TJC Manual The Joint Commission Manual (Current Edition) http://www/accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?FR=1020.30

NRC Title 10 (10 CFR, Part 35) Nuclear Regulatory Commission Compliance Regulations

11. (Accounting for Contract Services) (Jul 2007) The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor will report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract. The Contractor is required to completely fill in all the information in the format using the following web address “https://cmra.army.mil”. The required information includes: (1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative; (2) Contract number, including task and delivery order number; (3) Beginning and ending dates covered by reporting period; (4) Contractor name, address, phone number, e-mail address, identity of Contractor employee entering data; (5) Estimated direct labor hours (including sub-Contractor);

(6) Estimated direct labor dollars paid this reporting period (including sub- Contractor); (7) Total payments (including sub-Contractor); (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub-Contractor if different); (9) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information); (10) Locations where Contractor and sub-Contractors perform the work (specified by zip code in the United States and nearest City, Country, when in an overseas location, using standardized nomenclature provided on website); (11) Presence of deployment or contingency contract language, and, (12) Number of Contractor and sub- Contractor employees deployed in theater this reporting period (by country). (13) As part of its submission, the Contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each Government fiscal year and must be reported by 31 October of each calendar year. The Contractor shall notify the G-POC by the 5th working day of November whether or not they have completed this report. If the G-POC is unavailable, the Contractor will notify the Contracting Officer."

The following information is provided for the Contractor’s use in completing the above report:

Unit Identification Code for the Report Schedules are based on the Government’s Fiscal Year cycle, regardless of the contract period of performance cycle. This contract requires a final CMR report which does NOT align to the

Fiscal Year. The final CMR report shall be due NLT 30 days after the performance period ends. If this contract is extended beyond the final CMR reporting period, the modification authorizing the extension will reflect the revised final CMR due date.

12. Exclusion from Participation in Federal Health Care Programs

12.1. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (DHHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at http://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of- Healthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

12.2. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the Lists and no such names appear on either of the Lists.

12.3. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

12.4. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

12.5. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

12.6. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a-7a):

12.6.1. There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

12.6.2. Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person.

12.7. DHHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at http://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

13. Performance Requirements Summary (PRS)

The following performance requirements summary will be utilized to assess the entire contract. The Government may modify inspection methods in accordance with site specific requirements.

PERFORMANCE

OBJECTIVE

PERFORMANCE

STANDARD

REF PWS METHOD OF

ASSESSMENT

Comply with Performance Work Statement

Comply initially and as required 100% of the time.

PWS 100% Assessment of COR.

Comply with Security Requirements.

Comply initially and as required 100% of the time.

Paragraph 3.3. and Supplement to the PWS

100% Assessment of COR.

Comply with Scope of Work

Comply initially and as required 100% of the time.

Paragraph 6, 7, 8. 100% Assessment of COR.

STANDARD MEASUREMENT PAST PERFORMANCE ASSESSMENT

99% to 100% Excellent Document Past Performance Assessment Report, paying particular attention to performance that exceeds the standard. 96% to 98% Very Good 95% Satisfactory 91% to 94% Marginal 90% or Less Unsatisfactory

(END TO THE PERFORMANCE WORK STATEMENT)

SUPPLEMENT TO THE PERFORMANCE WORK STATEMENT

1. GOVERNMENT HOLIDAYS

The following Government Holidays are observed:

New Year’s Day, January 1 Martin Luther King, Jr.’s Birthday, 3rd Monday in January

President’s Day, 3rd Monday in February Memorial Day, Last Monday in May Juneteenth National, June 19 Independence Day, July 4

Labor Day, 1st Monday in September

Columbus Day, 2nd Monday in October Veteran’s Day, November 11

Thanksgiving Day, 4th Thursday in November Christmas Day, December 25

Note: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

2. INVOICING AND PAYMENT MONTHLY

The contractor shall submit monthly, in arrears, itemized invoices in accordance with DFARS 252.232-7003 & 252.232- 7006, for services rendered under this contract. Information regarding Wide Area Workflow is available on the Internet at https://piee.eb.mil

3. TOBACCO FREE MEDICAL CAMPUS (TFMC)

The Contractor shall ensure that all contract personnel comply with the U.S. Army Medical Command and MTF smoking policies while performing services under this contract. Smoking restrictions will apply at any location or building where health care activities are performed under this contract.

In accordance with Army Regulation 600-63, paragraph 7-3, 14 April 2015; Operations Order 15-48 (Army Medical Command (MEDCOM) Tobacco Free Living – USAMEDCOM), 8 May 2015; and any Operations Order, regulation or other instruction implementing, defining or otherwise addressing the Tobacco Free Medical Campus (TFMC) on any military installation or DoD-controlled location, Contractor personnel are prohibited from using any tobacco product on or within any TFMC while performing under this contract. TFMCs are established at each installation or DoD-controlled location and include: (1) any property or non-residential building that is operated, maintained or assigned to support medical activities, including but not limited to, hospitals, medical laboratories, outpatient clinics (including medical, dental, and veterinary facilities), or aid stations operating for the primary purpose of delivering medical care and services for DOD eligible beneficiaries and /or meeting the mission of the Army Medical Command; (2) all other facilities in which medical activities or administration take place, to include HQ MEDCOM and Defense Health Headquarters; (3) all internal roadways, sidewalks and parking lots; and (4) all sidewalks, parking lots and grounds external but adjacent to the building or related to the migratory corridors surrounding the medical facility. The contractor shall obtain from the COR any orders, regulations, instructions or other documents implementing, defining or otherwise addressing the TFMC for any given installation or DoD-controlled location where contractor personnel may perform under this contract and shall instruct contractor personnel on the TFMC limitations for installations or DoD-controlled locations where they may perform under this contract.

4. EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE PROGRAM Exclusion from Participation in Federal Health Care Programs (October 2015)

1. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at http://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of- Healthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

2. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the Lists and no such names appear on either of the Lists.

3. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

4. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

5. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

6. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a-7a):

a) There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

b) Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person.

7. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at h ttp://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

Personally Identifiable Information, Protected Health Information, and Federal Information Requirements (Revised 10/27/2020)

1.General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter.

DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S.

Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA including the National Capital Region Medical Directorate

(NCRMD).

2. Records Management When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA) The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA) If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data) The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances.

Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office.

Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSA for De-Identified Data DSA for PHI DSA for PII Without PHI DUA for Limited Data Set DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (Applies if contract requirements may include human subject research) This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

7. Privacy Act and HIPAA Training The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

8. HIPAA Business Associate Provisions

8.1 Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Privacy-Contract- Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS. b.i. and (3)b.ii

9. Breach Response [This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference.

9.1 Definitions Related to Breach response

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

9.1.3 A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

How the event was discovered;

Did the information stay within the covered entity’s control;

Was the information actually accessed/viewed; and Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4 A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

9.1.5 A HIPAA breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule.

The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e.

the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule. Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; the unauthorized person who used the PHI or to whom the disclosure was made; Whether the PHI was actually acquired or viewed; and the extent to which the risk to the PHI has been mitigated.

9.1.6 A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

9.2 General

9.2.1 The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

9.2.2 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non-breach, confirmed

vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline.