PWS Programmatic and Financial Draft.docx

PERFORMANCE WORK STATEMENT (PWS)

MEDCOM HQ Capability Support: Programmatic and Financial Support Services United States Army Medical Command (MEDCOM) Headquarters (HQ)

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personnel services contract to provide programmatic and financial support services to the United States Army Medical Command (MEDCOM) Headquarters (HQ), and Regional Health Commands (RHCs). The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1 Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide programmatic and financial support services as defined in this Performance Work Statement (PWS), except for those items specified as Government-furnished property and services. The Contractor shall perform to the standards in this contract.

1.2 Background: As the Military Health System (MHS) works to implement Section 702 of the National Defense Authorization Act for Fiscal Year 2017 (FY17 NDAA) and other subsequent legislation, the United States Army Medical Command (MEDCOM) is transforming its purpose and functions. In accordance with budget authority for Military Treatment Facilities (MTFs) transitioning from MEDCOM to the Defense Health Agency (DHA) in FY 2020, MEDCOM is shifting its focus primarily to readiness and managing the $1 billion in medical Army readiness funding. However, the recent Transfer of Function realigning existing headquarters functions and personnel to DHA has reduced MEDCOM’s capacity to manage operations, budgets, and personnel. MEDCOM currently processes $1.2 billion in Medical Readiness requirements via the General Fund Enterprise Business System (GFEBS). MEDCOM also has the responsibility to perform accounting and audit services for five years of prior year funding in the Defense Health Program (DHP) and Operations and Maintenance-Army (OMA).

1.3 Objectives:

To provide programmatic and financial management support to analyze data, ensure audit readiness and compliance, make recommendations, identify current and future trends that will enhance MEDCOM and the RHC’s overall mission capabilities.

To support requirements for the RHCs (Atlantic, Central, and Pacific), MEDCOM/OTSG Deputy Chief of Staff (DCOS) offices (Army Recovery Care Program, Quality and Safety, Public Health, G-1/4/6, G-3/57, G-8/9), and OneStaff (Business Office, Special Staff, Executive Offices, All ancillary Staff under TSG, Deputy Surgeon General (DSG), and Chief of Staff (CoS) and Public Affairs), by filling capability gaps caused by the reduction in MEDCOM HQ Authorizations; MEDCOM HQ Transfer of Function to DHA, additional Army-directed decrement as a result of MHS Reform, and reduction in Army Active Duty (AD) (at the MTF Levels), along with increased requirements from the new Readiness Mission and changes in mission such as COVID-19. These decrements have created numerous capability gaps to achieve the Readiness Mission. The requirement is to provide services in the 11 different work streams that will grow capability areas within MEDCOM, including but not limited to: Administrative Support/Security, Audit Response and Remediation, Data Analytics, Financial Management/GFEBS, Functional Analysis/Studies, Information Technology (IT) Project Management, Process Improvement, Project Management, Strategic Outreach (Communications), Strategic Planning, and Training.

Additionally, successful implementation of the following is critical:

· Enhance MEDCOM HQ and RHC senior leader decision-making capability by providing detailed information and decision briefs/papers.

· Provide senior leaders with timely and accurate data through dashboards and analytical tools.

· Establish financial management processes in MEDCOM that align with the United States Army Programming and Budget process.

· MEDCOM is audit compliant and gets a clean financial statement audit opinion on an annual basis.

1.4 Scope: The Contractor shall provide HQ programmatic and financial management support, which is comprised of Financial Management and Administrative Assistance; and Program Management Assistance services to MEDCOM Regional Health Commands (RHCs) Atlantic, Central, and Pacific. The Financial and Management services consists of: administration, audit capabilities, data analytics, financial management support, and IT support. Program Management Assistance services consists of: process improvement, project management, communications and strategic planning support, and education priority management (internal). The Contractor shall support the MEDCOM HQ at Joint Base San Antonio and the Defense Health Headquarters (DHHQ) at Fall Church, VA, along with supporting the RHCs.

· Program Management. Provide United States Army headquarters staffing capability that consists of: conducting studies, developing information and decision papers, facilitate work groups, and work issues through a project management framework.

· Data Analytics. Establish analytical capability to include the creation and maintenance of dashboards that provide information for senior leader decision-making.

· Financial Management. Provide a financial management capability that aligns with the United States Army Programming and Budget process.

· Audit Support. Establish a MEDCOM audit response and remediation capability that addresses Independent Auditor findings on both DHP and OMA funding.

· Information Technology. Plan, schedule, execute, and monitor IT programs and projects.

1.5 Period of Performance: This contract has a base year plus 4 option years.

1.6 General Information

1.6.1 Nondisclosure: The Contractor shall maintain a signed Nondisclosure Agreement (NDA) (Deliverable 1) for each staff member immediately upon beginning work on this contract and submit to the COR within 1 week of commencement of work.

1.6.1.1 Monthly Progress Reporting: The first Management Status Report (MSR) is due 45th day after contract award, and on the 15th of every month thereafter to the COR (Deliverable 2). The MSR shall outline key activities and accomplishments during the reporting period and document any risks to the contractor’s ability to meet performance requirements/objectives.

1.6.2 Quality Control: The Contractor shall develop and maintain an effective quality control plan (QCP) (Deliverable 3) to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s QCP is the means by which work is deemed to be completed in accordance the requirement of the contract. The QCP is to be delivered within 30 calendar days after contract award to the Contracting Officer (KO) and the Contracting Officer’s Representative (COR) as an electronic copy. The Contractor shall submit changes to the QCP no later than five (5) business days to the COR and KO.

The QCP shall include, at minimum, the following requirements:

· A description of the inspection system to cover all major services and deliverables. The description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title of inspectors.

· A description of the methods to be used for identifying and preventing defects in the quality of service performed.

· A description of the records to be kept to document inspections and corrective or preventative actions taken.

· All records of inspections performed shall be retained and made available to the Government upon request throughout the task order performance period, and for the period after task order completion, until final settlement of any claims under this contract.

1.6.2.1 Quality Assurance: The Government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). The Government reserves the right to choose the inspection methods to implement the QASP and to vary the inspection methods utilized during the work, without notice to the Contractor.

1.6.3 Recognized Holidays:

Memorial Day

1.6.4 Hours of Operation: The Contractor is responsible for conducting business, between the hours of 8am to 4:30pm Monday thru Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings. These hours are subject to change, should mission-critical tasks require it. The Contractor must, at all times, maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.6.5 Place of Performance: The work performed under this contract will primarily be performed at Army Medicine HQ at either the Office of Surgeon General (OTSG) at the Defense Health Headquarters (DHHQ), Falls Church, VA, or at the United States Medical Command (MEDCOM) located at Joint Base San Antonio, Texas. Contractor positions supporting RHCs will perform work at the respective RHC HQ locations listed below. However, in certain instances, for example, in light of the current public health emergency related to COVID-19, the Contractor may be required to work off-site at a contractor-provided facility or virtually, as appropriate. The Government has the discretion, post-COVID-19 or any future emergency requirement, to require contractors to work off-site. In those cases when Contractor personnel work efforts are performed outside of Government facilities, performance will be limited to contractor facilities that comply with all requirements of the contract, including, but not limited to, facilities that comply with applicable security requirements. If support is required for OCONUS locations, such support will be provided remotely from CONUS. All positions on the contract are eligible for telework at the discretion of the Government lead. Each staff member will sign a telework agreement outlining telework expectations within 30 days of starting on the contract (Deliverable #4)

MEDCOM Headquarters 2478 Worth Road JBSA Fort Sam Houston, TX 78234-6000

Defense Health Headquarters 7700 Arlington Blvd.

Falls Church, VCA 22042-5140

1.6.6 Type of Contract: The Government will award an Indefinite Delivery/Indefinite Quantity.

1.6.7 Security Requirements: Contractor personnel performing work under this contract must have a Public Trust at time of the proposal submission, and must maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached Department of Defense (DD) 254 Contract Security Classification Specification. Contractors shall be required to maintain Public Trust or Secret level clearances.

1.6.8 Access and general protection/security policy and procedures: Contractor and all associated sub-contractors/employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services, or the Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.6.9 The Contractor is not required to handle or access classified equipment or information. The Contractor personnel do not require a security clearance, but will be performing privileged-level Information Assurance (IA) tasks, as defined by DoD 8570.01-M. Personnel must first pass a background investigation appropriate for Automated Data Processing Category for the task, as defined in AR 380–67, Paragraph 3-2. or controlling DoD regulation. The Government (Security Manager) will perform these background investigations and Provost Marshal Office (PMO), issue CACs, and badges as warranted, to perform the work. All contractor employees shall sign a Computer User Agreement Acceptable Use Policy (AUP) and Non-disclosure Agreement (NDA) prior to being given access to a Government computer, or the local network.

1.6.9.1 Physical Security: The Contractor shall be responsible for safeguarding Government equipment, information, and property provided for contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

1.6.9.2 Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced, and are not used by unauthorized persons. All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the KO.

1.6.9.2.1 In the event keys (other than master keys) are lost or duplicated, the Contractor shall, upon direction of the KO re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.9.2.2 The Contractor shall prohibit the use of Government-issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.6.9.3 Lock Combinations, N/A

1.6.10 Special Qualifications: The Contractor will use various systems to support the following government functions within scope. The systems are presented in Exhibit 3.

Program Manager: The Program Manager must possess the following qualifications:

10+ years’ Army Medical Sr. Leadership experience Masters of Business Administration or Masters of Healthcare Administration Project Management Professional (PMP) certification

Financial Manager: The Financial Manager must possess the following qualifications:

· 5+ years’ experience managing teams

· Experience in Federal accounting, budget development & execution

· Experience in Vantage

· Experience with SAP ERP Central Component (ECC) – Funds Management, Financials, Controlling, Materials Management, and Sales & Distribution

· Experience with SAP Business Intelligence (BI)

· Experience in FMIS/RSBUX

· Working knowledge of DoD and the Military Health System

Data Analytics Manager: The Data Analytics Manager must possess the following qualifications:

· 5+ years’ experience managing teams

· Degree in Statistics, Analytics or related field

· Experience with healthcare and data systems (i.e. Electronic Health Record (EHR))

· Experience with BI tool such as Tableau, PowerBI or Qlik

· Experience with statistical tool such as R or Python or SAS

· Working knowledge of DoD and the Military Health System

System/Software Integration Engineer Manager: The System/Software Integration Engineer Manager must possess the following qualifications:

· 5+ years’ experience managing teams

· Degree in Health Policy, Health Administration, Information Systems, Health Informatics, Data Analytics or other related field

· One of more of the following certifications: CompTIA A+, PMP, SCM, CPHIMS, CAHIMS

· Working knowledge of DoD IT and the Military Health System

Accounting Specialist (Audit) Manager: The Accounting Specialist (Audit) Manager must possess the following qualifications:

· 5+ years’ experience managing teams

· Degree in Auditing, Accounting, or related field

· Experience in Federal accounting, audit, audit readiness, audit remediation, audit strategy, and management internal control program

· Working knowledge of DoD and the Military Health System

Management Analyst Manager: The Management Analyst Manager must possess the following qualifications:

· 5+ years’ experience managing teams

· Experience in planning, leading, directing, and managing projects and tasks

· Experience managing essential personnel documents and training statistics

· Experience planning and facilitating meetings and events

· Knowledge of tools such as SharePoint, Task Management Tracker (TMT), Digital Training Management System (DTMS)

· Working knowledge of DoD and the Military Health System

1.6.11 Post-Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post-award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the KO will apprise the Contractor of how the government views the Contractor's performance, and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.12 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract, perform inspections necessary in connection with contract performance, maintain written and oral communications with the Contractor concerning technical aspects of the contract, issue written interpretations of technical requirements, including Government drawings, designs, specifications, monitor Contractor's performance and notify both the KO and Contractor of any deficiencies, coordinate availability of Government-furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.13 Key Personnel: The contractor shall provide a Program Manager who shall be responsible for the performance of the work. The name of this person shall be designated in writing to the contracting officer. The Program Manager shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The Program Manager shall be available between 8:00 a.m. to 5:00 p.m. Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.6.14 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products, or that contractor participation is appropriately disclosed.

1.6.15 Contractor Travel: Contractor will be required to travel CONUS during the performance of this contract to attend meetings, conferences, and training. The Contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this PWS. Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires Government approval/authorization and notification to the COR.

1.6.15.1 Contractor Travel: The COR is the CONUS travel order approval authority as designated in writing by the KO. All CONUS travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the COR, and are on a strictly cost reimbursable basis. The Contractor shall be authorized travel expenses consistent with the substantive provisions of the JTR and the limitation of funds specified in this contract. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR 31.205-46 Travel Costs, subject to local policy and procedures.

1.6.15.2 Travel Arrangements: Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. The Contractor shall remain current on applicable regulations, policies, and procedures that may impact processes for travel and modify their processes accordingly. No later than 30 calendar days prior to schedule the travel date, the Contractor shall submit an estimate for travel to the COR in an official memorandum format (Deliverable 5). The estimate shall include airline ticket costs, car rental, per diem, registration fees and any other allowable costs associated with the travel request. All travel and transportation shall utilize commercial sources and carriers, provided the method used for the appropriate geographical area that results in reasonable charges to the Government. The Government will not pay for economy plus, business class, or first-class travel. The COR will provide the Contractor a signed approval of Government Contractor Official Travel Letter of Identification before the Contractor is authorized to travel.

1.6.15.3 Travel Claim Procedures, Approval, and Reimbursement: Travel shall be reimbursed after the KO has determined fair and reasonable cost reimbursement IAW the JTR and FAR Part 31.205-46. The Contractor shall submit an estimate for travel to the COR no later than 30 calendar days prior to the first day of travel; in order for the Contractor to obtain economical travel arrangement and cost. The COR or KO will need to approve the travel prior to the Contractor traveling.

1.6.15.4 The COR will verify the travel receipts are valid and match the travel requirements identified in the PWS. The Contractor shall provide a trip report to include costs associated with the travel to the COR within ten (10) calendar days after the completion of travel trip. (Deliverable 6) All travel costs shall be billed within 30 days after travel is complete, unless an approval for later billing is approved by COR or KO. All travel cost reimbursement requests must detail all authorized expenses associated with the travel and all receipts including ticket stubs (booked airline, hotel receipts, etc.) shall be provided to substantiate claims for costs of all expense items in excess of $75.00.

1.6.16 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government, and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.17 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.), or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may enact other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.18 Phase-in /Phase-out Period: To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the 30-day phase in/ phase out periods. During the phase in period, the Contractor shall become familiar with performance requirements in order to commence full performance of services on the contract start date.

1.6.19 Common Access Card (CAC):

1.6.19.1 For contractors requiring Common Access Card (CAC). Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

1.6.19.2. The Contractor shall ensure that all users on the Local Area Network (LAN) have obtained a CAC, and have the appropriate Army Knowledge Online (AKO) account required for the issuance of personal digital security certificates. The Government person whose operations are supported by the contracted services will provide sponsorship for the AKO account and provide for access to the Contractor Verification System (CVS) for the issuance of a CAC.

1.6.19.3. Contractor will return all issued United States Government CACs, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility.

1.6.19.4. The Contractor shall possess and maintain a NACI facility clearance from the Defense Security Service. The Contractor’s employees, performing work in support of this contract shall have been granted a NACI security clearance from the Defense Industrial Security Clearance Office. The DD 254 will be completed in the event that the Government requires contractors to possess and maintain a Secret clearance for contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the Contractor. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements (CFR clause 52.204-9, Personal Identity Verification of Contract Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.6.19.5 Data Use Agreements: Access to Army or MHS data requires the contractor to have an approved Data Sharing Agreement (DSA) in place with MEDCOM. The Contractor shall prepare and submit the requisite DSA accompanied by a Business Associates Agreement (BAA), and a System Security Verification (SSV) found at https://health.mil/Reference-Center/Forms. Contractor is also required to abide by Memo: “Security of Unclassified DoD Information on Non-DoD Information Systems,” found in the Appendix and the standard contracting language dealing with the storage and use of Protected Health Information (PHI)/Personally Identifiable Information (PII) data. The Contractor will be accessing systems (M2, MDR, etc.,) that contain PHI/PII and thus the Contractor will need to enter into a BAA and a DSA that will be submitted to the DHA Privacy Office (Deliverable 7) within 45 days of award. The Contractor will be accessing and storing data from the MHS systems on government furnished equipment. This approach will minimize the risk of a data breach.

1.6.20. Business Associate Agreement (BAA)

1.6.20.1 General Requirements Overview – PHI/PII and Federal Information Laws

This section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and DoD issuances. In general, the Contractor shall comply with the specific requirements set forth in this section and elsewhere in this contract. The Contractor shall also comply with requirements relating to records management as described herein.

This contract incorporates by reference the Federal regulations and DoD issuances referred to in this section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a Federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address, or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this section, the following definitions apply.

DoD Privacy Act Issuances refers to the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11-R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules refers, collectively, to the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances refers to the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

MEDCOM Privacy Office is the MEDCOM Privacy and Civil Liberties Office. The MEDCOM Privacy Office Chief is the HIPAA Privacy and Security Officer for MEDCOM.

1.7. SEXUAL HARASSMENT/ASSAULT RESPONSE AND PREVENTION (SHARP).

1.7 1. The Contractor shall require all Contract Service Providers (CSPs) with knowledge of an incident of sexual assault occurring on a Government facility, to include a Government-leased facility, where the Contractor is providing services under this contract, to report the incident to the Contractor who shall immediately (within 24 hours of gaining knowledge of the incident) report the incident in writing to the Government's COR. This reporting policy also applies to sexual assault incidents involving MEDCOM personnel that occur on the Contractor’s owned or leased facility under this contract. All incidents shall be reported whether they involve Contractor personnel or Government personnel, or other individuals, when the incidents occur on a Government facility or a Government-leased facility.

1.7 2. The Contractor shall require all CSPs with knowledge of an incident of sexual harassment occurring on a Government facility, to include a Government-leased facility, where the Contractor is providing services under this contract, to report the incident to the Contractor who shall immediately (within 24 hours of gaining knowledge of the incident) report the incident in writing to the Government's COR. This reporting policy also applies to sexual harassment incidents involving MEDCOM personnel that occur on the Contractor’s owned or leased facility under this contract. All incidents shall be reported whether they involve Contractor personnel or Government personnel, or other individuals, when the incidents occur on a Government facility or a Government-leased facility.

1.8. TRUSTED ASSOCIATE SPONSORSHIP SYSTEM (TASS):

1.8.1. The Contractor shall comply with agency personal identity verification procedures that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

1.8.2. The Contractor shall comply with agency personal identity verification procedures in all subcontracts when the subcontractor is required to have physical access to a federally-controlled facility or access to a Federal information system.

1.8.3. The Contractor shall ensure compliance with the provisions set forth below. For purposes of Federal Acquisition Regulation (FAR) 52.204-9, the Government will designate a Trusted Agent (TA) for this contract. The Government reserves the right to amend or supplement these provisions pursuant to the changes clause in the contract.

1.8.4. The Contractor is responsible for absences of contract employees. Furthermore, the Contractor shall seek appropriate guidance on how to resolve issues that may arise due to expired identification, or denial of access to documents. Such absences shall not relieve the Contractor of its obligation to perform the services required under this contract.

1.8.5. The Government will sponsor the contract employees for an Army Knowledge Online (AKO) account. All contract employee’s email addresses will identify them as a contractor and use the format firstname.lastname.ctr@mail.mil. The Government will discontinue AKO accounts when personnel no longer require access.

1.8.6. The Government TA will send a notice through TASS to the AKO e-mail address provided. The contract employee’s user ID and password will be provided in the email and shall require a change at first login. In the event the e-mail message is not received, the Contractor may request the username and password from the TA and proceed to the website https://www.dmdc.osd.mil/tass to complete the process.

1.8.7. The contract employee’s agents shall log into TASS and complete the verification process by submitting the application to the TA for approval.

1.8.8. The application will be accepted, returned, or rejected by the TA. Notice as to whether the application has been accepted, returned, or rejected will be provided to the individual's e-mail address within 48 hours after submission. If the application is returned or rejected, the contract employee shall contact the TA and comply with the TA's guidance to attempt to correct and resolve the issues.

1.8.9. Upon approval of the application, the contract employee shall receive an e-mail sent to the address provided stating the CAC application was approved. The applicant must then go to a Real-Time Automated Personnel Identification System (RAPIDS) Issuing Facility to have the Government credential issued. The contract employee must present two acceptable forms of ID, which may include Driver’s License, Military ID, Contractor Company ID with picture and expiration date, charge card with picture imprinted, or passport.

1.8.10. Revalidation Requirements. The TA is required to revalidate all contract employees through TASS every 180 days. In the event revalidation is denied, the CAC credentials shall be revoked and the CAC will not be usable to login.

1.8.11. Out-processing Requirements. When a contract employee‘s performance under this contract ceases, each agents shall personally bring the CAC to the TA and complete the Department of the Army (DA) Form 2962. The TA will revoke the CAC from TASS.

1.8.12. The contract employee shall immediately report any lost or stolen badges to the COR within 24 hours or the next business day.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1 DEFINITIONS:

2.1.1 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2 CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government.

Note: The Contracting Officer is the only individual who can legally bind the Government.

2.1.3 CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the United States Government appointed by the Contracting Officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5 DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6 KEY PERSONNEL. The key personnel is the Program Manager.

2.1.7 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8 QUALITY ASSURANCE. The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9 QUALITY ASSURANCE Surveillance Plan (QASP). An organized, written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11 SUBCONTRACTOR. One that enters into a contract with a prime contractor.

2.1.12 WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.13 WORK WEEK. Monday through Friday, unless specified otherwise.

2.2 ACRONYMS:

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1 Facilities. The Government will provide the necessary facilities and office space to carry out the requirements listed in the PWS. This includes desk space, telephones, computers, network access, and other items necessary to maintain an office environment.

3.2 Utilities. The Government will provide all utilities in the Federal facilities. These utilities will be available for the Contractor’s use in performance of tasks outlined in this PWS. The Contractor shall instruct employees in utility conservation practices. The Contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after use.

3.3 Equipment. The Government will provide office equipment (scanners, fax machines and printers) to include Government laptops.

3.3.1 The Government will hand receipt Government-Furnished Equipment to contractors used to perform their job tasks. Items that must be signed for by the Contractor include equipment control numbered (ECN) but not all-inclusive; such as: computers, cellphones, job specific devices and tools. The Contractor will sign for the equipment when picked up. If the contractor is 100% remote, arrangements will be made to ship the GFE and gather the necessary signatures virtually.

3.4 Materials. The Government shall provide all furniture, forms, and regulatory materials to support training and set-up required for commencement of operations. The Government shall provide all official forms and envelopes. All other expendable supplies will be provided by the Contractor. All official mail sent from transition sites will be processed for postage metering and certified/registered mail at Government expense. The Government shall provide all required office machines other than fax and photocopy machines. The Government shall provide Information Management Office support. The Government shall not be responsible for contractor-owned property.

3.5 Systems Access. The Government will provide IT systems access so that contract personnel can directly access relevant MHS and MEDCOM data systems. Contractor personnel will submit the appropriate forms for access for COR approval, including the DD2875, SAAR. The Contractor will enter into a BAA and submit a DSA to the DHA Privacy Office in order to access MHS data systems. The Contractor shall comply with the document entitled "Personally Identifiable Information (PII), Protected Health Information (PHI), and Federal Information Requirements", which is incorporated in its entirety. To view PII, PHI, and Federal Information Requirements, refer to Clause Section for DHA Procedures, Guidance and Information 224.90 if applicable.

3.6 Government Training

3.6.1 Antiterrorism (AT) Level I Training. The Government will provide AT Level I awareness training at the following website: http://jko.jten.mil. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date, or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR within 30 calendar days after completion of training by all employees and subcontractor personnel (Deliverable 8). All contractor employees must complete AT awareness training annually.

3.6.1.2. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required United States-based contractor employees and associated subcontractor employees to make available and to receive Government-provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

3.6.2. iWATCH Training: The requiring activity Antiterrorism Officer (ATO) will provide iWATCH training for contractor employees, to include subcontractor employees, with an area of performance within an Army controlled installation, facility or area. The ATO shall brief all employees on the local iWATCH program. This locally developed training will be used to inform employees of the types of behavior to watch for, and instruct employees to report suspicious activity to the ATO. This training shall be completed within 30 calendar days of start date and within 30 calendar days of new employees commencing performance with the results reported to the COR, not later than (NLT) 35 calendar days after contract start (Deliverable 9).

3.6.3. Army Training Certification Tracking System (ATCTS). Contractor employees are required to establish and maintain an ATCTS account while employed by this contract. They must successfully complete the DoD Information Assurance Awareness prior to accessing the information system and annually thereafter. Submit certificate of completion within 14 calendar days of contract start date to the COR. (Deliverable 10)

3.6.4. Operations Security (OPSEC). The Government will provide OPSEC training. In accordance with AR 530-1, OPSEC, new contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete OPSEC awareness training annually. Certificates documenting completion of the training shall be supplied to the COR within 14 Calendar Days of Training Completion (Deliverable 11).

3.6.5. Cyber Awareness Training. The Government will provide online Cyber Awareness Training. All users (military, civilian, and contractor personnel) who use Government computers shall accomplish this training prior to commencement of services and then annually thereafter in accordance with DoD 8570.01-M. Certificates documenting completion of the training shall be supplied to the COR within 14 Calendar Days of Training Completion (Deliverable 12).

3.6.5.1. For Cyber Security training. All contractor employees and associated subcontractor employees must complete the DoD Cyber Security training before issuance of network access and annually thereafter. All contractor employees working Cyber Security functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01-M, and AR 25-2 within six months of appointment to IA/IT functions. Certificates documenting completion of the training shall be supplied to the COR within 14 Calendar Days of Training Completion (Deliverable 13).

3.6.5.2 For IA/IT certification. Per DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, the Contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award. Certificates documenting completion of the training shall be supplied to the COR within 14 Calendar Days of Training Completion (Deliverable 14).

3.6.6 Threat Awareness Reporting Program (TARP). The Government will provide TARP training. All contractor employees must complete TARP training annually in accordance with AR 381-12 Threat Awareness and Reporting Program. Certificates documenting completion (Deliverable 15) of the training shall be supplied to the COR within 14 Calendar Days of Training Completion.

PART 4

CONTRACTOR FURNISHED ITEMS…