75FCMC2021R0001 Amendment 0001.pdf

(x)

75FCMC2021R0001

x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

AGG/JM

Contract Specialist Justin Menefee

ASG - DPIFMC

BALTIMORE MD 21244-1850

7500 SECURITY BLVD., MS: B3-30-03

CMS,OAGM,ASG,DPIFMC

11/25/20200001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

10/28/2020

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of Amendment 0001 is to:

Provide answers to the questions;

Include a revised solicitation; and, Include a Revised SOW.

***Amendment 0001 will not include a "Page 2" to ensure the page numbers remain in line with the original solicitation.***

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Nicole Hoey

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

75FCMC2021R0001

RAC Region 1

This solicitation includes the award for Recovery Auditor Contractor (RAC) Region 1. The purpose of this solicitation is to acquire a RAC to identify underpayments and recoup overpayments associated with services for which payment is made under Medicare including Part A or B of Title XVIII of the Social Security Act.

This is a Firm Fixed Contingency fee contract.

SECTION B - CONTINUATION OF SF 1449

B.1 Continuation of Blocks 19 – 24

SCHEDULE OF SUPPLIES/SERVICES

The chart below will set forth an Offeror’s applicable firm fixed contingency fee proposed per category of recovery for Region 1. The contingency fee proposed by each offeror for the four categories below will apply to the Base Period and subsequent exercised Option Periods. Any changes to an Offeror’s contingency fee must be negotiated and changed by contract modification.

New Process: In order to be complaint with CMS systems, funding will be included at the time of award. The amount of funding that is obligated to this contract is not guaranteed to the contractor. The RAC payments process is identified below in B.2. The obligated amount for this contract is $TBD. It is the contractor’s responsibility to notify the Contracting Officer (CO) and Contracting Officer Representative (COR) when the contractor expects to incur or exceed 75% of the obligated amount added to this contract. Delay in this notice will delay payments until a modification is completed. (This process should not impact an offeror’s proposal submission and will be finalized when award is made or via an amendment. If an Offeror is impacted by this change, please notify CMS of your concerns immediately.)

An Offeror shall propose one firm fixed Contingency fee percentage that will be applied to each category below:

Category Proposed

Contingency Fee Percentage (%)

When recovery (of overpayments) or repayment (of underpayments) is made by CMS on an improper payment identified by the RAC through automated review

When recovery (of overpayments) or repayment (of underpayments) is made by CMS on an improper payment identified by the RAC through complex review

When recovery (of overpayments) or repayment (of underpayments) is made by CMS on an improper payment identified by the RAC after a CMS referral that required review of the issue

When recovery (of overpayments) or repayment (of underpayments) is made by CMS on an improper payment identified by the RAC through the use of extrapolation

The period of performance for Region 1 will include 8.5 years of active recovery auditing and a closeout and reconciliation Option period, referred to as the “Administrative and Appeals Option” period. During the Administrative and Appeals Option period, CMS will continue to recoup overpayments from providers, allow the RAC to invoice for recoupments received, require the RACs to support the appeal process and allow CMS to recoup payment attributable to overturned appeals from the RAC. CMS reserves the right to extend the contract until such time as all pending appeals are dispositioned.

The period of performance for Region 1 is <TBD > through <TBD>.

This contract includes the following:

CLIN Description Period of Performance 0001 Base Period Date of Award - TBD (8.5 Years)

0002 Administrative and Appeals Option TBD-TBD (18 months)

(The period of performance may change to a base period (twelve months) plus 8 twelve-month option periods/one 6-month option and a 1.5 administrative and appeals option. This should not impact an offeror’s proposal submission and will be finalized when answers to the questions are providedaward is made or via an amendment. If an Offeror is impacted by this change, please notify CMS of your concerns immediately.)

B.2 Continuation of Block 18a

SCHEDULE OF PAYMENTS

The contractor shall be paid in accordance with their firm fixed contingency fee as described above. The RAC shall not receive any payments for the mere identification of improper overpayments. There are specific statutory timeframes for filing appeals at each level. The RAC may invoice for the applicable firm fixed contingency fee when all required claim elements are input into the RAC Data Warehouse (RACDW) and either: (1) the improperly paid claims have successfully exited (adjudication in favor of the RAC) the second level of the appeals process (QIC level) in the event an appeal is filed; or (2) if no appeal has been filed within the initial 120 days that a provider has to appeal, the RAC may then invoice for their firm fixed contingency fee payment.

The firm fixed contingency fee will be calculated by applying the applicable percentage to the underpayments refunded and the overpayments collected, without subtracting or netting out the underpayments. Amounts attributed to interest owed by or charged to the provider will not be included in overpayments or underpayments when calculating the contingency fee.

If a provider files an appeal disputing the overpayment determination and the appeal is adjudicated in the provider’s favor at ANY level, the RAC shall repay CMS the contingency payment it received for that recovery. Repayments to CMS will be subtracted from the next applicable invoice, e.g. offset, or may be the subject of a demand pursuant to FAR Subpart 32.6

B.3 Continuation of Block 11

DELIVERABLES

Task Number Deliverable Number

Deliverable Due Date (from contract award date) Task 1 1 Initial Meeting 2 weeks from date of award Task 2 2 Project Plan Draft within 2 weeks after the initial meeting with

CMS.

Subsequent Project Plans due by COB on the fifth business day following the end of each quarter.

–Task 13 3 Conference Calls Weekly and as needed Task 14 4 Monthly Reports

(Administrative, Appeals, New Issue)

Monthly – by COB on the fifth business day following the end of the month

–TASK 4.D. 5 Annual Case File Submissions

Annually and within 15 days prior to the end of the administrative period of the contract

Administrative and

6 Final Report- Draft Within 6 weeks prior to the end of the contract period

Miscellaneous Issues - K

Administrative and

Miscellaneous Issues - K

6 Final Report- Final Within 2 weeks prior to the end of the contract period

SECTION C – CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS – COMMERCIAL ITEMS

(OCT 2018)

C.2 ADDENDA TO 52.212-4 CONTRACT TERMS AND CONDITIONS –

COMMERCIAL ITEMS (OCT 2018)

The following changes to clause FAR 52.212-4 are as follows:

(a) Inspection/Acceptance. The Contractor shall only tender for acceptance a determination of improper payments (overpayments or underpayments) that conform to the requirements of this contract. Providers may, within specific statutory timeframes, appeal a determination of an improper overpayment or underpayment. A RAC determination shall be tendered for acceptance by the Government for invoicing provided that all required information is input into the RAC data warehouse and 120 days has passed and the Provider has not appealed the RAC determination. CMS uses the RAC Data warehouse as the central repository for all RAC review and invoicing activity.

Claims will not be available for invoicing if required fields are not completed in the RAC DW. If the provider appeals the RAC determination, the RAC may tender for acceptance by the Government 180 days after the Medicare Redetermination Notice, or the date of an unfavorable decision at the second level of the appeal process. The Government reserves the right to inspect or test any services that have been tendered for acceptance. The Government may require the reperformance of nonconforming services at no increase in contract price.

C.3 HHSAR CLAUSES INCORPORATED BY REFERENCE

DEPARTMENT OF HEALTH AND HUMAN SERVICES ACQUISITION

REGULATIONS (HHSAR) CLAUSES INCORPORATED BY REFERENCE (JAN

2016)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were provided in full text. Upon request, the Contracting Officer (CO) will provide the information in full text. The full text of a clause is also available electronically at http://www.hhs.gov/policies/hhsar/.

NUMBER TITLE DATE

352.203-70 ANTI-LOBBYING DEC 2015

352.208-70 PRINTING AND DUPLICATION DEC 2015

352.211-3 PAPERWORK REDUCTION ACT DEC 2015

352.222-70 CONTRACTOR COOPERATION IN EQUAL

EMPLOYMENT OPPORTUNITY INVESTIGATIONS DEC 2015

http://www.hhs.gov/policies/hhsar/

352.224-70 PRIVACY ACT DEC 2015

352.227-70 PUBLICATIONS AND PUBLICITY DEC 2015

C.4 352.224-71 CONFIDENTIAL INFORMATION (DEC 2015)

(a) Confidential Information, as used in this clause, means information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization.

(b) Specific information or categories of information that the Government will furnish to the Contractor, or that the Contractor is expected to generate, which are confidential may be identified elsewhere in this contract. The Contracting Officer may modify this contract to identify Confidential Information from time to time during performance.

(c) Confidential Information or records shall not be disclosed by the Contractor until:

(1) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to release findings of studies or research, to which an agency response may be appropriate to protect the public interest or that of the agency.

(2) For information provided by or on behalf of the government,

(i) The publication or dissemination of the following types of information are restricted under this contract: Personally Identifiable Information (PII), Protected Health Information (PHI), and/or Federal Tax Information (FTI),

(ii) The reason(s) for restricting the types of information identified in subparagraph (i) is/are: [the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Patient Protection and Affordable Care Act (ACA) set national standards REQUIRES THE RESTRICTION OF PII and PHI. ANY BASIS FOR NONDISCLOSURE WHICH

WOULD BE VALID UNDER THE FREEDOM OF INFORMATION ACT IS

SUFFICIENT UNDER THIS CLAUSE.]

(iii) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to disseminate or publish information identified in subparagraph (2)(i). The contractor shall not disseminate or publish such information without the written consent of the Contracting Officer.

(d) Whenever the Contractor is uncertain with regard to the confidentiality of or a property interest in information under this contract, the Contractor should consult with the Contracting Officer prior to any release, disclosure, dissemination, or publication.

C.5 HHSAR 352.237-75 KEY PERSONNEL (DEC 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

*All proposed substitutions shall be submitted, in writing, to CMS at least 30 days prior to the proposed substitution. Each request shall provide a detailed explanation of the circumstance necessitating the proposed substitution, a complete resume and any other information required by CMS. All proposed substitutions shall have qualifications equal to or greater than the person being replaced.

The following individuals are considered key personnel under this contract:

Project Manager Completed at award Contractor Medical Director Completed at award Chief Information Officer Completed at award Systems Security Officer Completed at award

C.6 DATA TO BE DELIVERED

a. Any working papers, interim reports, data given by the Government or first produced by the Contractor under the contract or collected or otherwise obtained by the Contractor under the contract, or results obtained or developed by the Contractor (subcontractor or consultants) pursuant to the fulfillment of this contract are to be delivered, documented, and formatted as directed by the CO and COR.

b. In addition, information and/or data, which are held by the Contractor related to the operation of their business and/or institution and which are obtained without the use of Federal funds, shall be considered “PROPRIETARY DATA” and are not subject data to be delivered under this contract.

C.7 CONFLICT OF INTEREST (OCT 2020)

a. General: The contractor and the services provided under this contract shall be free, to the greatest extent possible, of all Organizational and Personal Conflicts of Interest. Consistent with these terms and conditions, all references to Organizational and/or Personal Conflicts of Interests will be referred to individually or collectively, as Conflicts of Interest (COI). Except as defined by these terms and conditions and in accordance with FAR 9.503, the Contracting Officer shall not maintain a contract with a contractor the Contracting Officer (CO) determines has, or has the potential for, an unresolved COI.

b. Definitions:

Actual COI– The COI is either currently in existence as determined by the contractor or CMS. This form of COI will require avoidance, neutralization or mitigation acceptable to CMS.

Affiliates –Associated business concerns or individual(s) if, directly or indirectly, either one controls or can control the other; or a third party controls or can control both.

Apparent (Perceived) COI – The COI on first observation appears to be an actual or potential COI, but may or may not be after analysis.

Avoidance – To prevent the occurrence of a COI through actions such as exclusion of sources or modification of requirements. Avoidance precludes the conflict.

Contractor – The term contractor is used synonymously with offeror.

Financial Relationships – A direct or indirect ownership or investment interest (including a stock option or non-vested interest) in any entity that exists through equity, debt, or other means and includes any indirect ownership or investment interest no matter how many levels removed from a direct interest.

Mitigation– To reduce the effects of a COI to an acceptable level of risk so that the Government’s interest with regard to fair competition and/or contract performance are not impaired. The conflict remains but action was taken that minimizes the impact of the conflict to an acceptable level of risk.

Mitigation Plan – The contractor’s written approach to mitigating a COI as documented in D.2 Section B.4.

Neutralization – To counteract, through a specific action, the effects of potential or actual COI. The conflict remains, but the impact of the conflict has been negated.

Organizational Conflict of Interest – Occurs when other activities or relationships with other persons, a person is unable or potentially unable to render impartial assistance or advice to the Government, or the person’s objectivity in performing the contract work is or might be otherwise impaired, or a person has an unfair competitive advantage.

Personal Conflicts of Interest – A situation in which a person has a financial interest, personal activity, or relationship that could impair the person’s ability to act impartially and in the best interest of the Government when performing under this contract.

Potential COI – A future situation or circumstance that would create a conflict of interest.

Three (3) Types of COIs include:

Conflict Types Definitions

Biased Ground Rules

Consists of situations where a contractor and/or its affiliate(s), as part of its performance of a Government contract, has helped (or is in a position to help) set the ground rules for another Government contract by, for example, writing the statement of work or the specifications, or establishing source-selection criteria. In these “biased ground rules” cases, the primary concern is that the entity could skew the competition, whether intentionally or not, in favor of itself and/or its affiliates.

Impaired Objectivity

Consists of situations where a contractor and/or its affiliate(s) has an interest (typically financial) that may conflict with the interest of the Government to whom the contractor has a contractual obligation, and where the entity’s work under the Government contract could give the contractor the opportunity to benefit its other business interests. If the entity is providing recommendations, judgment or advice, and its other business interests could be affected by that recommendation, judgment or advice, it’s objectivity may be impaired. An example is where the entity was evaluating itself or evaluating an affiliate or a competitor, either through an assessment of performance under another contract or an evaluation of proposals.

Unequal Access to Information

“Unfair” access to non-public information – Consists of situations where a contractor and/or its affiliate(s) has access to nonpublic information (including proprietary information and non-public source-selection information) as part of its performance of a Government contract and that information may provide the entity with a competitive advantage in a later competition for a Government contract. In these “unequal access to information” cases, the concern is limited to the risk of the contractor and/or its affiliates gaining an unfair competitive advantage;

there is no issue of bias. Note: Incumbency alone does not constitute “unequal access to information.”

c. Significant Potential Conflict of Interest:

1. Nature of Conflict: Although not all inclusive, the following are considered to be an actual, potential or apparent COI with the work to be performed under this contract. The contractor shall promptly notify the CO if it is an entity, or affiliated with an entity, where any of the following circumstances exist:

a) Biased Ground rules, impaired objectivity or unequal access to information as explained in the definitions above and/or;

b) Within the three types of conflicts of interest, the CO has identified the following specific circumstances of conflicts:

i. Prepared work or is under contract to prepare work that would be reviewed under this contract;

ii. Is affiliated or has a financial relationship, as these terms are explained above, with a provider or supplier to be reviewed/evaluated under the contract: or

iii. Is affiliated or has financial relationship, as these terms are explained above, with an entity that serves as a CMS contractor responsible for the adjudication of appealed claims through any level of the Medicare fee-for-service (FFS) appeals process, contractors responsible for referring providers to the RAC, or contractors providing recommendations on the claims processing and appeals process. Examples include, but may not be limited to: Medicare Administrative Contractor (MAC), Unified Program Integrity Contractor (UPIC), Qualified Independent Contractor (QIC), Administrative –QIC (AdQIC), Beneficiary Family Centered Care Quality Improvement Organizations (BFCC-QIO) End Stage Renal Disease (ESRD) or Shared System Maintainers (SSMs) also known as claims processing system contractors.

2. Proposed Restraint on Future Contractor Activities: CMS is proposing to restrain future contractor activities as follows:

A RAC may not become a MAC, UPIC, BFCC-QIO, QIN-QIO, QIC, AdQIC, ESRD, or SSM at any time in the jurisdiction where it holds a RAC contract.

For purposes of this proposed restraint, a “UPIC” is defined as any of the Jurisdictional task orders awarded under the UPIC IDIQ (e.g. Northeastern Jurisdiction, Midwestern Jurisdiction, etc.)

d. Conflict of Interest Oversight and Mitigation Plan:

1. Conflict of Interest Oversight Program: The contractor shall maintain an effective

COI Oversight Program throughout the performance of the contract which includes procedures to monitor and disclose all Organizational and Personal Conflicts of Interest. A COI oversight program should include the monitoring of personal conflicts of interest such as, but not limited to:

a) Managers or Key Personnel who would be, or are involved with, the performance of this contract;

b) Governing Body Members (e.g., Board of Directors; Trustees); and

c) Principals of the organization as defined by FAR 52.203-13, Contractor Code of Business Ethics and Conduct.

2. Mitigation Plan: At any time during the performance of the contract if an actual, potential, or apparent COI is identified whether by the CO, the contractor or otherwise, the contractor shall submit a mitigation plan (D.2 Contractor/Offeror COI Submission Template) within 30 days unless otherwise specified by the CO. It is the contractor’s responsibility under the terms and conditions to provide timely notification to the CO those COIs that are self-identified. The CO will notify the contractor regarding the specifics for submission. The Government will review the submission at which time a determination will be made whether a COI has been satisfactorily mitigated or if further action is necessary and will notify the contractor accordingly. In cases where a COI cannot be, or has not been, mitigated to the Government’s satisfaction, the Government may take the following actions (this list is not all inclusive):

a) Request a waiver in accordance with FAR 9.503 Waiver, from the Head of the

Contracting Activity;

b) Make changes to the requirements of the contract;

c) Require a subcontractor change (if the conflict lies with the subcontractor); and/or

d) Terminate the contract in whole or in part.

e. Subcontractor Flow-Down Terms and Conditions: The prime contractor is responsible for avoiding, neutralizing and mitigating all actual, potential, or apparent COIs of its subcontractors, in accordance with these terms and conditions. Therefore, the prime contractor shall flow-down terms and conditions C.7 Conflict of Interest and Compliance, of this contract in all subcontracts. For subcontractors, wherever the term “contractor” is used, insert “subcontractor.”

(End of Clause)

C.8 CONTRACTOR PAST PERFORMANCE EVALUATION(S) (OCT 2014)

a. General:

In accordance with Federal Acquisition Regulation (FAR) 42.15, Contractor Performance Information, past performance evaluations shall be prepared at least annually and at the time the work under a contract or order is completed. Additional interim performance evaluations may be prepared at CO discretion, as necessary.

CMS will utilize the Contractor Performance Assessment Reporting System (CPARS), the Government-wide evaluation reporting tool for all past performance reports on contracts and orders, as appropriate. CPARS is a secure Internet website located at https://www.cpars.gov.

b. CPARS Process:

1. CPARS Training: Contractors may obtain CPARS training material and register for on-line training https://www.cpars.gov.

2. Post-Award Contract Registration: CMS is responsible for registering the contract in CPARS within 30 calendar days of contract award. The Contractor shall:

i. Designate at least one (1) point of contact that will be responsible for serving as the Contractor’s Representative (CR). Additional CRs may also be identified; and,

ii. Provide the CMS Contract Specialist with the name(s) and email address(es) of the CPARS point(s) of contact.

Once CMS registers the contract in CPARS, the CR(s) will receive an automated CPARS email message that contains User IDs and instructions for creating a password for future past performance evaluation processing.

3. Interim, Annual and Final Past Performance Evaluation Reports:

i. Issuing the Evaluation: Once the CMS Assessing Official (AO) issues an https://www.cpars.gov/ https://www.cpars.gov/ evaluation to the Contractor in CPARS, the CR(s) will receive an email instructing them to login to CPARS to review the evaluation.

ii. Contractor Comments: The CR has the option to provide comments on the evaluation, indicate if they concur or do not concur with the evaluation, sign, and then return the evaluation to the AO. The CR has a total of 60 days following the AO’s evaluation signature date to submit comments. If the CR submits comments within the first 14 days following the AO’s signature date and the AO closes the evaluation, the evaluation will become available in Past Performance Information Retrieval System - Report Card (PPIRS-RC) within 1 day.

On day 15 following the AO’s evaluation signature date, the evaluation will become available in PPIRS-RC with or without CR comments and whether or not it has been closed by the AO. If no CR comments have been sent and the evaluation has not been closed, it will be marked as “Pending” in

PPIRS-RC.

If the CR sends comments at any time prior to 61 days following the AO’s evaluation signature date, those comments will be reflected in PPIRS-RC within 1 day. On day 61 following the AO’s evaluation signature date, the CR will be “locked out” of the evaluation and may no longer send comments.

C.9 DISSEMINATION, PUBLICATION AND DISTRIBUTION OF INFORMATION

a. Data and information either provided to the Contractor, or to any subcontractor or generated by activities under this contract or derived from research or studies supported by this contract, shall be used only for the purposes of the contract. It shall not be duplicated, used or disclosed for any purpose other than the fulfillment of the requirements set forth in this contract. This restriction does not limit the contractor's right to use data or information obtained from a non-restrictive source. Any questions concerning "privileged information" shall be referred to the CO.

b. Some data or information may require special consideration with regard to the timing of its disclosure so that preliminary findings which could create erroneous conclusions are not disclosed. Also, some data or information, which relate to policy matters under consideration by the Government, may also require special consideration with regard to the timing of its disclosure so that the open and vigorous debate, within the government, of possible policy options is not damaged.

c. Any questions about use or release of the data or information or handling of material under this contract shall be referred to the CO who must render a written determination.

The CO’s determinations will reflect the results of internal coordination with appropriate program and legal officials.

d. Written advance notice of at least forty-five (45) days shall be provided to the CO of the Contractor's desire to release findings of studies or research or data or information described above. If the Contractor disagrees with the CO’s determination, and if this disagreement cannot be settled by the Contractor and the CO in a mutually satisfactory manner, then the issue will be settled pursuant to the "Disputes" clause.

e. Any presentation of any report, statistical or analytical material based on information obtained from this contract shall be subject to review by the COR before dissemination, publication, or distribution. Presentation includes, but is not limited to, papers, articles, professional publications, speeches, testimony or interviews with public print or broadcast media. This does not apply to information that is made available under the Federal Freedom of Information Act.

f. The COR review shall cover accuracy, content, manner of presentation of the information, and also the protection of the privacy of individuals. If the review finds that the Privacy Act is or may be violated, the release/use of the presentation shall be denied until the offending material is removed or until the CO makes a formal determination, in writing, that the privacy of individuals is not being violated.

g. If the review shows that the accuracy, content, or manner of presentation is not correct or is inappropriate in the light of the purpose of the project, the COR shall immediately inform the Contractor, in writing, of the nature of the problem. If the Contractor disagrees, the COR may insist that the presentation contain, in a manner of equal importance, materials which show the government's problem with the presentation.

h. The Contractor agrees to acknowledge support by CMS whenever reports of project funding levels, in whole or in part, by this contract are published in any medium. The Contractor shall include in any publication resulting from work under this contract, an acknowledgement substantially, as follows:

"The analyses upon which this publication is based were performed under Contract Number [ ], entitled, "[ ]," sponsored by the Centers for Medicare and Medicaid Services, Department of Health and Human Services."

Any deviation from the above legend shall be approved, in writing, by the CO.

C.10 HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)

All Protected Health Information (PHI), as defined in 45 C.F.R. §160.103, that is relevant to this Contract, shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. § 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor's duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

"Business Associate'' shall mean the Contractor (and/or the Contractor’s subcontractors or agents) if/when it uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS’ HIPAA-covered functions.

"Covered Entity" shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

"Secretary" shall mean the Secretary of the Department of Health & Human Services or the Secretary's designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or on behalf of, Covered Entity other than as permitted or required by this Contract or as required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual for:

A. Filing a complaint under 45 CFR § 160.306;

B. Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under 45 CFR Part 160; or C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its security policies and procedures, including workforce security measures, to ensure proper security awareness and training (including security incident response and reporting), and security incident procedures, in accordance with this Contract, including this HIPAA Business Associate Clause and the Contract’s clause entitled “CMS Information Security.”

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI created, received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as provided for by this Contract. In doing so, it shall implement policies and procedures to address the following and, where applicable, ensure that such policies and procedures are also in conformance with this Contract’s clause entitled “CMS Information Security:”

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual’s access rights to PHI (including the implementation of workforce security measures to ensure continued appropriate role-based access to PHI), and technical policies and procedures to ensure compliance with grants of access (including unique user identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities in which they are housed.

C. Implement policies, procedures and physical security measures that will limit access to PHI through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or outside of the Business Associate’s facility as well as the disposal and reuse of media containing PHI.

E. Implement appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability (including the use of contingency plans) of any electronic protected health information ("EPHI") it creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, maintenance or transmission of such EPHI. In the establishment of such safeguards, Business Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, and its hardware and software security capabilities.

iii. Assess, and implement, where appropriate, any addressable implementation specifications associated with applicable PHI security standards.

iv. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

v. Comply with the following Incident Reporting:

A. Report to Covered Entity any security incident/breach involving unsecured PHI, of which it becomes aware, including those of its agents and subcontractors. The Business Associate shall report any violation of the terms of this contract involving PHI and any security incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in accordance with the CMS Risk Management Handbook (RMH), specifically “RMH Vol II Procedure 7-2 Incident Handling Procedure” and “RMH Vol III Standard 7-1 Incident Handling.” These procedures can be found at http://www.cms.gov/Research-Statistics-Data-and- Systems/CMS-Information-Technology/InformationSecurity/Information- Security-Library.html In addition, the Business Associate will also notify the CMS Contracting Officer and the Contracting Officer’s Representative (COR) by email within one (1) hour of identifying such violation or incident.

B. Upon Covered Entity's knowledge of any material security incident/breach by Business Associate, Covered Entity will provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination clause of this Contract. See also paragraph D. Term of Clause below.

vi. Ensure that any agent or subcontractor agrees through a written contract, or other legally enforceable arrangement, to the same restrictions and conditions that apply through this HIPAA Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or on behalf of, Covered Entity.

vii. Upon Covered Entity’s request:

A. Provide the Covered Entity or its designee with access to the PHI created, received, maintained or transmitted by Business Associate from or on behalf of the Covered Entity in the course of contract performance in order to ensure Covered Entity’s ability to meet the requirements under 45 CFR § 164.524.

B. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR § 164.526.

viii. Make its facilities and any books, records, accounts, and any sources of PHI, including any policies and procedures, that are pertinent to ascertaining its own compliance with this contract or the Covered Entity’s compliance with the applicable HIPAA requirements, available to Covered Entity, or, in the context of an http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html investigation or compliance review, to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the various rules implementing the

HIPAA.

ix. Document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

x. Provide to Covered Entity, or an individual identified by the Covered Entity, information collected under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with

45 CFR § 164.528.

xi. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of

PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

d. Term of Clause

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of the PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity in accordance with “CMS Information Security” procedures. Business Associate shall not retain any PHI.

2. Security Incident/Breach:

Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall take action consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts – Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of Contracts, if the Business Associate does not cure the security incident/breach within the time specified by Covered Entity and/or cure is not possible; or, B. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

ii. Other Agreements –Covered Entity shall either:

A. Provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination terms of this Contract. Covered Entity may terminate this Contract for default if the Business Associate does not cure the breach or end the violation within the time specified by Covered Entity; or, B. Consistent with the terms of this Contract, terminate this Contract for default if Business Associate has breached a material term of this Contract and cure is not possible; or, C. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

3. Returning or Destroying PHI:

Business Associate, as defined above, which includes subcontractors or agents of the Contractor, shall:

i. Upon expiration or termination of this Contract, for any reason, return or destroy all PHI received from Covered Entity or another Business Associate of the Covered Entity, as well as any PHI created, received, maintained or transmitted from or on behalf of Covered Entity, or another Business Associate of the Covered Entity, in accordance with this contract, including the “CMS Information Security” clause.

ii. In the event that Business Associate determines that returning or destroying the PHI is infeasible, provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon such notice that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such

PHI.

e. Miscellaneous

1. A reference in this Contract to a section in the Rules issued under HIPAA means the section as in effect or as amended.

2. The respective rights and obligations of Business Associate under paragraph D.3.b of the section entitled "Term of Clause" shall survive the termination of this Contract.

Any ambiguity in this Contract clause shall be resolved to permit Covered Entity to comply with the Rules implemented under HIPAA.

C.11 CMS INFORMATION SECURITY (APR 2013)

All CMS information shall be protected from unauthorized access, use, disclosure, duplication, modification, diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, integrity, and availability of such information. Therefore, if this contract requires the contractor to provide services (both commercial and non-commercial) for Federal Information/Data, to include any of the following requirements:

Process any Information/Data; or Store any Information/Data (includes “Cloud” computing services); or Facilitate the transport of Information/Data; or Host/maintain Information/Data (including software and/or infrastructure developer/maintainers); or Have access to, or use of, Personally Identifiable Information (PII), including instances of remote access to, or physical removal of, such information beyond agency premises or control, The contractor shall become and remain compliant with the requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and- Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS- Information-Security-Contract-Clause-Provision.html. The requirements cover all CMS contracts and associated deliverables, which are required on a “per contractor” basis.

The contractor shall ensure that the following Federal information security standards are met for all of its CMS contracts:

Federal Information Security Management Act (FISMA) – FISMA information can be found at http://csrc.nist.gov/groups/SMA/fisma/index.html. FISMA requires each Federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source; and, Federal Risk and Authorization Management Program (FedRAMP) – FedRAMP information can be found at http://www.gsa.gov/portal/category/102371. The FedRAMP is a government-wide program that provides a standardized approach to https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security-Contract-Clause-Provision.html security assessment, authorization, and continuous monitoring for cloud products and services.

The Contractor shall include in all awarded subcontracts the FISMA/FedRAMP compliance requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Security- Contract-Clause-Provision.html..

C.12 CONFIDENTIALITY OF INFORMATION

(a) Confidential information, as used in this clause, means information or data of a personal nature about an individual or proprietary information or data submitted by or pertaining to an institution or organization.

(b) The CO and the Contractor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the CO and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. Failure to agree will be settled pursuant to the ‘‘Disputes’’ clause.

(c) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, the Contractor will follow the rules and procedures of…