S02 - Attachment 02 - QASP - IV Buffer Support - 19AUG2026.pdf

Quality Assurance Surveillance Plan

Insurance Entry and Verification Buffer Support Services This Quality Assurance Surveillance Plan [QASP] applies to the Performance Work Statement [PWS] for Insurance Entry and Verification Buffer Support Services supporting VA Revenue Operations [RO] and the Consolidated Patient Account Center [CPAC] nationwide program. The QASP establishes the Government's surveillance approach for monitoring Contractor performance under the Indefinite- Delivery, Indefinite-Quantity [IDIQ] contract and resulting Task Orders for insurance entry and verification services, including reverification actions and new-policy actions, including Medicare policy actions, and any other insurance actions authorized by an applicable Task Order within the scope of the PWS and the parent IDIQ contract.

The Government will use this QASP together with the PWS, Performance Requirements Summary Matrix [PRSM], Section B, applicable contract clauses, and individual Task Orders to assess whether required results are achieved. If there is a conflict, the parent IDIQ contract and applicable contract clauses control. This QASP does not change the PWS, PRSM, Section B, or any other contract term. This QASP is intended to support performance-based administration by focusing on outcomes, measurable standards, documented surveillance, and timely corrective action when performance does not meet contract requirements.

Introduction The Contractor is responsible for the quality and timeliness of all work performed under the contract, including the work of subcontractors. The Government will rely on the Contractor's internal quality control processes, reports, and supporting documentation, but Government surveillance under this QASP will determine whether performance is acceptable for contract administration, inspection, acceptance, invoice support, and performance documentation.

The Government may revise surveillance procedures by written notice from the CO when the revision does not change contractual performance requirements. Any change to performance standards, AQLs, payment, deductions, scope, price, or schedule requires a contract modification.

Roles and Responsibilities Contracting Officer The CO is responsible for contract administration, interpretation of contract terms, resolution of contractual issues, and execution of any contract modifications. The CO is the only official authorized to change contract terms, authorize out-of-scope work, modify price or schedule, or make final determinations on remedies for nonconforming performance.

Contracting Officer's Representative The COR is the Government's designated representative for technical monitoring and day-to-day surveillance within the limits of the written designation letter. The COR is responsible for monitoring recurring performance, reviewing reports and deliverables, validating surveillance findings, coordinating with program personnel, documenting performance trends, and recommending acceptance, rejection, or corrective action to the CO as appropriate.

Program Office and Technical Monitors Program officials, CPAC Insurance Verification Manager, Supervisor, or other Government official identified in the applicable Task Order, and other designated technical personnel may assist the COR by reviewing reports, validating workload status, confirming service impacts, and documenting observed performance issues. These personnel may provide surveillance input, but they are not authorized to direct the Contractor to change contract scope, alter performance standards, or modify contract terms.

Contractor The Contractor is responsible for managing performance, maintaining qualified staff, preserving required access, protecting PII and PHI, and implementing internal quality-control measures sufficient to meet or exceed the standards in the PWS, PRSM, QASP, and applicable Task Orders. The Contractor shall provide accurate, timely, and complete reports and shall take prompt corrective action when notified of deficiencies.

Surveillance Approach The Government will use a combination of 100 percent review of required reports, periodic inspection, random sampling, trend analysis, validation of complaints, and documented review of system access or privacy incidents. Surveillance methods will be selected based on the criticality of the task, the availability of objective evidence, workload volume, and observed performance trends.

Surveillance under this QASP will focus on whether performance outcomes are achieved, rather than on supervising Contractor methods or individual personnel. Where performance issues are attributable to Government-controlled factors, such as incomplete source data, unavailable required system access, background-investigation or credentialing delays, or VistA or provider-portal outages, the Government will document the issue and exclude those impacts from adverse performance calculations when supported by contract records.

Performance Standards The required performance standards and acceptable quality levels are derived from the PWS and PRSM for this requirement. The Government will evaluate performance by rating period, normally monthly unless otherwise stated in the Task Order or unless a quarterly assessment is more appropriate for a specific metric.

Consistent with the PRSM, timeliness calculations will use as the denominator the total number of insurance actions assigned and available for Contractor processing during the rating period, after provision of complete records and required system access. Accuracy calculations will be based on sampled accepted completed actions, using sampling methods and Acceptable Quality Levels [AQLs] defined in the PRSM and QASP appendices.

Performance Requirements Summary

Indicator Standard Acceptable Quality Level

[AQL]

Surveillance Method

Surveillance Frequency

Remedy / Government Response

Timely completion of insurance actions

Contractor completes assigned and available insurance actions within the delivery period stated in the applicable Task Order

At least 93 percent of assigned and available actions completed on time during the applicable rating period

Review of VA CPAC quality-assurance documents or periodic Government inspection

Per QASP/Task Order

Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including Section B, or another applicable contract term.

Data accuracy Contractor performs insurance actions accurately, completely, and in accordance with CPAC guidebooks, VA policy, and Task Order requirements

Individual data-entry quality review does not fall below 95 percent during the rating period

Review of VA CPAC quality-assurance documents or periodic Government inspection

Per QASP/Task Order

Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including Section B, or another applicable contract term.

Resolution of Contractor-caused rejected actions

Contractor reviews and takes required corrective action within the required timeframe

100 percent reviewed and corrected within five business days

Review of quality-assurance documents

Monthly/as needed

Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including Section B, or another applicable contract term.

[AQL]

Surveillance Method

Surveillance Frequency

Remedy / Government Response

Resolution of insurance-action questions and concerns

Contractor provides clear, timely, and effective communication

No more than three validated communication failures per quarter

Validated user complaints

Quarterly/as needed

Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including Section B, or another applicable contract term.

Participation in required meetings

Contractor participates in required calls, meetings, and performance-management sessions

No more than two missed calls per rating period; 100 percent key-person or authorized-representative attendance when required

Validated attendance records

Per rating period

Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including Section B, or another applicable contract term.

Maintain required system and provider-portal access

Contractor maintains access necessary to perform assigned insurance actions

No more than one access reset per month attributable to Contractor failure

Validated requests to regain access

Monthly/as needed

Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including

[AQL]

Surveillance Method

Surveillance Frequency

Remedy / Government Response

Confidentiality and information security

Contractor performs insurance actions in compliance with applicable VA privacy, confidentiality, and information-security requirements

No substantiated privacy or security violations

Revenue Operations Privacy Officer or designated Government review

Incident-driven

Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including Section B, or another applicable contract term.

Monthly Itemized Statement

On time, complete, and accurate report submitted by the due date

100 percent on time, complete, and accurate by the fifth day of each month, unless Task Order states otherwise

COR review Monthly Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including Section B, or another applicable contract term.

Monthly Staffing Report

On time, complete, and accurate report submitted by the due date

100 percent on time, complete, and accurate by the fifth day of each month, unless Task Order states otherwise

COR review Monthly Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including

[AQL]

Surveillance Method

Surveillance Frequency

Remedy / Government Response

Weekly Pending Workload Report

On time, complete, and accurate report submitted by the due date

100 percent on time, complete, and accurate by Monday of each week, unless Task Order states otherwise

COR review Weekly Document the deficiency;

require correction or corrective action as appropriate; increase surveillance or refer the matter to the CO. The Government may take any payment, deduction, credit, nonpayment, or other contractual action only when expressly authorized by the parent IDIQ contract, including

Methodologies to Monitor Performance

Random Sampling Random sampling may be used for accuracy reviews of sampled accepted completed actions where workload volume makes 100 percent inspection impractical. Sample size, frequency, and review methodology may be adjusted by the COR based on workload, error trends, Task Order risk, or recurring deficiencies, provided the approach remains consistent with the parent IDIQ contract, PWS, PRSM, and this QASP and is documented in the surveillance record. Any Task Order-specific sampling plan shall be consistent with those documents and shall not change a contractual performance standard or AQL.

Sampling plans, including minimum sample sizes, frequency, and confidence considerations, may be identified in an applicable Task Order or QASP appendix, provided they remain consistent with the parent IDIQ contract, PWS, PRSM, and this QASP and do not change a contractual performance standard or AQL.

Periodic Inspection Periodic inspection will be used to assess timeliness, report quality, communication effectiveness, and adherence to procedural requirements. Periodic inspection may include review of selected case files, workload queues, meeting participation, correction cycles, and documentation of non-chargeable exceptions versus Contractor-caused rejected actions, as defined in the PWS and pricing schedule.

100 Percent Review The Government will use 100 percent review for required recurring reports, documented Contractor-caused rejected actions, and substantiated privacy or security incidents. This method is appropriate because these performance areas are limited in number, high in significance, and supported by objective documentation.

Validated Complaints and Feedback Customer complaints and user concerns may be used as surveillance input when they are documented, specific, and validated by the COR or designated Government monitor. Complaints caused by Government-controlled factors will not be counted as Contractor performance failures unless the Contractor contributed materially to the issue.

Trend Analysis The COR will review monthly and quarterly trend data to identify recurring performance shortfalls, staffing instability, workload backlogs, or access-related risks. Trend analysis will be used to determine whether increased surveillance, a CAP, or referral to the CO is warranted.

Rating Periods and Performance Attribution The Government will distinguish among accepted completed actions, Contractor-caused rejected actions, and non-chargeable exceptions in accordance with PWS Section 4.1.3, Section 4.2, and Section

8.1 and Section B.

An accepted completed action is eligible for payment only when it was assigned and available for Contractor processing; completed in accordance with CPAC guidebooks, VA policy, the PWS, and Task Order instructions; validated by the Government as accurate and properly documented; and accepted in accordance with the CO’s delegation of authority and the contract’s invoice and acceptance procedures.

Contractor-caused rejected actions are not billable and shall be corrected at no additional cost. Non-chargeable exceptions are not accepted completed actions and are not billable.

The Government will not hold the Contractor responsible for delays or inaccuracies caused by documented Government-controlled conditions, including incomplete source data, unavailable required system access, background-investigation or credentialing delays, and VistA or provider-portal outages, when the Contractor documents and reports the condition under the contract and applicable Task Order.

Performance Documentation The COR will maintain surveillance records sufficient to support acceptance, payment recommendation, corrective action, and performance assessment documentation. Documentation may include monitoring checklists, report review notes, meeting minutes, complaint validations, trend analyses, sampling worksheets, copies of CAPs, and written correspondence regarding deficiencies or corrective actions.

The Contractor's reports will be reviewed against the contract requirements and internal consistency of data, and any discrepancies may be elevated for explanation, correction, or further inspection. When a deliverable is rejected, the COR will document the basis for rejection and track the Contractor's correction within the required correction window, generally 5 workdays unless otherwise directed by the contract or Task Order.

Corrective Action and Escalation When surveillance identifies deficient performance, the COR will notify the Contractor in writing, identify the performance standard affected, describe the observed deficiency, and request a response or CAP as appropriate. CAPs should identify root cause, corrective steps, responsible personnel, and expected completion dates.

Performance deficiencies may result in one or more of the following actions, depending on severity, frequency, and contract terms:

▪ Increased surveillance.

▪ Formal CAP requirement.

▪ Rejection of deliverables and required rework.

▪ Recommendation for payment adjustment, deduction, credit, or nonpayment only where expressly authorized by the parent IDIQ contract, including Section B, or another applicable contract term.

▪ Referral to the CO for further contractual action, including cure notice, personnel removal request, or other remedy.

Serious privacy or security violations, repeated failure to meet critical standards, or sustained performance deterioration may be elevated immediately to the CO without waiting for the end of a rating period.

Meetings and Reviews The Government will normally conduct monthly performance reviews with the Contractor to discuss trends, reports, concerns, corrective actions, and projected workload issues. Additional meetings may be required for transition, ramp-up, access issues, privacy or security concerns, persistent deficiencies, or surge workload events.

The agenda for performance reviews may include:

▪ Monthly performance data and trend analysis.

▪ Accuracy and timeliness results.

▪ Status of Contractor-caused rejected actions and non-chargeable exceptions.

▪ Staffing changes, training status, and access readiness.

▪ Open CAPs and resolution status.

▪ Upcoming workload changes, Task Order adjustments, and risk items.

Incentives and Remedies This requirement is structured primarily around acceptable performance and contract remedies for failure to meet standards rather than award-fee or incentive-fee mechanisms. The Government will apply the payment treatment established in Section B and the applicable Task Order consistently with this QASP and the PWS.

Meeting the AQL does not waive the Contractor's obligation to correct deficiencies, maintain compliance with privacy and security requirements, or perform all contract requirements. Conversely, performance shortfalls attributable to Government-controlled conditions will be documented and excluded from adverse treatment when contractually appropriate.