Solicitation N6264520R0053_COVID-19 Analytics.docx

N6264520R0053

Section SF 1449 - CONTINUATION SHEET

COMBINED SYNOPSIS/SOLICITATION

This is a requirement for commercial items and the solicitation/synopsis will be prepared in accordance with FAR 12.6, Streamlined Procedures for Evaluation and Solicitation of Commercial Items and FAR 13, Simplified Acquisition Procedures. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued. It is the contractor’s responsibility to be familiar with the applicable FAR and DFARS clauses and provisions. The FAR and DFARS clauses may be accessed in full text at https://www.acquisition.gov/

The NAICS code is 541715, with a business size standard of 1,000 people.

***NOTE: PROPOSALS ARE NOT BEING REQUESTED AS A RESULT OF THIS SOLICITATION***

Please return quote no later than 10:00AM EST, 13 May 2020.

ADMINISTRATIVE INFORMATION

Please provide details to the following:

Complete company name and address Company Point of Contact Email Address Phone number Tax Identification Number (TIN) CAGE Code DUNS number

In accordance with FAR 19.702(b)(1), a Subcontracting Plan is not required.

COVID-19 Analytics & Strategic Planning

FFP

Ad Hoc COVID-19 Analytics and Naval Medical Strategic Planning Process Development FOB: Destination

PSC CD: B537

NET AMT

PERFORMANCE WORK STATEMENT

1. Contracting Officer Representative (COR).

a. Primary COR.

Department of Defense Activity Address Code (DODAAC):

TBD

2. Contract or Task Order Title: Ad Hoc COVID-19 Analytics and Naval Medical Strategic Planning Process Development

3. Background:

The Department of Defense is currently engaged in one of the great global challenges of its time. Today’s threat, as a testament to the unpredictable nature of everyone’s future security, is a microscopic particle that no one can see, but whose impact is striking at the world’s economy with the ferocity of a full-scale kinetic war. As strongly as any surprise attack could, the specter of the Coronavirus Disease 2019 (COVID-19) pandemic has changed just about everything surrounding everybody’s daily lives. The agile qualities of the Naval medical community has contributed to the Department of the Navy’s (DoN) ability to respond to the nation’s call. USNS MERCY and USNS COMFORT deployment to two major American cities along with the additional Naval medical forces that were mobilized to perform vital support work amplifies the need for comprehensive, current and complete, data to support rapid decision making.

As the Government does its part to mitigate the effects of this pandemic, Navy Medicine must remain prepared to carry out its core national security missions as adversaries may look to exploit this crisis as much of the world's attention is directed elsewhere. In order to adapt, innovate, and continue to demonstrate why the American people call on Navy Medicine during the most trying times, Navy Medicine must continue its focus on greater agility as it fights through this crisis and learns more about how to prepare for the next one. There is a need to build systemic views data to assess decisions in context of ways no one could imagine the day before. It is Navy Medicine’s job to do that imagining—to be agile enough to step up whenever and wherever it is required to do so. It is for these reasons that the Naval Medical community must immediately establish a Strategic Planning Process that delivers capabilities, services, and training to enable Navy Medicine to be fully ready to conduct operations and address the next challenge head on. Such a Naval Medical Strategic Planning Process would allow the enterprise to focus capability development on the most important shortfalls and prioritize resource allocation on operational readiness informed by risk. This proactive approach to planning and programming effectively delivers ready medical forces to well-defined operational requirements for current and future conflicts with analytic rigor sufficient for planners and programmers to clearly articulate resource-informed requirements.

Senior leaders across all functional areas of Navy Medicine require adequate tools and data to make force development and readiness decisions with sufficient responsiveness to meet force management and Planning, Programming, Budgeting and Execution (PPBE) process timelines. A majority of the analyses currently undertaken are based on disconnected local productivity tools and databases. Quick-turn analytical requirements are met by ad hoc methods that are limited by poor quality or missing information. Navy Medicine seeks a Strategic Planning Process with decision support capability that includes high quality data and effective assessment of capability needs and risks to force, mission and institution.

Comprehensive analytic and data science capabilities that enable decision-makers to optimize resource allocation and readiness recovery actions across Navy Medicine and the Service are needed, especially to:

1) Support the horizontal (across functions) and vertical (within functions) management of enterprise resources;

2) Support the integration of force development and force management actions;

3) Promote institutional readiness through informed resource allocation;

4) Support the ability to quantify strategic decisions in order to inform readiness metrics;

5) Forecast and optimize functions to assess future institutional readiness using predictive analytics; and

6) Increase analytical speed, accuracy, and effectiveness over existing force planning and force management tools.

4. Objective: This initiative seeks to add ad hoc analytic capacity specifically pertaining to COVID-19 response planning and to make forward progress in the establishment of a Naval Medical Strategic Planning Process. Both elements are complimentary and critical to supporting Navy Medicine’s mission of providing well-trained medical experts, operating as high-performance teams to project medical power in support of Naval superiority, especially in light of the current response to COVID-19. Ad hoc data collection and analysis is a critical input for the envisioned concept-informed and capability-based process expected to be implemented on an annual basis as a way to identify naval medical capabilities across doctrine, organization, training, materiel, leadership and education, personnel, facilities, and policy. Such an annual process informed by real-world operations such as COVID-19 response must provide the analytic rigor and decision space for the Surgeon General to recommend input into the Department of Navy and Department of Defense budget submissions.

5. Scope:

Additional analytic capability and capacity is immediately required to support Navy Medicine’s crisis response planning related to COVID-19.

Supporting this analytic capability and capacity surge, Navy Medicine has immediate needs for additional descriptive and diagnostic analytics associated with the COVID-19 pandemic that are historically based, predominantly transactional, and focused on performance evaluation. Navy Medicine must immediate transition these descriptive and diagnostic analytics toward forward looking predictive and prescriptive analytics. This shift will provide Navy Medicine with the ability to make optimal planning and programmatic decisions that generate readiness and answer questions about what is likely to happen, what can be done to make things happen, and how to leverage opportunities or mitigate risks as events unfold.

The scope includes leveraging and expanding capabilities associated with models and simulations using a variety of modeling approaches to include: quantitative, qualitative, architectural, linear, non-linear, deterministic, stochastic, statistical, network, discrete event, agent based, and system dynamics modeling.

Insights gained from real-time crisis response analysis must eventually support future force development. Force development activities plan, design, and implement the translation of strategic priorities into manned, trained, and equipped naval medical organizations able to provide capabilities throughout the Navy, Marine Corps, and Unified Combatant Commands. Force development involves integrating future capability requirements with current operational needs and consists of all activities “from guidance to Program Objective Memorandum (POM)” that integrate materiel and non-materiel elements to produce Navy Medicine capabilities for Force Generation and Force Employment.

With this understanding, the end state for this Firm Fixed Price, severable contract is a draft Concept of Operations with initial implementation guidance for a Naval Medical Strategic Planning Process that achieves the objective stated above and can be implemented to support POM 2024 decisions.

The short-term goal under this contract establishes a process to document existing and planned force capabilities and supports development of future capability requirements and capability gaps, based on projected changes in the following: threat capabilities and intent; service and joint missions; service, naval, and joint concepts; service and joint force structure; and opportunities (technology, partnerships, etc.).

The contractor shall focus on the following primary activities:

a. Data collection to support Ad Hoc COVID-19 Analytics - Interface with Navy Medicine supporting staff and program managers to obtain manpower, personnel, training, readiness, and other COVID-19 related response data in the effort to identify solutions for existing, new, and/or emerging requirements. Further, the contractor will determine shortfalls in Navy Medicines’ abilities for Navy Medicine to provide solutions to operational missions.

b. Data collection to support Naval Medical Strategic Planning Process Development - Identify potential data sources necessary to successfully implement a concept-informed and capabilities-based strategic planning process.

i. Data collection includes documenting tasks, conditions, and standards of required capabilities.

ii. Data collection includes documenting capability and capacity shortfalls.

iii. Data collection must support quantifiable gap risk assessment by documenting gap risk based on likelihood of gap causing an issue/impact and severity of that impact.

iv. Data must support identification of solution strategies for validated capability gaps, to include Doctrine, Organization, Training, Materiel, Leadership and education, Personnel, Facilities, and Policy (DOTMLPF-P), cost, and feasibility assessments of proposed solutions.

c. Data analysis - Provide analytic services across all operational medical readiness capability areas, including readiness reporting; capabilities development and requirements determination; force employment, synchronization, and allocation; force resourcing and budgeting; unit/platform management; training management; risk modeling and analysis; medical manpower and personnel staffing; process improvement; innovations, research, and development; and, evaluation of information systems, tools, and technologies.

i. Support quick-turn and ad hoc analysis. Define analytic objectives and milestones, conduct analysis, author abbreviated technical reports, and review conclusions with sponsors.

ii. Support development of decision support models, tools, dashboards, or other artifacts. Define modeling objectives, conduct exploratory analysis, develop minimum-viable proto-type to meet decision objectives, and review results with sponsors.

d. Process analysis – Document a feasible and supportable framework for a concept-informed and capabilities-based strategic planning process that enables Navy Medicine to assess and affect key decisions on future force development.

i. Identify stakeholders necessary to successfully implement such a process.

ii. Process must support identification of capability requirements, capability gaps and capability redundancies.

iii. Process must be scenario-based and consider insights from wargames, experiments, studies, and analyses.

iv. Process must support recording and validation of new capability requirements and requirement modifications.

v. Process must support Program Objective Memorandum (POM) development.

e. Communication - Interface with Navy Medicine stakeholders to identify and prioritize analytic use cases to focus support on achieving immediate solutions to requirements.

i. Identify key stakeholders within Navy Medicine’s business architecture who should be involved in Navy Medicine force development and programming.

ii. Ensure all requirements are known by conducting interviews and hold forums to illicit and organize key functions, tasks, and deliverables required by stakeholders.

iii. Document results of a concept-informed and capabilities-based strategic planning process for senior leader approval and POM development.

In the performance of duties under this contract, the contractor will:

· Require Government Furnished Equipment, to include Common Access Cards, SIPR tokens, and government laptops.

· Require access to unclassified NIPR and classified SIPR networks; the Contractor shall complete a DD254 (required if personnel need a Secret clearance) prior to the start of services.

· Require access to systems such as Total Force Manpower Management System (TFMMS), the Officer Personnel Information System (OPINS), the Navy Enlisted System (NES), the Individual Augmentee (IA) Portal, Defense Medical Human Resources System internet (DMHRSi), Joint Medical Planning Tool (JMPT), the Fleet Training Management Planning System (FLTMPS), the Individual Medical Readiness (IMR), the Status of Readiness and Training System (SORTS), the Defense Manpower Data Center (DMDC), the Navy Manpower Program and Budget System (NMPBS) and potentially others as deemed necessary.

· May require an existing Data Sharing Agreement

The contractor shall:

· Participate in a government-led Cross-Functional Teams (CFT), Operational Planning Teams (OPT), and government staff.

· Provide briefing support to Naval Medical and Navy leadership;

· Facilitate meetings and working groups that directly support COVID-19 response planning and other crisis response planning as directed by the Government Sponsor.

· Facilitate meetings and working groups that directly support the development and implementation of a Naval Medical Strategic Planning Process.

· Facilitate or deliver demonstrations to key stakeholders.

6. Performance Requirements:

6.1 Task 1– Ad Hoc COVID-19 Crisis Response Analytics – The Contractor must possess excellent analytic, project management, and strategic assessment skills. The Contractor shall provide ad hoc analytic capabilities and capacity to support COVID-19 and other crisis response-related analytics. This ad hoc analytics shall include, but not limited to, the following:

a. Data collection. Interface with Navy Medicine supporting staff and program managers to obtain manpower, personnel, training, readiness, and other COVID-19 related response data in the effort to identify solutions for existing, new, and/or emerging requirements.

b. Data Analysis. Perform and participate in quick-turn and ad-hoc analyses related to COVID-19 and other appropriate crisis response-related activities.

c. Model and Simulation development. Apply a variety of modeling approaches appropriate to solve specific problems. Modeling proficiency includes: quantitative, qualitative, linear, non-linear, inductive reasoning, deterministic, stochastic, statistical, network, discrete event, agent based, and system dynamics modeling.

d. Results reporting. Contractor must possess the ability to interact, provide advice, and coordinate with Navy senior leadership and senior management at the various Navy Medicine and OPNAV staff agencies. Contractor shall have the ability to present delicate positions and analytic results to inform guidance, policies and strategies.

6.2 Task 2– Naval Medical Strategic Planning Process Plan - The Contractor shall complete a written final document that is a draft Naval Medical Strategic Planning Process Plan for government consideration. This planning document shall be provided in both paper and electronic format and shall include, but not limited to, the following:

e. Executive summary. This section shall very briefly discuss the background of the problem, questions addressed by the proposed solution, and a summary of recommendations resulting from the study.

f. Proposed mission. This section shall include the proposed mission statement for such a process.

g. Proposed execution with concept of operations. This section shall include an overview of the envisioned execution of the process, to include the envisioned concept of operations.

h. Proposed governance. This section shall include a discussion of governance considerations necessary to ensure a successful process.

i. Proposed tasks for key participants and stakeholders. This section shall include a discussion of proposed tasks for key participants and stakeholders.

j. Proposed coordinating instructions. This section shall include a discussion of coordinating instructions.

k. Administrative and logistical considerations. This section shall include a discussion of administrative and logistical considerations.

7. Deliverables:

A Kick-Off meeting will be scheduled within seven (7) days from Contract initiation.

This contract will include the following deliverables with anticipated delivery dates:

15 May 20

8. Period of performance

The Contract’s period of performance will be from 15 May 2020 through 30 September 2020.

9. Methods of Quality Assurance Surveillance

9.1. This Quality Assurance Surveillance Plan (QASP) serves as the principal basis for assessing overall performance quality by the Contractor and is delineated in the table below. This document will be used by the Government to assess the effectiveness of the Contractor’s performance, including on a risk rated basis. This QASP provides the methodology by which the Contractor's performance will be monitored to determine compliance with established performance objectives and to establish performance benchmarks that ensure a quantifiable basis for measuring effectiveness. The plan is designed so that surveillance is limited to that which is necessary to verify the Contractor is performing satisfactorily and relates directly to performance objectives of the performance objectives delineated in the PWS.

9.2. QASP Matrix

TASK/

DELIVERABLE

ACCEPTABLE LEVEL OF PERFORMANCE (ALP)

METHOD OF SURVEILLANCE

AND RISK RELATED SCHEDULE

PERFORMANCE RATING

Performance meets all technical and functional requirements in the PWS, and contains pertinent, useful, and informative data and information.

Contractor’s technical performance meets all contract requirements.

Problems that are encountered are minor in nature, and are as follows:

· does not cause a delay in schedule;

· does not cause costs to increase;

· involves minimal effort to fix; and

· does not affect overall contractor performance

All matters shall be resolved in a satisfactory and timely manner.

100% Inspection

Are study reports complete and are they compliant with various Government regulations?

Assignment of performance rating and criteria:

Excellent: Performance meets and exceeds contract requirements. Performance delivered with no required re-performance /rework; problems encountered were minor and resolved in a highly effective manner, having no impact on schedule, costs, and overall contractor performance.

Acceptable: Performance meets most contract requirements. Performance delivered with minimal re-performance/rework; problems encountered were minor and resolved in a satisfactory manner.

Unacceptable: Performance fails to meet many contract requirements. Substantial problems were encountered and were resolved in a less than satisfactory manner causing significant impact to schedule, cost, and/or overall contractor performance. Significant re-performance or rework required.

Performance meets all technical and functional requirements in the PWS, and contains pertinent, useful, and informative data and information.

Contractor’s technical performance meets all contract requirements.

Problems that are encountered are minor in nature, and are as follows:

· does not cause a delay in schedule;

· does not cause costs to increase;

· involves minimal effort to fix; and

· does not affect overall contractor performance

All matters shall be resolved in a satisfactory and timely manner.

100% Inspection

Is the contractor meeting established timeframes?

Assignment of performance rating and criteria:

Excellent: Performance meets all contract timeliness requirements. Problems that are encountered are minor and resolved in a highly effective manner, having no impact on schedule, cost, and overall contractor performance.

Acceptable: Performance meets most timeliness requirements. Performance delivered with minimal re-performance/rework; problems encountered were minor and resolved in a satisfactory manner. Minimal impact on schedule, cost, and overall contractor performance Unacceptable: Performance fails to meet many timeliness requirements. Substantial problems were encountered and were resolved in a less than satisfactory manner causing significant impact to schedule, cost, and/or overall contractor performance.

Performance meets all technical and functional requirements in the PWS, and contains pertinent, useful, and informative data and information.

Contractor’s technical performance meets all contract requirements. Problems that are encountered are minor in nature, and are as follows:

· does not cause a delay in schedule;

· does not cause costs to increase;

· involves minimal effort to fix; and

· does not affect overall contractor performance

All matters shall be resolved in a satisfactory and timely manner.

100% Inspection

Is the contractor committed to high customer satisfaction? How proactive is the contractor? Is the contractor providing positive value to the Government?

Assignment of performance rating and criteria:

Excellent: Performance meets and exceeds contract requirements. Performance delivered with no required re-performance /rework; problems encountered were minor and resolved in a highly effective manner, having no impact on schedule, costs, and overall contractor performance.

Acceptable: Performance meets most contract requirements. Performance delivered with minimal re-performance/rework; problems encountered were minor and resolved in a satisfactory manner. Minimal impact on schedule, cost, and overall contractor performance.

Unacceptable: Performance fails to meet many contract requirements. Substantial problems were encountered and were resolved in a less than satisfactory manner causing significant impact to schedule, cost, and/or overall contractor performance. Significant re-performance or rework required.

Performance meets all technical and functional requirements in the PWS, and contains pertinent, useful, and informative data and information.

Contractor’s technical performance meets all contract requirements. Problems that are encountered are minor in nature, and are as follows:

· does not cause a delay in schedule;

· does not cause costs to increase;

· involves minimal effort to fix; and

· does not affect overall contractor performance

All matters shall be resolved in a satisfactory and timely manner.

Periodic Inspection

What is the Governments overall satisfaction with the contractor?

Assignment of performance rating and criteria:

Excellent: Performance meets and exceeds contract requirements. Performance delivered with no required re-performance /rework; problems encountered were minor and resolved in a highly effective manner, having no impact on schedule, costs, and overall contractor performance.

Acceptable: Performance meets most contract requirements. Performance delivered with minimal re-performance/rework; problems encountered were minor and resolved in a satisfactory manner. Minimal impact on schedule, cost, and overall contractor performance.

Unacceptable: Performance fails to meet many contract requirements. Substantial problems were encountered and were resolved in a less than satisfactory manner causing significant impact to schedule, cost, and/or overall contractor performance. Significant re-performance or rework required.

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

DELIVERY INFORMATION

30-SEP-2020

COR

140 SYLVESTER RD

SAN DIEGO CA 92106-3521

619-553-8552 FOB: Destination N63116

SPECIAL CONTRACT REQUIREMENTS

AUTHORIZED CHANGES ONLY BY THE CONTRACTING OFFICER

(a) Except as specified in paragraph (b) below, no order, statement, or conduct of Government personnel who visit the contractor’s facilities or in any other manner communicates with contractor personnel during the performance of this contract shall constitute a change under the “Changes” clause of this contract.

(b) The contractor shall not comply with any order, direction or request of Government personnel unless it is issued in writing and signed by the Contracting Officer, or is pursuant to specific authority otherwise included as a part of this contract.

(c) The Contracting Officer is the only person authorized to approve changes in any of the requirements of this contract and notwithstanding provisions contained elsewhere in this contract, the said authority remains solely the Contracting Officer’s. In the event the contractor effects any change at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in charges incurred as a result thereof.

ENVIRONMENTAL STANDARDS

Note: This requirement applies to work performed at the contractor’s or subcontractor’s facility.

By accepting funds under this contract, the contractor assures that it will:

Comply with all applicable standards, orders, or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401, et seq.) and Federal Water Pollution Control Act (33 U.S.C. 1251, et.seq.), as implemented by Executive Order 11738 [3 CFR, 1971-1975 comp., p. 799] and Environmental Protection Agency (EPA) rules at 40 CFR Part 15. In accordance with the EPA rules, the contractor further agrees that it will:

Avoid use of any facility with a current compliance status of (1) violation, (2) non-compliance, (3) significant non-compliance, or (4) high priority violation in the EPA’s Enforcement and Compliance History Online (ECHO) website (http://echo.epa.gov/) in performing any contract that is nonexempt under 40 CFR 15.5 (contracts of less than $100,000, and certain other contracts, exempt from the EPA regulations), as long as the facility remains in one of the listed current compliance statuses.

Notify the awarding agency if it intends to use a facility in performing this contract that is in one of the listed EPA current compliance statuses or that the contractor knows has been recommended to be placed in one of the listed current compliance statuses.

Identify to the awarding agency any impact this contract may have on:

The quality of the human environment, and provide help the agency may need to comply with the National Environmental Policy Act (NEPA, at 42 U.S.C. 4321, et seq.) and to prepare Environmental Impact Statements or other required environmental documentation. In such cases, the contractor agrees to take no action that will have an adverse environmental impact (e.g., physical disturbance of a site such as breaking of ground) until the agency provides written notification of compliance with the environmental impact analysis process.

Coastal barriers, and provide help the agency may need to comply with the Coastal Barriers Resource Act (16 U.S.C. 3501, et seq.), concerning preservation of barrier resources.

Any existing or proposed component of the National Wild and Scenic Rivers system, and provide help the agency may need to comply with the Wild and Scenic Rivers Act of 1968 (16 U.S.C. 1271, et seq.).

NAVY ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION (ECMRA)

This requirement consists of non-personal services.

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the NHRC Research Support Services via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

CONTRACTOR SUPPORT NOTICE: NAVY USE OF SUPPORT CONTRACTOR FOR CONTRACT CLOSEOUT FUNCTIONS

Naval Medical Logistics Command uses two private contractors in support of the contract closeout process. Those companies are Contracting Resources Group, Inc. from Baltimore, MD, doing business under the authority of the Small Business Administration’s 8(a) program, and the Ability One Program, doing business under the authority of the Javits-Wagner O’Day Act (41 U.S.C. § 47).

The contract closeout process includes activities such as processing de-obligation modifications, obtaining contractor and requiring activity concurrence, preparing the DD-Form 1594 (Contract Completion Statement), and preparing closed files for archiving. Support contractors may perform additional administrative duties, including filing and processing simple administrative modifications. Performing these functions require the contractor employees to have access to the contract file. Therefore, information provided to the Government or information already in the possession of the Government may be viewed by these support contractors in the course of performing contract close-out functions. The information that may be made available to the contractor may include pricing and technical proposals and performance information.

Naval Medical Logistics Command has signed Non-Disclosure Agreements with each support contractor employee and has required both contractors to provide a Conflict of Interest Mitigation Plan to ensure these employees are firewalled from all business development activity.

By submission of its proposal that was accepted by the Government, the contractor and its subcontractors consent to access of their business sensitive/confidential or proprietary data by the Government’s support contractor personnel in order to perform closeout services.

CONTRACT OMBUDSMAN

The Contract Ombudsman will review complaints from contractors regarding the award of contracts and ensure that all contractors are afforded a fair opportunity to be considered, consistent with the procedures in the contract. The Contract Ombudsman for this contract is the Navy Competition Advocate General. Contractors are encouraged to settle their complaints through the Competition Advocate chain of command, seeking review by the Command Competition Advocate at the Naval Medical Logistics Command before taking their complaints to the Navy Competition Advocate General. The Naval Medical Logistics Command's Competition Advocate can be reached at the following address:

Naval Medical Logistics Command ATTN: Competition Advocate 693 Neiman St.

Fort Detrick, MD 21702-9203

PRIVACY ACT AND HIPAA

Contractor personnel performing work under this requirement may also have access to personnel information.

The contractor shall ensure that all Protected Health Information (PHI) is protected in accordance with the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandated safeguards to ensure confidentiality of health information. All contractor personnel are required to complete HIPAA training within one (1) year prior to the provision of services under this contract. Contractor personnel must complete HIPAA refresher training annually.

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (BAA) incorporates HIPAA/HITECH Act requirements under the HHS Final Omnibus Rule (78 FR 5566, published 25 Jan 2013), effective 23 Sep 2013. This BAA is for use by MHS components outside of DHA.

Business Associate Agreement

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where 12 Nov 2013 Page 2 of 10 persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the contractor.

Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the Government facility(s) and office(s) that are supported under this contract.

DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by the Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of the Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively), as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in the Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in the Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in the Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in the Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall provide the Business Associate with the notice of privacy practices that the Covered Entity produces in accordance with 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

If the DHA Privacy Office determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the DHA Privacy Office, regardless of whether the breach occurs at DHA or at one of the Service components. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office. The following provisions of Part V set forth the Business Associate’s Privacy Act and HIPAA breach response requirements for all breaches, including but not limited to HHS breaches.

This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response, the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals, and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business Associate shall implement these breach response requirements immediately upon the Business Associate’s discovery of a possible breach.

(b) Government Reporting Provisions

The Business Associate shall report the breach within one hour of discovery to the US Computer Emergency Readiness Team (US CERT), and, within 24 hours of discovery, to the DHA Privacy Office and the other parties set forth below. The Business Associate is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer or other agent of the Business Associate.

The Business Associate shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report/. Before submission to US-CERT, the Business Associate shall save a copy of the on-line report. After submission, the Business Associate shall record the US-CERT Reporting Number. Although only limited information about the breach may be available as of the one hour deadline for submission, the Business Associate shall submit the US-CERT report by the deadline. The Business Associate shall e-mail updated information as it is obtained, following the instructions at http://www.us-cert.gov/pgp/email.html. The Business Associate shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office and the applicable Service-Level Privacy Office, if requested by either. Business Associate questions about US-CERT reporting shall be directed to the DHA or Service-Level Privacy Office, not the US-CERT office.

The Business Associate report due within 24 hours shall be submitted by completing the New Breach Reporting Form DD 2959 at the Breach Response page on the DHA Privacy Office web site and emailing that form to, as applicable, the DHA Privacy Office, the Service-Level Privacy Office, the Contracting Officer (CO) and Contracting Officer’s Representative (COR) and the Business Associate’s DoD point of contact (POC) unless the POC specifies another addressee for breach reporting. Encryption is not required, because Breach Report Forms should not contain PII/PHI. The email address for notices to the DHA Privacy Office is provided at the Privacy Office website breach response page. If electronic mail is not available, telephone notification is also acceptable, but all notifications and reports delivered telephonically must be confirmed by email as soon as technically feasible.

If multiple beneficiaries are affected by a single event or related set of events, then a single reportable breach may be deemed to have occurred, depending on the circumstances. The Business Associate shall inform the DHA Privacy Office as soon as possible if it believes that “single event” breach response is appropriate; the DHA Privacy Office will determine how the Business Associate shall proceed and, if appropriate, consolidate separately reported breaches for purposes of Business Associate report updates, beneficiary notification, and mitigation.

When a Breach Report Form initially submitted is incomplete or incorrect due to unavailable information, or when significant developments require an update, the Business Associate shall submit a revised form or forms, stating the updated status and previous report date(s) and showing any revisions or additions in red text. Examples of updated information the Business Associate shall report include, but are not limited to: confirmation on the exact data elements involved, the root cause of the incident, and any mitigation actions to include, sanctions, training, incident containment, follow-up, etc.