A11 - SSA-RFP-10-1001.doc

PAGE

SSA-RFP-10-1001

TABLE OF CONTENTS

PART 1 –

Addenda to Standard Form 1449

SECTION A – SCHEDULE OF ITEMS AND PRICE

SECTION B – DESCRIPTION OF SUPPLIES OR SERVICES

PART II – CONTRACT CLAUSES AND TERMS AND CONDITIONS

SECTION C- ADDENDEUM TO FAR CLAUSE 52.212-4, CONTRACT TERMS AND CONDITIONS – COMMERCIAL ITEMS C-1

SUPPLEMENT TO PARAGRAPHS IN 52.212-4

C-2

ADDITIONAL FAR CLAUSES INCORPORATED BY REFERENCE

C-3

FAR CLAUSES INCORPORATED BY FULL TEXT

C-4

ADDITIONAL AGENCY SPECIFIC TERMS AND CONDITIONS

SECTION D – CONTRACT TERMS AND CONDITIONS REQUIRED

TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS

D-1

FAR 52-212-5 CONTRACT TERMS AND CONDITIONS REQUIRES TO

IMPLEMENT STATUTES OR EXECUTIVE

ORDERS – COMMERCIAL ITEMS (MAY 2009)

PART III – CONTRACT DOCUMENTS, EXHIBITS, ATTACHMENTS

SECTION E – CONTRACT DOCUMENTS, EXHIBITS AND ATTACHMENTS

ATTACHMENTS

· Attachment 1 – Electronic Health Records Content Checklist Document……40

· Attachment 2 – Small Business Subcontracting Plan Outline…………...……40 Part IV -- SOLICITATION PROVISIONS SECTION F – ADDENDUM TO FAR PROVISION 52.212-1, INSTRUCTIONS TO OFFERORS --COMMERCIAL ITEMS (JUN 2008) F-1 Revisions to Paragraphs in 52.212-1 F-2 Additional FAR Provisions Incorporated by Full Text F-3 Additional Agency Specific Provisions

SECTION G – ADDENDUM TO FAR PROVISION 52.212-2, EVALUATION -- COMMERCIAL ITEMS (JAN 1999)

G-1 52.212-2 Evaluation – Commercial Items (Jan 1999) G-2 Additional Agency-Specific Provisions G-3 Best Value Award Selections

SECTION H—FAR PROVISION 52.212-3, OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL ITEMS (JUN 2009) ………………………49

PART I - ADDENDUM TO STANDARD FORM 1449

In accordance with Federal Acquisition Regulation (FAR) 12.302 and 12.303, this Part I contains addenda to the Standard Form 1449. The addenda provide for the continuation of the schedule and description of the supplies and services to be acquired.

SECTION A – SCHEDULE OF ITEMS AND PRICE

The Contractor shall provide the services described in the description of services included at Section B, and in accordance with all the terms and conditions of this contract for a period of one year at the prices listed in section A-1.

Section A-1 -- Price of Services

The firm-fixed price for services includes all personnel, labor, facilities, materials, supplies, equipment (unless otherwise furnished by the Government) necessary to perform the services required by the contract. The price is subject to change only as agreed to by the parties based on changes in the requirement that may impact the price.

Contract Performance shall begin when notice to proceed is issued by the Contracting Officer.

Total Price of Contract: $______________ Item No.

Milestone

Percentage of Total Price:

Submittal and approval of Sample Continuity of 15%

Care Document (Refer to Section 4.2.1 of the

Statement of Work); and verified certification of

Electronic Health Record application Submittal and approval of Verification Continuity 25%

Of Care Documents (Refer to Section 4.2.2 of the

Statement of Work) 0003 Production submittal of up to 5% of expected

60% annual volume, complying with specifications outlined in the Statement of Work. (Refer to

Section 4.2.3 of the Statement of Work) Each milestone (Lines 0001, 0002, and 0003) must be successfully completed for payment (see section C-1). SSA will allow 45 days for the correction of any issues/problems during each milestone. If progress for payment is not achieved within the specified timeframe, SSA reserves the right to terminate the contract for the convenience of the government in accordance with Federal Acquisition Regulations (FAR) clause 52.212-4(l) Termination for the Government’s convenience.

SECTION B – DESCRIPTION OF SUPPLIES OR SERVICES

Section B-1 --STATEMENT OF WORK

The Contractor shall provide all necessary personnel and services needed to perform the work set forth in the following sections.

1. Overview

1.1. The Social Security Administration (SSA) disability program will process almost three million disability applications this year alone. This includes cases processed at the initial, reconsideration, hearings, and appeals levels. To process these applications, SSA makes more than 15 million patient-authorized requests for medical information from health care providers at all levels of the disability adjudication process. On average, it takes SSA over two months to process an initial disability application. That time frame increases dramatically at the hearings and appeals levels. Much of this time is spent waiting for medical records. Conventionally, it takes weeks and months to gather the required information. Similar timeframes are experienced at the hearings and appeals levels. Leveraging health information technology (HIT) to automate both the authorized request and receipt of data may reduce this time to minutes and seconds.

1.2. SSA’s objective is to improve the speed and quality of the disability determination process through a more efficient and effective medical information gathering process. To meet this objective, SSA intends to expand the number of healthcare providers participating with SSA in the Nationwide Health Information Network (NHIN). This will give medical providers the capability to receive a standardized electronic request for medical records along with a patient’s authorization. Medical providers will then be able to automatically respond to SSA requests with structured medical information through a Continuity of Care Document (CCD).

1.3. With these fixed price contracts, SSA intends to partner with medical providers to request and receive medical information in a standards based data format through the NHIN. SSA realizes that HIT will revolutionize the health care industry and needs to be fully engaged in its development. SSA intends to institutionalize HIT within our organizational structures to ensure its long term viability

1.4. This project will be accomplished in phases. Medical providers need a certified Electronic Health Record (EHR) application and must be able to demonstrate the technical ability to create a Sample CCD with de-identified electronic health record information. To ensure the medical information is sufficient to support SSA’s disability program, SSA will perform a verification of the electronic health information contained in the Verification CCDs that are based on actual patient clinical content. After validating the content and interoperability, SSA will enter into production with the medical providers and begin requesting and receiving medical information on active disability applications.

1.5. Period of Performance. After award is made, SSA will issue a notice to proceed that will include a firm start date and a firm completion date. The Contractor shall not begin work until receipt of the notice to proceed. The contract will be in effect for a period of one (1) year from start date on the notice to proceed.

1.6. Payment for the medical evidence (comparable to reimbursement for conventional release of information services) provided in the Production environment is outside the scope of this contract. Payment for medical evidence will be provided under a separate arrangement.

1.7. This effort will be funded through the American Reinvestment and Recovery Act (ARRA) which mandates the Contractor adhere to additional reporting requirements identified in Section D-1 (b)(4) of the Request For Proposal (RFP).

2. Definitions and References.

2.1. Definitions.

2.1.1. CCD (Continuity of Care Document): The proposed consensus standard for a patient health summary that harmonizes use of the ASTM Continuity of Care Record (CCR) and HL7 Care Record Summary (CRS). It is designed to operate within the HL7 Clinical Document Architecture. It permits creation of flexible documents that contain the most relevant and timely core health information about a patient, and to send these electronically from one care giver to another. It contains various sections such as patient demographics, insurance information, diagnosis and problem list, medications, allergies and care plan.

2.1.1.1. Sample CCD: For the purposes of this contract, a Sample CCD is based on de-identified electronic health record content generated from the participating healthcare providers/facilities' EHR system.

2.1.1.2. Verification CCD: For the purposes of this contract, a Verification CCD is a CCD that is produced during the verification phase of the project. It is based on real patient clinical content generated from the participating healthcare providers/facilities' EHR on patients for whom SSA provides a valid, current patient authorization to release medical information.

2.1.1.3. Production CCD: For the purposes of this contract, a Production CCD is a CCD that is produced during the production phase of the project. It is based on real patient clinical content generated from the participating healthcare providers/facilities' EHR on patients for whom SSA provides a valid, current patient authorization to release medical information.

2.1.2. CCHIT (Certification Commission for Healthcare Information Technology): CCHIT is a voluntary, private-sector organization launched in 2004 to certify specific proprietary health information technology (HIT) products such as electronic health records and the networks over which they interoperate.

2.1.3. CDA (Clinical Document Architecture): A CDA is a HL7 document markup standard that specifies the structure and semantics of clinical documents for the purpose of exchange.

2.1.4. EHR (Electronic Health Record): An EHR is a provider maintained electronic health or medical record is a computer-based patient medical record that can be used to collect and look up patient data by physicians or health professionals at various locations such as doctors' offices or hospitals. For purposes of this contract it is interchangeable with Electronic Medical Record (EMR). The record includes information such as patient problems, medications, allergies, laboratory results, etc.

2.1.5. HIE (Health Information Exchanges): HIEs are organizations or collaborations that support the exchange of personal-level health information relevant to their patient's health care.

2.1.6. HITSP (Healthcare Information Technology Standards Panel): HITSP is a cooperative partnership between the public and private sectors for the purpose of achieving a widely accepted and useful set of standards specifically to enable and support widespread interoperability among healthcare software applications, as they will interact in a local, regional and national health information network for the United States.

2.1.7. HL7 (Health Level 7): HL7 is an ANSI accredited standards organization focusing on healthcare specific data exchange between computer applications. HL7 messages are used for interchange between hospital and physician record systems and between EHR systems and practice management systems; HL7 Clinical Document Architecture (CDA) documents are used to communicate documents such as physician notes and other material. HL7 is one of several ANSI accredited Standards Developing Organizations (SDOs) operating in the healthcare arena.

2.1.8. ICD (International Classification of Diseases): Published and maintained by the World Health Organization (WHO), the ICD is a coding system used world-wide for morbidity and mortality statistics, reimbursement systems and automated decision support in medicine.

2.1.9. IHE (Integrating the Healthcare Enterprise): IHE is an initiative by healthcare professionals and industry to improve the way computer systems in healthcare share information. IHE promotes the coordinated use of established standards such as HL7 to address specific clinical need in support of optimal patient care.

2.1.10. Interoperability: Compatibility. The ability of software and hardware on multiple pieces of equipment (made by different companies or manufacturers) to communicate and work together. The key requirement for a national health information network.

2.1.11. LOINC® (Logical Observation Identifiers Names and Codes): LOINC® is a clinical database protocol aimed at standardizing laboratory and clinical codes for use in clinical care, outcomes, management, and research.

2.1.12. NIST (National Institute of Standards and Technology): Founded in 1901, NIST is a non-regulatory federal agency within the U.S. Department of Commerce. NIST's mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

2.1.13. OID (Object Identifier): OID is a globally unique string representing an identifier in a form that consists only of numbers and dots (e.g., "2.16.840.1.113883.3.1").

2.1.14. ONC (Office of the National Coordinator for Health IT): ONC is a government agency (part of the Department of Health and Human Services) that oversees and encourages the development of a national, interoperable (compatible) health information technology system to improve the quality and efficiency of health care.

2.1.15. RHIO (Regional Health Information Organization): RHIOs are electronic networks intended to help multiple healthcare organizations such as hospitals, labs, radiology centers, etc., in a given area exchange health and patient data.

2.1.16. SSL (Secure Sockets Layer): SSL is a commercially available encryption process that scrambles a message so that only the intended audience has access to the information.

2.1.17. XML (Extensible Markup Language): XML is a general-purpose markup language for creating special-purpose markup languages, capable of describing many different kinds of data. Its primary purpose is to facilitate the sharing of data across different systems, particularly systems connected via the Internet.

2.2. References

A page has been established on the SSA Health IT web site (www.socialsecurity.gov/hit) with additional documentation, information and links to relevant materials that support this Statement of Work (SOW). Look for the block link entitled: “Information on our contracts to provide medical records using HIT”. The pertinent documents referenced throughout the SOW will be found at this site.

3. Minimum Requirements

3.1. The Contractor’s proposal must include providers/facilities that have an EHR application installed and in use.

3.2. The installed EHR application must be certified by the CCHIT (see SSA Web site listed in Section 2.2. for a link to the CCHIT Web Site) or other Department of Health and Human Services recognized certification bodies. This certification must include evaluating the EHR for suitability, quality, interoperability, data portability and security. Certification must be completed as part of the requirement for the payment identified as price item 0001 in Section A-1 of the RFP. SSA reserves the right to verify certification prior to making payment.

4. Contractor Tasks

The Contractor shall perform the following tasks:

4.1. Task Area 1: General Tasks

4.1.1. The Contractor shall provide a HL7 registered Object Identifier (OID) prior to SSA’s interoperability testing. The Contractor may provide a separate HL7 registered OID for each lifecycle environment (Development, Validation, Integration, and Production). The Contractor shall send the OID to SSA using an electronic means that is mutually agreeable between SSA and Contractor.

4.1.2. The Contractor’s system must conform to the most current industry standards, when issued the notice to proceed. This includes but is not limited to: HL7, IHE, CDA, CCD, and HITSP.

4.1.3. The Contractor shall develop a system to generate the CCD to conform to the NHIN content specifications as outlined in SSA’s Implementation Guide. (See SSA Web site listed in Section 2.2. for a link to SSA’s Implementation Guide document.)

4.1.4. The Contractor’s system shall process all NHIN standard transactions for electronic request for medical information, including the patient’s authorization to release information, within five (5) hours of receiving the electronic request.

4.1.5. The Contractor shall provide a detailed project plan showing the tasks and time frames necessary to meet the requirements of the SOW. It should include but not be limited to the SSA Tasks (See Section 5 for SSA tasks and timeframes) and include all providers/facilities participating in the proposal. An electronic and hard copy of the project plan will be due to SSA one (1) business day prior to the contract kick-off meeting.

4.1.6. The Contractor shall adhere to all appropriate privacy policies and the governance model for the NHIN as published by ONC. (See SSA Web site listed in Section 2.2. for a link to the ONC Governance Policies.)

4.2. Task Area 2: CCD Content Tasks

4.2.1. The Contractor shall produce a Sample CCD based on available EHR content generated from their participating healthcare providers/facilities. The Sample CCD must adhere to the technical specifications identified in SSA’s Implementation Guide. (See SSA Web site listed in Section 2.2. for a link to SSA’s Implementation Guide document for further details.) Additional content may be agreed to by both parties.

Contractor must validate the sample CCD utilizing the NIST CCD testing tool. (See SSA Web site listed in Section 2.2. for a link to the NIST Testing Suite.)

After successfully processing the Sample CCD through the NIST tool and correcting all errors, the Contractor will then submit the Sample CCD to SSA. SSA will review the Sample CCD to ensure all SSA Implementation Guide specifications are met. In the event there are issues and/or problems with the Sample CCD, it is expected that the Contractor will resolve all issues and resubmit the Sample CCD within an agreed upon timeframe. Upon receipt, SSA will reevaluate the Sample CCD. This cycle will be repeated until the Sample CCD identically reflects, at a minimum, the elements identified as available in the Contractor submitted Electronic Health Records Checklist document and is accepted by SSA.

Upon acceptance of the Sample CCD and verification of valid EHR certification, SSA will notify the Contractor. At this point, the Contractor may submit an invoice for the payment identified as price item 0001 in Section A-1 of the RFP.

4.2.2. The Contractor shall provide a set of Verification CCDs, created for up to 50 individuals that have been identified by SSA, for verification using a secure electronic means that is mutually agreeable between SSA and Contractor. The Verification CCDs must be developed in compliance with the guidelines provided in SSA’s Implementation Guide. (See SSA Web site listed in Section 2.2 for a link to Implementation Guide document.)

SSA will review each Verification CCD to ensure that their content identically reflects, at a minimum, the elements identified as available data (Structured and/or Unstructured) in the Contractor submitted Electronic Health Records Checklist document. SSA will perform the verification process and provide feedback to the Contractor within five (5) business days using a secure electronic means that is mutually agreeable between SSA and Contractor. In the event that there are issues and/or problems with the Verification CCDs, it is expected that the Contractor will resolve all issues and resubmit the same set of Verification CCDs within an agreed upon timeframe. Upon receipt, SSA will reevaluate the Verification CCD set. This cycle will be repeated until the Verification CCDs identically reflects, at a minimum, the elements identified as available in the Contractor submitted Electronic Health Records Checklist document and are accepted by SSA.

Upon acceptance of the Verification CCDs, SSA will notify the Contractor. At this point, the Contractor may submit an invoice for the payment identified as price item 0002 in Section A-1 of the RFP.

4.2.3. Once in Production, the Contractor must exchange a minimum number of Production CCDs up to 5% of their expected annual volume (reflected in the Contractor’s response provided in Section 3 of the Electronic Health Records Checklist document) in response to SSA requests for medical information. For example, if the Contractor estimates their transaction volume is 1,000 over the past 12 months, the Contractor will complete this task when up to 50 Production CCDs are provided. Past experience has shown that this volume may be reached in approximately three (3) weeks. SSA will evaluate these Production CCDs to ensure compliance with specifications outlined in the SOW to ensure continued success.

SSA will notify the Contractor when final production requirements have been met based on expected annual volume. At this point the Contractor may submit an invoice for the payment identified as price item 0003 in Section A-1 of the RFP.

4.3. Task Area 3: NHIN Tasks

4.3.1. The Contractor shall provide a production NHIN gateway environment for their participating healthcare providers/facilities to work in conjunction with the Contractor’s proposed system. Note: An open source gateway called, CONNECT, which was built through a collaboration of multiple federal agencies is available for use. (See SSA Web site listed in Section 2.2 for a link to the CONNECT gateway software).

4.3.2. The technical specifications are subject to change during the course of the RFP process and after contract award. When given the notice to proceed, the Contractor’s NHIN gateway must conform to the most current technical specifications for the NHIN as approved by the ONC. (See SSA Web site listed in Section 2.2. for a link to the NHIN Specifications and Use Cases).

4.3.3. The Contractor shall develop a system to support the following NHIN transactions (see SSA Web site listed in Section 2.2. for a link to the NHIN Specifications and Use Cases) as a responder to SSA requests:

4.3.3.1. Messaging Platform

4.3.3.2. Authorization Framework

4.3.3.3. Subject Discovery

4.3.3.4. Query for Documents

4.3.3.5. Retrieve Documents

4.3.3.6. Health Information Event Messaging

4.3.4. The Contractor shall test the NHIN transactions listed above from Contractor’s Gateway with NIST interoperability testing tool and resolve any issues prior to conducting interoperability testing with SSA. (See SSA Web site listed in Section 2.2. for a link to the NIST Testing Suite.)

4.3.5. The Contractor shall test the NHIN transactions from their Gateway with the ONC interoperability testing tool, if it is available. (See SSA Web site listed in Section 2.2. for a link to the ONC Testing Tool, if available.) If the ONC interoperability testing tool is not available, the NHIN transactions from the Contractor’s Gateway will be tested using a test system established by SSA.

4.3.6. The Contractor shall obtain a Digital Certificate for each supported NHIN Gateway(s) to implement two-way Secure Sockets Layer (SSL) communications between their Gateway(s) and SSA Gateway. The Digital Certificate(s) must be compliant with NHIN standards for security, if the Digital Certificate standards for security are established by ONC at the time of implementation. (See SSA Web site listed in Section 2.2. for a link to the ONC Digital Certificate standards, if available). If Digital Certificate standards for security have not been established at time of implementation, Digital Certificates must meet requirements as defined by SSA.

4.3.7. The Contractor shall integrate participating providers/facilities to the NHIN as per the published specification by ONC for the Authorized Release of Information to a Trusted Entity. (See SSA Web site listed in Section 2.2. for a link to the NHIN Specifications and Use Cases).

4.3.8. The Contractor shall provide the URL address for each supported environment of their NHIN gateway. At a minimum, the Contractor must support and maintain a Validation and a Production environment for the period of performance of the contract.

4.3.9. The Contractor shall support NHIN interoperability testing for all SSA lifecycle environments (Development, Validation, Integration, and User Acceptance Testing).

4.3.10. The Contractor shall support testing for any individual provider/facility or combination of providers/facilities listed in the proposals as designated by SSA.

5. SSA Tasks This table identifies specific tasks and the estimated number of days needed by SSA to complete each task. These timeframes must be incorporated into your overall Project Plan milestones, so appropriate time is allocated for the satisfactory completion of these tasks.

Dependency on completion and approval of the Verification CCD.

6. Contractor Deliverables This table lists specific Contractor deliverables for the satisfactory performance of all tasks identified in the SOW.

7.

Post Award Meeting

Within 15 business days after receipt of notice to proceed, the Contractor and appropriate staff shall attend a post award meeting to discuss and ensure mutual understanding relative to the administration of the contract. The post award meeting can be conducted via conference call or at SSA Headquarters in Baltimore, Maryland. The Contractor will not be separately reimbursed for any travel expenses related to attending this meeting. It is not anticipated that meetings other than the post award meeting will be held. However, meetings may be scheduled as needed. The Contractor will not be separately reimbursed for attendance at such meetings.

8. Project Management The Contractor shall provide a Project Manager (PM) to conduct overall management coordination and be the central point of contact for overall performance of work under the contract. The Contractor shall also designate an alternate PM to act during the PM’s absence. The PM or designated alternate shall ensure that required supervision of Contractor personnel is provided whenever work is being performed.

SSA anticipates that the PM will serve as the Contractor’s principal point of contact with the Contracting Office (CO) and the Contracting Officer’s Technical Representative (COTR) or his/her authorized representative, regarding all contract management matters, providing overall supervision and direction of all Contractor activities and personnel, ensuring the successful and timely performance of all contract tasks.

9. Reporting Requirements

During the course of the contract, the Contractor Project Manger shall provide the reports identified below in electronic format to SSA. All reports must be in Microsoft Office formats.

1. Monthly Status Report

The monthly status report must arrive no later than ten (10) business days after the end of the month. The monthly status report should include at a minimum a summary review of the project schedule and include the following:

· summary of past month's accomplishments

· progress on current activities

· open issues

2. Weekly Project Reports The weekly project reports must arrive no later than one (1) business day prior to the weekly status call and at a minimum include:

· detailed status on all open issues (e.g., being researched, fixed or tested)

3. Weekly Status Calls

· review the status of each open item

· analysis of impact on overall progress of the project

PART II -

CONTRACT CLAUSES AND TERMS AND CONDITIONS

SECTION C - ADDENDUM TO FAR CLAUSE 52.212-4, CONTRACT TERMS AND CONDITIONS-COMMERCIAL ITEMS (MAR 2009) In accordance with FAR 12.301 (a)(3) and 12.302, the provision at 52.212-4 is hereby incorporated by reference via Block 27 of the Standard Form 1449 and tailored by this addendum as follows:

Section C-1 -- Supplement to Paragraphs in 52.212-4

In accordance with FAR 12.301(a)(3), FAR clause 52.212-4(g) Invoice is supplemented as follows:

INVOICE SUBMISSION AND PAYMENT RELATED INFORMATION

You may submit your invoice, electronically via email, by regular mail, or by hand carrying it to the Office of Finance at the addresses below. Your invoice must include all of the elements of a proper invoice as defined in the invoice or payment clause used in this award as well as any other information required below or in the contract.

Payment will be made to the awarded Contractors in three (3) parts. The first payment will be made after SSA approval of the Sample CCD submitted by the contractor, and verification that the contractor's EHR application is properly certified. The second payment will be made after SSA approval of Verification CCDs. The third payment will be made after SSA approval of up to 5% of expected annual volume Production CCDs that comply with the specifications outlined in the SOW. (Refer to Section 4.2 of the Statement of Work.) Evidence of the relevant SSA approval must be submitted with each invoice.

SENDING THE INVOICE ELECTRONICALLY:

Submit your invoice either as an attachment to an email message, or within the message itself, to: OFPO.OF.DAP.INVOICES@ssa.gov.

FOR INVOICES NOT SUBMITTED ELECTRONICALLY:

Submit an original and three (3) copies of the invoice to:

If sent by mail:

Social Security Administration

Office of Finance

Post Office Box 47

Baltimore, Maryland 21235-0047

If Hand Carried:

Social Security Administration

Office of Finance

Customer Service Help Desk

2-B-4 East Low Rise Building

6401 Security Boulevard

Baltimore, Maryland 21235-0047

The telephone number of the customer service help desk is (410) 965-0607.

• Taxpayer Identification Number (TIN) and Dun and Bradstreet Number (DUNS):

In order to assist the government in making timely payments, please include your TIN, your DUNS number, and the Order Number on each invoice.

• Submission of Electronic Funds Transfer (EFT) Information and Remittance Information:

The Government shall make payment to the Contractor using the EFT information contained in the Central Contractor Registration (CCR) database. In the event that the EFT information changes, the Contractor shall be responsible for providing the updated information to the CCR database.

Remittance information associated with EFT payments is now available via the Payment Advice Internet Delivery (PAID) System on the Department of Treasury's Internet site at http://fms.treas.gov/paid/index.asp. This site provides an explanation of the system, how it works, security and access information, a user demonstration, and registration information. There is no charge to use the PAID system.

You may also direct payment inquiries to SSA's Office of Finance by using its Financial Interactive Voice Response System (FIVR). FIVR is an automated self-service telephone system available 24 hours a day that allows direct electronic access to administrative payment information using the telephone keypad. You can access FIVR by calling (410) 965-0607. The services available through FIVR will be available through a Telecommunications Device for the Deaf (TDD) Line at 410-597-1395. Customer Service Representatives will be available to answer Contractor payment inquiries Monday - Friday, between 8 a.m. and 4:30 p.m. Eastern Time.

You may also address any payment inquiries to SSA’s Office of Finance by sending an email to payment.inquiries@ssa.gov , or visiting its internet site at http://www.ssa.gov/vendor/contact.htm . You can also access the PAID system through a link on this site.

Section C-2 -- Additional FAR Clauses Incorporated By Reference

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: http://www.arnet.gov/far/.

52.203-3 Gratuities (Apr 1984) 52.219-16 Liquidated Damages—Subcontracting Plan (Jan 1999) 52.233-1 Disputes (July 2002)

Section C-3 -- FAR Clauses Incorporated By Full Text

C-3.1

52.217-8 – Option to Extend Services (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor at any time during the contract performance period.

Section C-4 – Additional Agency Specific Terms and Conditions

The following agency-specific terms and conditions are hereby incorporated in full text as follows.

C-4.1

Protection of Confidential Information (DEC 2008)

(a) Confidential information, as used in this clause, means information or data, or copies or extracts of information or data, that is: (1) provided by the SSA to the Contractor for, or otherwise obtained by the Contractor in, the performance of this contract; and (2) of a personal nature about an individual, such as name, home address, and social security number, or proprietary information or data submitted by or pertaining to an institution or organization, such as employee pay scales and indirect cost rates.

(b) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information or categories of information that the Government will furnish to the Contractor or that the Contractor is expected to generate which are confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. The confidential information will be used only for purposes delineated in the contract; any other use of the confidential information will require the Contracting Officer’s express written authorization. The Contracting Officer and the Contractor will settle any disagreements regarding the identification pursuant to the "Disputes" clause.

(c) The Contractor shall restrict access to all confidential information to the minimum number of employees and officials who need it to perform the contract. Employees and officials who need access to confidential information for performance of the contract will be determined in conference between SSA's Contracting Officer, Contracting Officer’s Technical Representative, and the responsible Contractor official. Upon request, the Contractor will provide SSA with a list of “authorized personnel,” that is, all persons who have or will have access to confidential information covered by this clause.

(d) The Contractor shall process all confidential information under the immediate supervision and control of authorized personnel in a manner that will: protect the confidentiality of the records; prevent the unauthorized use of confidential information; and prevent access to the records by unauthorized persons.

(e) The Contractor shall inform all authorized personnel with access to confidential information of the confidential nature of the information and the administrative, technical and physical safeguards required to protect the information from improper disclosure. All confidential information shall, at all times, be stored in an area that is physically safe from unauthorized access. See paragraph (f) below regarding the minimum standards which the safeguards must meet.

(f) Whenever the Contractor is storing, viewing, transmitting, or otherwise handling confidential information, the Contractor shall comply with the applicable standards for security controls that are established in the Federal Information Security and Management Act (FISMA). (These standards include those set by the National Institute of Standards and Technology (NIST) via the Federal Information Processing Standards (FIPS) publications and NIST Special Publications, particularly FIPS 199, FIPS 200, and NIST Special Publications - 800 series.) The applicable standards for security controls related to health care information technology systems are covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The standards for HIPAA are detailed in NIST Special Publication 800-66.

(g) If the Contractor, in the performance of the contract, uses any information subject to the Privacy Act of 1974, 5 U.S.C. 552a, and/or section 1106 of the Social Security Act, 42 U.S.C. 1306, the Contractor must follow the rules and procedures governing proper use and disclosure set forth in the Privacy Act, section 1106 of the Social Security Act, and the Commissioner's regulations at 20 C.F.R. Part 401 with respect to that information.

For knowingly disclosing information in violation of the Privacy Act, the Contractor and Contractor employees may be subject to the criminal penalties as set forth in 5 U.S.C. Section 552(i)(1) to the same extent as employees of SSA. For knowingly disclosing confidential information as described in section 1106 of the Social Security Act (42 U.S.C. 1306), the Contractor and Contractor employees may be subject to the criminal penalties as set forth in that provision.

(h) The Contractor shall assure that each Contractor employee with access to confidential information is made aware of the prescribed rules of conduct, and the criminal penalties for violations of the Privacy Act and/or the Social Security Act.

(i) Whenever the Contractor is uncertain how to handle properly any material under the contract, the Contractor must obtain written instructions from the Contracting Officer addressing this question. If the material in question is subject to the Privacy Act and/or section 1106 of the Social Security Act or is otherwise confidential information subject to the provisions of this clause, the Contractor must obtain a written determination from the Contracting Officer prior to any release, disclosure, dissemination, or publication. Contracting Officer instructions and determinations will reflect the result of internal coordination with appropriate program and legal officials.

(j) Performance of this contract may involve access to tax return information as defined in 26 U.S.C. Section 6103(b) of the Internal Revenue Code (IRC). All such information shall be confidential and may not be disclosed without the written permission of the SSA Contracting Officer. For willfully disclosing confidential tax return information in violation of the IRC, the Contractor and Contractor employees may be subject to the criminal penalties set forth in 26 U.S.C. Section 7213.

(k) The Government reserves the right to conduct on-site visits to review the Contractor's documentation and in-house procedures for protection of and security arrangements for confidential information and adherence to the terms of this clause.

(l) The Contractor must include this clause in all resulting subcontracts whenever there is any indication that the subcontractor(s), engaged by the Contractor, and their employees or successor subcontractor(s) and their employees might have access to SSA's confidential information.

(m) The Contractor must assure that its subcontractor(s) and their employees or any successor subcontractor(s) and their employees with access to SSA confidential information are made aware of the prescribed rules of conduct. For knowingly disclosing SSA's confidential information, any subcontractor(s) and their employees or successor subcontractor(s) and their employees may be subject to criminal penalties as described in section 1106 of the Social Security Act (42 U.S.C. 1306) and the Privacy Act (5 U.S.C. 552a).

C-4.2

Protecting and Reporting the Loss of Personally Identifiable Information: Responsibilities Concerning Individual Employees (DEC 2008)

1. Definitions

The following terms are defined for the purposes of this clause:

“Agency” means the Social Security Administration (SSA).

“Employee(s)” means an individual(s) employed, including, for the purposes of this clause, management officials, by either the Contractor or subcontractor that are working under this contract.

“Handling PII” means having access, either currently or in the future, to personally identifiable information (PII), as defined in this clause.

“Lost, compromised, or potentially compromised PII” means that, while the Contractor/employee is in possession of PII, the PII has become physically missing (e.g., it has been stolen) or has been otherwise breached so that persons other than authorized users, and for other than an authorized purpose, have access or potential access to the PII, regardless of the form (e.g., electronic or physical) in which it was stored. Indications of lost, compromised, or potentially compromised PII include missing equipment (e.g., laptops and removable storage devices such as USB flash or “thumb” drives, CDs, DVDs, etc.) and/or paper documents potentially containing PII, as well as actions where PII was emailed in violation of the terms contained in Section 2.(d), Emailing PII, below.

“Personally Identifiable Information” (PII): SSA follows the definition of PII provided by the Office of Management and Budget in OMB Memorandum OMB M-07-16: “The term ‘personally identifiable information’ refers to any information which can be used to distinguish or trace an individual's identity, such as their name, Social Security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.” Other examples of PII may include, but are not limited to: Social Security benefit data, official State or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number, home address, and medical information. Within this clause, “PII” shall specifically mean PII as defined above which: (1) SSA has a primary responsibility for and/or interest in protecting; and (2) is made available or becomes accessible to the Contractor and/or any subcontractor, including their respective employees, as a result of performing under this contract (e.g., under the contract, SSA directly furnishes PII to the Contractor/subcontractor, or the Contractor/subcontractor, in order to perform its duties under the contract, collects PII from outside sources, such as in a public survey).

“Secure Area” or “Secure Duty Station” means, for the purpose of this clause, either of the following, unless SSA expressly states otherwise on a case-by-case basis: (1) an employee’s official place of work that is in the Contractor’s or subcontractor’s established business office in a commercial setting, OR (2) a location within SSA or other Federal- or State-controlled premises. A person’s private home, even if it is used regularly as a “home office” (including that of a Contractor or subcontractor management official), shall not be considered a secure area or duty station.

2. Employee Responsibility in Safeguarding PII

The Contractor shall establish, maintain, and follow its own policy and procedures to protect PII, including those for reporting lost or compromised, or potentially lost or compromised, PII (see Section 4. (a), below). The Contractor shall inform its employees handling PII of their individual responsibility to safeguard it. In addition, the Contractor shall, within reason, take appropriate and necessary action to: (1) educate employees on the proper procedures designed to protect PII, as described below and as otherwise approved by the Agency; and (2) enforce their compliance with the policy and procedures prescribed as follows:

(a) General. Employees shall properly safeguard PII from loss, theft, or inadvertent disclosure. Employees are responsible for safeguarding this information at all times, regardless of whether or not the employee is at his or her regular duty station. Examples of proper safeguarding include, but are not limited to: maintaining the confidentiality of each employee’s individual password (by not sharing the password with any other individual or entity and not writing it down); verifying the identity of individuals before disclosing information to them; preventing others in the area from viewing PII on one's computer screen; consistently locking or logging off one's workstation when one is away; and ensuring that PII is appropriately returned or, upon receiving SSA’s approval, destroyed when no longer needed.

(b) Transporting PII Outside a Secure Area/Secure Duty Station. Note: The term “transporting” used here does not include shipping by a common or contract carrier, as defined in FAR 47.001, or by the U.S. Post Office.

(1) Employees shall make every reasonable effort to safeguard equipment, files, or documents containing PII when transporting information from a secure area/secure duty station. Employees must ensure that the laptops and other electronic devices/media being used to transport PII are encrypted and password protected. The Contractor shall make every reasonable effort to ensure that the encryption and password protection are in accordance with any SSA-prescribed standards or policies which shall be communicated separately from this clause. Employees must use reasonable protection measures when transporting PII, e.g., storing files in a locked briefcase, not leaving files and/or equipment in plain view.

(2) Employees transporting PII, including transporting PII duplications, such as electronic copies and photocopies, from their secure duty station or an otherwise secured area to an unsecured area shall obtain prior approval in accordance with the Contractor’s established policy. The Contractor shall provide employees with contact information and instructions based on the Contractor’s security/PII loss incident policy and procedures. (NOTE: Agency-prescribed contact information and instructions for reporting lost or possibly lost PII are discussed in Section 3. below.)

(3) Tracking files.

Unless the PII is being transported for disposal pursuant to the contract, (see (c) below), the Contractor shall, within reason, take appropriate and necessary action to ensure that the file(s) or document(s) being physically transported or transmitted electronically outside the secure area/secure duty station are tracked through a log: they must be logged out prior to transport as well as logged back in upon return. The Contractor can establish any mechanism for tracking as long as the process, at a minimum, provides for the following information to be logged:

· first and last name of the employee taking/returning the material;

· the name of the file or document containing PII that he/she intends to transport from the office;

· all the forms or media in which the PII was transported (e.g., electronic, such as laptop, thumb drive, CD—be as specific as possible; paper, such as paper file folders or printouts);

· the reason he/she intends to transport the file or document containing PII;

· the date he/she transported the file or document containing PII from the secure duty station; and

· the date he/she returned the file or document containing PII to the secure duty station.

Materials must be returned or documented as destroyed within 90 days of removal from the office or have Contractor supervisory approval for being held longer.

The log must be maintained in a secure manner. Upon request by the Agency, the Contractor shall provide the information from the log in a format (e.g., electronic or paper) that can be readily accessed by the Agency.

(c) Employee Disposal of PII. The marked statement below applies to this contract:

[ ] This contract entails employee disposal of PII. Employees shall follow the procedures described in [Contracting Officer: Fill in reference to appropriate section, paragraph, article, etc., of the contract as applicable. Page numbers are optional.]

[X] This contract does not entail employee disposal of PII. The Contractor shall, within reason, take appropriate and necessary action to ensure that the procedures detailed in (3) above pertaining to the logging of PII that is transported outside a secure area/from their secure duty station are followed.

(d) Emailing PII. The Contractor’s corporate or organizational email system is deemed not to be secure.