Statement of Objectives - Vitek Testing Requirement 15 Jul 2026 (003).docx

STATEMENT OF OBJECTIVES

Reagents for Automated Mass Spectrometry Rapid Microbiology Identification, Automated Antimicrobial Susceptibility Testing, Automated Biochemical Identification and Blood Culture Testing Department of Pathology and Area Laboratory Services (DPALS) Brooke Army Medical Center (BAMC)

1. GENERAL REQUIREMENT:

The Department of Pathology and Laboratory Services at Brooke Army Medical Center, JBSA - Fort Sam Houston, Texas has a requirement for automated mass spectrometry rapid microbiology identification testing; automated antimicrobial susceptibility testing; automated biochemical identification testing; and blood culture monitoring. The number of tests per year are identified in the workload data table.

2. SCOPE OF WORK:

2.1. The successful contractor shall furnish all equipment (to include instrument/equipment/(s)), reagents, consumables, controls, and any necessary services (e.g., maintenance of furnished equipment) to conduct testing under a Cost-per-Test (CPT) Agreement (except as paragraph 2.2 in which contractor will provide only reagents compatible with government equipment). All equipment and reagents/consumables to conduct testing for automated mass spectrometry rapid microbiology identification, automated antimicrobial susceptibility, and automated biochemical microbial identification shall be supplied and serviced through the Contractor to include all parts, equipment, supplies, and other services required to ensure BAMC is able to meet its objectives as listed herein.

2.2 The instruments and software provided to conduct testing as per paragraph 2.1 above will not be government owned, and therefore the contractor will be responsible for maintenance and service of their own instrumentation and software.

3. ORDERING PERIOD:

3.1 The Government will order items on an as needed basis and shall only pay for the actual number of tests ordered, received, and accepted by the Government. The quantities listed in the workload data table represent anticipated test volumes for the period of performance listed; however, quantities could increase and/or decrease during certain periods and/or months.

3.2 The inspection and acceptance for all deliverables rendered under this contract will be by the appointed Ordering Officer. The performance by the contractor technician, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance and review for acceptance by the designated ordering officer representative. Other evaluation factors will be monitored that are not quantified by numerical measurements.

4. HOURS OF OPERATION:

The microbiology lab is in operation 24 hours a day, 7 days a week. Normal business hours for administrative personnel are Monday through Friday between the hours of 0730 – 1630 CST. Contractor shall coordinate maintenance scheduled with Ordering Contracting Officer and appointed on duty staff in absence of OCOR no less than 48 hours.

5. SECURITY REQUIREMENTS AND SAFETY:

5.1 SECURITY. The Contractor shall ensure its personnel comply with the local installation requirements for vehicle registration and operation on the military facility. Any vehicle entering the military installation must have the minimum liability coverage required by the state in which the performance is located. The Contractor shall ensure its personnel comply with installation and MTF personnel identification and access requirements.

5.2 SAFETY. The Contractor shall ensure its personnel comply with all installation and MTF safety regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal. Copies of these regulations are available in the medical activity safety office or may be obtained through the appointed personnel. The use of cellular phones and 2-way radios is expressly forbidden in all Medical Treatment Facilities and Health Clinics. The government and the contractor’s service representative will exchange hazard communication information before the commencement of any repair. When required, the contractor’s service representative will comply with the Office of Safety and Health Administration (OSHA) lockout/tag-out standards while performing sustainment on MD/MDS.

6. INSTRUMENT/EQUIPMENT REQUIREMENT (OWNED BY CONTRACTOR):

6.1 Contractor shall provide all instruments/equipment necessary to conduct testing as per workload data table on the testing identified. The instrument/equipment provided will be utilized for BAMC's automated mass spectrometry rapid microbial identification, automated antimicrobial sensitivity, and automated biochemical microbial identification needs. In addition, the instrument/equipment must include an automated component that facilitates ease of sample preparation and seamless input of data via barcode scanning. A printer for the production of hard copy patient reports and other reports generated shall also be provided.

6.2 The contractor shall provide redundancy in the form of multiple instruments and/or equipment used to perform automated antimicrobial sensitivity, and automated biochemical microbial identification testing.

6.3 These instruments, to include any connections between the instruments/equipment, shall be approved by the US Food and Drug Administration (FDA).

6.4 The instruments will be able to correctly identify and perform antimicrobial sensitivities from a pure culture of unknown microbiological organism.

6.5 The instruments supplied, all of its associated parts, and all accessories must be maintained at the most up-to-date hardware and software to include running Windows 11. When necessary to maintain hardware updates, the existing instrument/equipment, associated parts, and accessories must be exchanged by the contractor. All software updates or file exchanges shall be completed using CD/DVDs only. At no time will USB, internet or cloud-based services be allowed.

6.6 The server database must be SQL 2022. SQL 2022 Express is not acceptable. The server operating system must be Microsoft 2022 Server.

6.7 The instrument system shall be equipped with an Uninterruptible Power Supply (UPS) capable of providing all necessary electrical power to the instrument/equipment system for at least 45 to 60 minutes.

6.8 The instruments shall be able to be connected to the hospital LIS, currently Composite Health Care System (CHCS), or whichever LIS system the hospital will use in the future. The contractor must provide full technical support to ensure that the LIS connectivity is functioning properly.

6.9 The instruments, reagents, and software provided shall comply with the specific requirements listed in this SOO. The instruments and software provided for Automated Microbial Identification and Antimicrobial Susceptibility Testing will not be government owned, and therefore the contractor will be responsible for maintenance and service of the instrumentation and software.

6.10 The data management/quality control software shall be able to generate the following type of reports:

a. Statistical reports - to include positive incidence summary reports, days to detection summary reports, detail reports, positive rate reports, blood culture volume reports, and unconfirmed positive rate reports;

b. Epidemiology reports- to include trending reports, phenotype occurrence reports, phenotype trending reports, susceptibility reports, cumulative by MIC reports, bio-number distribution reports and incidence detail reports; Instrument reports- to include workload reports, load reports, unload reports, and calibration reports.

6.11 Software upgrades. Contractor shall have access to all necessary diagnostic software. All software upgrades, corrective in nature, or which enhance MD/MDS features shall be at no cost to the government.

6.12. Contractor shall provide all documentation required to meet all regulatory compliance testing procedures.

6.13 Contractors shall coordinate and conduct a site visit if necessary to the BAMC Microbiology section, for the purpose of surveying and assessing current laboratory set-up, laboratory environmental control, and available utilities with regard to potential placement of their instruments in the laboratory. Any changes to the layout of the laboratory, environmental control, or to utilities as currently in existence to accommodate placement of their proposed instruments must be identified.

6.14 Method Verification (Correlation Studies) will include parallel runs with existing equipment. Specificity and Sensitivity shall be equal to or exceed the manufacturer stated claims.

6.15 The Contractor will provide one (1) paper copy and one (1) CD copy of the Operator’s and Maintenance manuals and a statement of the warranty terms.

6.16 Lab Layout. The contractor shall provide a diagram or other graphical representation demonstrating how its proposed equipment fits within the dimensions below with its quote.

7. PREVENTATIVE MAINTENANCE, FAILURES AND REPAIRS:

7.1 The contractor shall provide all personnel, equipment, tools, materials, supervision, parts, transportation, and other items and services necessary to perform all required repairs and scheduled preventive maintenance/safety inspections and calibrations of their equipment and must be able to provide full-service maintenance for the government-owned BioMérieux’s BacT/Alert Virtuo equipment and data management/quality control software. Contractor shall coordinate with the designated point of contact all scheduled maintenance within ten (10) business days prior to performing preventative maintenance services.

7.2 The performance of scheduled periodic preventive maintenance, safety checks, and calibrations that are not normally performed at the operator level will be performed by contractor service personnel in accordance with requirements as specified in the contractor’s instrument maintenance manual. The contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required by manufacturer in order to maintain the system in optimal operating condition.

7.3 The contractor shall provide a full service plan to include the recommended unscheduled and preventive maintenance service for their instrument/equipment period as well as provide full-service maintenance for the government-owned BioMérieux’s BacT/Alert Virtuo. Service shall include repair and replacement of defective parts, complete maintenance program (as required by the manufacturer’s maintenance manuals), and hotline telephone service, in order to assist customer in troubleshooting problems.

7.4 Preventive maintenance services shall be performed in accordance with the manufacturer’s standard/procedure maintenance service shall include, but is not limited to, safety, calibration, complete operational testing, lubrication, adjustments, and cleaning of equipment to which the operator does not have access. This also includes the installation of all non-operator parts required to ensure proper operation.

7.5 Upon notification of equipment failure own by contractor, the contractor shall respond to telephonic requests for unscheduled repair within 24 hours. Should the instrument/equipment become inoperable, the contractor’s Repair Service Engineer / technician shall be on-site within 24 hours of initial notification for routine/emergency failures. If the equipment is out of service for longer than 72 hours (from the time of service technician’s arrival on site), the contractor shall notify the government point of contract on duty, in writing, as to the reason(s) (i.e. non- availability of parts, etc.) for non-compliance.

7.6 If the equipment cannot be repaired, a replacement instrument shall be provided within seven (7) days. If the equipment cannot be replaced, the Government may seek remedies for non-compliance with terms and conditions of this contract.

7.7 Within one (1) business day after completion of a repair, the contractor’s representative shall furnish the Point of Contact (POC) one (1) copy of a service report for all services performed. The service report shall contain, at a minimum, the following information:

a. Nomenclature, date, description of services performed (i.e. preventative maintenance service, or unscheduled repair service)

b. Location of services performed, duration of services performed, list of parts replaced and;

c. Other actions taken to restore operability of the instrument/equipment, name of technician.

**Full report shall be submitted to designated government point of contact**

7.8 Contractor shall notify government of any hazard information before beginning equipment repair and shall comply with the Occupational Safety and Health Administration while performing maintenance on electrical equipment.

7.9 When appropriate, the contractor’s representative shall attach and complete a DD Form 2163 (sticker), entitled “Medical Equipment Verification/Certification” to the equipment upon completion of calibration services. The Point of Contact will provide the DD Form 2163 to the contractors’ representative. If the DD Form 2163 is already attached to the equipment, the contractors' representative shall update the existing DD Form 2163. Procedures for updating the 2163 will be provided by the Point of Contact.

8. CUSTOMER SERVICE:

8.1 The Contractor shall provide direct customer service and support, during normal business hours and on-call emergency repair service support, to assist operators in correcting equipment operation problems.

8.2 For Emergency Services and unscheduled services the Contractor’s qualified service technician shall be on-site to provide emergency service (service requiring immediate repair) within 24 hours. The equipment shall be repaired and operational at the minimum of 72 hours after arrival of contractor on site.

8.3 The Contractor shall perform preventive maintenance services (PMS), safety tests, calibrations, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment. Scheduled routine services shall be performed between 0730-1630 LOCAL Monday-Friday, excluding U.S. Holidays.

8.4 The Contractor shall provide a full unscheduled and preventive maintenance service for the instrument/ equipment owned by contractor. All maintenance and repairs shall be inclusive of all costs for the performance of scheduled periodic maintenance (as required by the Contractor’s instrument maintenance manuals), unscheduled maintenance and repair of the analyzers and any associated equipment provided by the Contractor as part of the analyzer system, including replacement parts, replacement part shipment costs, and service technician travel costs for performance of maintenance services.

8.5 The contractor’s qualified service technician shall be on site to provide routine services; service requiring immediate repair; and scheduled services for preventive maintenance (as specified in the Contractor’s instrument maintenance manual), safety and calibration as required by this statement of work. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

8.6 Upon analyzer failure, the Contractor’s qualified service technician shall be on-site to provide unlimited emergency service (service requiring immediate repair; an unscheduled maintenance/service requirement) within 24 hours. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

8.7 Should the analyzer at BAMC become inoperable, the Contractor’s technical repair specialist shall be on-site within 24 hours of initial notification and make the repair within 72 hours after arrival of contractor on site. If the analyzer cannot be repaired within 72 hours after arrival of contractor on site, a replacement analyzer, at no additional cost to the U. S. Government, will be provided within seven (7) days of the initial notification to be utilized by the U.S. Government until the original instrument is fully repaired and accepted for service.

8.8 During the period when the analyzer is inoperable, the BAMC laboratory will send out testing to a College of American Pathologists accredited clinical laboratory of their choice. The selected laboratory will provide patient reports. The Contractor will be responsible for covering the cost up to the amount of supplies that would have been used to perform this testing in house, for as long as the analyzer remains inoperable.

8.9 The Contractor shall provide all necessary user-replaceable maintenance items that will be required to support the analyzer, and any analyzer specific tools/supplies necessary to perform operator-level periodic maintenance tasks, at no additional cost to the U.S. Government.

9. DELIVERY OF EQUIPMENT

9.1 All equipment (owned by contractor) shall include delivery, installation, maintenance, and removal upon termination of contract. Contractor shall furnish all necessary calibrators/standards and quality control materials necessary to perform the initial method verifications per CLIA/NCCLS guidelines.

9.2 The contractor shall coordinate the delivery of instrument(s)/equipment to the Brooke Army Medical Center (4th floor)within 30 days or less after contract award. Exact installation location shall be coordinated by contractor and government point of contact (OIC and/or NCOIC). Equipment setup, LIS connectivity, and on-site training, shall be completed by vendor personnel within six (6) weeks or less after contract award to ensure that equipment is fully operational. The contractor field support team will assist in establishing method verification studies.

9.3 SAFETY DATA SHEETS (SDS): The contractor shall provide safety data sheets (SDS) for each item delivered under this contract that is considered to be HAZARDOUS MATERIAL. The SDS shall contain information on the hazards associated with each specific chemical or material. The SDS shall contain at a minimum the following information: identification of the specific hazard, the required practice for the safe use of the product, first aid procedures, and what to do in the event of a spill or other mishap or accident.

10. REAGENTS/CONSUMABLES:

10.1 All assays shall be FDA approved and must have a minimum shelf life of six (6) months upon receipt by the Government, or, if this shelf life requirement cannot be met the Contractor shall identify the guaranteed shelf life after receipt that can be accommodated in their response to the Solicitation for Bid.

10.2 The manufacturer will provide the required quality control materials and test reagents and ensure that there is minimal change in lot numbers during the contract year.

10.3 The blood culture reagents provided must be compatible with the government owned Biomerieux BacT/Alert Virtuo Microbial Detection System.

10.4 All reagents and quality control material shall be provided by the manufacturer of the equipment; be marked with the required storage temperature and expiration dates; be maintained at the proper storage temperature during transportation from the Contractor’s storage facility to the U.S. Government acceptance site and be delivered on time at the appropriate storage temperature. Preservation and packing - Preservation and packing shall be performed in accordance with the best commercial practices and in such a manner to afford adequate protection against any damage during shipment from source to destination.

10.5 The reagents and quality control material must be perform within the manufacturer’s stated/published package inserts. Deliveries of required items will be called in to the Contractor by the designated Contracting Officer’s Representatives. Orders will be delivered within five (5) business days of requested date of delivery.

10.6 Emergency orders will be delivered using overnight shipping, or, if this shipping requirement cannot be met, the Contractor shall identify the guaranteed emergency order shipping method that can be accommodated in their response to the Solicitation for Bid.

11. TRAINING:

11.1 The Contractor will provide initial operator training to all technicians assigned to the U.S. Government site (BAMC Department of Pathology Microbiology staff), as well as annual refresher training, as needed, to ensure adequate user competency during times of personnel turnover.

11.2 All training manuals/guides, instructional literature, and any other related written/electronic material shall be provided. Training shall include basic operation of the analyzers, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use of the data management/quality control software.

11.3 In the case of any significant software or assay procedural updates, the Contractor shall provide one (1) primary (key) operator training slot per major instrument/equipment, one (1) key operator Training per new instrument install, one (1) key operator raining for the existing instrumentation, two (2) On-site in lab training slots for the instrumentation to be used over the 5 year term of the agreement as the lab needs for staff changes. This training can be on or off-site at the Contractor’s full expense.

WORKLOAD DATA TABLE 1.

Automated mass spectrometry rapid microbiology identification testing (cost per test)

Automated Gram Negative antimicrobial susceptibility testing (cost per test)

Automated Gram Positive Antimicrobial susceptibility testing (cost per test)

Automated Gram Negative microbial identification (cost per test)

Automated Gram Positive microbial identification testing (cost per test)

General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract.

The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (October 29, 2014) and DoD 5400.11-R (May 14, 2007).

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules. DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (January 24, 2003), Department of Defense Instruction (DoDI) 6025.18 (December 2, 2009), and DoDI 8580.02 (August 12, 2015). Defense Health Agency (DHA) Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

1. Records Management

When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

2. Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action: The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042- 5101 (or email requests addressed to DHA.FOIA@mail.mil), and that the request shall describe the desired record as completely as possible (ideally with Contract or modification number) to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible. In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

3. Systems of Records

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99- 05, Attachment B, and OMB Circular A-130. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

4. Privacy Impact Assessment (PIA) Contractors are not required to submit PIAs to DHA.

5. Data Sharing Agreement (DSA)

(Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract. The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances. Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation. To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSA for De-Identified Data DSA for PHI DSA for PII Without PHI DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

5.1 (Applies if contract requirements may include human subject research) This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

6. Privacy Act and HIPAA Training The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of alcohol and drug abuse patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

7. HIPAA Business Associate Provisions

7.1 Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. This paragraph 8 serves as the required BAA. As a Business Associate, the Contractor shall comply with the HIPAA Rules and the DoD HIPAA Issuances applicable to a business associate performing under this Contract.

7.1.1 Catch-All Definition

The following terms used, but not otherwise defined in paragraph 8.1, shall have the same meaning as those terms have in the DoD HIPAA Issuances: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information (Unsecured PHI), and Use. The Contractor shall not use or further disclose PHI other than as permitted or required by the Contract or as Required by Law. The Contractor shall use appropriate safeguards, and comply with the HIPAA Security Rule with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Contract. The Contractor shall report to DHA any breach of which it becomes aware, and shall proceed with breach response steps as required by paragraph 9 (if this Contract incorporates by reference the TOM, then all references to paragraph 9 shall be deemed to refer to the breach response provisions of the TOM, Ch. 1, Sec. 5, paragraphs 2.1- 2.2). With respect to electronic PHI, the Contractor shall also respond to any security incident of which it becomes aware in accordance with any applicable DoD cybersecurity and National Institute of Standards and Technology (NIST) requirements. If at any point the Contractor becomes aware that a security incident involves a breach, the contractor shall immediately initiate breach response as required by paragraph 9.In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), respectively, as applicable, the Contractor shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Contractor agree to the same restrictions, conditions, and requirements that apply to the Contractor with respect to such PHI. With respect to individual rights of access to PHI, the Contractor shall make available PHI in a designated record set to the individual or the individual’s designee as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.524. If the Contractor intends to deny the individual’s request, the Contractor shall forward it (within seven working days of receipt) to the CO. The CO shall make a determination within 20 calendar days (50 calendar days for justified delays) of the request. The CO shall notify the individual, with a copy to the Contractor, of any approved or denied access determinations and the reason for any denial. The individual may appeal the denial determination to the DHA Privacy Office. The Contractor shall make any amendment(s) to PHI in a designated record set as directed or agreed to by DHA, or take other measures as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.526.The Contractor shall maintain and make available to the Government the information required to provide an accounting of disclosures to the MHS or to the individual as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.528.To the extent the Contractor is to carry out one or more of DHA’s obligation(s) under the HIPAA Rules, the Contractor shall comply with the requirements of the HIPAA Rules. The Contractor shall make its internal practices, books, and records available to the HHS Secretary for purposes of determining compliance with the HIPAA Rules. Permitted Uses and Disclosures

7.2 General Use and Disclosure Provisions

The Contractor may only use or disclose PHI as necessary to perform the services set forth in this Contract or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA Issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Contract or directed by DHA. The Contractor agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances. The Contractor shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the covered entity, except uses and disclosures for the Contractor’s own management and administration and legal responsibilities or for data aggregation services as set forth in paragraphs 8.3.1 – 8.3.3.

Specific Use and Disclosure Provisions

· Except as otherwise limited in this Section, the Contractor may use PHI for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

· Except as otherwise limited in paragraph 8.3, the Contractor may disclose PHI for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

· Except as otherwise limited in this Section, the Contractor may use PHI to provide Data Aggregation services relating to DHA’s health care operations.

· Contractor Compliance with DHA Notices and Restrictions

· DHA will provide the Contractor with the notice of privacy practices that DHA produces in accordance with the DoD HIPAA Issuances and the corresponding 45 CFR 164.520.

· Upon notification by DHA of any changes in, or revocation of, permission by an individual to use or disclose his or her PHI, the Contractor shall comply to the extent that such changes may affect the Contractor’s use or disclosure of PHI.

· Upon notification by DHA, the Contractor shall comply with any restriction on the use or disclosure of PHI that the Government has agreed to or is required to abide by under the DoD HIPAA Issuances or the corresponding 45 CFR 164.522, to the extent that such restriction may affect Contractor’s use or disclosure of PHI.

(1) Permissible Requests by DHA The Government will not request the Contractor to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this Contract.

(2) Termination

· Effect of Noncompliance Noncompliance by the Contractor (or any of its staff, agents, or subcontractors) with any requirement in these HIPAA Business Associate Provisions (paragraph 8) may subject the Contractor to termination under any applicable default or other termination provision of this Contract.

· Effect of Termination

· If this Contract has records management requirements, the Contractor shall handle such records in accordance with the records management requirements. If this Contract does not have records management requirements, the Contractor shall handle such records in accordance with paragraphs 8.6.2.2 and 8.6.2.3 below. If this Contract has provisions for transfer of records and PII/PHI to a successor contractor, or if DHA gives directions for such transfer, the Contractor shall handle such records and information in accordance with such Contract provisions or DHA direction.

· If this Contract does not have records management requirements, except as provided in paragraph 8.6.2.3 below, upon termination of the Contract, for any reason, the Contractor shall return or destroy all PHI received from the Government, or created or received by the Contractor on behalf of the Government that the Contractor still maintains in any form. This provision shall apply to PHI that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the PHI.

· If this Contract does not have records management provisions and the Contractor determines that returning or destroying the PHI is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of PHI is infeasible, the Contractor shall extend the protections of the Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such PHI.

8.7 Miscellaneous

8.7.1 Survival

The obligations of the Contractor under the “Effect of Termination” provision of Paragraph 9 shall survive the termination of this Contract.

8.7.2 Interpretation

Any ambiguity in this Contract shall be interpreted in a manner to permit compliance with the HIPAA Rules and the DoD HIPAA Issuances.

(l) Breach Response [This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference. See paragraph 8.1.4 above]

· Definitions Related to Breach response

· Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for other than an authorized purpose have access or potential access to PII, whether physical or electronic. The foregoing definition is based on the definition of breach in DoDD 5400.11. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non- cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

· A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

· How the event was discovered;

· Did the information stay within the covered entity’s control;

· Was the information actually accessed/viewed; and

· Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4 A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

9.1.5 A HIPAA breach is an incident that satisfies the definition of breach in 45 CFR 164.402.

9.1.6 A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

9.2. General

9.2.1 The breach response requirements set forth in this paragraph 9 are designed to satisfy both the DoD Privacy Act Issuances and the HIPAA Breach Rule, 45 CFR Part 164, Subpart D, as applicable. The definition of breach above is based on the definition of breach in the DoD Privacy Act Issuances. This Privacy Act definition is broader than a HIPAA breach as defined above. Thus, a Privacy Act breach would not constitute a HIPAA breach if the PII involved does not include PHI or if it involves PHI but is excluded from the definition of HIPAA breach. If a breach is not a HIPAA breach, then the Contractor has no HIPAA breach response obligations. In such cases, the Contractor must still comply with breach response requirements under the DoD Privacy Act Issuances, as stated in this paragraph 9.

9.2.2 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents. The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non-breach, confirmed vs. possible, cyber vs. non-cyber). Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline (see paragraph 9.3.2) while waiting for the DHA Privacy Office guidance or while investigating the incident. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

9.2.4 In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency Readiness Team (US-CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below. The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirements.

9.2.5 Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery. The time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours) under paragraph 9.3.2. If a cybersecurity incident is involved, the contractor’s deadline for US- CERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein.