Statement of Work.docx

Statement of Work VA Sierra Nevada Health Care System Cancer Registry Abstracting Services

GENERAL: Contractor shall furnish all labor, supervision, materials, equipment, facilities, transportation, and resources necessary to provide Abstracting Services to the Department of Veterans Affairs, Sierra Nevada Health Care System (VA or SNHCS), in accordance with the terms and conditions contained herein. This contract will consist of a Base Year and four one (1) year options. The contract does not require a separate Business Associate Agreement as cancer (Tumor) registry programs are authorized under Public Health reporting guidelines.

DESCRIPTION AND SCOPE OF WORK

1. Contractor Responsibilities

Contractor shall be responsible for all abstracting services to include maintenance of a Tumor Registry within the framework of directives established for approval of Cancer Registries by the American College of Surgeons (ACOS) based on available data. Services shall include but will not be limited to the following: maintaining a lifetime repository of records and data related to the treatment; evaluation and study of cancer on a cumulative basis; identifying and abstracting relevant information on all patients treated at the VA, with reportable neoplastic growths that require prolonged follow-up and observation.

Contractor shall maintain the confidential and security of patient data stored in the tumor registry computer database files.

Contractor shall maintain quality control of case finding, abstracting, coding of follow-up information and processing procedures to include ensuring that each follow up case contains the following at a minimum:

· Dates and types of treatment for persistent or recurrent disease

· Site or sites of distant metastasis

· Site and histology of subsequent primaries

· Date of last contact

· Status of the patient and the cancer

2. Other data requirements:

Basal and squamous cell carcinomas of the skin that, at initial diagnosis have invaded regional tissue or nodes or have metastasized shall be included in the registry.

Reportable cases shall include inpatient admissions and patients seen in ambulatory care. Localized basal and squamous cell carcinomas of the skin do not need to be included in the registry.

Contractor or its personnel shall provide Abstracting services, which shall include but not be limited to the following:

· Obtain core information from the patient’s medical records including demographic characteristics, history of cancer, diagnostic procedures, diagnosis, and extent of disease and staging of treatment

· Maintain data system and ensure that each electronic master patient index card contains core data in compliance with guidelines established by the American College of Surgeons (ACOS) Commission on Cancer

· Prepare abstracts for analytical cases that meet the criteria for inclusion in the registry as outlined in the Cancer Program Manual published by the Commission on Cancer of the American College of Surgeons (ACOS)

· For patients who have multiple primary malignancies, an abstract shall be prepared for each reportable primary diagnosed or treated at the VASNHCS after the registry’s reference date. Multiple primaries shall be cross-referenced

VA will be responsible for arranging Contractor to obtain such access to patient health care records as is permitted by law and is necessary to provide the services.

3. Security Incident Investigations

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the Contracting Officer’s Representative (COR) and simultaneously, the designated Information Security Officer (ISO) and Privacy Officer (PO) for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised) and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

4. Liquidated Damages for Data Breach

Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

· Nature of the event (loss, theft, unauthorized access);

· Description of the event, including:

1. date of occurrence

2. data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code

3. Number of individuals affected or potentially affected

4. Names of individuals or groups affected or potentially affected

5. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text

6. Amount of time the data has been out of VA control

The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons)

Known misuses of data containing sensitive personal information, if any; assessment of the potential harm to the affected individuals.

Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

· Notification

1. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports

2. Data breach analysis

3. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution

4. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

5. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

5. Period of Performance:

6. Workdays/Hours:

Workdays and hours shall be mutually agreed upon between the COR and the Contractor, excluding the following federal holidays: New Year’s Day, Martin Luther King Jr. Birthday, President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, and Christmas Day and any other day declared as a holiday by the President of the United States.

Services may be provided after hours or on weekends, on such days and at such time as mutually agreed upon between the Contractor and the COR.

7. Contractor Qualifications:

Personnel assigned by the Contractor to perform the services required under this contract shall be qualified as follows:

Hold current certification as a Certified Tumor Registrar (CTR) from the National Cancer Registrars Association or must have completed a course in Cancer Patient Data System Methodology or equivalent. A copy of such certification will be provided to the Contracting Officer prior to performance of work under the contract by any contractor and/or sub-contractor personnel.

Have working knowledge of the International Classification of Diseases for oncology (ICD- O), the guidelines required by the American College of Surgeons Commission on Cancer, and the Joint Commission.

Have knowledge of the following: Natural history of cancers, including knowledge of cell types associated with various types of cancer and procedures for identifying neoplasms; anatomy and physiology as well as medical terminology, common acronyms and symbols; tumor nomenclature and classifications, ability to code topography, morphology and register tumor cases; descriptive statistics and end results reporting; and automated data processing techniques with ongoing or proposed computerized systems.

The CO and/or COR or designees specifically reserve the right to reject any of the Contractor’s personnel and refuse them permission to provide services under this contract.

Personnel assigned to provide services under this contract shall have a minimum of two (2) years’ experience performing the specific services described herein, in a Tumor Registry.

Personnel assigned to provide services under this contract shall have a minimum of two (2) years’ experience performing the specific services described herein, in a Tumor Registry.

8. Contract Monitoring:

The services provided under this contract will be monitored for quality, accuracy and technical acceptability by the COR.

The Contractor’s personnel shall be required to submit a record for each period of work performed under the contract. This record will be maintained by the COR, and verified against monthly invoices submitted by the Contractor. The Contractor should establish and maintain a separate record keeping system of hours worked for all its personnel providing services under the Contract.

9. Quality Assurance Surveillance Program (QASP) and Contract Performance Monitoring:

The Contractor and its personnel providing services under this contract shall ensure 100% turnaround of all case finding cases, abstracting cases, follow-up cases, master patient index annotation, patient care evaluation and program assessment.

The Contractor and its personnel shall have, and use established regular quality control procedures to ensure quality, accuracy and consistency, and to ensure that all serviced provided under this contract are provided in a manner to ensure work is error free and of the highest quality.

The COR or designee shall monitor the Contractor’s work for accuracy and completeness. In addition, the Northern California Cancer Committee shall have access to the VANCHCS computerized database and will review all cases. Cases found to have error shall be corrected by the Contractor’s personnel within 48 hours of notification by the COR or designee of the Cancer Committee.

In accordance with VA regulations, a record-keeping system will be established and maintained by the COR to ensure contract compliance.

Before approval of payment of contractor’s invoice by the COR, the delinquent medical records report will be reviewed for accuracy in order to verify services have been provided.

Once verification of services is established, payment will be authorized by the COR.

10. Performance Standards:

Performance standards define desired services. The Government performs surveillance to determine if the contractor exceeds, meets or does not meet these standards.

The Government shall use these standards to determine contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL). Refer to QASP document.