Statement of Work.pdf

Dated 12/5/2024 Statement of Work 75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center 12033 Agency Rd, Parker, AZ 85344

A. INTRODUCTION:

The Parker Indian Health Center, Parker, AZ and the Peach Springs Health Center, Peach Springs, AZ, are located on the North West side of the State of Arizona. The Colorado River Service Unit is the primary provider of comprehensive direct and high priority contract inpatient, ambulatory care, preventive and community health, and environmental health services for members of the Colorado River Indian Reservation, Chemehuevi Indian Reservation, Hualapai Indian Reservation, Havasupai Indian Reservation and the Moapa Indian Reservation. The CRSU serves over 13,000 members in the tribal communities of Parker, AZ; Peach Springs, AZ; Supai, AZ; Havasu Lake, CA; Moapa, NV.

B. PURPOSE OF CONTRACT:

The IHS continues to experience difficulties in recruiting and retaining radiology specialist who can provide radiology services within the IHS medical facilities. Given the current availability of teleradiology/telemedicine technology, the IHS is pursuing contracts to provide these services within the IHS facilities.

C. SCOPE OF WORK:

I. Contractor shall provide:

A.) The Contractor shall perform off-site teleradiology for Colorado River Service Unit, Parker Indian Health Center, which is located at 12033 Agency Rd, Parker, AZ 985344; and Peach Springs Health Center, 943 Hualapai Way, Peach Springs, AZ 86434.

B.) Reading all plain radiographs (X-ray), sonograms, computerized tomography (CT) studies, and other diagnostic radiology studies performed at Parker Indian Health Center and Peach Springs Health Center. Studies will be designated by the Parker diagnostic imaging department as “routine” or “emergent” (24/7). Emergent studies will not exceed 40% of the total study volume. Contacting the IHS ordering provider or clinical director in the absence of the ordering provider immediately in the event that the interpretation of a study suggests a significant health risk to the patient.

C.) Providing a final written interpretation on all routine studies within 24 hours after receipt of the study. Interpretations on studies received with <24hrs remaining in the business week (Monday – Friday, excluding holidays) will be provided on the first business day of the following week.

D.) Providing a final written interpretation on all emergent studies (24/7) within one hour of receipt of the study. Emergent interpretation services will be available 24 hours per

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center day, seven days per week.

E.) Be available 24/7 for questions from providers concerning the Contractor’s study interpretations. Contractor will define the method for contacting the Radiologist.

F.) Providing teleradiology reception capability compatible with Indian Health Services

(IHS) Resource and Patient Management System (RPMS) and the Department of Veteran Affairs (VA) VistA Imaging system.

G.) Providing all transcription services, reports will be transmitted to Colorado River Service

Unit via fax or virtual fax and/or facility technicians will be able to view, copy/paste final reports directly from ALLVALLEY’s PACS, as HIPAA compliant cloud-based platform.

• There will be an option to convert to an HL7 interface should it become evident that the benefits would outweigh the costs, but initially CRSU will utilize the Gateway system to retrieve reports.

H.) PC required for the gateway application is optioned to be purchased/supplied by IHS, or provided by ALLVALLEY at a cost as noted in Bid Schedule (allowing the IHS location to retain the equipment upon termination of the contract).

I.) Provide a point of contact for network and technical issues during the Hours of

Operation.

J.) Provide a point of contact for interpretation/clinical issues during the Hours of

Operation.

II. Reports:

A.) Provide a final written interpretation on all routine studies within 24 hours after receipt of the study. Interpretations on studies received within < 24hrs remaining in the business week (Monday -Friday, excluding holidays) will be provided on the first business day of the following week.

B.) -- Intentionally left blank --

C.) Protocol for Critical Results Reporting:

The contractor will call the report to the requesting provider of a radiology exam within 30 minutes after receiving the examination that can have a critical impact on the patients care (critical results). Results will be communicated to the ordering provider.

D.) The ALLVALLEY Gateway Application will be the primary method for the reporting

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center and completion of an exam. However, in the event of a downtime, the contactor shall exercise the Protocol for Critical Results Reporting for all examinations.

III. Quality Management and Qualifications:

Contractor shall provide:

A.) The contractor will have in place a daily proactive monitoring system to ensure that contract interpretation benchmarks are met.

B.) Contractor will have a designated coordinator for technical and medical staff issues.

C.) Contractor shall have a designated primary technical consultant for computer, network and software issues relative to this contract.

D.) Contractor will develop or shall demonstrate a Quality Assurance (QA) program to monitor performance and submit quarterly reports to Contracting Officer Representative (COR).

E.) The contractor must provide all applicable criteria for credentialed and privileged attending physicians who will be providing these services.

F.) Contractor will enter into a "Distant Site Telemedicine Entity Credentialing and Privileging Agreement" with Colorado River Service Unit.

G.) The contractor must be Joint Commission accredited.

H.) The contractor shall provide, if necessary, a completed credentials file which shall include documentation of:

i.) Radiology residency training ii.) Board certification radiology iii.) Medical school training iv.) Tort claims history and liability coverage v.) Expe1ience appropriate to the scope of service vi.) Licensure (active unrestricted U.S. medical license)

IV. Services Overview

The following are service points ALLVALLEY is committing to provide for this contract.

• ALLVALLEY shall provide radiology interpretative reports for all plain radiographs (X-ray), sonograms, computerized tomography (CT) for studies performed at Parker Indian Health Center and Peach Springs Health Center.

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

• ALLVALLEY shall provide Routine and Emergent services, providing Routine Final reports within 24 hours of receiving an order and all imaging data. Emergent Final reports will be provided within 60 minutes of receiving an order and all imaging data.

Interpretation services will be available 24 hours per day, seven days per week.

• ALLVALLEY shall contact the IHS ordering provider or clinical director in the absence of the ordering provider immediately in the event that the interpretation of a study suggests a significant health risk to the patient.

• ALLVALLEY shall make available a Radiologist 24/7 for questions from providers concerning the ALLVALLEY’s study interpretations.

• ALLVALLEY shall work to connect the Indian Health Services (IHS) Resource and Patient Management System (RPMS) and the Department of Veteran Affairs (VA) VistA Imaging systems.

• ALLVALLEY reports will be transmitted to Colorado River Service Unit via fax.

Technicians will be given access to ALLVALLEY’s HIPAA compliant cloud-based platform.

• ALLVALLEY will provide 24/7 access to network and technical and operations staff.

• ALLVALLEY shall call critical results to the requesting provider within 30 minutes after transmission of the interpretation.

• ALLVALLEY shall comply with all Quality Management policies and provide full documentation for physician privileging.

D. PRICE/COST:

The Contractor shall be compensated at the agreed contract amount based on invoices submitted and only for services in direct performance of this contract.

The Contractor does not allow for annual or sick leave or other fringe benefits.

Per mandate by the U. S. Department of Treasury and effective July 1996, payments by Electronic Funds Transfer System (EFTS) will be made to the Contractors designated financial institute.

The Federal Government DOES NOT WITHHOLD taxes from the Contractor, any Local, and State or Federal taxes. It is the Contractor's sole-responsibility to pay their own taxes and other personal obligations that they may have.

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

Below, please find two sets of pricing, one if the sites are providing orders to ALLVALLEY using HL7, and one price if they are not. Pricing for Emergent and Routine is the same. As you can see, the pricing for no HL7 feed is higher than if there is an HL7 feed. We want to encourage the use of HL7 order creation and report delivery whenever possible to the point that we will not charge a start-up fee to connect our facilities together via HL7. So, please find our pricing as follows:

Pricing with HL7 Data Connectivity and Self Validation As Needed Initial Term 2020 2021 2022 2023 2024

CT $42.00 $42.84 $43.70 $44.57 $45.46

CT Abd/Pelvis $60.90 $62.12 $63.36 $64.63 $65.92

US $29.40 $29.99 $30.59 $31.20 $31.82

X-Ray $14.70 $14.99 $15.29 $15.60 $15.91

Pricing without HL7 Data Connectivity and Self Validation

Initial Term 2020 2021 2022 2023 2024

CT $44.00 $44.84 $45.70 $46.57 $47.46

CT Abd/Pelvis $62.90 $64.12 $65.36 $66.63 $67.92

US $31.40 $31.99 $32.59 $33.20 $33.82

X-Ray $16.70 $16.99 $17.29 $17.60 $17.91

E. PERIOD OF PERFORMANCE:

Contract performance shall commence on date of award of this modification and four (4) option years. Extension of the contract shall not be executed unless by written notification.

F. SITE LOCATIONS:

a. Peach Springs 943 Hualapai Way Peach Springs, AZ 864434

b. Parker Indian Health Center.

12033 Agency Road Parker, AZ 85344

G. INFORMATION TECHNOLOGY AND INFORMATION SECURITY REQUIREMENTS:

The Indian Health Service (IHS) is responsible for maintaining an information security program that provides protection for information collected or maintained by or on behalf of the Agency; and information systems used or operated by the Agency or by a contractor of the Agency or other organization on behalf of the Agency.

1.) Phoenix Area Office Department of Information Resource Management (IRM) must review, 75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center approve, and verify the Contractor connectivity functionality. The Contractor will be responsible for establishing and maintaining computer network connectivity with Colorado River Service Unit as well as associated costs, including configuring their system for connectivity. Minimum specifications require a "business class" high-speed internet connection such as Symmetric Digital Subscriber Line (SDSL) or a dedicated Tl to the Contractor and/or Internet Service Provider (ISP).

2.) Contractor is required to make the appropriate arrangements with all hardware and software vendors for proper licensing of their products for Contractor computer systems.

3.) ALLVALLEY has the ability to provide HL7 interface, however CRSU volumes may not warrant the expense to IHS/Taxpayers. CRSU technicians, care providers and patients will utilize ALLVALLEY’s Gateway Application which provides a 99.999% uptime record, is HIPAA compliant and provides a streamlined study/report sharing capability for patients and referring physicians. However, CRSU will have the option to purchase the HL7 interface should they decide that the benefits outweigh the costs after using the Gateway. This option will remain for the life of the contract or until exercised.

4.) The Contractor must maintain a system that is reliable and functional to prevent any disruption in the delivery of services. The Contractor and/or sub-contractor must always maintain data transmission security.

5.) Contractor and/or sub-contractor must notify the Phoenix Area Office IRM Department or the CRSU Radiology Department radiology staff immediately of any equipment malfunctions that would impact the ability to provide reports.

6.) Contractor must handle data containing patient-specific identifiers in such a way as to prevent disclosure to unauthorized parties. This includes transmission of data as well as storage of the data by the Contractor shall comply with all applicable data security laws and guidelines, as well as HIPAA and Joint Commission or equivalent provisions. The Contractor and/or subcontractor will provide care and attention to patient data. All patients must feel assured of their privacy and personal dignity in accordance with applicable laws, rules, and regulations.

All patient information remains the sole property of the U.S. Government and may not be used for any purpose other than those stipulated in this contact. CRSU will be the primary custodian of the patient information (including both the image data and the report) for all purposes related to CRSU and Government records retention requirements. Upon request, the Contractor will provide CRSU with access to information pertaining to the way in which the Contractor maintains CRSU patient data and the steps taken on an ongoing basis to assure the privacy and security thereof. This includes, but is not limited to, information regarding computer network architecture, configuration of firewall(s), routers, and other pieces of networking equipment, information about installed security software, and audits of patches for known security vulnerabilities. The Contractor must ensure the installation of all relevant security-related Operating System patches, approved anti-virus software, and all updates on all computer systems that access CRSU data.

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

7.) Contractor and/or sub-contractor(s) computer systems or networks that transmit, store or process CRSU protected healthcare information must implement the appropriate security controls to protect that data from unauthorized access, disclosure, modification, or loss.

Contractor and/or subcontractor computer systems shall have virus protection installed and maintained with current updates. The Contractor and/or sub-contractor must install and maintain all operating systems and software applications, configured and maintained at the current release and security update/patch. Contractor and/or sub-contractor will, after award, demonstrate, create, implement, and document a backup plan with a periodic testing schedule.

8.) All Contractor and/or sub-contractor personnel who process, store, or transmit on Contractor and/or sub-contractor or CRSU computer systems shall be assigned unique user identifications (IDs) and passwords. Contractor and/or sub-contractor personnel shall be responsible for all activity performed with their user IDs. Contractor and/or sub-contractor personnel must not share or allow anyone to use their IDs, to include associates, friends, family members, or others. These IDs are for the exclusive use of each Contractor and/or sub-contractor only and must remain secure at all times. Contractor and/or sub-contractor personnel are forbidden from performing any activity with user IDs belonging to other individuals. The Contractor and/or sub-contractor shall notify the Contracting Officer Representative and/or CRSU Information Security Officer immediately when their personnel no longer require access to the computer systems.

9.) All Contractor and/or sub-contractor personnel who process, transmit or access CRSU computer systems or networks shall be required to sign and submit a copy to the Contracting Officer the Indian Health Service of Rules of Behavior Agreement. A signature on this statement indicates the user understands and agrees to adhere to Indian Health Service policies, standards, procedures, and guidelines.

10.) Whenever a computer connection is established between the CRSU and the Contractor's and/or subcontractor's computer system located outside the official Indian Health Service network or facility, and whenever the connections transmit, this information shall be encrypted using Indian Health Service approved standard algorithms and implementations.

11.) The Contractor and/or sub-contractor shall report any information security violations or attempted violations or any unanticipated threats, disclosures or hazards to CRSU Radiology Department or Phoenix Area IRM Department immediately.

12.) Indian Health Service reserves the right to audit and review Contractor and/or subcontractor personnel security, information security, and privacy controls to determine their adequacy in regards to Federal or State regulations and laws, and Indian Health Service policy, standards, procedures and guidelines. This includes, but is not limited to inspecting the Contractor's and/or sub-contractor's facility, installations, operations, documentation, records and databases.

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

H. CONTRACTOR AND/OR SUBCONTRACTOR REMOTE ACCESS

REQUIREMENTS:

The Contractor and/or subcontractor will use remote access to connect to the CRSU computer systems or network(s) in the performance of the Contract. Indian Health Service has stringent policies and procedures covering remote access. Therefore, the Contractor and/or subcontractor must follow the responsibilities outlined below:

1.) Al l remote connections to the Indian Health Service network shall be through the Information Technology Access Control (ITAC) office. Office Cyber Security (OCS) authorized configurations and access points. Contractor and/or subcontractors will access, through the internet or other networks using Indian Health Service remote access Virtual Private Network (VPN) Service and software.

2.) Indian Health Service shall provide secure and reliable remote access to systems, applications, and information on the CRSU network to the Contractor and/or subcontractor.

2.) All Contractor and/or subcontractor personnel requesting remote access shall be required to sign an Indian Health Services VPN Rules of Behavior. The Contractor and/or subcontractor shall be responsible to ensure their personnel follow the terms of the agreement. On award, the Contractor must complete an Interconnect Security Agreement

(TSA).

4.) The Contractor and/or subcontractor shall adhere to the remote access requirements, and ensure proper and appropriate configuration of each system and that security mechanism and monitoring devices are up to date with best practices and technical standards.

I. IT SECURITY-INFORMATION SYSTEMS SECURITY AWARENESS (ISSA)

TRAINING:

Information Systems Security Awareness (ISSA) is mandatory annual security awareness training for all IHS system users and fulfills Federal mandates and regulations. IHS develops the modules in line with National Institute of Standards and Technology (NIST) guidelines on information security awareness and information security trainings.

The ISSA modules fulfill an IHS user's annual requirements for the following:

1.) Acknowledgement and acceptance of the IHS Rules of Behavior 2.) Privacy training 3.) Protecting sensitive information and the Health Insurance Portability and Accountability Act (HIPAA) & the Health Information Technology for Economic and Clinical Health Act

(HITECH)

4.) Physical and information security 5.) Appropriate email use 6.) Protecting mobile devices and portable media 7.) Social engineering awareness 8.) Incident response and learning from past incidents

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

You can take the training or learn more at the ISSA website.

All IHS information system users must take annual security and privacy training in order to fulfill federal mandates and regulations. In addition, all new users must successfully complete this course within 24 hours off receiving access unless the user has read the IHS Quick Guide to Information

Security, in which case they will have 30 days to complete the training. Failure to complete training requirements will result in the loss of information systems access.

J. INCIDENT RESPONSE PROCEDURES:

To meet federal requirements and provide IHS with centralized incident reporting and response services, IHS established the IHS Incident Response Team (IRT) to coordinate IHS-wide cyber security information sharing, analysis, and response activities. The IHS IRT provides a centralized resource for collecting, analyzing, and disseminating information technology security incident-related information.

If you witness an IHS suspicious event or a potential incident, IMMEDIATELY do the following:

1. Contact - via email, phone or in person - your site manager or local ISSO. Be prepared to provide the date, time, location, and any other information you feel may be useful.

2. If you do not reach your site manager or local ISSO, contact your Area ISSO.

3. If you do not reach the Area ISSO, contact the IRS IRT using the information at the bottom of this page.

4. Do not discuss any suspicious activity with others to minimize impact on a possible investigation.

5. If the potential incident involves an information system:

a) STOP using the information system. Wait for further instructions from your ISSO or the

IRT.

b) LOCK the system (e.g., Ctrl+Alt+Delete ' Lock Computer).

c) Do NOT tum it off, logout, or otherwise change anything.

d) Impossible, prevent others from physically accessing the system.

K. QUALITY CONTROL:

1.) The Contractor shall provide services under the te1ms and of this contract with staff capable of providing proper and adequate services and workmanship.

2.) The Contractor shall be responsible for monitoring and evaluating the safety, quality and appropriateness of services provided and shall maintain the quality control program.

L. METHOD OF PAYMENT AND INVOICE SUBMISSION:

Invoice Processing Platform (IPP) - The purpose of this guidance is to provide you support, since HHS and IHS are implementing an electronic invoicing system. The requirement to utilize this invoicing platform is in accordance with

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

HHSAR 352.232-71 Electronic Submission of Invoice Payment Requests (Feb 2022), which can be found in the terms and conditions section of your contract. The Invoice Processing Platform (IPP) is a secure, web-based electronic invoicing system provided by the U.S. Department of the Treasury’s Bureau of the Fiscal Service, in partnership with the Federal Reserve Bank of St. Louis (FRSTL). The Office of Management and Budget (OMB) M-15-19 memorandum “Improving

Government Efficiency and Saving Taxpayer Dollars through Electronic Invoicing” directs Federal agencies to adopt electronic invoicing as the primary means to disburse payment to vendors.

HHSAR 352.232-71 Electronic Submission of Invoice Payment Requests (Feb 2022)

(a) Definitions. As used in this clause—

Payment request means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system. Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with HHS procedures.

(d) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

(END OF CLAUSE)

If you require assistance registering or IPP account access, please contact the IPP Helpdesk at (866) 973- 3131 (M-F

8AM to 6PM ET), or IPPCustomerSupport@fiscal.treasury.gov.

Vendor Resources –

Vendor Webinars: Each month, IPP hosts a live, Web-based information session that provides an overview of IPP's electronic invoicing system, its benefits and features (including remittance download and payment notification options), and more. This is a great opportunity to learn the basics or call in and ask the IPP team questions about the IPP application.

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

Video Tutorial: The following video tutorial is intended to help users understand the process for logging in to the IPP Collector Module for the first time and the associated one-time log-in setup tasks

- Tutorial: IPP First Time Login.

As well as, a link to vendor landing site for IPP Training information:

https://www.ipp.gov/vendors/training-vendors.

M. DESIGNATED CONTRACTING OFFICERS REPRESENTATIVE (COR):

Carlos Quiñones, Diagnostic Radiologic Technologist, is hereby designated as POC/COR for this service. Her phone number is 928-669-3380. The POC/COR’s responsibilities will be to coordinate with the contractor the technical aspects of this service and the review of performance hereunder.

N. CONTRACTING OFFICERS REPRESENTATIVE (COR):

1.) The Contracting Officer shall designate the COR representing the Government for the purpose of this contract in writing. Such designation will set forth the duties specifically delegated in regard to the performance of this contract. A copy of the designation will be provided to the contractor.

2.) The major responsibility of the COR is to ensure Contractor accountability, monitor contract performance, and assist the Contractor in the resolution of program problems encountered during the performance of this contract.

3.) The COR shall be responsible for:

a) Monitoring the Contractor’s technical progress, including the surveillance and assignment of performance and recommending to the contracting Officer changes in requirements;

b) Interpreting Statement of Work;

c) Performing technical evaluation as required;

d) Performing technical inspection and acceptance required by the contract;

e) Assisting the contractor in the resolution of technical problems encountered during performance.

The COR’s responsibilities will be to coordinate with the contractor the technical aspects of this service and the review of performance hereunder. The COR does not have the authority to change or alter the order amount, terms and conditions.

O. CONTRACTING OFFICER:

The Contracting Officer is the only person with authority to act as the agent of the Government under this contract. Only the Contracting Officer has authority to: (1) Direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule;

(4) authorize reimbursement to the contractor for any costs incurred during the performance of this

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center contract; or (5) otherwise changes any Terms and Conditions of this contract. The Government my unilaterally change its COR designation.

P. ARIZONA STATE SALES TAXES:

The Department of Health and Human Service, Colorado River Service Unit is tax exempt for the following: 42-5074.B.8, 42-5071.B.2(a), 42-5061.A.25(b), AND 42-5159.A.13(d), State of Arizona Department of Revenue. (Copy of Certificate available upon request). Contractor is responsible for determining and paying all required taxes. The final proposal amount shall include all applicable taxes.

Q. POINT OF CONTACT (CLINICAL):

Derek Cox Telephone: 928-669-3380 Email: Derek.Cox@ihs.gov Parker Indian Health Center 12033 Agency Road Parker, AZ 85344

Carlos Quiñones Telephone: 928-669-3380 Email: Carlos.QuinonesGomez@ihs.gov Parker Indian Health Center 12033 Agency Road Parker, AZ

R. POINT OF CONTACT (TECHNICAL):

Ryan Lewis Telephone: 602-364-5283 Email: ryan.lewis@ihs.gov Phoenix Area Office 40 N. Central Ave.

Suite 605 Phoenix, AZ 85004

S. DEPARTMENT OF LABOR:

No contractor or subcontractor holding a service contract for any dollar amount shall pay any of its employees working on the contract less than the minimum wage specified in section 6(a)(1) of the Fair Labor Standards Act (29 U.S.C. 206).

The Department of Labor, Wage and Hour Division has issued a Wage Determination for laborers to be employed under this purchase order. Wage Determination applicable shall be based on the

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center location/s of contractor’s employees. This is pursuant to Federal Acquisition Regulation (FAR) 22.1108-2.

In addition, to paying employees appropriate hourly wages the contractor is responsible for fringe benefits applicable to all classes of service employees engaged in purchase order performance. Fringe benefits are not included in the hourly wages.

T. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA):

The Contractor shall adhere to the Provisions of Public Law 104-191, HIPAA of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI).

Medical records of IHS patients are Federal records and are subject to some or all of the following laws: the Privacy Act. 5 U.S.C. 552a; the Freedom of Information Act. 5 U.S.C. 552; the Drug Abuse Prevention. Treatment. and Rehabilitation Act. 21 U.S.C. 1101. the Comprehensive Alcohol Abuse and Alcoholism Prevention.

Treatment and Rehabilitation Act. 42 U.S.C. 4541. the Health Insurance Portability and Accountability Act of 1996.42 U.S.C. 1301. Fort Yuma Health Center's Confidentiality of Certain Medical Records. 38 U.S.C. 7332; Confidential Nature of Claims. 38 U.S.C. 5701; Medical Quality Assurance Records Confidentiality. 38 U.S.C. 5705. and Federal regulations promulgated to implement those acts. 38 U.S.C. 5705 (Confidentiality of Healthcare Quality Assurance Review Records), 38 U.S.C. 7332 (Confidentiality of certain medical records), as well as 45 C.F.R. Parts 160,162 and 164 (Health Insurance Portability and Accountability Act) should be followed.

U. MEDICAL RECORDS:

Patient medical records are confidential and are protected by the Privacy Act of 1974, 5 U.S.C. 552a.

Any breach of confidentiality and/or unauthorized release of information is subject to monetary penalty. Any individual making unauthorized disclosures may be criminally liable for violations of the Act.

V. BUSINESS ASSOCIATE AGREEMENT:

I. Authority:

Pursuant to 45 C.F.R. § 164.502(e), the Indian Health Service (IHS), as a covered entity, is required to enter into an agreement with a “business associate,” as defined by 45 C.F.R. § 160.103, under which the business associate must agree to appropriately safeguard Protected Health Information (PHI) that it will use and disclose when performing functions, activities or services pursuant to its contract with the IHS. By signing Contract No. (Contract), HHSI247201700016C agrees that it is a Business Associate and will comply with the terms below, in addition to other applicable Contract terms and conditions, and applicable law, relating to the safekeeping, use, and disclosure of PHI. This Appendix comprises the Business Associate Agreement (Agreement).

II. Definitions:

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

The following terms shall have the same meaning as those terms in 45 C.F.R. Part 160 and Part 164, which are the federal regulations implementing the Health Insurance Portability and

Accountability Act of 1996 (HIPAA), as amended: Breach, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy

Practices, PHI, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, and Use.

A. Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 C.F.R. § 160.103, and in reference to the party to this Agreement shall mean_____.

B. Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 C.F.R. § 160.103, and in reference to the party to this

Agreement, shall mean the IHS.

C. HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach

Notification, and Enforcement Rules at 45 C.F.R. Part 160 and Part 164.

D. Master Patient Index (MPI). The “Master Patient Index” or “MPI” is composed of a unique list of patients and a current list of medical centers where each patient has been seen. This enables the sharing of patient data between operationally and regionally diverse systems. Each record (or index entry) on the MPI contains a small amount of patient data used to identify individual entries.

The mission of the MPI is to uniquely identify a patient and to “link” that patient’s data throughout the IHS facilities using the Integration Control Number (ICN). The MPI is the authoritative source of a patient’s ICN, the enterprise-wide identifier for IHS facilities and the key to accessing a patient’s record. The accuracy of patient information and patient identification directly affect clinical, administrative, billing, and interdepartmental processes.

III. Obligations and Activities of Business Associate:

A. Compliance: Business Associate agrees not use or disclose PHI other than as authorized by the Agreement or as required by law. Business Associate acknowledges that it is directly liable under the HIPAA Rules and subject to civil and, in some cases, criminal penalties for making uses and disclosures of PHI that are not authorized by the Agreement or required by law. Business Associate agrees that it will require all of its agents, employees, subsidiaries, and affiliates, to whom Business Associate provides PHI, or who create or receive PHI on behalf of Business Associate for Covered Entity, to comply with the HIPAA Rules and to enter into written agreements with Business Associate that provide the same restrictions, terms, and conditions as set forth in the Agreement.

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

B. Subcontractors: In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), which govern relations with subcontractors, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit

PHI on behalf of Business Associate agree to the same restrictions, terms, and conditions that apply to Business Associate with respect to such PHI.

C. Safeguarding PHI: Business Associate shall develop and use appropriate procedural, physical, and electronic safeguards to protect against the use or disclosure of PHI in a manner not authorized by this Agreement or required by law.

Business Associate will limit any use, disclosure, or request for use or disclosure of PHI to the minimum amount necessary to accomplish the intended purpose of the use, disclosure, or request.

D. Safeguarding Electronic PHI: Business Associate agrees to use appropriate safeguards, as set forth in Subpart C of 45 C.F.R. Part 164 with respect to electronic

PHI, to prevent use or disclosure of electronic PHI other than as authorized by this Agreement or required by law.

E. Reporting Use or Disclosures Not Authorized By this Agreement or Required by

Law: Business Associate agrees to report to Covered Entity any use or disclosure of PHI not authorized by this Agreement or required by law within thirty (30) days of discovering the use or disclosure, or any security incident of which it becomes aware.

In addition, Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of the use, disclosure, or security incident.

F. Reporting of Breach: In accordance with the policy of the Department of Health and Human Services, Business Associate will report, within one hour of discovery, all suspected or confirmed breaches to Covered Entity.

G. Notification of Breach of Unsecured PHI: In addition to the above, Business

Associate shall notify Covered Entity of a breach, as set forth in 45 C.F.R. § 164.410, of the security of any unsecured PHI that Business Associate received from, or created or received on behalf of, Covered Entity within thirty (30) calendar days after the discovery of the breach by Business Associate, its employees, officers, and/or other agents, unless notification is specifically excepted by 45 C.F.R. § 164.412.

1. Requirements of Notice. Such notice shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such breach; a brief description of the circumstances of the breach of security, including the date of the breach and the date of Business Associate’s discovery of the breach; and the type of unsecured PHI involved in the breach. Business Associate agrees to provide any other available information that Covered Entity is required to

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center include in notification to the individual under 45 §164.404(c). In the event notification is delayed, evidence demonstrating the necessity of the delay shall accompany the notification.

H. Individual Access to PHI: Business Associate shall maintain a designated record set for each individual for whom it maintains PHI. In accordance with an individual’s right to access his or her PHI, Business Associate shall make available all PHI in the individual’s designated record set to the individual to whom that information pertains, or, upon the request of the individual, to that individual’s authorized representative, as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. §

164.524. Availability to access PHI shall be made within five (5) calendar days of receipt of a valid request.

I. Accounting of Disclosures: Business Associate shall maintain records of PHI received from, or created or received on behalf of, Covered Entity and shall document subsequent uses and disclosures of such information by Business

Associate. Business Associate shall, within five (5) calendar days after receiving a request from Covered Entity, provide to Covered Entity such information as Covered Entity may require to fulfill its obligations to account for disclosures of PHI pursuant to 45 C.F.R. § 164.528.

J. Amendment of PHI: Business Associate shall, within five (5) calendar days of a request by Covered Entity, make PHI available to Covered Entity for Covered Entity to fulfill its obligations under 45 C.F.R. § 164.526 to amend PHI and shall, as directed by Covered Entity, within five (5) calendar days of receipt of such direction, incorporate any amendments into PHI held by Business Associate. In addition, Business Associate shall ensure incorporation of any such amendments into PHI held by its agents or subcontractors within ten (10) days of such direction, and shall notify Covered Entity within five (5) calendar days of when those agents or subcontractors have completed the incorporation of the amendments. Business Associate shall forward to Covered Entity all requests to amend PHI that it receives directly from individuals within five (5) calendar days of its receipt of a request.

K. Carrying out Covered Entity’s Obligations: To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R.

Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).

L. Disclosures for Verifying Compliance: Upon request, Business Associate shall permit access by the Secretary and Covered Entity during normal business hours to its facilities, books, records, accounts, and any other sources of information, including PHI and any agreements that it has with subcontractors, vendors, and/or other agents relating to the use and disclosure of PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, for purposes of determining both Business Associate’s and Covered Entity’s compliance with the HIPAA Rules.

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

IV. Permitted Uses and Disclosures by Business Associate:

A. Business Associate shall not use or disclose PHI except to perform functions, activities, or services on behalf of Covered Entity as provided for in the Contract, this Agreement, the HIPAA Rules, or other applicable law.

B. Business Associate agrees that it may use or disclose PHI on behalf of Covered

Entity only:

1. Upon obtaining the authorization of the individual to whom the PHI pertains;

2. For the purposes of treatment, payment or health care operations unless Covered Entity has agreed to a restriction pursuant to 45 C.F.R. § 164.520(b)(iv)(A) or 45 C.F.R. § 164.522; or

3. Without an authorization or consent, if in accordance with 45 C.F.R. §

164.510, 45 C.F.R. § 164.512, 45 C.F.R. § 164.514(e), 45 C.F.R. § 164.514(f), or 45 C.F.R. § 164.514(g).

C. Business Associate shall use and disclose PHI in compliance with each applicable requirement of 45 C.F.R. § 164.504(e), which section is fully incorporated herein.

D. Business Associate agrees to make uses, disclosures, and requests for PHI consistent with Covered Entity’s minimum necessary policies and procedures.

E. It is anticipated that Business Associate will have access to the MPI.

F. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth below:

1. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

V. Obligations of Covered Entity:

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

A. Covered Entity shall provide Business Associate with its Notice of Privacy Practices and any changes to the Notice.

B. Covered Entity shall notify Business Associate of any limitation(s) in Covered

Entity’s Notice of Privacy Practices under 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

C. Covered Entity shall notify Business Associate of any change in, or revocation of, the permission by an individual to use or disclose his or her PHI to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

D. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

E. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as provided in Part IV, Subpart F, Section 1.

VI. Termination:

A. Term: The Term of this Agreement shall be effective as of the date Business

Associate signs the underlying Contract and shall terminate when the Contract ends or on the date covered entity terminates for cause as authorized in paragraph (b) of this Section, whichever is sooner.

B. Termination for Cause: Business Associate authorizes termination of this Agreement by Covered Entity, if Covered Entity determines Business Associate has violated a material term of the Agreement and Business Associate has not ended the violation within the time specified by Covered Entity.

C. Obligations of Business Associate Upon Termination: Upon termination of this Agreement for any reason, Business Associate, with respect to PHI received from

Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

1. Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

2. Return to Covered Entity, or, if agreed to by Covered Entity, destroy, the remaining PHI that Business Associate does not need to continue its proper management and administration or to carry out its legal responsibilities;

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

3. Continue to use appropriate safeguards, in compliance with Subpart C of 45 C.F.R. Part 164, with respect to electronic PHI to prevent use or disclosure of

4. electronic PHI, other than as provided for in this Part, for as long as Business Associate retains the PHI;

5. Not use or disclose PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out above, at Part IV, Subpart F, Section 1 of the Agreement which applied prior to termination;

6. Return to Covered Entity, or, if agreed to by Covered Entity, destroy, the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities; and

7. If Business Associate or its agent or subcontractor destroys any PHI, Business Associate will provide Covered Entity with documentation evidencing such destruction within thirty (30) days of completion of destruction.

D. Survival: The obligations of Business Associate under this Part shall survive the termination of this Agreement.

VII. Indemnification:

In the event Business Associate is investigated and/or becomes a party to a civil or criminal cause of action in any forum relating to its failure to comply with the HIPAA Rules, Business Associate shall reimburse Covered Entity all reasonable costs and expenses Covered Entity may incur relating to such investigation and/or cause of action, and will otherwise hold Covered Entity harmless for any and all reasonable costs and expenses relating to the foregoing.

VIII. Miscellaneous:

A. Incorporation: This Agreement is attached to and fully incorporated into the Contract.

B. Notices: All notices under this Agreement shall be provided by certified mailing, and shall require proof of date of receipt.

C. Regulatory References: A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

D. Amendment: The Parties agree to take such action as is necessary to amend this

75H71219P00037 Off-Site Teleradiology Interpretation Services Colorado River Service Unit and Peach Springs Health Center

Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.

E. Interpretation: Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.

F. Successors and Assigns: This Agreement shall be binding upon, inure to the benefit of and be enforceable by and against the Parties and their successors and assigns.

G. Severability: If a court of competent jurisdiction deems any provision of this Agreement unenforceable, such provision shall be severed from this Agreement and every other provision of the Agreement shall remain in full force and effect.