UPDATED PWS (POST REVIEW) SEP 2025.pdf

PERFORMANCE BASE WORK STATEMENT

Annual Maintenance

Martin Army Community Hospital (MACH) Fort Benning, Georgia

GENERAL: The contractor shall provide annual support and maintenance for the following Drager Anesthesia equipment.

Equipment Type Serial numbers Dräger Atlan A350 XL Anesthesia Machines

ASTM-0486, ASTM-0486, ASTM-0488, ASTM-0487, ASUA-0450, ASUA-0449, ASUA-

0448, ASUA-0451

Dräger Apollo Anesthesia Machine

ASFL-0064

Dräger Vaporizers ASTL-0199, ASTL-1141, ASTL-1143, ASTL-0196, ASTL-0197, ASTL-1144, ASTL-1142, ASTL-0198, ASUA-0136, ASUA-0763, ASUA-0139, ASUA-0765, ASUA-0137, ASUA-0764, ASUA-0138, ASUA-0762

1. The services to be provided are described in the Performance Work Statement. This contract is a non-personal services contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control prevailing in relationships between the government and its employees.

1.1 Scope of Work: During the term of this contract, if the equipment is defective in workmanship or materials, or if the software fails to operate in accordance with Original Manufacturer Specifications (OMS), the contractor shall repair or replace defective parts, software, or the equipment to return the system to fully operational condition.

1.2 Qualifications: Upon request, the contractor shall provide written evidence that service personnel to be utilized on this contract shall have either been trained by the Original Equipment Manufacturer (OEM) on the specific equipment they service and have at least 2 years of experience or have an Associate Degree in Biomedical Technology or Electronics with a minimum of 3 years’ experience servicing the specific equipment.

1.2.1 Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

1.3 QUALITY CONTROL: The contractor shall submit a quality control inspection system to the Contracting Officer (KO) and the government representative This should include descriptions of persons and positions charged with the responsibility of making inspections, methods of identifying deficiencies in services, and in quality control functions. Final copy of the Contractor’s Quality Control Plan shall be required and submitted to the Contracting Officer for approval not later than ten (10) days after award.

1.4 HOURS OF OPERATION.

Monday – Friday 7:30 am to 4:00 pm SAFETY REQUIREMENTS: The government and the contractor’s service representative will exchange hazard communication information before the commencement of any repair.

When required, the contractor’s service representative will comply with The Office of Safety and Health Administration (OSHA) lockout/tag-out standards while performing maintenance on medical devices and or medical device systems (MD/MDS).

1.5 Security Requirements: The contractor shall be responsible for the security of all beneficiaries’ information.

1.5.1 Neither the contractor nor any of its contract service providers shall disclose or cause to disseminate any information concerning operations of military activities. Such action(s) could result in violation of the contract and possible legal actions.

1.5.2 All inquiries, comments or complaints arising from any matter observed, experienced, or learned of because of or in connection with the performance of this contract, the resolution of which may require the dissemination of official information, shall be directed to the Contracting Officer.

1.5.3 The contractor shall only conduct business with designated government personnel listed as points of contact (POCs).

Names of authorized personnel shall be provided to the contractor by the government, in writing, and updated as necessary throughout the contract period.

1.5.4 U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports are maintained by the contractor, but remain the property of the U.S. Government. These files/results must be surrendered to the government personnel.

1.5.5 The contractor shall comply with agency personal identity verification procedures in all subcontracts when the subcontractor is required to have physical access to a federally controlled facility or access to a federal information system.

1.5.6 For contractors that do not require CAC but require access to a DoD facility or installation. The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office.

The contract’s employee shall not be permitted on the installation when their presence is considered detrimental to the security of the installation. The government reserves the right to remove from the job site any contract’s employee whose continued employment is not consistent with the interest of military security or who is found to be otherwise impaired.

1.5.7 Contractor service representative shall report in person or telephonically notify the maintenance manager, building 9250, room GC 122, telephone number 762-408-1605, and prior to commencing services during normal duty operating hours 7:30 am to 4:00 pm to sign in and obtain a badge. Contract personnel are required to wear hospital visitor badges while onsite. During other than normal operating hours, the contractor’s representative shall report to the Administrative Office of the Day (AOD), building 9200, Room 38 to sign in and obtain a badge. Contract personnel are required to wear hospital visitor badges while onsite. Personnel must return badges to room 38 and sign out upon leaving the premises.

1.5.8 Contract personnel shall by government personnel while conducting work on the premises.

1.5.9 General Government Oversight Instructions for All Government Data Including Protected Health Information.

1.5.10 The contractor shall correct any deficiencies identified by the Army of the contractor's physical security posture through contract modification.

1.6 VEHICLE REGISTRATION: The contractor’s service representative shall comply with all applicable requirements of Fort Benning, Maneuver Center of Excellence (MCoE) Regulation No. 190-5, Motor Vehicle Traffic Regulation, in effect during the performance of this contract.

1.7 VEHICLE OPERATION: Contractor personnel operating motor vehicles on the installation shall have a valid state license for the category of vehicle being operated and shall comply with vehicle operation directives regarding motor vehicle use on the installation.

1.8 DEFINITIONS AND ABBREVIATIONS

1.8.1 DEFINITIONS:

CONTRACTOR. The term as used in this contract refers to the prime contractor.

CONTRACTING OFFICER. A person with authority to enter a contract; administer or terminate contracts or make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

GOVERNMENT REPRESENTATIVE. An employee of the U.S. Government appointed by the contracting officer to monitor contractor performance. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

PHYSICAL SECURITY. Actions that prevent the loss or damage of government property.

QUALITY ASSURANCE. The government procedures to verify that services being performed by the contractor are performed according to acceptable standards.

QUALITY CONTROL. All necessary measures taken by the contractor to assure that the quality of an end product or service shall meet contract requirements.

SUBCONTRACTOR. One that enters into a subcontract and assumes some of the obligations of the primary contractor.

WORKDAY. Monday through Friday, 8:00 A.M. to 4:30 P.M and Saturday from 8:00 A.M. to 4:00 P.M. EST.

WORK WEEK. Monday through Sunday (dependent on workload and mobilization requirements).

SCHEDULED MAINTENANCE: The scheduled care and servicing of equipment for the purpose of the equipment to be maintained in a serviceable condition in accordance with the manufacturer's specifications.

UNSCHEDULED MAINTENANCE: Repair action necessary to return the equipment to a totally operational condition as it was designed to operate in accordance with the manufacturer's specifications.

QUALITY CONTROL PLAN: The contractors' written plan describes how he will ensure the performance of the services required by the contract are met or exceeded. At a minimum, the contractor's Quality Control Plan will include:

- Method for acquiring acceptable replacement parts.

- Inspection intervals and a copy of the checklist to be used by the contractors QA Inspector.

REPLACEMENT PART: A component or module of the existing system or approved upgraded/modified system requiring replacement through a fault developed through normal use or normal wear and tear. Replacement parts do not include consumable supplies. Replacement parts include components that are installed solely for cosmetic appearance i.e. cowlings, molding, keyboard keypad set.

OEM: Original Equipment Manufacturer.

1.8.2 ABBREVIATIONS

ADP Automated Data Processing ALP Acceptable Level of Performance AMA American Medical Association AOD Administrative Officer of the Day AR Army Regulation

AT Anti-Terrorism ATO Antiterrorism Officer MACH Martin Army Community Hospital CAC Common Access Card CDR Contract Discrepancy Report; Commander CHCC Center for Health Care Contracting CLIN Contract Line Item Number CIS Clinical Information System DA Department of the Army DCCS Deputy Commander for Clinical Services DOD Department of Defense EMS Emergency Medical Service FAR Federal Acquisition Regulation GFP Government Furnished Property HIPAA Health Insurance Portability & Accountability Act of 1996 IAW In accordance with ID Identification IS Information System(s) KO Contracting Officer LOSS Line of Sight Supervision MD/MDS Medical Device/Medical Device System MEDCOM Medical Command MEDDAC Medical Department Activity MTF Military Treatment Facility NCOIC Noncommissioned Officer in Charge OIC Officer in Charge OPSEC Operations Security OSHA Occupational Safety and Health Administration PAM Pamphlet PHI Protected Health Information PL Public Law POC Point of Contact POP Period of Performance PBWS Performance Based Work Statement QA Quality Assurance QC Quality Control SOP Standard Operating Procedures TJC The Joint Commission (formerly known as JCAHO)

1.9 GOVERNMENT FURNISHED PROPERTY

1.9.2 Facilities. The government will provide the necessary workspace for contractor to support the tasks outlined in the PWS.

1.9.3 Government Services. The government will provide copier and guest Wi-Fi services when available. The contractor shall request the guest Wi-Fi access code from the government representative.

1.9.4 Utilities. The government will provide all standard facility utilities such as electricity, water, etc., for the contractor’s use in the performance of this PWS.

1.9.5 The contractor shall safeguard all government property provided to the contractor for repair. If contractor causes damages to government property, supplies, and /or equipment, while performing services on site, the contractor may be held accountable.

1.10 CONTRACTOR FURNISHED PROPERTY AND RESPONSIBILITIES.

1.10.1 The contractor shall provide all labor, material, supplies, tools, diagnostic software, test equipment, and portal/database except for those identified in Section 3, Government-Furnished Items and Services, necessary to perform MD/MDS maintenance and repair services.

1.10.2 The contractor shall provide a toll-free telephone number for service calls.

1.11 REPORTS: Upon completion of services by the contractor, a service report shall be provided to the clinical engineering manager or the administrative officer of the day (AOD). The service report shall provide detailed information regarding the cause of the MD/MDS malfunction and corrective action taken. It will include, at a minimum, the time required to complete the work, price of labor (hourly rate), and a list of parts replaced with part numbers and prices for each part prior to leaving the facility.

1.11.1 In the event all information is not available to the contractor’s service representative when services are performed, the initial service report/invoice shall include all available information to close work order within 5 days. The contractor shall provide the balance of the required information to the clinical engineering manager no later than 10 days after services are completed.

1.12 SPECIFIC TASKS.

1.12.1 The contractor shall provide for the furnishing of two scheduled preventative maintenance and all unscheduled emergency repairs of installed Draeger brand Anesthesia equipment. Coverage includes all scheduled PM parts, PM kit installation, includes all unscheduled repairs and repair parts and calibration of devices, labor, travel, tools, and test equipment necessary to maintain and/or restore the contracting equipment to operating specifications according to manufacturer’s recommendations. Contract response time for emergency, warranty, and contracted maintenance services are scheduled by the Draeger Triage Center, repair services are available 24 hours a day, seven days a week. Telephone response times, upon a clinical engineer contacting the Triage Center for a service request, a field service technician should respond via telephone or onsite within two hours during the term of this contract.

1.13 Contract Management. The contractor shall ensure contractual compliance to basic contract, and contract changes/modifications.

1.13.1 Labor and materials necessary to maintain the Apollo and Fabius Tiro Anesthesia units and the D-Vapor 2000 Anesthesia unit vaporizers to OEM specifications. Upon notification by Equipment Maintenance Branch Clinical Engineer personnel of a problem with the Apollo, Fabius Tiro and D-Vapor 2000 units, the contractor shall provide labor/materials necessary to return unit to fully functional capability. If on site serviced is required, contract service personnel shall report to Building 9250 room GC122 to sign in.

1.13.2 A government representative must be physically present and capable of observing contractor personnel during any service activity that requires a key, ID, or password, or in any situation in which contractor personnel have access to the government’s inventory.

1.13.3 After performing Calibration/Verification/Certification services, the Contract Officer Technical Representative (COTR) will affix and/ or update DD Form 2163 (Medical Equipment Verification/Certification) in accordance with the instructions provided in TB 38-750-2, or by the clinical engineering activity’s internal SOP.

1.13.4 Contractor must furnish all software upgrades issued by the medical device/medical device systems (MD/MDS) manufacturer.

1.13.5 Contractor shall have access to all necessary diagnostic software.

1.13.6 Contractor shall use only OEM new or OEM refurbished repair parts.

1.13.7 Authorized access to the government network for all vendors is via a Business-2-Business (B2B) connection. If access is required, you must contact the hospital Information Management Division to receive the required paperwork. Once all the paperwork is submitted and approved the B2B connection shall be established for the system requested.

1.13.8 Provide onsite repair within twenty-four (24) hours of notification.

1.13.9 To ensure accountability of equipment and proper handling of sensitive information, all equipment (Servers, Workstations etc…) and components exchanged by the contractor during maintenance shall be processed through the Property Book Office (PBO), MACH, before the contractor leaves the premises or within 24 hours (1 workday) workdayweekend or holiday. Any changes in serial numbers, models numbers, etc…will be clearly identified by line for each/any changes to the equipment on any documentation provided to the PBO, MACH.

1.13.10 System Down-Time. The system cannot be inoperable greater than forty-eight (48) hours.

Exhibit A, IARC

(End of Summary of Changes)

Performance Requirements Summary

END OF THE PERFORMANCE WORK STATEMENT

SUPPLEMENT TO THE PERFORMANCE WORK STATEMENT

SUPPLEMENT TO THE PERFORMANCE WORK STATEMENT

1. GOVERNMENT HOLIDAYS

The following Government Holidays are observed:

New Year’s Day Martin Luther King Jr.’s Birthday President’s Day Memorial Day Juneteenth Day Independence Day Labor Day Columbus Day Veteran’s Day Thanksgiving Day Christmas Day

Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contractor is scheduled to perform maintenance is closed due to a holiday declared by an Executive Order and the contractor is not required to report in, contractor shall service equipment on the available day staff will be present. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

2. Invoicing and Payment The contractor shall submit monthly, in arrears, itemized invoices in accordance with DFARS 252.232-7003 & 252.232-7006, for services rendered under this contract. Information regarding Wide Area Workflow is available on the Internet at https://piee.eb.mil

3. TOBACCO FREE MEDICAL CAMPUS (TFMC)

The Contractor shall ensure that all contract personnel comply with the U.S. Army Medical Command and MTF smoking policies while performing services under this contract. Smoking restrictions will apply at any location or building where health care activities are performed under this contract.

In accordance with Army Regulation 600-63, paragraph 7-3, 14 April 2015; Operations Order 15-48 (Army Medical Command (MEDCOM) Tobacco Free Living – USAMEDCOM), 8 May 2015; and any Operations Order, regulation or other instruction implementing, defining or otherwise addressing the Tobacco Free Medical Campus (TFMC) on any military installation or DoD-controlled location, Contractor personnel are prohibited from using any tobacco product on or within any TFMC while performing under this contract. TFMCs are established at each installation or DoD-controlled location and include: (1) any property or non-residential building that is operated, maintained or assigned to support medical activities, including but not limited to, hospitals, medical laboratories, outpatient clinics (including medical, dental, and veterinary facilities), or aid stations operating for the primary purpose of delivering medical care and services for DOD eligible beneficiaries and /or meeting the mission of the Army Medical Command; (2) all other facilities in which medical activities or administration take place, to include HQ MEDCOM and Defense Health Headquarters; (3) all internal roadways, sidewalks and parking lots; and (4) all sidewalks, parking lots and grounds external but adjacent to the building or related to the migratory corridors surrounding the medical facility. The contractor shall obtain from the Government Representative any orders, regulations, instructions or other documents implementing, defining or otherwise addressing the TFMC for any given installation or DoD-controlled location where contractor personnel may perform under this contract and shall instruct contractor personnel on the TFMC limitations for installations or DoD-controlled locations where they may perform under this contract.

4. EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE PROGRAM Exclusion from Participation in Federal Health Care Programs (October 2015)

a. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of people in executive or leadership roles and administrative and management services, whether such services are billed separately. The LEIE may be found at h ttp://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at h ttp://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of- H ealthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

b. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the Lists and no such names appear on either of the Lists.

c. During performance of the contract, and prior to persons other than those whose names were queried in accordance with https://piee.eb.mil/ http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

d. The Contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of contractor personnel working in the MTF against the Lists, as specified in OTSG/MEDCOM Policy Memo 15-037. The Government will notify the Contractor in the event any contractor personnel working in the MTF appear on either of the Lists.

e. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

f. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

g. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a- 7a): There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at h ttp://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

5. Personally Identifiable Information, Protected Health Information, and Federal Information Requirements (Revised 10/27/2020)

General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

1. DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019, and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and http://www.dtic.mil/whs/directives are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS).

These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA) The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action.

Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA http://www.foia.gov/ mailto:DHA.FOIA@mail.mil http://www.defenselink.mil/privacy/documents/pa1974.pdf mailto:DHA.PrivacyAct@mail.mil mailto:DHA.PrivacyAct@mail.mil

Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the

SORN.

5. Privacy Impact Assessment (PIA) If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSA for De-Identified Data DSA for PHI DSA for PII Without PHI DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (Applies if contract requirements may include human subject research) This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code.

Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

7. Privacy Act and HIPAA Training The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

http://www.tricare.mil/tma/privacy/Templates.aspx

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Government Representative within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

8. HIPAA Business Associate Provisions

8.1 Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Privacy-Contract-Language/HIPAA-Compliant- Business-Associate-Agreement-for-the-MHS. b.i. and (3)b.ii.

9. Breach Response [This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference.

9.1 Definitions Related to Breach response

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for another than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

9.1.3 A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

How the event was discovered.

Did the information stay within the covered entity’s control.

Was the information accessed/viewed; and Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4 A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

9.1.5 An HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS https://www.health.mil/Military-Health-Topics/Privacy-and-Civil-Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.

The unauthorized person who used the PHI or to whom the disclosure was made.

Whether the PHI was acquired or viewed; and The extent to which the risk to the PHI has been mitigated.

9.1.6 A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI.

However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

9.2 General

9.2.1 The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

9.2.2 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to breaches and cybersecurity incidents.

The contractor should consult with the DHA Privacy Office where guidance is needed, such as when the contractor is uncertain whether a discovered breach is the contractor’s responsibility (e.g., if the contractor discovers a breach not caused by the contractor), or how the contractor is to classify an incident (breach vs. non-breach, confirmed vs. possible, cyber vs. non-cyber).

Under no circumstances will a contractor delay reporting a confirmed or possible breach to the DHA Privacy Office beyond the 24-hour deadline. In conjunction with its initial investigation, the contractor shall immediately take steps to minimize any impact from the occurrence, proceed with further investigation of any relevant details (such as root causes, vulnerabilities exploited), and initiate further breach response steps.

9.2.4 In the event of a cybersecurity incident not involving a PII/PHI breach, the contractor shall follow applicable DoD cybersecurity and NIST requirements, which include United States- Computer Emergency Readiness Team (US-CERT) reporting (see paragraph 9.3). If at any point a contractor finds that a cybersecurity incident involves a PII/PHI breach (possible or confirmed), the contractor shall immediately initiate the reporting procedures set forth below. The contractor shall also continue to follow any required cybersecurity incident response procedures and other applicable DoD cybersecurity requirements.

9.2.5 Contractors shall require subcontractors who discover a possible breach or cybersecurity incident to initiate the incident response requirements herein by reporting the incident to the contractor immediately after discovery. The time of that report to the contractor shall trigger the contractor’s DHA Privacy Office reporting deadline (24 hours) under paragraph 9.3.2. If a cybersecurity incident is involved, the contractor’s deadline for US-CERT reporting (1 hour) runs from the time the incident is confirmed. The contractor shall require the subcontractor to cooperate as necessary to meet these deadlines, maintain records, and otherwise enable the contractor to complete the breach response requirements herein. Alternatively, the contractor and subcontractor may agree that the subcontractor shall report directly to US-CERT and the DHA Privacy Office, and that the subcontractor shall be responsible for completing the response process, provided that such agreement requires the subcontractor to inform the contractor of the incident and the subsequent response actions.

9.2.6 Contractors shall maintain records of all breach and cybersecurity incident investigations, regardless of the outcome.

Investigations identifying unauthorized disclosures must be logged for HIPAA and Privacy Act disclosure accounting purposes, whether individual notification is required under the HIPAA Breach Rule.

9.2.7 Contractors, when acting as HIPAA-covered entities, and not as business associates, are not subject to the breach response requirements herein. However, such contractors are subject to both the HIPAA Breach Rule (applicable to them in their capacity as covered entities) and DoD cybersecurity requirements (applicable to them in their capacity as DoD contractors).

9.3 Reporting Provisions

9.3.1 Immediately upon discovery of a possible or confirmed breach or cybersecurity incident, the contractor shall initiate an investigation. If the incident involves electronic PII/PHI, and if the investigation finds a confirmed breach or cybersecurity incident, the contractor shall report it, within 1 hour of confirmation, to the US-CERT Incident Reporting System at https://forms.us- cert.gov/report/, as required by the Department of Homeland Security (DHS).

Note: DHS no longer requires US-CERT reporting of non-cyber breaches or unconfirmed electronic breaches. However, DHS permits US-CERT reporting of unconfirmed cyber-related incidents on a voluntary basis. Thus, if a contractor is uncertain whether a possible cyber-related incident should be treated as confirmed and thus reportable, the contractor may voluntarily report the incident.

Before submission to US-CERT, the contractor shall save a copy of the on-line report. After submitting the report, the contractor shall record the US-CERT incident reporting number, which shall be included in the initial report to the DHA Privacy Office as described in paragraph 9.3.2.

Note: Regardless of whether an incident is confirmed as a breach, the contractor must also investigate whether the incident impacts data integrity or availability of PII/PHI. If such impact is confirmed, then the incident is reportable to US-CERT as a cybersecurity incident. For guidance on investigating the impact on data integrity and availability, refer to DoD cybersecurity and NIST guidance.

The contractor shall provide any updates to the initial US-CERT report by email to soc@us- cert.gov, with the Reporting Number in the subject line. The contractor shall provide a copy of the initial or updated US-CERT report to the DHA Privacy Office if requested. Contractor questions about US-CERT reporting shall be directed to the DHA Privacy Office, not the US- CERT office.

9.3.2 In addition to US-CERT reporting, the contractor shall report to the DHA Privacy Office by submitting the form specified below within 24 hours of discovery of a breach (possible or confirmed), unless the breach falls within a category that the Privacy Office has determined to be not reportable. This 24-hour period runs from the time of discovery, unlike the 1-hour US- CERT reporting period, which runs from the time a cybersecurity incident is confirmed. Thus, depending on the time needed to confirm, the report to the DHA Privacy Office may be due either before or after the US-CERT report.

The breach report form required within the 24-hour deadline shall be sent by e-mail to: DHA.PrivacyOfficer@mail.mil. The contractor shall also e-mail the report to the CO, the Government Representative and its usual point of contact at the applicable Program Office. Encryption is not required, because reports and notices shall not contain PII/PHI. If electronic mail is not available, telephone notification is also acceptable (at 703-275-6363), but all notifications and reports delivered telephonically mailto:DHA.PrivacyOfficer@mail.mil must be confirmed in writing as soon as technically feasible.

Contractors shall prepare the breach reports required within the 24-hour deadline by completing the Breach Reporting Department of Defense Form DD 2959 (Breach of PII Report), available at https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd2959.pdf. For non-cyber incidents without a US-CERT number, the contractor shall assign an internal tracking number and include that number in Box 1.e of the DD Form 2959. The contractor shall coordinate with the DHA Privacy Office for subsequent action, such as beneficiary notification, and mitigation.