Scriptpro_PWS_6.29.16.pdf

Performance of Work for ScriptPro Equipment

1. GENERAL. This is a non-personal service contract. The Contractor shall provide qualified personnel in accordance with (IAW) this basic Performance Work Statement (PWS) and as further defined by each issued task order’s specific PWS.

1.1. Scope of Work. The Contractor shall provide all labor, supplies, tools, material, transportation, parts, and equipment to provide service and support to maintain the Government owned ScriptPro equipment in support of the Medical Treatment Facilities (MTF) within the area of responsibility of U.S. Army Medical Command (MEDCOM), Regional Health Contracting Office – Central (Provisional) (RHCO-C). This includes unlimited telephonic assistance and unlimited on-site maintenance repairs.

1.2. Period of Performance: The period of performance is a base year period plus two additional one-year option periods as follows:

Base Year 1 October 2016 – 30 September 2017 Option Period 1 1 October 2017 – 30 September 2018 Option Period 2 1 October 2017 – 30 September 2019

1.3. Hours of Operation: Monday through Friday, 7:00 am. to 5:00 p.m. for on-site repairs and 24 hour telephonic assistance, excluding national holidays and weekends. Specific hours will be identified on the individual task order.

1.4. Place of Performance. The place of performance will be identified in the individual task orders.

1.5. Holidays: The following federal holidays are observed by the Government.

New Year’s Day 1st January Martin Luther King Jr.’s Birthday 3rd Monday in January President’s Day 3rd Monday in February Memorial Day Last Monday in May Independence Day 4th of July Labor Day 1st Monday in September Columbus Day 2nd Monday in October Veterans Day 11th November Thanksgiving Day 4th Thursday in November Christmas Day 25th December

When one of the above designated legal holidays falls on a Sunday, the following Monday will be observed as a legal holiday. When a legal holiday falls on a Saturday, the preceding Friday is observed as a holiday. This list of holidays relates to Government duty days, and is not intended to supplement or otherwise alter the provisions of the Wage Determination regarding paid holidays.

1.6. Key Personnel. The Contractor shall provide a work force possessing the skills, knowledge, and training to satisfactorily perform the services required by this contract. Personnel performing work under this contract shall remain employees of the Contractor and will not be considered employees of the Government.

1.6.1. The Contractor shall provide technically competent field service technicians within the timeframe stated in each individual task order. Contractor shall report to or telephonically notify the Government representative.

1.6.2. Personnel Qualifications. The Contractor shall ensure ScriptPro equipment field service technicians are qualified and manufacture trained on the specific model of Government ScriptPro equipment. In addition to this training, the field service technicians must have proof of two years of working experience, effective with the current date. The contractor prior to service commencing shall present documented proof of successful completion of experience and training.

1.6.3. Contract Representative (POC). The contractor shall designate a primary and alternate point of contact to act as the representative responsible for the coordination of work performed under the contract/task order and shall have the authority to act or make decisions for the contractor on all matters pertaining to the contract. The Contractor shall provide this information to the Government representative. Any changes shall be provided to the Government representative in writing within 72 hours of change.

1.7. Conduct of Personnel. The Contracting Officer (KO) may require the Contractor to remove any employee working under this contract for reason of misconduct, security, or found to be under the influence of alcohol, drugs, or other incapacitating agent. Contractor employees shall be subject to dismissal from the premises upon determination by the KO that such action is necessary in the interests of the Government. The installation commander has the authority to bar individuals from the installation. Removal from the job site or dismissal from the premises shall not relieve the Contractor of the requirement to perform the services as required by this work statement.

2. DEFINITIONS. (acronyms)

2.1 Administrative Officer of the Day (AOD)

2.2. Contracting Officer’s Representative (COR): A government employee selected and designated in writing by the contracting officer to act as his/her designated representative in administering a contract/task order.

2.3. Government Representative: Government point of contact identified on individual task order.

2.4. Quality Assurance Plan. The Government will establish and maintain a Quality Assurance Surveillance Plan (QASP) to ensure that the quality of service is being provided and meet and exceed the specifications, terms and conditions of the contract.

2.5. Quality Control: Contractor’s actions to control and ensure contract compliance.

2.6. Quality Control Plan: The Contractors’ written plan describes how they will ensure the performance of the services required by the contract are met or exceeded. At a minimum, the Contractor’s Quality Control Plan will include:

2.6.1. Method for acquiring acceptable replacement parts.

2.6.2. Inspection intervals and a copy of the checklist to be used by the Contractor’s QA Inspector.

2.7. OEM: Original Equipment Manufacturer.

2.8. Preventive Maintenance (PM): Maintaining equipment IAW the OEM’s standards and providing systematic inspection, detection, and correction of incipient failures either before they occur or before they develop into major defects.

2.9. Replacement Part: A component or module of the existing system or approved upgraded/modified system requiring replacement through a fault developed through normal use or normal wear and tear. Replacement parts do not include consumable supplies. Replacement parts include components that are installed solely for cosmetic appearance i.e. cowlings, molding, keyboard keypads (when the key designation is work off), etc.

2.9. Scheduled Maintenance: The scheduled care and servicing of equipment for the purpose of the equipment in a serviceable condition IAW the manufacturer’s specifications.

2.10. Service and support: Systematic procedure as defined by the Original Equipment Manufacturer (OEM) specifications for defined operation. Insures equipment operates within all OEM’s parameters for maximum performance and patient quality of care.

2.11. Unscheduled Maintenance: Repair action necessary to return the equipment to a totally operational condition as it was designed to operate IAW the manufacturer’s specifications.

3. GOVERNMENT FURNISHED PROPERTY AND SERVICES:

3.1. Equipment: Each task order issued by the Government will specify and describe all associated Government furnished equipment, data, information, documentation, and facilities, as well as its: accessibility and condition; maintenance, preservation, safeguarding and care requirements, coordination point(s) of contact, and the availability of such equipment, information, and facilities. The equipment covered under this contract will be made available to the Contractor for the purpose of scheduled or unscheduled service. The Contractor shall obtain Government representative approval for the time and duration of the service to be conducted and shipping instructions.

3.2. Property: The Contractor shall not use property provided by the Government for any purpose other than in the performance of this contract.

3.3. Utilities: Reasonable amounts of electric power and other utilities will be provided to the Contractor to perform required services. The Contractor is responsible for conserving utilities while working in the installation.

4. CONTRACTOR FURNISHED EQUIPMENT: Only the property and services referenced in paragraph 3.1 and 3.2 will be provided to the Contractor to perform required services. All other property and services required in the performance of this contract shall be furnished by the Contractor. For example:

4.1. Tools

4.2. Test equipment

4.3. Current service manuals with guaranteed ability to provide product updates, guaranteed to provide factory mandated equipment modifications, schematics, wiring diagrams and troubleshooting guides. Failure to provide product updates or factory mandated modifications is grounds for contract termination.

4.4. All other items necessary to perform service such as common hardware, connectors, tubing and etc.

4.5. Replacement Parts. The Contractor shall have ready access to unique and/or high mortality replacement parts. All parts shall be compatible with the ScriptPro equipment.

4.5.1. All replacement parts shall become the property of the Government and the replaced malfunctioning part shall become the property of the Contractor.

4.5.2. Freight, postage and storage charges associated with shipment and receipt of replacement parts and the return of work or defective parts shall be the responsibility of the Contractor.

4.5.3. The Contractor shall use only new or reconditioned parts for which the quality is equal to or better than the OEM’s original part. Any parts provided by the Contractor considered by the OEM to be substandard may be replaced at the Contractor’s cost. When discrepancies occur, the Government representative will make the final determination about whether a replacement part is of equal or better quality.

4.5.4. The Contractor shall provide all replacements and service necessary to restore the equipment to 100% operational condition as specified by the OEM.

4.6. Specific Equipment and Software to be covered IAW site specific requirements and will be included with task orders.

5. SPECIFIC TASKS TO BE PERFORMED:

5.1. Services shall be provided as required IAW the PWS and IAW the terms and conditions of the contract.

5.1.2. Services, labor, parts and materials. The Contractor shall provide services, labor, parts, and materiel necessary to cause subject equipment to be in proper working condition IAW the OEM's specifications at the completion of each service call. Equipment shall not be removed from site unless approved by the Government.

5.1.3. Preventive Maintenance and Calibration. Preventive Maintenance (PM) and Calibration shall be in accordance with the OEM’s checklist. The Contractor shall schedule the PM and Calibration and coordinate the scheduled date with the Government representative.

5.1.3.1. All equipment repairs or modifications made shall be in compliance with the manufacturer’s specification and Food and Drug Administration guidance.

5.1.3.2. Work shall be performed at location(s) identified on individual task order.

5.2. Preventive Maintenance and Calibration. Preventive Maintenance (PM) and Calibration shall be IAW the OEM’s checklist. The Contractor shall schedule the PM and Calibration and coordinate the scheduled date with the Government representative.

5.2.1. Upon completion of calibration, the Contractor shall affix a DD Form 2163 (Medical Equipment Calibration/Verification/ Certification) to the control panel of the equipment in plain view. If the form is already present, it will be annotated with the new date and initialed. (Forms to be provided by Government representative as needed).

5.2.2. The Contractor shall complete repairs within the time frames indicated.

5.2.3. If equipment requires a major disassembly or major overhaul, a replacement product or part shall be ordered and the replacement part or product shall become the property of the Government site and the non-functioning component shall become the property of the Contractor.

5.3. Modifications and updates. The Contractor shall perform OEM specified modifications and software updates with the consent of and without charge to the Government. Resultant Contractor must have direct contact with the OEM to accomplish field modifications to equipment IAW the time schedule set forth by the OEM. All modifications and upgrades will be documented in the government owned operator and service literature.

5.4. Service calls. The Government representative will initially evaluate any equipment malfunction and facilitate repairs (screening process). If a service call is necessary, the Contractor shall provide unlimited service calls. The MTF will determine if the required repair service is emergency or routine.

5.4.1. The Contractor shall perform routine repair service during normal duty hours. Contractor response time shall be within 24 clock hours after telephonic notification excluding weekends and Legal Public Holidays.

5.4.2. Repair completion time for a routine repair service shall not be more than 96 clock hours after telephonic notification excluding weekends and Legal Public Holidays for critical or major severity level issues. Only the designated Government representative will make requests for repairs.

5.5. Identification Badges. Contractor personnel shall wear a vendor identification badge at all times when performing services at the Government site. Identification badges shall be worn in a clearly visible area of the field service technician’s outer garment. The badge will be furnished by Government representative.

5.6. Service Reports. The Contractor shall prepare a service report for each job performed.

During duty hours, the service reports will be authenticated with the Government representative during normal duty hours and with the Administrative Officer of the Day (AOD) after normal duty hours.

5.6.1. On weekends and after normal duty hours, service tickets shall be given to the Government representative.

5.6.2. In the event that all information is not available to the Contractor's field service technician when services are performed, the initial service report shall include all information available.

Contractor shall provide the balance of the required information in writing to Government representative not later than 10 days after services are completed.

5.6.3. Contractor shall provide a copy of the invoice to the Government representative for verification of services performed.

5.6.4. The service reports shall include the following information as a minimum:

5.6.4.1. Government contract number

5.6.4.2. Equipment identification data

5.6.4.3. System nomenclature, room number, location, model and serial number

5.6.4.4. Purpose of service (scheduled service or unscheduled service call)

5.6.4.5. Start date/time and completion date/time

5.6.4.6. Description of defect and corrective action taken

5.6.4.7. List of parts and cost. Total cost of service to include labor and parts

5.6.4.8. Explanations of any deferred or delayed repair action with an estimated get well date.

5.7. Calibration Documentation. All calibration services shall be documented by the Contractor on the service report and a DD 2163 Calibration/Verification Certification label is attached to the medication management system if needed. The verification shall be affixed to the units with the service date, initials and date next service due annotated. If the Contractor does not have labels, the Government representative will furnish the Department of Defense (DoD) Form DD 2163 Verification/Certification.

5.8. Maintenance Logs: A maintenance log will be maintained with the field service technician for the system. The log will be documented for any service performed. The log will remain on-site with the system.

5.9. Scheduled Maintenance documentation: All scheduled maintenance shall be documented on a service contract. This form will be furnished upon completion of service to the Government representative.

5.10. The Contractor shall be responsible for all items of Government equipment throughout the period equipment remains under the Contractor’s control. The Contractor shall be responsible for any contractor-caused damage to Government-owned property and shall replace or repair at the Contractor’s expense. The Government representative will approve replacements or repairs.

5.11. The Contractor shall ensure all areas where equipment is serviced on-site are left in a clean, neat, safe, and orderly condition. To prevent safety hazards, no equipment shall be left pulled out or apart at the end of the workday. All equipment under repair shall be secured at all times.

5.12. If the Contractor determines that the item being serviced is uneconomically repairable, the Government representative shall be notified. The Government representative will determine economic reparability IAW U.S. Army Directives.

5.13. Coordination for scheduled and unscheduled services. Preventive maintenance shall be performed IAW the manufacturer’s specifications during the specified month. The Contractor shall coordinate 15 days in advance with the Government representative for preventive maintenance, certification, and calibration. The field service technician shall provide online/internet support (IF APPLICABLE) within twenty-four (24) hours of notification.

Government request for remedial repairs will be placed telephonically by the Government representative to the Contractor’s POC.

5.14. The Contractor’s response to requests for remedial repairs may include a telephone consultation between the equipment user/operator or Government’s technician and a Contractor’s field service technician. The purpose of this telephone consultation shall be:

5.14.1. To determine the most likely cause of the problem.

5.14.2. To determine if resolution of the problem requires the dispatch of a field service technician once determination has been made that a Contractor’s field service technician is required on site. The Contractor’s field service technician shall have 24 hours to be on-site from the time of notification by the Government representative to the Contractor and restored fully operational within 72 hours of change.

5.14.3. To identify replacement parts if any likely to be required in order to return the equipment to 100% operational condition as specified by the OEM.

5.14.4. The Government and the Contractor will exchange hazard communication information before the commencement of any repair.

5.14.5. The contractor will comply with the OSHA lockout/tagout standard while performing maintenance on electrical equipment.

5.15. Scheduled/Unscheduled Maintenance documentation. All scheduled and unscheduled maintenance shall be documented on a service report. This form will be furnished upon completion of service within five working days to the Government representative.

5.16. Equipment Modification/Alteration/Upgrades.

5.16.1. The contractor shall perform/incorporate only OEM specified modifications, alterations, and upgrades. Approval shall be obtained from the Government representative prior to the contractor’s installation of the modification, alteration, or upgrade.

5.16.2. The contractor shall perform or cause to be performed all OEM field modifications and safety alert inspections.

5.16.3. The contractor shall maintain contact with the OEM to determine the requirement for field modifications and to ensure accomplishment of these field modifications are IAW the time schedule set forth by the OEM.

5.16.4. The contractor will make known to the Government representative of minor or routine OEM software upgrades when they become available by the manufacturer.

5.16.5. Hardware and software changes not supported by the OEM are not authorized.

5.17. Repair Parts. All repair parts shall meet exact manufacturer’s specifications and be the most current revision level. All parts shall be new or remanufactured by the manufacturer of the instruments.

5.18. Services beyond the scope of the performance work statement: The contractor shall immediately notify the Government representative (in writing) of the existence or development of any defects in/or repairs required to the equipment covered under this contract, especially which the contractor considers they are not responsible under the terms of the contract. At the same time of the notification, the contractor shall furnish the Government representative with a written estimate of the cost to make the necessary repairs.

5.19. Quality Control.

5.19.1. The Contractor shall develop and maintain an effective Quality Control Plan (QCP) to ensure services are performed IAW federal, state, installation policies, procedures and IAW this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

5.19.2. The QCP shall describe how the Contractor intends to ensure quality performance during the contract POP. The Contractor shall maintain a QCP that includes performance metrics. The Contractor shall submit a written QCP to the KO and COR not later than 30 calendar days after contract award. The QCP shall describe the quality management surveillance methodology and approaches used under this contract. The final updated/revised QCP shall be incorporated into the contract by reference as a compliance document. The Contractor shall update/revise the QCP, as necessary, and submit the updated/ revised QCP to the KO and COR not later than 7 calendar days for review/comments prior to implementation.

6. SECURITY REQUIREMENT.

6.1. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

6.2. Contractor personnel or any representative of the contractor entering Fort Hood Army Installation shall abide by all security regulations and shall be subject to security checks.

6.3. Contractor personnel and property shall be subject to search and seizure upon entering the confines of Fort Hood Army Installation and while on the installation in accordance with AR 190-13 (The Army Physical Security Program).

6.4. All personnel entering a military reservation are subject to background screening and search at any time. Contractor and subcontractor will ensure that personnel requiring access to the installation or military treatment facility are able to comply with U.S. Government requirements for installation access. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract; should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

6.5. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office.

Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

6.6. For contractors that do not require CAC, but require access to a DoD facility or installation.

Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190- 13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

6.7. Electronic Security.

6.8. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of the Medical Treatment Facility shall operate in accordance with controlling laws, regulations, DoD, Army, and local policy.

6.9. Certification & Accreditation (C&A) requirements apply to all DoD and contractor’s IS/networks that receive, process, display, store or transmit DoD information. The contractor shall comply with the C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and nontechnical security features and countermeasures required for each system/network.

6.10. Accreditation is the formal approval by the government to operate the contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections; and with appropriate level of protection for the specified period.

6.11. The contractor shall comply with C&A requirements, as specified by the government that meet appropriate DoD Information Assurance requirements. The C&A requirements shall be met before the contractor’s system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

6.11.1. Attending and supporting C&A meetings with the government

6.11.2. Supporting/conducting the vulnerability mitigation process

6.11.3. Supporting the C&A Team during system security testing

6.12. Contractors must confirm that there is/networks are locked down prior to initiating testing.

6.12.1. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

6.12.2. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

6.13. Any re-configuration or change in the system during the C&A testing process will require a rebaselining of the system and documentation of system changes.

6.14. IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the government shall be in compliance with all known applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

6.15. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

6.16. Information Assurance Vulnerability Management (IAVM) The contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to Army networks. The program shall meet the scope and intent of AR25-2 and (Insert MTF Name) IA policies to provide protection against known threats and vulnerabilities. Compliance with Army IAVM alerts and bulleting is required for these systems, and shall be completed within the specified timeframe.

6.17. Information Systems (IS)/Networks Physical Security. The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the contractor will support a Physical Security Audit performed by the Government of the contractor's internal information management infrastructure. The MHS Physical Security Audit Matrix is available at: http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%2 0version.xls. The contractor shall correct any deficiencies identified by the Government of the contractor's physical security posture.

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls

6.18. Special Requirements for Protected Health Information. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the contractors must:

6.18.1. Notify the Medical Treatment Facility.

6.18.2. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

7. SEXUAL ASSAULT AND SEXUAL HARASSMENT UNDER THE SEXUAL ASSAULT

PREVENTION AND RESPONSE PROGRAM (SHARP).

The contractor shall comply with OTSG/MEDCOM Policy Memo 13-062, Policy for Reporting Incidents of Sexual Assault and Sexual Harassment under the Sexual Assault Prevention and Response Program (SHARP), 12 November 2013. The SHARP reporting requirements apply only to knowledge obtained by contractor personnel while performing services under this contract.

The contractor shall require all Contract Service Providers (CSP) with knowledge of an incident of sexual assault occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours) report the incident in writing to the Government's Contracting Officer’s Representative (COR). All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals.

The contractor shall require all CSPs with knowledge of an incident of sexual harassment occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours) report the incident in writing to the Government's COR. All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals.

Government Unique Training

The contractor shall ensure all service providers receive Sexual Harassment/Assault Response and Prevention (SHARP) training not later than 60 calendar days after contractor personnel begins performance under this contract. Training can be obtained either online or in person.

Contractor personnel can attend SHARP training provided by Carl R. Darnall Army Medical Center, Fort Hood, TX. If the employee has an AKO account, they can access online the Team Bound Self Study course through Army Learning Management System (ALMS) at http://www.atsc.army.mil/tadlp/delivery/alms.asp

PWS/Advisory publications Army Regulation 600-20, Army Command Policy, 20 Sep 2012 http://www.atsc.army.mil/tadlp/delivery/alms.asp

OTSG/MEDCOM Policy Memo 13-062, Policy for Reporting Incidents of Sexual Assault and Sexual Harassment under the Sexual Assault Prevention and Responses Program (SHARP), 12 Nov 2013.

8. PERFORMANCE REQUIREMENT SUMMARY (PRS).

The following minimum Performance Requirements Summary applies. The Government may modify inspection methods IAW site specific requirements. Site specific PRS (if applicable) will be included with task orders.

PERFORMANCE

OBJECTIVE

PERFORMANCE

STANDARD

REF PWS

SECTION

METHOD OF

ASSESSMENT

Establish and maintain a Quality Control Plan

Documentation IAW regulations, established guidelines

5.19 COR Review

Have access to unique and/or high mortality replacement parts.

Comply initially and as required 100% of the time.

4.5 COR Maintain Log

All repair parts shall meet exact manufacturer specifications and be the most current revision level; all parts shall be new or remanufactured by the manufacturer of the instruments.

Comply initially and as required 100% of the time.

5.14 COR Maintain Log

Comply with security requirements.

Comply initially and as required 100% of the time.

11 COR maintain log

STANDARD MEASUREMENT PAST PERFORMANCE ASSESSMENT

99% to 100% Excellent Document Past Performance 96% to 98% Very Good Assessment Report, paying 95% Satisfactory particular attention to 92% to 94% Marginal performance that exceeds 92% or Less Unsatisfactory the standard

9. CONTRACTOR MANPOWER REPORTING.

"ACCOUNTING FOR CONTRACT SERVICES-The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address “https://cmra.army.mil.” The required information includes: (1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative; (2) Contract number, including task and delivery order https://cmra.army.mil/ number; (3) Beginning and ending dates covered by reporting period; (4) Contractor name, address, phone number, e-mail address, identity of contractor employee entering data; (5) Estimated direct labor hours (including sub-contractor); (6) Estimated direct labor dollars paid this reporting period (including sub-contractor); (7) Total payments (including sub-contractor);

(8) Predominant Federal Service Code (FSC) reflecting services provided by contractor (and separate predominant FSC for each sub-contractor if different); (9) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the contractor with its UIC for the purposes of reporting this information); (10) Locations where contractor and sub-contractors perform the work (specified by zip code in the United States and nearest City, Country, when in an overseas location, using standardized nomenclature provided on website); (11) Presence of deployment or contingency contract language, and, (12) Number of contractor and sub-contractor employees deployed in theater this reporting period (by country). (13) As part of its submission, the contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported by 31 October of each calendar year. The contractor shall notify the COR by the 5th working day of November whether or not they have completed this report. If the COR is unavailable, the contractor will notify the Contracting Officer."

10. HCAA LOCAL CLAUSE 5001 - NON-DEFENSE HEALTH AGENCY (NON-DHA)

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

BUSINESS ASSOCIATE AGREEMENT (BAA) (7 JULY 2014)

Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a BAA between the signatory parties for purposes of the HIPAA and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

—Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

—Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [insert name of Business Associate signatory to this BAA].

—Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

—Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean [insert name of MHS component signatory to this BAA].

—DHA Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

—DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

—DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoD 5400.11 (2007) and DoD 5400.11-R (2007).

—HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45

CFR 164.402.

—HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5566-5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

—Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and HIPAA privacy compliance.

I. Obligations and Activities of Business Associate

(a) The Business Associate shall not use or disclose PHI other than as permitted or required by the Agreement or as required by law.

(b) The Business Associate shall use appropriate safeguards, and comply with the DoD HIPAA Rules with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement.

(c) The Business Associate shall report to Covered Entity any Breach of which it becomes aware, and shall proceed with breach response steps as required by Part V of this BAA. With respect to electronic PHI, the Business Associate shall also respond to any security incident of which it becomes aware in accordance with any Information Assurance provisions of the Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response as required by part V of this BAA.

(d) In accordance with 45 CFR 164.502(e)(1)(ii)) and 164.308(b)(2), respectively), as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

(e) The Business Associate shall make available PHI in a Designated Record Set, to the Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 CFR 164.524.

(f) The Business Associate shall make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526.

(g) The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.528.

(h) To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Privacy Rule, the Business Associate shall comply with the requirements of HIPAA Privacy Rule that apply to the Covered Entity in the performance of such obligation(s); and

(i) The Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

II. Permitted Uses and Disclosures by Business Associate

(a) The Business Associate may only use or disclose PHI as necessary to perform the services set forth in the Agreement or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Agreement or directed by the Covered Entity.

(b) The Business Associate agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances.

(c) The Business Associate shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the Covered Entity, except uses and disclosures for the Business Associate’s own management and administration and legal responsibilities or for data aggregation services as set forth in the following three paragraphs.

(d) Except as otherwise limited in the Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

(e) Except as otherwise limited in the Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in the Agreement, the Business Associate may use PHI to provide Data Aggregation services relating to the Covered Entity’s health care operations.

III. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) The Covered Entity shall provide the Business Associate with the notice of privacy practices that the Covered Entity produces in accordance with 45 CFR 164.520 and the corresponding provision of the DoD HIPAA Issuances.

(b) The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

(c) The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such changes may affect the Business Associate’s use or disclosure of

PHI.

IV. Permissible Requests by Covered Entity

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

V. Breach Response

(a) In general.

In the event of a breach of PII/PHI held by the Business Associate, the Business Associate shall follow the breach response requirements set forth in this Part V, which is designed to satisfy both the Privacy Act and HIPAA as applicable. If a breach involves PII without PHI, then the Business Associate shall comply with DoD Privacy Act Issuance breach response requirements only; if a breach involves PHI (a subset of PII), then the Business Associate shall comply with both Privacy Act and HIPAA breach response requirements. A breach involving PHI may or may not constitute an HHS Breach. If a breach is not an HHS Breach, then the Business Associate has no HIPAA breach response obligations. In such cases, the Business Associate must still comply with breach response requirements under the DoD Privacy Act Issuances.

If the DHA Privacy Office determines that a breach is an HHS Breach, then the Business Associate shall comply with both the HIPAA Breach Rule and DoD Privacy Act Issuances, as directed by the DHA Privacy Office, regardless of whether the breach occurs at DHA or at one of the Service components. If the DHA Privacy Office determines that the breach does not constitute an HHS Breach, then the Business Associate shall comply with DoD Privacy Act Issuances, as directed by the applicable Service-Level Privacy Office. The Business Associate shall contact the Covered Entity for guidance when the incident is not an HHS Breach.

This Part V is designed to satisfy the DoD Privacy Act Issuances and the HIPAA Breach Rule as implemented by the DoD HIPAA Issuances. In general, for breach response, the Business Associate shall report the breach to the Covered Entity, assess the breach incident, notify affected individuals, and take mitigation actions as applicable. Because DoD defines “breach” to include possible (suspected) as well as actual (confirmed) breaches, the Business Associate shall implement these breach response requirements immediately upon the Business Associate’s discovery of a possible breach.

(b) Government Reporting Provisions

The Business Associate shall report the breach within one hour of discovery to the Covered Entity and to the US Computer Emergency Readiness Team (US CERT) -the other parties as deemed appropriate by the Covered Entity. The Business Associate is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing

it) who is an employee, officer or other agent of the Business Associate.

The Business Associate shall submit the US-CERT report using the online form at https://forms.us-cert.gov/report/. Before submission to US-CERT, the Business Associate shall save a copy of the on-line report. After submission, the Business Associate shall record the US- CERT Reporting Number. Although only limited information about the breach may be available as of the one hour deadline for submission, the Business Associate shall submit the US-CERT report by the deadline. The Business Associate shall e-mail updated information as it is obtained, following the instructions at http://www.us-cert.gov/pgp/email.html. The Business Associate shall provide a copy of the initial or updated US-CERT report to the -Covered Entity and the applicable Service-Level Privacy Office, if requested by either. Business Associate questions about US-CERT reporting shall be directed to the Covered Entity or Service-Level Privacy Office, not the US-CERT office.

The additional US Army and the US Army Medical Command (MEDCOM) reporting requirements are addressed in the PII Breach Reporting and Notification Policy. The latest version of this policy can be obtained from the Covered Entity or the MEDCOM Privacy Act/Freedom of Information Act (FOIA) Office at: usarmy.jbsa.medcom.list.medcom-foia-users@mail.mil .