A.01.02_PWS.pdf

PERFORMANCE WORK STATEMENT

1. GENERAL

1.1. DESCRIPTION OF WORK. The Contractor shall provide the services of Health Information Exchange (HIE) within participants of the state of Colorado that includes inbound and outbound clinical data at Fort Carson located in Colorado Springs, CO. HIE services will be provided to multiple locations to include Fort Carson Based Clinics and Evans Army Community Hospital, 21st Medical Squadron at Schriever AFB, 10th Medical Group at Air Force Academy, 21st Medical Group at Peterson AFB, 460th Medical Group at Buckley AFB, Premier Army Health Clinic, and Mountain Post Medical Home.

1.1.1. This contract is a NON-PERSONAL SERVICES contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

1.1.2. Performance Measurements Requirement Summary. The following performance objectives and measures will be used to evaluate Contractor performance and compliance under the contract. This information will be used to prepare annual past performance evaluations.

PERFORMANCE

MEASUREMENT

OBJECTIVE

STANDARD ACCEPTABLE QUALITY

LEVEL

METHOD OF

ASSESSMENT

1. Scheduled downtime will be no more than 4 hours during non-business hours/week

System will be maintained efficiently to decrease unscheduled downtime.

Uptime shall be maintained above 98.8%

Monthly status report will be provided by the contractor

2. Unscheduled downtime will be no more than 2 hours during business hours/week

System will be functional and accessible to all authorized users.

Unscheduled downtime to be maintained at less than 1.2% per year.

Monthly status report will be provided by the contractor

3. Provide help desk support and resolve routine issues within 48 hours and high priority issues same day.

To provide customer assistance as needed to authorized users.

All required documentation processed. No significant omissions.

Help desk support data to be provided every 6 months by the contractor.

1.1.3. The inspection and acceptance point for all services rendered under this contract will be by the Information Management Division. The performance by the contract personnel, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance and review for acceptance by the Contracting Officer’s Representative (COR) or designated representative. Any services rendered by the contract personnel to patients or interaction with military/civilian personnel deemed unprofessional/ threatening/dangerous by the Department Chief will be considered as grounds for immediate removal of the Contractor Personnel (CP) and termination under clause 52.212-4 (m) Termination for Cause.

Services provided by the Contractor shall be reviewed and rated in accordance with the Military Treatment Facility (MTF) by-laws and Joint Commission (JC) standards.

1.2. QUALIFICATIONS AND REQUIREMENTS.

1.2.1. Qualifications.

1.2.1.1. Be a state designated provider of Health Information Exchange Services.

1.2.1.2. Meet HealtheWay Certification Standards.

1.2.2. Requirements.

1.2.2.1. The CP shall be the certified provider of Health Information Exchange Services for the state of Colorado.

1.3. Administrative

1.3.1. Reports. The Contractor shall submit reports to the COR as requested for use in monitoring Contractor performance. Such reports may include, but are not limited to, personnel recruitment/credential status, projected losses.

1.3.1.1. Weekly Progress Report. Until the CP are performing duties at the MTF and any other period where a replacement CP is required, the Contractor shall provide to the Contracting Officer (KO) and the COR, on a weekly basis, a progress report indicating the candidate’s name, date identified by the Contractor, date the résumé was submitted to the Government for review, date the credentials package was submitted to the Government, date the MTF privileged the provider, and the targeted start date as applicable.

1.3.2. Contracting Officer’s Representative (COR). The COR will be appointed in writing by the KO after the contract is awarded. The KO will provide a copy of this designation and COR contact information to the Contractor.

1.3.3. Billing: The Government will only pay for hours, days or units actually worked/provided. The Contractor shall only submit payment requests for hours, days or units actually worked/provided. Submitting a payment request for more than the amount due based on the number hours, days or units actually worked/provided may constitute fraud or a false claim and may result in administrative or criminal action or both.

1.4. HOURS OF PERFORMANCE:

1.4.1. Health Information Exchange shall be operational 24 hours a day, 7 days a week.

1.4.1.1. Scheduled down time exempted and will be coordinated with Evans Army Community Hospital Information Management Division.

1.4.1.2. The Contractor shall notify Evans Army Community Hospital Information Management Division of any unscheduled downtime and or degradation of performance within the system within 30 minutes of the outage discovery .

1.4.2. Hours worked do not include travel time to reach the MTF or other place of performance.

1.5. CONFIDENTIALITY OF INFORMATION. Unless otherwise specified, all financial, statistical, personnel, and/or technical data which are furnished, produced or otherwise available to the Contractor during the performance of this contract are considered confidential business information and shall not be used for purposes other than performance of work under this contract. The Contractor or the CP shall not release any of the above information without prior written consent of the KO.

2. DEFINITIONS/ACRONYMS.

2.1. Definitions. Following is a list of basic definitions.

2.1.1. Armed Forces Health Longitudinal Technology Application (AHLTA). This contains the MTF’s appointment scheduling program, pharmacy, lab, and radiology ordering system and is interlinked with other departments in the MTF. In addition, it contains the electronic medical records for MHS beneficiaries.

2.1.2. Beneficiaries of The Military Healthcare System. Those individuals entitled to care at the MTF in accordance with AR 40-3.

2.1.3. Composite Healthcare System (CHCS). An automated medical information system which will provide integrated support for the functional work centers of inpatient and outpatient care facilities, patient administration, patient appointments and scheduling, nursing, laboratory, pharmacy, radiology, and clinical dietetics.

2.1.4. Contracting Officer (KO). Is a person with the authority to enter into, administer, and/or terminate contracts/task orders and make related determinations and findings.

2.1.5. Contracting Officer’s Representative (COR). A Government employee selected and designated in writing by the KO to act as his/her designated representative in administering a contract. A COR has no authority to change or modify the terms of a contract.

2.1.6. DMHRSi. Defense Medical Human Resource System Internet. Is a system that allows time keeping for all employees.

2.1.7. Military Time is on a 24-hour clock, e.g.:

8:00 a.m. - 0800 9:10 a.m. - 0910 Noon - 1200 8:00 p.m - 2000 9:10 p.m - 2110 Midnight - 2400 12:01 a.m. - 0001

2.1.8. Military Dates are written by placing the day of the month, followed by the first three letters of the month, followed by the last two digits of the year, e.g.:

January 02, 2015 - 02 Jan 15 January 10, 2015 - 10 Jan 15

2.1.9. Quality Assessment and Improvement. Those actions taken by the Government to check services to determine if they meet the requirements of the Joint Commission, U.S. Army Medical Command, quality assurance and risk management program, and ensure that the Contractor and its HCPs comply with the terms and conditions of the contract.

2.1.10. Quality Control. Those actions taken by a Contractor to control the performance of services to ensure that they meet the requirements of the contract.

2.1.11. TRICARE. A regionalized, tri-service, Contractor supported, DoD managed, healthcare system.

2.2. Acronyms/Abbreviations. Following is a list of basic acronyms/abbreviations used in this contract.

ADP - Automated Data Processing ADT - Admission Discharge and Transfer AHLTA - Armed Forces Health Longitudinal Technology Application AR - Army Regulation BCLS - Basic Cardiac Life Support BLS - Basic Life Support CFR - Code of Federal Regulations CHAMPUS - Civilian Health and Medical Program of the Uniformed Services CHCS - Composite Health Care System CLIN - Contract Line Item Number CMO - Chief Medical Officer CMR - Contract Manpower Report CONUS - Continental United States COR - Contracting Officer’s Representative CORHIO - Colorado Regional Health Information Organization CPARS - Contractor Performance Assessment Reporting System

CPR - Cardiopulmonary Resuscitation CSMHS - Colorado Springs Military Health System CV - Curriculum Vitae DA - Department of the Army DEA - Drug Enforcement Administration DHA - Defense Health Agency DoD - Department of Defense DODI - Department of Defense Instruction DMHRSi - Defense Medical Human Resource System - Internet ECFMG - Educational Commission for Foreign Medical Graduates EFT - Electronic Funds Transfer EKG - Electrocardiogram ETS - Expiration Term of Service FAR - Federal Acquisition Regulation FBI - Federal Bureau of Investigation FL - Form Letter FPP - Family Practice Physician FTE(s) - Full Time Equivalent(s) HCAA - Health Care Acquisition Activity HCP - Health Care Provider HHS - Health and Human Services HIE - Health Information Exchange HIP - Health Information Portal HIPAA - Health Insurance Portability & Accountability Act of 1996 IAW - In Accordance With IRC - Installation Record Check IV - Intravenous JC - Joint Commission (formerly referred to as the Joint Commission on Accreditation of Healthcare Organizations [JCAHO]) JLV - Joint Legacy Viewer LOSS - Line of Sight Supervision KO - Contracting Officer MEDCOM - Medical Command MEDDAC - Medical Department Activity MHS Genesis - Military Health System Genesis (New EHR planned for implementation 2017-2018) MTF - Medical Treatment Facility NACI - National Agency Check with Inquiries NCOIC - Noncommissioned Officer in Charge NP - Nurse Practitioner OCONUS - Outside the Continental United States OIC - Officer in Charge OSHA - Occupational Safety and Health Administration or Act PA - Physician Assistant PAD - Patient Administration Division PALS - Pediatric Advance Life Support Pam - Pamphlet PAR - Performance Assessment Report PCF - Practitioner's Credentials File PCO - Procurement KO/Procuring KO PCS - Permanent Change of Station PL - Public Law POC - Point of Contact PWS - Performance Work Statement (may also be referred to as work statement or statement of work) QA - Quality Assurance QA&I - Quality Assessment & Improvement

OBGYN - Obstetrics and Gynecology QC - Quality Control RHC-C - Regional Health Command - Central RN - Registered Nurse RFQ - Request for Quotation RFP - Request for Proposal RPO - Radiation Protection Officer SF - Standard Form SRP - Soldier Readiness Processing TAB - Therapeutic Agents Board TDY - Temporary Duty TO(s) - Task Order(s) USAF - United States Air Force USC - United States Code USPS - United States Postal Service VLER - Virtual Lifetime Electronic Record

3. GOVERNMENT PROPERTY

3.1. The Government will provide use of all available MTF facilities and support services, materials, publications and forms, equipment, and specialty clothing required for contract performance (except as designated in the contract). The Contractor shall ensure that its CP keep Government-furnished supplies, equipment, and work areas in a safe, orderly and clean condition. The Contractor shall notify the Government whenever maintenance of equipment is required. Personal long distance calls are not authorized and the cost of all personal long distance calls made will be deducted from the Contractor’s invoice.

4. SPECIFIC TASKS. The CP shall perform all procedures and duties that are normal to the scope of that individual’s particular specialty. Specific tasks include, but are not limited to:

4.1 Subject to the terms of this Agreement, CORHIO will use commercially reasonable efforts to provide the following services and deliverables under this Agreement:

4.1.1. System Interfaces.

CORHIO will implement and maintain the following interfaces between Participant systems and the HIE to the extent that compatible technology is made available by Participant systems. Participant is responsible for scheduling the implementation with its system vendors and any resulting system vendor fees.

4.1.1.1 Inbound - CORHIO will implement inbound interfaces between the HIE and the Participant EHR that supports the following data types to include but not limited to:

Lab Results Pathology Reports Radiology Reports Transcribed Reports Continuity of Care Document (CCD) Public health exchange with Colorado Department of Public Health (CDPHE) Other DoD and non-DoD Entities

4.1.1.2 Outbound - CORHIO will implement outbound interfaces between the Participant EHR and the HIE that supports the following data types:

Public health exchange with Colorado Department of Public Health (CDPHE) Admit, Discharge, Transfer (ADT): Interface from the hospital ADT system to the HIE to provide patient identification and demographic information, including admit, discharge and transfer information, to the Community Master Patient Index (CMPI).

4.1.1.3 Patient Routing Notifications - CORHIO will implement a Patient Routing and Clinical Notifications system.

This system consists of daily report and real time alerts of DoD member admission and discharges with CORHIO.

4.1.2 Software, Services and Data Center: CORHIO will implement and maintain the following through the HIE.

4.1.2.1 Software Data Stage - A dynamic data staging environment engineered to accommodate the diverse clinical information essential to providers delivering care

4.1.2.2 Novo Grid or Comparable Functionality - Forms a secure peer-to-peer network to distribute and exchange health information, as made available by CORHIO in the HIE—including orders, results, transcribed reports, problems, medications, allergies and demographic data. The Novo Grid provides standards independent delivery to EHRs and immunization and bio-surveillance registries, as available in the HIE

4.1.2.3 Identity Management Services - Automates the matching of patients and data across disparate systems using a common master patient index. Identity Management Services create a virtual patient record from information residing in many sources within the HIE by indexing all the clinical information on each patient for metadata published to the HIE by contributing systems. In concert with the Data Stage, Identity Management Services create a patient record that includes clinical data from many sources. CORHIO’s Identity Management Services contain pointers to all organizations with a patient’s clinical data, which allows that patient data to be retrieved efficiently, while ensuring that protected health information is safeguarded according to the custodial organization’s policies.

4.1.2.4 Provider Directory - An index that includes Authorized Users of the HIE. CORHIO will collect, in a standard format, Authorized User data from Participant to populate the Provider Directory.

4.1.2.5 Secure VPN Connection: Data Providers - CORHIO will provide a secure VPN tunnel to participating organizations that provide data to the HIE. Organizations participating with Colorado Telehealth Network (CTN) can connect to CORHIO via CTN.

4.1.2.6 Data Retention and Management - Data will be retained for no less than seven years.

4.1.2.7 Data Center - CORHIO will provide two SAS 70 Type II audited data center facilities. The primary data center is located in Colorado. A secondary data center will be maintained outside Colorado as backup management and disaster recovery.

4.1.3 Web Based Portal for Community Health Record & Clinical Messaging: CORHIO will make available CORHIO’s PatientCare 360 Portal (the “Portal”) for access to each Authorized User. The Portal is a private label version of Medicity’s ProAccess product or a comparable product. Any Authorized User allowed access to the HIE under this Agreement will be given the option to establish a username and password to access the Portal, through their account or thru a single sign on mechanism such as the use of Common Access Card (CAC) enabled protocols.

The Portal optimizes the display and distribution of electronic clinical data with the HIE. It is designed to adapt to the workflow of most physician offices and provides convenient, personalized access to complete clinical data, as available in the HIE. The Community Health Record function of the portal provides Authorized Users with query based access to a longitudinal view of a patient’s health data as available via the HIE. The Portal currently includes but is not limited to the following functionality:

4.1.3.1 Community Health Record

4.1.3.1.1 Longitudinal Patient View - The longitudinal patient view includes the following aggregated across disparate health systems’ available data sources from all civilian and military CORHIO participating healthcare providers , as available in the HIE:

Demographic and face sheet data Clinical claims summary and aggregated claims views

Inpatient and ambulatory medication history Lab results in several formats (trending tables, tables, and graphs) Links to image viewing libraries Encounter documentation including physician and nursing notes, vital signs, chief complaint, provider encounter date, and insurance information Radiology and imaging reports and images Immunizations Allergies Medical Diagnosis and Problems List with Dates Medical Treatments and Procedures with Dates Past Hospitalizations with Dates Ambulatory Encounters with Dates

4.1.3.1.2 Delivery Preferences Utility - Enables Authorized Users to specify how, where, and when to receive new data including:

Ordering physician Result flag (abnormal, normal, critical) Result type (lab, radiology, transcription, etc) Sending facility Sending application Result status (preliminary, final corrected) Order priority (stat, urgent, standard)

4.1.3.1.3 Secure Referential Links- Enables users to access secure referential links, for example to clinical care guidelines.

4.1.3.1.4 Break-the-Glass - Enables auditable access to patient information based on documented reasons supported by CORHIO Policies

4.1.3.1.5 CCD Exchange - Allows Authorized Users to create, send, and receive a CCD from the Portal.

4.1.4 Implementation Services - CORHIO will provide the following services in support of implementation of Participant onto the HIE.

4.1.4.1 Interface Analysis, Design, and Development - CORHIO will provide the following services as part of the analysis, design, and testing of HIE interfaces:

Support set up of secure VPN connection with CORHIO data center Conduct analysis of production data feeds Develop interface specifications Build interfaces Connect interfaces to the HIE infrastructure

4.1.4.2 Interface Testing and Activation - CORHIO will provide the following services as part interface testing and activation:

Conduct interface certification testing Support user acceptance test preparation and testing activities Support production readiness planning and HIE go-live

4.1.4.3 Project & Implementation Management - CORHIO will assign a project manager to oversee implementation planning, scheduling and execution. The project manager will be the first point of contact for Participant during Implementation. CORHIO Project Manager and Participant Project Manager will jointly be responsible for managing the project schedule, risks, and issues.

4.1.4.4 Assessments - Participant must complete an HIT Assessment as part of the implementation analysis.

CORHIO will support Participant in completing this assessment. CORHIO will perform various other assessments throughout the course of the Implementation to plan and deliver agreed upon services and training.

4.1.4.5 HIE Administrative Training: Data Provider - CORHIO will provide the following HIE administrative training services as part of the HIE deployment:

Portal Authorized User Administration and Maintenance training Portal Provider Directory training Portal CMPI Patient Merge training Message Delivery Monitoring training

4.1.4.6 Training - CORHIO will coordinate with Participant to plan and deliver the following training sessions (as referenced under HIE Administrative training above):

– Super user/train the trainer sessions

– Classroom or small group training sessions for not more than 15 attendees in each session

– Individual desk side training.

– The above trainings to cover the topics of:

Portal Community Health Record

4.1.4.7 Provider Directory Set-up Escalation Contact - CORHIO will work with Participant to collect and input required data to populate the Provider Directory. Additional services include establishing an ongoing update and maintenance approach with Participant to capture changes to Provider Directory.

CORHIO shall make available a point of contact for escalation of issues or concerns during the Implementation.

4.1.5 Ongoing and Maintenance Services: The following ongoing and maintenance services are provided to Participant under this Agreement:

4.1.5.1 Access to the Admin tool to allow Participant to generate reports that include user audit and PHI disclosure information, including data required to comply with applicable Laws, such as HIPAA and HITECH.

4.1.5.2 Project management and training for existing services when HIE system-wide upgrades are taken by CORHIO, from CORHIO’s vendor.

4.1.5.3 Interface changes associated with participant system upgrades or replacements that do not result in costs from CORHIO’s vendor to CORHIO.

4.1.5.4 Service Desk Support.

5. APPLICABLE TECHNICAL ORDERS, SPECIFICATIONS, REGULATIONS, AND MANUALS.

5.1. Following is a list of basic publications applicable to this contract. Current issues of many DA publications can be accessed at http://www.usapa.army.mil. Current issues of many forms can be accessed at http://www.usapa.army.mil. Publications and forms not on the internet can be obtained from the MTF.

5.1.1. The Publications have been coded as mandatory or advisory. The Contractor is obligated to follow those coded as mandatory only to the extent that they apply to this contract. Supplements, amendments, or changes to these mandatory publications may be issued during the life of the contract. Advisory publications may be used for information and guidance but are not binding for compliance.

5.2. Publications.

5.2.1. Mandatory.

10 USC 1089 - Defense of Certain Suits Arising Out of Medical Malpractice 10 USC 1091 - Personal Services Contracts PL 91-596 - Occupational Safety and Health Act 0f 1970 PL 101-647, Section 231 - Crime Control Act of 1990 PL 102-190, Section 1094 - National Defense Authorization Act PL 104-191k - Health Insurance Portability and Accountability Act of 1996 DoD Directive 5200.28 - Security Requirements for Automated Information Systems (AISs) DoD 5200.2-R - Personnel Security Program DoD 6025.18-R - Department of Defense Health Information Privacy Regulation DoD 8580.02-R - DoD Health Information Security Regulation DoDI 1402.5 - Criminal History Background Checks on Individuals In Child Care Services

Applicable MTF Standard Operating Procedures (SOPs) and Policies:

AR 25-2 - Information Assurance AR 40-1 - Composition, Mission, and Functions of the Army Medical Department AR 40-3 - Medical Services: Medical, Dental, and Veterinary Care AR 40-4 - Army Medical Department Facilities/Activities AR 40-5 - Preventive Medicine AR 40-48 - Non-Physician HCPs AR 40-66 - Medical Records Administration and Health Care Documentation AR 40-68 - Clinical Quality Management AR 40-501 - Standards of Medical Fitness AR 40-562 - Immunizations and Chemoprophylaxis AR 340-21 - The Army Privacy Program (05 Jul 85) AR 351-3 - Professional Education and Training Programs of the Army Medical Department AR 380-19 - Information Systems Security AR 380-67 - The Department of the Army Personnel Security Program AR 385-40 - Army Accident Investigations and Reporting AR 600-85 - Army Substance Abuse Program Civilian Services MEDCOM Reg 715-3 - Contractor/Contractor's Employees and MEDCOM Personnel Relationships

5.2.2. Advisory.

AR 310-25 - Dictionary of United States Army Terms MEDCOM Pam 25-31 - Index of Command Administrative Publications (16 Sep 02)

5.3. The following is a listing of forms that may be required, and may customarily be used by a HCP performing services. A complete list of forms can be accessed at http://www.apd.army.mil/AdminPubs/ProductMap.asp.

5.3.1. Standard Forms.

SF 85-P - Questionnaire for Public Trust Positions SF 88 - Medical Record – Report of Medical Examination SF 93 - Report of Medical History SF 504 - Medical Record - History SF 505 - Medical Record – History – Parts 2 and 3 SF 506 - Medical Record – Physical Examination SF 507 - Medical Record SF 509 - Medical Record – Progress Report SF 513 - Medical Record – Consultation Sheet SF 515 - Medical Record - Tissue Examination

SF 519-B - Radiologic Consultation Request/Report (Radiology/Nuclear Medicine/Ultrasound/ Computed Tomography Examinations SF 523 - Medical Record –Authorization for Autopsy SF 523A - Disposition of Body SF 541 - Medical Record – Gynecologic Cytology SF 550 - Medical Record –Urinalysis SF 551 - Medical Record –Serology SF 557 - Medical Record – Miscellaneous SF 558 - Medical Record – Emergency Care and Treatment SF 600 - Medical Record – Chronological Record of Medical Care

5.3.2. Department of Army.

DA 3894 - Hospital Report of Death DA 4106 - Incident Report DA 4700 - Medical Record – Supplemental Medical Data DA 5008 - Telephone Medical Advice/Consultation Record

5.3.3. Department of Defense.

DD 577 - Appointment/Termination Record – Authorized Signature DD 689 - Sick Slip, Individual DD 1289 - Prescription Form DD 2161 - Medical Care, Referral for Civilian DD 2795 - Pre-Deployment Health Assessment Questionnaire DD 2796 - Post-Deployment Health Assessment

5.3.4. Other Forms.

FD Form 258 - FBI US Department of Justice Fingerprint Card

6. ADDITIONAL INSTRUCTIONS.

6.1. Medical Records from the Family Advocacy Program or Army Substance Abuse Program participants will be identified thru their MEPRS code and information contained within will not be shared IAW AR 40-66.

6.2. ADP Security Requirements.

6.2.1. Since the CP shall have access to and/or process information requiring protection under the Privacy Act of 1974, these positions are considered “ADP Sensitive” positions. Compliance with DoD Directive 5200.28, DoD 5200.2-R, AR 25-2, and AR 380-67 is mandatory for ADP Sensitive positions. Therefore, a National Agency Check with Inquiries (NACI) is required for each HCP. The Contractor shall ensure that each CP fully adheres with the provisions of referenced publications by making an appointment (through the COR) with the appropriate security organization at the installation. The CP will be fingerprinted and required to complete the appropriate forms, usually a Standard Form 85-P, Questionnaire for Public Trust Positions. The Contractor is advised that a positive report for its CP is needed as a condition of employment under this contract. The Contractor shall ensure that its CP applies for the NACI within three workdays after start of performance.

6.2.2. Contractor employees may be required to sign a Computer User Agreement Acceptable Use Policy and complete End User Awareness Training prior to being given access to a Government computer or the local network.

Despite anything to the contrary in the Computer User Agreement Acceptable Use Policy, Government computers and other resources shall only be used for official Government business related to the performance of this contract.

7.2 Remote Connectivity by Virtual Private Network

7.2.1. General Government Oversight Instructions

7.2.1.1. Program/Project Managers will follow the policies and procedures identified in the contract language.

Specifically, Program/Project Managers will ensure that Standard Contract Language and Instructions for All Government Data Including Protected Health Information is included in all contracts that require a VPN connection.

7.2.1.2. Business Partners that require access to Government systems will follow Army Regulation 25-1, “Army Knowledge Management and Information Technology, AR 25-2, “Information Assurance (IA)”, DoD Health Information Privacy Regulation.

7.2.2 Business Partner Responsibilities

7.2.2.1. Use the MEDCOM Business to Business Virtual Private Network Gateway or the Military Health Systems Virtual Private Network Gateway as the only approved access solutions.

7.2.2.2. Initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

7.2.2.3. Validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN.

7.2.2.4. Provide, maintain and configure VPN concentrator that complies with DoD security standards.

7.2.2.5. Ensure Government Property, if utilized is maintained and returned in the same condition to Site.

7.2.3. Site Responsibilities

7.2.3.1. Provide Business Partner with the appropriate level of security requirements for the type of access requested and ensure that the Business Partner remains compliant.

7.2.3.2. Provide Business Partner with Government Property or contractor furnished equipment which meets two factor authentication requirements to access the government network, not to include the VPN concentrator.

7.2.3.3. Ensure return of Government Property utilized by Business Partner.

7.3. General Use and Disclosure Provisions.

Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, the HIPAA Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

7.4. Specific Use and Disclosure Provisions.

(a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1).

7.5. Obligations of the Government.

Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

(a) The Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520.

(b) The Government shall provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor’s permitted or required uses and disclosures.

(c) The Government shall notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

(d) The Government shall provide end user training and maintain documentation of that training within the MTF end user’s training record.

(e) The Government shall provide the Contractor with the names of no more than five (5) MTF staff members from all major MTFs within the CSMHS. That are authorized requestors of all user account requests for access to the HIE.

7.6. Permissible Requests By The Government.

The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, the HIPAA Security Rule, or any applicable Government regulations (including without limitation, DoD 6025.18-R and DoD 8580.02-R) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

7.7. Termination.

(a) Termination. A breach by the Contractor of this clause, may subject the Contractor to termination under any applicable default or termination provision of this Contract.

(b) Effect of Termination.

(1) If this contract has records management requirements, the records subject to the Clause should be handled in accordance with the records management requirements. If this contract does not have records management requirements, the records should be handled in accordance with paragraphs (2) and (3) below

(2) If this contract does not have records management requirements, except as provided in paragraph (3) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government, or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subContractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health Information.

(3) If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the

Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

8. Miscellaneous.

(a) Regulatory References. A reference in this Clause to a section in DoD 6025.18-R, DoD 8580.02-R, Privacy Rule or Security Rule means the section currently in effect or as amended, and for which compliance is required.

(b) Survival. The respective rights and obligations of Business Associate under the “Effect of Termination” provision of this Clause shall survive the termination of this Contract.

(c) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DoD 6025.18-R, DoD 8580.02-R, the HIPAA Privacy Rule or the HIPAA Security Rule.

9. CONTRACT MANPOWER REPORTS (Accounting for Contract Services) (Jul 2007). The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor will report ALL Contractor manpower (including sub-Contractor manpower) required for performance of this contract. The Contractor is required to completely fill in all the information in the format using the following web address “https://cmra.army.mil”. The required information includes: (1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative; (2) Contract number, including task and delivery order number; (3) Beginning and ending dates covered by reporting period; (4) Contractor name, address, phone number, e-mail address, identity of Contractor employee entering data; (5) Estimated direct labor hours (including sub-Contractor); (6) Estimated direct labor dollars paid this reporting period (including sub- Contractor); (7) Total payments (including sub-Contractor); (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub-Contractor if different); (9) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information); (10) Locations where Contractor and sub-Contractors perform the work (specified by zip code in the United States and nearest City, Country, when in an overseas location, using standardized nomenclature provided on website); (11) Presence of deployment or contingency contract language, and, (12) Number of Contractor and sub- Contractor employees deployed in theater this reporting period (by country). (13) As part of its submission, the Contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement.

Reporting period will be the period of performance not to exceed 12 months ending September 30 of each Government fiscal year and must be reported by 31 October of each calendar year. The Contractor shall notify the Contracting Officer’s Representative (COR) by the 5th working day of November whether or not they have completed this report. If the COR is unavailable, the Contractor will notify the Contracting Officer."

Report Schedules are based on the Government’s Fiscal Year cycle, regardless of the contract period of performance cycle. If this order requires a final CMR report which does NOT align to the Fiscal Year; the final CMR report shall be due NLT 30 days after the performance period ends.

The following information is provided for the Contractor’s use in completing the above report:

Predominant Federal Service Code: Q301

Unit Identification Code for the Army Requiring Activity: W51HQT (Evans Army Community Hospital)

10. NOTICE OF CONFERENCE. The Contractor, or authorized representative, may be required to attend a conference prior to commencement of any work performed under this contract. A representative of the Contracting Office will notify the Contractor after entering into the contract as to the specific time and location of the conference. Such conferences will normally occur telephonically: however, the Government reserves the right to require the personal presence of the Contractor.