FY26 CPRR Urinalysis Analyzer Special Terms and Conditions 20250415.docx

SPECIAL TERMS AND CONDITIONS

CPRR URINALYSIS ANALYZER

1. GENERAL REQUIREMENTS: Contractor shall provide a lease, maintenance, reagents and consumables on a cost-per-reportable report (CPRR) basis on one (1) Primary Chemistry Analyzer and one (1) Microscopic Analyzer to work in tandem as one random access urinalysis analyzer system. This includes unlimited telephonic assistance and unlimited on-site maintenance repairs. The equipment will be located in the Pathology Department, General Leonard Wood Community Hospital (GLWCH) new building located at 4234 Illinois Avenue, Fort Leonard Wood Missouri 65473.

Analyzer Additional Details:

--The space available in the new hospital for the analyzer equipment is 29.88” wide x 29.75” deep x 33.75” high and must be a tabletop, counter unit or sit on a cart. The tabletop, countertop and/or cart are not required. The government will supply them. There should be 19.75” of right-hand clearance and the analyzer cannot exceed 200lbs.

--This must be a dry unit with ancillary drainage.

--Training on equipment required.

-The UA analyzer should hold 10 samples per rack at minimum and up to 50 patients (5 racks) can be analyzed in one hour.

2. SPECIFIC TASKS:

2.1 The contractor shall provide one (1) fully automated integrated platform, discrete random access urinalysis analyzer system, training, supplies, reagents, unscheduled maintenance, preventive maintenance for the equipment and telephonic assistance. Contractor shall include delivery, installation, all calibrators/standards, reagents/reagent packs, and quality control materials necessary to perform the initial method validation per Clinical Laboratory Improvement Amendments/National Committee for Clinical Laboratory Standards Quality Management (CLIA/NCCLS QM) guidelines and analyzer removal at the termination of the contract.

2.1.1 The urinalysis analyzer system must be capable of interfacing with the laboratory’s Laboratory Information System (LIS) Composite Health Care System (CHCS). The contractor must have an established driver compatible for interfacing with MHS Genesis. The interface between MHS Genesis and the analyzers must be bi-directional.

2.1.2 The analyzers must have a large capacity data management system to store cumulative quality control, statistical data and patient reports; capable of downloading data to a disk or USB drive.

2.1.3 Contractor shall provide Safety Data Sheets (SDS) for each item delivered under this contract that is considered to be HAZARDOUS MATERIAL by the United States. The SDS shall contain information on the hazards associated with each specific chemical or material. The SDS shall contain, as a minimum, the following information: identification of the hazardous material and the specific hazard, the required practices for the safe use of the product, first aid precautions and what to do in the event of a spill or other mishap or accident.

2.1.4 Delivery of the reagents will be on an “As Needed” basis by the individual delivery orders issued by the Ordering Officer. The Contracting Office or their representative shall be the only entity authorized to issue orders against the resulting contract.

2.1.5 Delivery of reagents will not exceed 7 calendar days from the date of request.

2.1.6 The contractor shall be responsible for the collection and transportation of equipment upon termination of the contract.

2.2 ANALYZER SALIENT CHARACTERISTICS:

2.2.1 The system allow for full automated urinalysis testing to include microscopic analysis; results must transfer to the Laboratory Information System (LIS)

2.2.2 The analyzer system must include a data management system for control of the operation of the analyzer system, management of the quality control program, management of the on-instrument useful life of the reagents/reagent packs, and management of patient results; and a printer for the production of hard copy patient reports and other reports generated via the analyzer system's data management system.

2.2.3 The analyzer must be random access, discrete analyzer system with STAT interrupt capability.

2.2.4 The analyzer system shall provide users with reliable tests results that are critical for patient care. It must be capable of performing in low, medium and high volume work periods to produce results that are accurate and precise throughout the manufacturer’s stated specifications.

2.2.5 Initial startup from the shutdown state must not exceed 20 minutes.

2.2.6 The analyzer system must come equipped with an un-interrupted power supply capable of providing all necessary electrical power to all components of the urinalysis system, for a minimum of thirty (30) minutes.

2.2.7 The analyzer system and all reagents shall be Food and Drug Administration approved. Analyzer and associated parts and accessories shall be new. No used, refurbished or like-new equipment will be provided in support of the contract at any time.

2.2.8 The analyzer system shall offer user defined suspect flags settings for optimization of review rates.

2.3 REAGENT SALIENT CHARACTERISTICS:

2.3.1 The analyzer must have the ability for onboard reagent monitoring.

2.3.2 Reagents must have minimum shelf life upon receipt by the Government of at least four (4) weeks, or if this shelf life cannot be met, the Contractor must identify the guaranteed shelf life after receipt that can be accommodated.

2.3.3 All reagents provided will be identical to those used in the FDA 510K approval application. The reagents/reagent packs will be provided as follows:

2.3.3.1 Reagents must be provided by the manufacturer of the equipment.

2.3.3.2 Reagents must be marked with the required storage temperature.

2.3.4 Reagents must be shipped in a manner that will preserve the proper storage temperature during transportation and be delivered on time at the appropriate storage temperature.

2.3.5 The contractor shall provide the reagents/reagent packs, calibrators/standards, user-replaceable maintenance items and analyzer specific tools/supplies.

2.3.6 Emergency orders will be delivered within 24 hours after the order is placed by 1400 Monday through Thursday. Emergency orders will not be included in a separate line.

2.3.7 The Government retains the right to modify the quantity of each reagent/reagent pack based on changing patient population and test requests.

2.3.8 Types of tests that are performed in Urinalysis (approximately 9,000 each annually):

1) Color / Appearance

2) Specific Gravity (SG)

3) pH

4) Glucose (GLU)

5) Protein (PRO)

6) Ketones (KET)

7) Urobilinogen (URO)

8) Bilirubin (BIL)

9) Hemoglobin/ Blood ( BLO)

10) Leukocyte Esterase (LEU)

11) Nitrite ( NIT)

Microscopic Analysis is automatically performed if following conditions are met (Approximately 3,600 annually):

1) Patient is under 3 years of age

2) Catharized Urine Samples ( Foley or Suprapubic)

3) Urine sample is positive for any of these analytes ( BLO, LEU, PRO, NIT) Automated Microscopic consists of the following tests.

1) Enumeration of Red Cells ( Erythrocytes)

2) Enumeration of White Cells ( Leukocytes)

3) Enumeration/ Identification of Epithelial Cells

4) Enumeration of Bacteria/ Yeast

5) Identification/Enumeration of Normal and Pathological Casts

6) Identification / Enumeration Sediment and Crystal forms.

DESCRIPTION

S.G. Calibrator (High) - 10mL Bottle

IQ Calibrator Pack

Aution Check Plus Control (Low & High) - 25mL Bottle

IQ Control/Focus Set

Iris Diluent Pack

Check Strip Set (2 strips/vial)

Thermal Paper (Qty 12)

Aution 10ea Strips (100 bottle)

Aution 9EB Strips (100/bottle)

Concentrated Washing Solution 3 (1L Bottle)

Iris System Cleanser Pack

IQ Lamina 2 Bottles per case

3. MAINTENANCE AND SERVICE:

3.1 MAINTENANCE:

3.1.1 At the start of the contract, the Contractor shall have a contract representative and alternate responsible for scheduling and coordination of service calls. The name and phone number of the designated individual and alternate shall be provided to the Chief, Clinical Engineering Branch at (573) 596-0482.

3.1.2 Contractor shall deliver all new equipment to the Property Management Section at the beginning of the contract. Clinical Engineering Section will perform acceptance inspection and establish maintenance records for equipment. These records will be maintained for the duration of the contract period. Clinical Engineering will maintain historical data that shows the acceptance inspection and services performed on the equipment by Medical Maintenance and/or the manufacturer while the equipment is in the Government Facility.

3.1.3 Any and all equipment contracts to include, lease, cost per test, loan, etc., must be reviewed and approved by the Chief, Clinical Engineering and reviewed by the PBO for purposes of maintenance and accountability, whether accomplished by in-house maintenance or contract personnel.

3.1.4 The GLWACH Medical Maintenance Branch will first evaluate any equipment malfunction and facilitate repairs (screening process). If a service call is necessary, the Contractor shall provide unlimited service calls. Only the Clinical Engineering Branch will determine if the required repair service is emergency or routine.

3.1.5 The contractor shall be responsible for furnishing maintenance, services, repairs and parts as required in order to maintain the system is operating in the proper working condition in accordance with the Original Equipment Manufacture’s (OEM) specifications.

3.1.6 The contractor is required to maintain all equipment installed under this contract except for repairs necessitated by willful damage or negligence on the part of the U.S. Government.

3.1.7 The contractor shall provide a full unscheduled and preventive maintenance service for the performance period at no additional cost. Service shall include repair and replacement of defective parts, complete maintenance program (as required by the manufacturer's manuals), and hotline telephone service to assist operators in troubleshooting problems in accordance with paragraph 3.4.2 of this Statement of Work.

3.2 REPAIR:

3.2.1 Upon notification of equipment failure, the Contractor shall respond to telephonic requests for unscheduled repair within one (1) working day. Should the analyzer become inoperable, the Contractor’s technical specialist must be on-site within eight (8) hours of initial notification.

3.2.2 All work shall be performed in a professional manner by an authorized service representative for the manufacturer agreement specific or have two (2) years of maintenance experience on the contracted equipment. If any deficiencies are found due to negligence of the service representative, the contractor shall be required to correct the deficiency to a fully operational status in accordance with manufacturer specifications at no additional cost to the U.S. Government.

3.2.3 Services to include preventative maintenance and equipment malfunction are to be performed during the month(s) of October through September. Contractor shall respond within 48-hours, during normal duty hours of 8:00 AM and 4:00 PM excluding Federal Public Holidays.

3.2.4 Contractor's representative shall report to Medical Maintenance/Clinical Engineering, 4430 Missouri Avenue, Room 034, General Leonard Wood Community Hospital, Telephone No. 573-596-0482, prior to commencing services during normal operating hours. The contractor shall ascertain a security badge from Logistics Division, Room 034. During other than normal operating hours, contractor's representative shall report to Staff Duty Front Desk, General Leonard Wood Community Hospital, 4430 Missouri Avenue. The service representative will obtain a badge before reporting to service area. This process will change upon completion of the new hospital (building address unknown at this time).

3.2.5 Contractor's service representative shall report in person or telephonically notify the maintenance manager, Building No. 310, 4430 Missouri Avenue, Medical Maintenance/Clinical Engineering Department, Telephone No. 573-596-0482 prior to commencing services during normal duty operating hours of 8:00 AM and 4:00 PM.

3.2.6 The government and the contractor’s service representative shall exchange any hazard communication information before the commencement of any repair.

3.2.7 When required, the contractor’s service representative will comply with the Office of Safety and Health Administration lockout/tag out standards while performing maintenance on equipment.

3.2.8 Upon completion of services by the contractor’s service representative, a written service report shall be provided to the maintenance manager or the Administrative Officer of the Day (AOD). The service report shall provide detailed information regarding the cause of the equipment malfunction and corrective action taken. Include, at a minimum, 1) the time required to complete the work 2) price of labor (hourly rate) 3) list of parts replaced with part numbers and prices for each part 4) Nomenclature and Serial Number 5) Date 6) Name of the Technician.

3.2.9 In the event all information is not available to the contractor's service representative when services are performed, the initial service report shall include all available information. The contractor shall provide the balance of the required information to the maintenance manager no later than 10 days after services are completed.

3.2.10 In the event of calibration, after performing Calibration/Verification/Certification services, the contractor’s service representative will affix and/or update DD Form 2163 (Medical Equipment Verification/Certification). The contractor shall complete DD Form 2163 in accordance with the instructions provided in Technical Bulletin (TB) 38-750-2, or by the maintenance activity’s internal SOP.

3.2.11 If the contractor's calibration equipment produces a printed summary of the calibration procedure used, attach the printed summary to the DD Form 2164. Ensure that the heading of the DD Form 2164 is filled out and that the form is properly signed.

3.2.12 Contractor’s service representative will be factory trained and have a minimum of two years of experience working on the contracted equipment.

3.3 MODIFICATIONS AND UPGRADES:

3.3.1 The Contractor shall perform OEM specified modifications and software upgrades with the consent of and without charge to the Government.

3.3.2 Contractor must have direct contact with the OEM to accomplish field modifications to equipment in accordance with the time schedule set forth by the OEM. All modifications and upgrades will be documented in the government owned operator and service literature.

3.3.3 Contractor must furnish all software upgrades issued by the equipment manufacturer.

3.3.4 Subject to mutual agreement between the Government and the Contractor, instrumentation may be upgraded within the specifications of the contract as new technology becomes available. Additionally, the Government will add reagents through the life of this contract as a result of advances in technology or changes to clinical practice standards. Any such change to the reagents shall be mutually agreed upon by the contractor and the Government through a bilateral modification.

3.4 SERVICE:

3.4.1 The GLWCH Medical Maintenance Branch will first evaluate any equipment malfunction and facilitate repairs (screening process). If a service call is necessary, the Contractor shall provide unlimited service calls. Only the Medical Maintenance Branch will determine if the required repair service is emergency or routine.

3.4.2 The Contractor shall provide direct customer service and support, 24 hours/7 days a week, to include hotline telephone service and on-call emergency repair service support, to assist operators in correcting equipment operation problems.

3.4.3 Preventive maintenance services shall be performed in accordance with the manufacturer's standards/procedures. A preventive maintenance service shall include, but is not limited to, safety, calibration, complete operational testing, lubrication, adjustments and cleaning of equipment to which the operator does not have access. This also includes the installation of all non-operator parts required to ensure proper operation.

3.4.4 The contractor shall notify the Point of Contact of the exact date and time for performance of a preventive maintenance service at least two (2) days prior to the scheduled preventive maintenance services.

3.4.5 The contractor's qualified service technician shall be onsite to provide routine services, service requiring immediate repair and one (1), two (2) or four (4) scheduled services for preventive maintenance (as specified in the Contractor's instrument maintenance manual), safety and calibration as required by this performance based work statement. The contractor will take every reasonable action to have the equipment repaired and operational within 48 hours after initial response by the contractor.

3.4.6 The Contractor shall perform routine repair service between 8:00 AM and 4:00 PM Monday through Friday, excluding Legal Public Holidays. Contractor response time shall be within 48 clock hours after telephonic notification excluding weekends and Legal Public Holidays.

3.4.7 Repair completion time for a routine repair service shall not be more than 96 clock hours after telephonic notification excluding weekends and Legal Public Holidays.

3.4.8 Upon analyzer failure between 8:00-4:00 Monday-Fridays, the Contractor's qualified service technician shall be on-site to provide unlimited emergency service (service requiring immediate repair; an unscheduled maintenance/service requirement) within 24 hours.

3.4.9 Should the analyzers at GLWACH become inoperable, the Contractor's technical repair specialist should be on-site within eight (8) hours of initial notification and the repair of the analyzer completed within one (1) working day of initial notification. If deemed necessary after consultation with the contractor, if analyzer cannot be repaired within one (1) working day of the initial notification, contractor will work with GLWACH for determining the identification of alternative sources of testing. The Contractor will pay all costs associated with the provision of this service, for as long as the analyzer remains inoperable.

3.4.10 If the equipment is determined to be out of service for longer than 48 hours (from the time of service technician's arrival on the site), the contractor shall notify the Lab Manager as to the reason(s) (i.e. non-availability of parts, etc.) for non-operability.

3.4.11 The Contractor shall provide all necessary user-replaceable maintenance items that will be required to support the analyzer, and any analyzer specific tools/supplies necessary to perform operator-level maintenance tasks, at no additional cost to the Government.

3.4.12 Service reports. Upon completion of services, a written service report shall be provided to the medical equipment maintenance manager, or the government medical equipment repairer assigned to the service call.

3.4.13 The service report shall indicate the Contract Number, service performed (e.g., PM and/or repair), provide detailed information regarding the cause of equipment malfunction, corrective action taken, to include the time required to complete the work. The service report shall also include the estimated price of labor (hourly labor rate); a list of parts replaced with price for each part, the unit Site ID and ECN number, and the name of the technician performing the service.

3.4.14 After normal duty hours, service tickets shall be given to the Government AOD/Staff Duty Non-commissioned Officer (SDNCO) at the Information/ reception desk. Faxed reports are acceptable with the concurrence of the Government.

3.4.15 In the event that all information is not available to contractor's representative when services are performed, the initial service report shall include all information available. Contractor shall provide the balance of the required information in writing to the Chief, Medical Equipment Branch, not later than 10 days after services are completed. The remaining information should be mailed to: Commander, General Leonard Wood Community Hospital, ATTN: MCXP-LOG Service Reports, 4430 Missouri Avenue, Ft. Leonard Wood, MO 65473-8952 or Faxed to 573-596-1786, ATTN: Medical Maintenance Branch. This address is not to be used for any purpose other than as stated in the paragraph and C.5.8.2.

3.4.17 Contractor shall provide a copy of the invoice to the Chief, Clinical Engineering Branch, for verification of services performed. This is in addition to the requirements of block 13 of the DD Form 1155, Order for Supplies or Services. The copy of the invoice can be mailed to Commander, General Leonard Wood Community Hospital, ATTN: MCXP-LOG Service Reports, 4234 Illinois Avenue, Fort Leonard Wood Missouri 65473 -8952 or Faxed to 573-596-1786, ATTN: Medical Maintenance Branch.

3.4.18 The Contractor shall be responsible for all items of Government equipment throughout the period they are under his control. The Contractor shall be responsible for any contractor-caused damage to Government-owned property and shall replace or repair at the contractor’s expense. The Contracting Officer is the only authority to approve replacements or repairs.

3.4.19 The Contractor shall ensure all areas where equipment is serviced on-site are left in a clean, neat, safe, and orderly condition. To prevent safety hazards, no equipment shall be left pulled out or apart at the end of the workday. All equipment under repair shall be secured at all times.

3.4.20 If the Contractor determines that the item being serviced is uneconomically repairable, the Chief, Clinical Engineering Branch shall be notified. The Chief, Clinical Engineering/Medical Maintenance Branch, GLWCH will determine economic reparability in accordance with US Army Directives.

4.0 TRAINING:

4.1.1 The Contractor will provide initial on-site operator training to all technicians assigned to the Pathology Laboratory prior to initiation of use of the analyzer for patient testing. In addition, the Contractor will provide at least one (1) training slots per analyzer at the Contractor's training site at no additional cost to the U.S. Government. The Contractor may charge the Government only for training services exceeding the basic requirement for a given year. Such training will be provided during designated implementation weeks and at mutually times, between the hours of 8 am - 4 pm local time.

4.1.2 Training shall include basic operation of the analyzers, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures and use of the data management/quality control software.

5.0 DELIVERY OF THE EQUIPMENT:

5.1.1 The Analyzer will be delivered to the location as indicated below within 30 calendar days after contract award. Equipment setup, on-site training, method validation studies, and analytical measurement range/linearity verification, shall (must) be completed by Contractor personnel within a period of time to ensure that equipment is fully operational on or before 1 October 2025. During the initial implementation, a dedicated technical representative must be available on site throughout the entire implementation period. Substitutions must be coordinated with the Government Point of Contact (POC).

5.1.2 Primary Locations of Complete System. Across the street of the current hospital located at General Leonard Wood Community Hospital, 4234 Illinois Avenue, Fort Leonard Wood Missouri 65473.

SUPPLEMENT TO THE SPECIAL TERMS AND CONDITIONS

1. GOVERNMENT HOLIDAYS

The following Government Holidays are observed:

New Year’s Day Martin Luther King Jr.’s Birthday President’s Day Memorial Day Juneteenth Day Independence Day Labor Day Columbus Day Veteran’s Day Thanksgiving Day Christmas Day

Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contractor is scheduled to perform maintenance is closed due to a holiday declared by an Executive Order and the contractor is not required to report in, contractor shall service equipment on the available day staff will be present. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

2. Invoicing and Payment The contractor shall submit monthly, in arrears, itemized invoices in accordance with DFARS 252.232-7003 & 252.232-7006, for services rendered under this contract. Information regarding Wide Area Workflow is available on the Internet at https://piee.eb.mil

3. TOBACCO FREE MEDICAL CAMPUS (TFMC)

The Contractor shall ensure that all contract personnel comply with the U.S. Army Medical Command and MTF smoking policies while performing services under this contract. Smoking restrictions will apply at any location or building where health care activities are performed under this contract.

In accordance with Army Regulation 600-63, paragraph 7-3, 14 April 2015; Operations Order 15-48 (Army Medical Command (MEDCOM) Tobacco Free Living – USAMEDCOM), 8 May 2015; and any Operations Order, regulation or other instruction implementing, defining or otherwise addressing the Tobacco Free Medical Campus (TFMC) on any military installation or DoD-controlled location, Contractor personnel are prohibited from using any tobacco product on or within any TFMC while performing under this contract. TFMCs are established at each installation or DoD-controlled location and include: (1) any property or non-residential building that is operated, maintained or assigned to support medical activities, including but not limited to, hospitals, medical laboratories, outpatient clinics (including medical, dental, and veterinary facilities), or aid stations operating for the primary purpose of delivering medical care and services for DOD eligible beneficiaries and /or meeting the mission of the Army Medical Command; (2) all other facilities in which medical activities or administration take place, to include HQ MEDCOM and Defense Health Headquarters; (3) all internal roadways, sidewalks and parking lots; and (4) all sidewalks, parking lots and grounds external but adjacent to the building or related to the migratory corridors surrounding the medical facility. The contractor shall obtain from the COR any orders, regulations, instructions or other documents implementing, defining or otherwise addressing the TFMC for any given installation or DoD-controlled location where contractor personnel may perform under this contract and shall instruct contractor personnel on the TFMC limitations for installations or DoD-controlled locations where they may perform under this contract.

4. EXCLUSION FROM PARTICIPATION IN FEDERAL HEALTH CARE PROGRAM Exclusion from Participation in Federal Health Care Programs (October 2015)

a. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at h ttp://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at h ttp://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of- H ealthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

b. Prior to start of contract performance, the Contractor shall (a) query the Lists to determine whether the name of any person the Contractor employs or contracts with to provide services or items for which payment may be made under this contract appears on the Lists, and (b) certify to the Contracting Officer that the Contractor has queried the Lists and no such names appear on either of the Lists.

c. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the Contractor shall (a) query the Lists as in paragraph 2, and (b) certify to the Contracting Officer that the names of such new persons do not appear on either of the Lists.

d. The Contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of contractor personnel working in the MTF against the Lists, as specified in OTSG/MEDCOM Policy Memo 15-037. The Government will notify the Contractor in the event any contractor personnel working in the MTF appear on either of the Lists.

e. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall (a) in cases where the Contractor identified the person, notify the Contracting Officer, and (b) promptly remove that person from the contract.

f. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

g. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a- 7a): There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at h ttp://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

5. SEXUAL HARASSMENT/ASSAULT RESPONSE AND PREVENTION

Sexual Harassment/Assault Response and Prevention (SHARP) Program. The contractor shall comply with Sexual Harassment/Assault Response and Prevention (SHARP) Program, The SHARP reporting requirements apply only to knowledge obtained by contractor personnel while performing services under this contract.

The contractor shall require all contract personnel with knowledge of an incident of sexual harassment occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours of gaining knowledge of the incident) report the incident in writing to the Government's COR. This reporting policy also applies to sexual harassment incidents involving Government personnel that occur on the contractor’s owned or leased facility under this contract. All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals, when the incidents occur on a Government facility or a Government leased facility.

The contractor shall require all contract personnel with knowledge of an incident of sexual harassment occurring on a Government facility, to include a Government leased facility, where the contractor is providing services under this contract, to report the incident to the contractor who shall immediately (within 24 hours) report the incident in writing to the government's COR. All incidents shall be reported whether they involve contractor personnel or Government personnel, or other individuals.

6. Personally Identifiable Information, Protected Health Information, and Federal Information Requirements (Revised 10/27/2020)

General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

1. DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDI 5400.11, DoD Privacy and Civil Liberties Programs, January 29, 2019 and DoDI 5400.11- R, Department of Defense Privacy Program, May 14, 2007.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended.

Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoDM 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs,” March 13, 2019, DoDI 6025.18, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 13, 2019, and DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, August. 12, 2015.

Defense Health Agency (DHA) Privacy Office is the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA.

2. Records Management When creating and maintaining official government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

3. Freedom of Information Act (FOIA) The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request preferably sent via the National FOIA Portal at: www.FOIA.gov. However, requesters may also submit requests via email at DHA.FOIA@mail.mil; or via postal delivery addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101. All FOIA requests shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Contract and/or Modification numbers must be included in all FOIA requests seeking DHA procurement records. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible and respond to DHA within ten working days.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 8.1.6, relating to individual rights of access to PHI.

4. Systems of Records In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, OMB Circular A-130, and Privacy Act of 1974 requirements applicable to contractors operating systems of records on behalf of federal agencies. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

5. Privacy Impact Assessment (PIA) If DHA data is stored on a Contractor owned system, a PIA is required from the Contractor.

6. Data Sharing Agreement (DSA)

6.1 (Applies if contract requirements involve the use of DHA data (including PII/PHI, a limited data set, or de-identified data)

The Contractor shall consult with the DHA Privacy Office to determine if the Contractor must obtain a DSA or Data Use Agreement (DUA), when DHA data will be accessed, used, disclosed or stored, to perform the requirements of this Contract.

The Contractor shall comply with the permitted uses established in a DSA/DUA to prevent the unauthorized use and/or disclosure of any PII/PHI, in accordance with the HIPAA Rules and DoD HIPAA Issuances. Likewise, the Contractor shall comply with the DoD Privacy Act Issuances.

Prior to using any data involving PHI for research purposes, as defined by HIPAA, the Contractor must gain approval from the DHA Privacy Board. Thus, the Contractor shall comply with DHA Privacy Board requests for additional documentation.

To begin the DSA request process, the Contractor shall submit a DSA Application (DSAA) to the DHA Privacy Office. Upon approval, the requestor shall enter into one of the following agreements, depending on the data involved:

DSA for De-Identified Data DSA for PHI DSA for PII Without PHI DUA for Limited Data Set

DSAs executed for contract support will expire after 1 year or at the end of the contract option year, whichever comes first. If the contractual use of DHA data will continue after the DSA expiration date, the Contractor shall submit a DSA Renewal Request template to the Privacy Office; however, if the DSA will not be renewed, the Contractor shall close the DSA by providing a Certificate of Data Disposition (CDD) to the DHA Privacy Office.

6.2 (Applies if contract requirements may include human subject research) This Contract incorporates by reference the Protection of Human Subject Research clause in the Defense Federal Acquisition Regulation Supplement (DFARS) at 48 CFR 252.235-7004. A separate DFARS provision, 48 CFR 235.072(e), requires that the clause be incorporated in contracts that include or may include research involving human subjects in accordance with 32 CFR 219, DoDI 3216.02, and 10 U.S.C. 980, including research that meets exemption criteria under 32 CFR 219.101(b), the clause applies to solicitations and contracts awarded by any DoD component, regardless of mission or funding Program Element Code. Thus, in the event a contractor participates in a study or demonstration project or other activity that involves human subject research, then the contractor shall comply with Protection of Human Subject Research clause. COs may not determine whether an activity is exempt from human subject research requirements. If contractor activity appears to involve human subject research, then the contractor shall consult the DHA Privacy Office, which may contact the Research Regulatory Oversight Office in the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)).

7. Privacy Act and HIPAA Training The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

8. HIPAA Business Associate Provisions

8.1 Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. The contractor shall use the DoD BAA, which shall be used by all organizational entities within the DoD, referred to collectively as the “DoD Components”, located at, https://www.health.mil/Military-Health-Topics/Privacy-and-Civil- Liberties/Privacy-Contract-Language/HIPAA-Compliant-Business-Associate-Agreement-for-the-MHS. b.i. and (3)b.ii.

9. Breach Response [This paragraph 9 is inoperative, and all references herein to “paragraph 9” shall be deemed to refer to the TOM breach responses provisions, if the contract incorporates the TOM by reference.

9.1 Definitions Related to Breach response

9.1.2 Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII; or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The foregoing definition is based on the definition of breach in DoDM 6025.18. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

9.1.3 A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the contractor. In determining whether unauthorized access should be suspected, the contractor shall consider at least the following factors:

How the event was discovered;

Did the information stay within the covered entity’s control;

Was the information actually accessed/viewed; and Ability to ensure containment (e.g., recovered, destroyed, or deleted).

9.1.4 A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the contractor knows that the PII/PHI is unencrypted, then the contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the contractor should re-classify the incident as a non-breach incident.

9.1.5 A HHS breach is an incident that satisfies the definition of breach in Section 164.402 of the HIPAA Breach Rule. The text of the HHS definition states:

Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under subpart E of this part [i.e. the HIPAA Privacy Rule] which compromises the security or privacy of the PHI.

HHS breach excludes:

Any unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a DoD covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule.

Any inadvertent disclosure by a person who is authorized to access PHI at a DoD covered entity or business associate to another person authorized to access PHI at the same DoD covered entity or business associate, or organized health care arrangement in which the DoD covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted the HIPAA Privacy Rule.

A disclosure of PHI where a DoD covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Except as provided in this definition, an acquisition, access, use, or disclosure of PHI in a manner not permitted under this issuance is presumed to be a breach unless the DoD covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment of at least the following factors:

The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification;

The unauthorized person who used the PHI or to whom the disclosure was made;

Whether the PHI was actually acquired or viewed; and The extent to which the risk to the PHI has been mitigated.

9.1.6 A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

9.2 General

9.2.1 The breach response requirements shall be followed for all unauthorized use or disclosure of information regardless of whether the information is PHI or solely PII.

9.2.2 Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

9.2.3 The…