Attachment 1 Statement Of Objectives (SOO).docx

STATEMENT OF OBJECTIVES

(SOO)

Hematology Reportable Tests Regional Health Command Europe

1. Scope

The Contractor shall provide four (4) automated hematology analyzers and reagents used in support of the hematology mission at Landstuhl Regional Medical Center (LRMC) and outlying clinics (Wiesbaden Health Clinic, SHAPE Healthcare Facility in Belgium, and Vicenza Health Clinic in Italy) and five (5) automated hematology analyzers and reagents used in support of the hematology mission at the U.S. Army Medical Department Activity-Bavaria laboratories (Grafenwoehr, Hohenfels, Ansbach, Vilseck, and Stuttgart). The successful offeror shall furnish all equipment, reagents, consumables, controls, and any necessary services (e.g., maintenance of furnished equipment) to the Department of Pathology and Laboratory to the respective laboratories for the purpose of hematology testing under a Price‐Per‐Test (PPT) contract. All equipment and reagents/consumables shall be supplied and serviced through the Contractor to include all parts, equipment, supplies, and other services required.

Medical Treatment Facilities (MTF) Locations

Landstuhl Regional Medical Center (LRMC) Department of Pathology, Core Laboratory Dr. Hitzelberger Strasse 66849 Landstuhl, Germany Grafenwoehr Army Health Clinic Grafenwoehr Lager, Building 475 92655 Grafenwoehr, Germany

Wiesbaden Army Health Clinic Fluggplatz 65205 Erbenheim, Germany Hohenfels Army Health Clinic BLDG 51 Rm 214 SPC Marlow Jackson St Hohenfels, 92366

Vicenza Army Health Clinic Caserma Carlo Ederle Building 2310, Room F14.1 36100, Vicenza, Italy Ansbach Army Health Clinic Urlas Kaserne Building 8156 Ansbach, 91522

SHAPE Healthcare Facility Building 401 2, Boulevard Président Kénnedy 7000 Mons, Belgium Vilseck Army Health Clinic Suedlager Rose Barracks Bldg 260 Vilseck, 92249

Stuttgart Army Health Clinic Pennsylvania St Patch Barracks Bldg 2300 Stuttgart, BW 70569

1.1. All costs integrated into this contract shall be calculated based on annual test volume. For reference, see below.

1.2. All supplies and equipment to include connections between equipment shall be approved by the US Food and Drug Administration (FDA).

* Complete blood count (CBC) ** Reticulocyte count (Retics)

Government Point of Contacts (POCs)

2. Reagent Requirements

The Contractor shall provide all reagents/reagent packs, calibrators/standards, quality control materials, user-replaceable maintenance items, and analyzer specific tools/supplies to support the ongoing delivery of laboratory services using the equipment outlined in this section.

2.1. Reagents/consumables shall meet the requirements of the twenty-four (24) hours per day and seven (7) days per week (24/7) LRMC mission, workload, and test menu and the requirements of normal duty hours workload and test menu at other locations. All complete blood count (CBC) tests shall have FDA approval for immature granulocyte providing a five or six-part differential, reticulocyte hemoglobin (RET-He) (LRMC laboratory only), immature platelet fraction (IPF) and fluorescent platelet count tests. Testing of body fluid (LRMC laboratory only) shall consist of white blood cell (WBC), red blood cell (RBC) and total nucleated count (TNC) with a two-part differential: polymorphonuclear (PMN) and mononuclear (MN) percent. Body fluid testing is provided, and includes WBC, RBC, TNC and two-part differential.

2.2. The Contractor shall provide quality control materials acceptable to the section Medical Director. This includes third-party controls when requested/required by the laboratory.

2.3. In determining reagent requirements, the Contractor shall consider requirements for routine quality control runs (as defined by the Laboratory Director), routine calibration, periodic calibration/calibration verification in accordance with departmental quality assurance policies and standard operating procedures, and troubleshooting of out-of-control assays when calculating the yearly requirements.

2.4. Reagents used for troubleshooting analytical systems shall be replaced by the Contractor at no additional cost.

2.5. The Contractor shall sequester required quality control and test reagent lots where possible.

2.6. Reagents shall have a shelf life of at least 3 months upon receipt at the Laboratory. Controls shall have a shelf life of 4-12 weeks.

2.7. Emergency orders shall be delivered within 24 hours after the order is placed. Contractor sets up a monthly standing order based upon test volume and reagent needs, so no emergency orders are anticipated. If test volumes dramatically change, the standing order may be adjusted through a contract modification.

3. Analyzer Delivery and Installation

3.1. All systems shall be delivered by 15 March and installed, validated, and ready to run patient samples by 30 April 2020 for LRMC and by 30 May 2020 for the Outlying Health Clinics. The analyzers shall meet the electrical requirements of 220-240 Volt, 50-60 Hertz.

3.2. The Contractor shall assign a Program Manager and Information Technology (IT) Program Manager to oversee all operations.

3.3. During the initial implementation, a primary, dedicated technical representative shall be assigned and available on site throughout the entire implementation period. Substitutions shall be coordinated with and approved by the Contracting Officer Representative (COR).

3.4. Method validation/verification shall be conducted by the Contractor in accordance with procedures outlined in the Clinical Laboratory Improvement Amendments (CLIA) and/or the College of American Pathologists (CAP).

3.5. Method validation/verification shall include, but not be limited to: normal range (reference interval) verification, verification of reportable range (to include WBC, RBC, HGB, PLT and reticulocyte as required), correlation to current methods, verification of precision, carryover studies and establishment of initial ranges using control materials, to include third party controls where designated by the Laboratory Director.

3.6. The method validation/verification shall be completed and approved by the Laboratory Director prior to reporting of patient results.

3.7. The Contractor shall provide a qualified Technical Service Representative (TSR), who possesses a thorough knowledge of method validation/verification and is familiar with the use of clinical laboratory statistical evaluation software (e.g. EP Evaluator®), to provide technical assistance for the method validation/verification studies. The assigned TSR shall be responsible for the entire method validation. Additional TSRs may be brought in to assist in method validations/verifications, but only the primary TSR shall be responsible for the entire operation.

3.8. All instrument reagents, calibrators, linearity materials and other required reagents/materials used in the method validation/verification study shall be provided by the Contractor at no additional cost to the Government. These materials shall not be used in the analysis of specimens for patient care.

4. Instruments at Core Lab LRMC

4.1. Reagents/consumables shall meet the requirements of the LRMC 24/7 mission, workload, and test menu. All CBC tests shall have FDA approval for immature granulocyte providing a six-part differential, RET-He, IPF, and fluorescent platelet count tests. Testing of body fluid shall consist of WBC, RBC and TNC with a two-part differential: PMN and MN percent. Body fluid testing is provided, and includes WBC, RBC, TNC and two-part differential.

4.2. Fully automated/integrated analyzers comprised of two (2) independently operating analyzers that work in tandem to provide load balancing. Capable of performing a full test profile using <200 ul of sample with a throughput of at least 100 CBCs per hour. Analyzers shall include a pre-diluted sample access mode for the sample volume of <100 ul to perform full hematology test profile.

4.3. Analyzers shall be FDA approved for body fluid testing. Contractor shall state which body fluids are FDA approved for analysis. Shall provide enhanced body fluid testing using fluorescent flow cytometry for serous, synovial and CSF (spinal fluid).

4.4. Platelet counts shall be able to read down to zero and verified on site.

4.5. Shall have Immature Granulocyte count capability, to include reportable Immature Granulocyte absolute value and Immature Granulocyte percentage, as part of the six-part differential.

4.6. Individual analyzers shall have fully automated, discrete random access capabilities. There shall be a single point of specimen entry for the routine analysis of all required tests. There shall be an optional procedure for priority analysis of STAT specimens.

4.7. Able to process without operator intervention once the run time has started: 100% walk-away. Instrument shall have above 95% uptime, with a 5% or less downtime per month. Contractor shall provide information to support this requirement. Contractor provides a service guarantee that if both analyzers are down and unable to perform a CBC, the Contractor shall provide emergency on site repair regardless of the time of day, at no additional charge.

4.8. Routine services and reagent delivery for Bavarian locations will not be required on U.S. Federal and German National Holidays. Routine services and reagent delivery for SHAPE will not be required on U.S. Federal and Belgian or German National Holidays.

4.9. Shall have a single aspiration pathway for open and closed tube sampling to eliminate the need for mode to mode correlation.

4.10. Shall be capable of achieving WBC linearity range of 0.0-440.0 x10^3/ul and directly measure HCT with a linearity and reportable range of 0.0-75.0%.

4.11. Daily shutdown and start up time should be less than 20 minutes.

4.12. Due to space constraints and LIS dropdown limitations, the system for the Core Laboratory shall incorporate two (2) CBC analyzers.

5. Instruments at Outlying Clinics and Bavaria

5.1. One (1) each standalone CBC analyzer capable of performing a full test profile (CBC with five-part differential, fluorescent nucleated RBC count) using <200 ul of sample for each laboratory. Shall include a pre-diluted sample access mode for lower sample volume of <100 ul to perform full hematology test profile.

5.2. Platelet counts shall be able to read down to zero and verified on-site.

5.3. All tests shall have FDA approval.

5.4. Able to process without operator intervention once the run time has started: 100% walk-away. Instrument shall have above 95% uptime, with a 5% or less downtime per month. Contractor shall provide information to support this requirement.

5.5. Shall have a single aspiration pathway for open and closed tube sampling to eliminate the need for mode to mode correlation.

5.6. Shall be capable of achieving WBC linearity range of 0.0-440.0 x10^3/ul and directly measure HCT with a linearity and reportable range of 0.0-75.0%.

5.7. Daily shutdown and start up time should be less than 20 minutes.

6. Service and Maintenance

6.1. The Contractor shall meet the following service, and maintenance requirements for testing at all locations:

6.1.1. The Contractor shall provide direct customer service and support, 24 hours a day/7 days a week, to include hotline telephone service (provided in English) and on-call emergency repair, to assist operators in correcting equipment problems.

6.1.2. The Contractor shall maintain all equipment installed under this contract except for repairs necessitated by willful damage or negligence on the part of the Government. This includes emergency repairs as well as routine Preventive Maintenance Services (PMS), safety tests, calibrations/calibration verifications, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment.

6.1.3. The Contractor shall provide calibration/verification of all analyzers every six (6) months in accordance with OEM specifications. All materials used during calibration/verifications shall be at no cost to the Government.

6.1.4. The Contractor shall provide all personnel, equipment, tools, materials, supervision, parts, transportation, and other items and services necessary to perform all required repairs and scheduled preventive maintenance/safety inspections and calibrations of equipment. The performance of scheduled periodic preventive maintenance, safety checks, and calibrations that are not normally performed at the operator level shall be performed by Contractor service personnel in accordance with requirements as specified in the Contractor’s instrument maintenance manual. Completion of analyzer installation shall establish time-zero for determining the time frame for performance of periodic services.

6.1.5. Any service technician provided by the Contractor shall adhere to all required reporting procedures for the respective laboratory prior to reporting to the laboratory for work. Current procedures will be available through the COR.

6.1.6. In all cases, the Contractor shall provide all reagents, calibrators, controls, and any other materials necessary to troubleshoot instrument failure. Replacement parts used, as necessary, claimed from local operator-level maintenance kits as well as any reagents that may have been used shall be replaced at no cost to the Government.

6.1.7. The Contractor shall notify the COR of the exact date and time for performance of a preventive maintenance service no later than ten (10) days prior to the scheduled preventive maintenance services.

6.1.8. Within one (1) working day after completion of a repair, the Contractor’s representative shall furnish the COR one (1) copy of a service report for all services performed with a copy to the Equipment Management Branch and the Laboratory Representative for the MTF. The report shall be in English and shall contain, as a minimum, the following information:

· Nomenclature and serial number

· Date of service

· Description of services performed (i.e., preventive maintenance service, or unscheduled repair service)

· Location of services performed

· Duration of performance (hours)

· List of parts replaced or other actions taken to restore operability of the instrument

· Name of technician

6.2. Equipment:

6.2.1. For equipment supporting LRMC, the service technician shall be on-site to provide unlimited service within one (1) business day of establishing telephonic contact. The equipment shall be repaired and operational within two (2) business days after initial on-site response by the Contractor. Should both CBC analyzers become inoperable, the Contractor’s service technician shall be on-site within twenty-four (24) hours of initial notification. The repair of at least one (1) analyzer shall be completed within eight (8) hours of initial notification. If deemed necessary, after consultation with the COR, if at least one (1) analyzer cannot be repaired within eight (8) hours of the initial notification, the Contractor shall, where requested, arrange the pickup and delivery of critical specimens to an accredited clinical laboratory, with priority testing service provided for STAT specimens. The Contractor shall pay all costs associated with the provision of this alternative testing, including those for delivery of hardcopy patient results by express courier, directly to the laboratory, for as long as all analyzers remain inoperable.

6.1.6. For equipment supporting other than LRMC locations, the service technician shall be on-site to provide unlimited service (service requiring repair) the next business day of establishing telephonic contact. The equipment shall be repaired and operational within two (2) business days after initial on-site response by the Contractor.

7. Training

7.1. The Contractor shall provide the following for all testing locations:

7.1.1. The Contractor shall provide initial on-site operator training to all technicians assigned to the Government site normally assigned to perform the associated testing prior to implementation of the analyzer for patient testing.

7. 1.2. All on-site training shall include basic analyzer operation, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use any data management/quality control software.

7. 1.3. The Contractor shall provide off-site training for one (1) person from LRMC and (1) person from each Outlying Health clinic for the base period and each option year.

7.2. Government Unique Training

7.2.1. The Contractor shall ensure all service providers receive Sexual Harassment/Assault Response and Prevention (SHARP) training not later than 60 calendar days after Contractor personnel begin performance under this contract. Training can be obtained either online or in person. Contractor personnel can attend SHARP training provided by MEDCOM on an every other month basis by contacting (210) 221-6118 for class date/ time availability. If the employee has an AKO account, they can access online the Team Bound Self Study course through Army Learning Management System (ALMS) at http://www.atsc.army.mil/tadlp/delivery/alms.asp.

8. Applicable Technical Order, Specifications, Regulations and Manuals

8.1. General:

Applicable documents - The latest practicable local (Germany) and national (US) technical regulations are applicable for the manufacturing of the system. In case of differences between local and national regulations, the regulations containing the most stringent requirements shall govern. Contractor shall comply with all U.S. laws pertaining to medical equipment. Contractor shall also comply with all Department of Defense (DOD), Department of Army (DA), MEDCOM), Regional Health Command Europe (RHC-E) and Landstuhl Army Medical Center regulations and policies pertaining to medical equipment. Current issues of many DA publications and forms can be accessed at http://www.apd.army.mil. Publications and forms not on the internet can be obtained from the MTF. These regulations include, but are not limited to, the following:

8.2. Publications:

The publications have been coded as mandatory or advisory. The Contractor is obligated to follow those coded as mandatory only to the extent that they apply to this contract. Supplements, amendments, or changes to these mandatory publications may be issued during the life of the contract. Advisory publications may be used for information and guidance but are not binding for compliance.

8.2.1. Mandatory Publications:

Clinical Laboratory Improvement Amendments https://www.fda.gov/medical-devices/ivd-regulatory-assistance/clinical-laboratory-improvement-amendments-clia

8.2.2. Advisory Publications:

OTSG/MEDCOM Policy Memo 19-019, Policy for Reporting Incidents of Sexual Assault and Sexual Harassment under the Sexual Assault Prevention and Responses Program (SHARP), 21 March 2019.

9. SEXUAL HARASSMENT/ASSAULT RESPONSE AND PREVENTION (SHARP).

9.1. The Contractor shall comply with OTSG/MEDCOM Policy Memo 19-019, Sexual Harassment/Assault Response and Prevention Program, 21 March 2019, or superseding DHA or DOD policy once issued and provided to the Contractor. The SHARP reporting requirements apply only to knowledge obtained by Contractor personnel while performing services under this contract.

9.2. The Contractor shall require all CSPs with knowledge of an incident of sexual assault occurring on a Government facility, to include a Government leased facility, where the Contractor is providing services under this contract, to report the incident to the Contractor who shall immediately (within 24 hours, after gaining knowledge) report the incident in writing to the Government's COR. This reporting policy also applies to sexual assault incidents involving MEDCOM personnel that occur on the Contractor’s owned or leased facility under this contract. All incidents shall be reported whether they involve Contractor personnel or Government personnel, or other individuals, when the incidents occur on a Government facility or a Government leased facility.

10. Exclusion from Participation in Federal Health Care Programs (October 2015)

10.1. The Contractor shall not employ or contract with any individual or entity (hereinafter collectively referred to as “person”) to provide items or services that will be included in invoices submitted to the Government under this contract if such person is listed on the Department of Health and Human Services (HHS) Office of the Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List. The Government is legally prohibited from paying for provision of items or services by such persons. The prohibition extends to services beyond direct patient care, such as services of persons in executive or leadership roles and administrative and management services, whether or not such services are billed separately. The LEIE may be found at http://oig.hhs.gov/fraud/exclusions.asp, and the TRICARE Sanctioned Provider list at http://www.health.mil/Military-Health-Topics/Access-Cost-Quality-and-Safety/Quality-And-Safety-of-Healthcare/Program-Integrity/Sanctioned-Providers. The LEIE and TRICARE Sanctioned Provider List are hereinafter collectively referred to as “the Lists.”

10.2. Prior to start of contract performance, the Contractor shall

10.3. During performance of the contract, and prior to persons other than those whose names were queried in accordance with paragraph 2, above, (hereinafter “new persons”) providing services or items under the contract, the Contractor shall

10.4. The Contractor is advised that during performance of the contract, MTF personnel will perform a recurrent recheck of the names of Contractor personnel working in the MTF against the Lists, as specified in OTSG/MEDCOM Policy Memo 15-037. The Government will notify the Contractor in the event any Contractor personnel working in the MTF appear on either of the Lists.

10.5. Should any person providing items or services under the contract appear on either of the Lists at any time during contract performance, the Contractor shall

10.6. Violation of any aspect of the above paragraphs shall be considered a material breach of the contract and may result in termination of the contract.

10.7. The Contractor is further advised that, in accordance with Civil Monetary Penalties Law [CMP] (codified at 42 USC § 1320a-7a):

a. There are steep civil monetary penalties associated with billing the Government for providing items or services by a person on either of the Lists, and with failing to return to the Government any overpayments received for provision of such items or services.

b. Billing under the contract for provision of items or services by a person on either List may also result in exclusion of the person that employs or contracts with such person.

10.8. HHS OIG has issued a Special Advisory Bulletin on the Effect of Exclusion from Participation in Federal Health Care Programs with additional information on the CMP. The Special Advisory Bulletin may be found at http://oig.hhs.gov/exclusions/files/sab-05092013.pdf.

11. Tobacco Free Medical Campus (TFMC)

In accordance with Army Regulation 600-63, paragraph 7-3, 14 April 2015; Operations Order 15-48 (Army Medical Command (MEDCOM) Tobacco Free Living – USAMEDCOM), 8 May 2015; and any Operations Order, regulation or other instruction implementing, defining or otherwise addressing the Tobacco Free Medical Campus (TFMC) on any military installation or DoD-controlled location, Contractor personnel are prohibited from using any tobacco product on or within any TFMC while performing under this contract. TFMCs are established at each installation or DoD-controlled location and include:

(1) any property or non-residential building that is operated, maintained or assigned to support medical activities, including but not limited to, hospitals, medical laboratories, outpatient clinics (including medical, dental, and veterinary facilities), or aid stations operating for the primary purpose of delivering medical care and services for DOD eligible beneficiaries and /or meeting the mission of the Army Medical Command;

(2) all other facilities in which medical activities or administration take place, to include HQ MEDCOM and Defense Health Headquarters;

(3) all internal roadways, sidewalks and parking lots; and

(4) all sidewalks, parking lots and grounds external but adjacent to the building or related to the migratory corridors surrounding the medical facility. The Contractor shall obtain from the COR any orders, regulations, instructions or other documents implementing, defining or otherwise addressing the TFMC for any given installation or DoD-controlled location where Contractor personnel may perform under this contract and shall instruct Contractor personnel on the TFMC limitations for installations or DoD-controlled locations where they may perform under this contract.

12. Personally Identifiable Information, Protected Health Information, and Federal Information Requirements (Revised May 23, 2017)

12.1. General Requirements Overview - Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Laws

This Section addresses the Contractor’s requirements under The Privacy Act of 1974 (Privacy Act), The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and Department of Defense (DoD) issuances. In general, the Contractor shall comply with the specific requirements set forth in this Section and elsewhere in this Contract. The Contractor shall also comply with requirements relating to records management as described herein.

This Contract incorporates by reference the federal regulations and DoD issuances referred to in this Section. If any authority is amended or replaced, the changed requirement is effective when it is incorporated under contract change procedures. Where a federal regulation and any DoD issuance govern the same subject matter, the Contractor shall first follow the more specific DoD implementation unless the DoD issuance does not address or is unclear on that matter. DoD issuances are available at http://www.dtic.mil/whs/directives.

For purposes of this Section, the following definitions apply.

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (October 29, 2014) and DoD 5400.11-R (May 14, 2007).

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 Code of Federal Regulations (CFR) Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-E (Enforcement), as amended. Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this Section and are not included in the term HIPAA Rules.

DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (January 24, 2003), Department of Defense Instruction (DoDI) 6025.18 (December 2, 2009), and DoDI 8580.02 (August 12, 2015).

Defense Health Agency (DHA) Privacy Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Chief is the HIPAA Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate (NCRMD).

12.2. Records Management

When creating and maintaining official Government records, the Contractor shall comply with all federal requirements established by 44 United States Code (U.S.C.) Chapters 21, 29, 31, 33 and 35, and by 36 CFR, Chapter XII, Subchapter B – Records Management. The Contractor shall also comply with DoD Administrative Instruction No. 15 (DoD AI-15), “OSD Records and Information Management Program” (May 3, 2013) and Records Management requirements outlined in the current TRICARE Operations Manual (TOM).

12.3. Freedom of Information Act (FOIA)

The Contractor shall comply with the following procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action:

The Contractor shall inform beneficiaries that DHA FOIA procedures require a written request addressed to the DHA Freedom of Information Service Center, 7700 Arlington Boulevard, Suite 5101, Falls Church, Virginia 22042-5101 (or email requests addressed to DHA.FOIA@mail.mil), and that the request shall describe the desired record as completely as possible (ideally with Contract or modification number) to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. Although the administrative time limit to grant or deny a request (ten working days after receipt) does not begin until the request is received by DHA, the Contractor shall act as quickly as possible.

In response to requests received by the Contractor for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria. All other requests from the public for release of DHA records and, specifically, all requests that reference FOIA shall be immediately forwarded to DHA, ATTENTION: Freedom of Information Officer, for appropriate action. Direct contact, including interim replies, between TRICARE Contractors and such requestors is not authorized. The Contractor shall process requests by individuals for access to records about themselves in accordance with directions from the DHA Freedom of Information Service Center. If such a requestor specifically makes the request under the Privacy Act or does not make clear whether the request is made under FOIA or the Privacy Act, the Contractor shall process the request in accordance with directions from the DHA Privacy Office. If requestor specifically seeks PHI under HIPAA, the Contractor shall follow paragraph 12.8.1.6., relating to individual rights of access to PHI.

12.4. Systems of Records

In order to meet the requirements of the Privacy Act and the DoD Privacy Act Issuances, the Contractor shall identify to the DHA Contracting Officer (CO) systems of records that are or will be maintained or operated for DHA where records of PII collected from individuals are maintained and specifically retrieved using a personal identifier. Upon identification of such systems to the CO, and prior to the lawful operation of such systems, the Contractor shall coordinate with the DHA Privacy Office to complete systems of records notices (SORNs) for submission and publication in the Federal Register as coordinated by the Defense Privacy, Civil Liberties, and Transparency Division, and as required by the DoD Privacy Act Issuances.

Following proper SORN publication and Government confirmation of Contractor authority to operate the applicable system(s), the Contractor shall also comply with the additional systems of records and SORN guidance, in coordination with the DHA Privacy Office, regarding periodic system review, amendments, alterations, or deletions set forth by the DoD Privacy Act Issuances, Office of Management and Budget (OMB) Memorandum 99-05, Attachment B, and OMB Circular A-130. The Contractor shall promptly advise the DHA Privacy Office of changes in systems of records or their use that may require a change in the SORN.

12.5. Privacy Impact Assessment (PIA)

Contractors are not required to submit PIAs to DHA.

12.6. Data Sharing Agreement (DSA)

12.7. Privacy Act and HIPAA Training

The Contractor shall ensure that its entire staff, including subcontractors and consultants that perform work on this Contract receive training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of alcohol and drug abuse patient records, 42 CFR Part 2. Refer to FAR 52.224-3 regarding specific requirements for Privacy Training appropriate to the Contractor’s scope of involvement with DHA’s PHI and its regulatory responsibilities as either a Covered Entity, or Business Associate.

The Contractor shall ensure all employees and subcontractors supply a certificate of all training completion to the Contracting Officer’s Representative (COR) within 30 days of being assigned and on an annual basis based on the trainee’s birth month thereafter.

12.8. HIPAA Business Associate Provisions

12.8.1. Business Associate – General Provisions

The Contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules and the DoD HIPAA Issuances. Therefore, a Business Associate Agreement (BAA) between the Contractor and DHA is required to comply with the HIPAA Rules and the DoD HIPAA Issuances. This paragraph 12.8. serves as the required BAA. As a Business Associate, the Contractor shall comply with the HIPAA Rules and the DoD HIPAA Issuances applicable to a business associate performing under this Contract.

12.8.1.1. Catch-All Definition

The following terms used, but not otherwise defined in paragraph 12.8.1., shall have the same meaning as those terms have in the DoD HIPAA Issuances: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information (Unsecured PHI), and Use.

12.8.1.2. The Contractor shall not use or further disclose PHI other than as permitted or required by the Contract or as Required by Law.

12.8.1.3. The Contractor shall use appropriate safeguards, and comply with the HIPAA Security Rule with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Contract.

12.8.1.4. The Contractor shall report to DHA any breach of which it becomes aware, and shall proceed with breach response steps as required by paragraph 12.9. (if this Contract incorporates by reference the TOM, then all references to paragraph 12.9. shall be deemed to refer to the breach response provisions of the TOM, Ch. 1, Sec. 5, paragraphs 12.2.1.- 12.2.2.). With respect to electronic PHI, the Contractor shall also respond to any security incident of which it becomes aware in accordance with any applicable DoD cybersecurity and National Institute of Standards and Technology (NIST) requirements. If at any point the Contractor becomes aware that a security incident involves a breach, the Contractor shall immediately initiate breach response as required by paragraph 12.9.

12.8.1.5. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), respectively, as applicable, the Contractor shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Contractor agree to the same restrictions, conditions, and requirements that apply to the Contractor with respect to such PHI.

12.8.1.6. With respect to individual rights of access to PHI, the Contractor shall make available PHI in a designated record set to the individual or the individual’s designee as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.524. If the Contractor intends to deny the individual’s request, the Contractor shall forward it (within seven (7) working days of receipt) to the CO. The CO shall make a determination within 20 calendar days (50 calendar days for justified delays) of the request. The CO shall notify the individual, with a copy to the Contractor, of any approved or denied access determinations and the reason for any denial. The individual may appeal the denial determination to the DHA Privacy Office.

12.8.1.7. The Contractor shall make any amendment(s) to PHI in a designated record set as directed or agreed to by DHA, or take other measures as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.526.

12.8.1.8. The Contractor shall maintain and make available to the Government the information required to provide an accounting of disclosures to the MHS or to the individual as necessary to satisfy DHA’s obligations under the DoD HIPAA Issuances and the corresponding 45 CFR 164.528.

12.8.1.9. To the extent the Contractor is to carry out one or more of DHA’s obligation(s) under the HIPAA Rules, the Contractor shall comply with the requirements of the HIPAA Rules.

12.8.1.10. The Contractor shall make its internal practices, books, and records available to the HHS Secretary for purposes of determining compliance with the HIPAA Rules.

Permitted Uses and Disclosures

12.8.2. General Use and Disclosure Provisions

The Contractor may only use or disclose PHI as necessary to perform the services set forth in this Contract or as required by law. The Business Associate is not permitted to de-identify PHI under DoD HIPAA Issuances or the corresponding 45 CFR 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by the Contract or directed by DHA. The Contractor agrees to use, disclose and request PHI only in accordance with the HIPAA Privacy Rule “minimum necessary” standard and corresponding DHA policies and procedures as stated in the DoD HIPAA Issuances. The Contractor shall not use or disclose PHI in a manner that would violate the DoD HIPAA Issuances or HIPAA Privacy Rules if done by the covered entity, except uses and disclosures for the Contractor’s own management and administration and legal responsibilities or for data aggregation services as set forth in paragraphs 12.8.3.1. – 12.8.3.3.

12.8.3. Specific Use and Disclosure Provisions

12.8.3.1. Except as otherwise limited in this Section, the Contractor may use PHI for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor. The foregoing authority to use PHI does not apply to disclosure of PHI, which is covered in the next paragraph.

12.8.3.2. Except as otherwise limited in paragraph 12.8.3., the Contractor may disclose PHI for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

12.8.3.3. Except as otherwise limited in this Section, the Contractor may use PHI to provide Data Aggregation services relating to DHA’s health care operations.

12.8.4. Contractor Compliance with DHA Notices and Restrictions

12.8.4.1. DHA will provide the Contractor with the notice of privacy practices that DHA produces in accordance with the DoD HIPAA Issuances and the corresponding 45 CFR 164.520.

12.8.4.2. Upon notification by DHA of any changes in, or revocation of, permission by an individual to use or disclose his or her PHI, the Contractor shall comply to the extent that such changes may affect the Contractor’s use or disclosure of PHI.

12.8.4.3. Upon notification by DHA, the Contractor shall comply with any restriction on the use or disclosure of PHI that the Government has agreed to or is required to abide by under the DoD HIPAA Issuances or the corresponding 45 CFR 164.522, to the extent that such restriction may affect Contractor’s use or disclosure of PHI.

12.8.5. Permissible Requests by DHA

The Government will not request the Contractor to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules or any applicable Government regulations (including without limitation, DoD HIPAA Issuances) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this Contract.

12.8.6. Termination

12.8.6.1. Effect of Noncompliance

Noncompliance by the Contractor (or any of its staff, agents, or subcontractors) with any requirement in these HIPAA Business Associate Provisions (paragraph 12.8.) may subject the Contractor to termination under any applicable default or other termination provision of this Contract.

12.8.6.2. Effect of Termination

12.8.6.2.1. If this Contract has records management requirements, the Contractor shall handle such records in accordance with the records management requirements. If this Contract does not have records management requirements, the Contractor shall handle such records in accordance with paragraphs 12.8.6.2.2. and 12.8.6.2.3. below. If this Contract has provisions for transfer of records and PII/PHI to a successor Contractor, or if DHA gives directions for such transfer, the Contractor shall handle such records and information in accordance with such Contract provisions or DHA direction.

12.8.6.2.2. If this Contract does not have records management requirements, except as provided in paragraph 8.6.2.3 below, upon termination of the Contract, for any reason, the Contractor shall return or destroy all PHI received from the Government, or created or received by the Contractor on behalf of the Government that the Contractor still maintains in any form. This provision shall apply to PHI that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the PHI.

12.8.6.2.3. If this Contract does not have records management provisions and the Contractor determines that returning or destroying the PHI is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of PHI is infeasible, the Contractor shall extend the protections of the Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such PHI.

12.8.7. Miscellaneous

12.8.7.1. Survival

The obligations of the Contractor under the “Effect of Termination” provision of Paragraph 12.9. shall survive the termination of this Contract.

12.8.7.2. Interpretation

Any ambiguity in this Contract shall be interpreted in a manner to permit compliance with the HIPAA Rules and the DoD HIPAA Issuances.

12.9. Breach Response

12.9.1. Definitions Related to Breach response

12.9.1.2. Breach means a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for other than an authorized purpose have access or potential access to PII, whether physical or electronic. The foregoing definition is based on the definition of breach in DoDD 5400.11. Breaches are classified as either possible or confirmed (see the following two definitions) and as either cyber or non-cyber (i.e., involving either electronic PII/PHI or paper/oral PII/PHI).

12.9.1.3. A possible breach is an incident where the possibility of unauthorized access is suspected (or should be suspected) and has not been ruled out. For example, if a laptop containing PII/PHI is lost, and the Contractor does not initially know whether or not the PII/PHI was encrypted, then the incident must initially be classified as a possible breach, because it is impossible to rule out the possibility of unauthorized access to the PII/PHI. In contrast, that possibility can be ruled out immediately, and a possible breach has not occurred, when misdirected postal mail is returned unopened in its original packaging. However, if the intended recipient informs the Contractor that an expected package has not been received, then a possible breach exists until and unless the unopened package is returned to the Contractor. In determining whether unauthorized access should be suspected, the Contractor shall consider at least the following factors:

• How the event was discovered;

• Did the information stay within the covered entity’s control;

• Was the information actually accessed/viewed; and

• Ability to ensure containment (e.g., recovered, destroyed, or deleted).

12.9.1.4. A confirmed breach is an incident in which it is known that unauthorized access could occur. For example, if a laptop containing PII/PHI is lost and the Contractor knows that the PII/PHI is unencrypted, then the Contractor should classify and report the incident as a confirmed breach, because unauthorized access could occur due to the lack of encryption (the Contractor knows this even without knowing whether or not unauthorized access to the PII/PHI has actually occurred). If the laptop is subsequently recovered and forensic investigation reveals that files containing PII/PHI were never accessed, then the possibility of unauthorized access can be ruled out, and the Contractor should re-classify the incident as a non-breach incident.

12.9.1.5. A HIPAA breach is an incident that satisfies the definition of breach in 45 CFR 164.402.

12.9.1.6. A cybersecurity incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices, with respect to electronic PII/PHI. A cybersecurity incident may or may not involve a breach of PII/PHI. For example, a malware infection would be a possible breach if it could cause unauthorized access to PII/PHI. However, if the malware only affects data integrity or availability (not confidentiality), then a non-breach cybersecurity incident has occurred.

12.9.2. General

12.9.2.1. The breach response requirements set forth in this paragraph 12.9. are designed to satisfy both the DoD Privacy Act Issuances and the HIPAA Breach Rule, 45 CFR Part 164, Subpart D, as applicable. The definition of breach above is based on the definition of breach in the DoD Privacy Act Issuances. This Privacy Act definition is broader than a HIPAA breach as defined above. Thus, a Privacy Act breach would not constitute a HIPAA breach if the PII involved does not include PHI or if it involves PHI but is excluded from the definition of HIPAA breach. If a breach is not a HIPAA breach, then the Contractor has no HIPAA breach response obligations. In such cases, the Contractor must still comply with breach response requirements under the DoD Privacy Act Issuances, as stated in this paragraph 12.9.

12.9.2.2. Because DoD defines “breach” to include possible (suspected), as well as actual (confirmed) breaches, the Contractor shall implement these breach response requirements immediately upon the Contractor’s discovery of a possible breach. These procedures focus on the first two steps (breach identification and reporting) of a comprehensive breach response program, but also require addressing the remaining steps: containment, mitigation (which includes individual notification), eradication, recovery, and follow-up.

12.9.2.3. The Contractor shall establish internal processes for carrying out the procedures set forth below. These processes shall assign responsibility for investigating, classifying, reporting and otherwise responding to…