Resident Wandering System Brand Name or Equal Pittsburgh VA Healthcare System
COMBINED SYNOPSIS/SOLICITATION General Information Document Type: Combined Solicitation/Synopsis Solicitation Number: 36C24419Q1204 Current Response Date: Wednesday, October 16, 2019 Product or Service Code: L063 Set Aside (SDVOSB/VOSB): Small Business NAICS Code: 561621 Contracting Office Address Department of Veterans Affairs Lebanon VA Medical Center 1700 South Lincoln Avenue Lebanon, PA 17046 Description This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Items, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested, and a written solicitation document will not be issued. This solicitation is a request for quotations (RFQ). The solicitation document and incorporated provisions and clauses are those in effect tough Federal Acquisition Circular 2005-95. The associated North American Industrial Classification System (NAICS) code for this procurement is 561621, with a small business size standard of $20.5 million. The Pittsburgh VA Medical Center is seeking to purchase, BRAND NAME or EQUAL, Wanderguard Blue, patient wandering system. All interested companies shall provide quotation(s) for the following: Supplies/Services Line Item Description Quantity Unit Price Total Price 0001 Installation Base Year POP Begin: 10/22/2019 POP End: 12/21/2019 2 MO 1001 Wandering System Ongoing Support and Licensing Option 1 POP Begin: 12/22/2019 POP End: 12/21/2020 12 MO 2001 Wandering System Ongoing Support and Licensing Option 2 POP Begin: 12/22/2020 POP End: 12/21/2021 12 MO 3001 Wandering System Ongoing Support and Licensing Option 3 POP Begin: 12/22/2021 POP End: 12/21/2022 12 MO 4001 Wandering System Ongoing Support and Licensing Option 4 POP Begin: 12/22/2022 POP End: 12/21/2023 12 MO Delivery/Service shall be provided no later than 30 calendar days after receipt of order/award of contract. Delivery terms FOB destination and must be coordinated with facility Point-of-Contact (POC), prior to delivery. The contractor shall deliver line item(s) 0001 tough 4001 to the multiple sites listed below: Delivery/Service Location Site #1 Address: Department of Veterans Affairs VA Pittsburgh Healthcare System 1010 Delafield Road Pittsburgh, PA Postal Code: 15215 Country: UNITED STATES Award shall be made to the quoter whose quotation offers the best value to the government, considering technical capability, past performance, and price. The government will evaluate information based on the following evaluation criteria: "(1) price, (2) past performance, and (3) technical capability factor "meeting or exceeding the requirement. Submission of Questions Questions regarding this solicitation shall be received no later than Monday, October 14, 2019 at 2:00 PM Eastern Standard Time (EST). Questions received after this time may not be considered for review. Questions shall be submitted to Daniel Johnson Contract Specialist at daniel.johnson44@va.gov. Prospective Offerors are asked to submit their questions grouped by solicitation section and referring to the paragraph in that section. The Subject Line for questions shall state VA Pittsburg Healthcare System, Resident Wandering System Questions . Responses to all inquiries/questions will be returned via amendment to posted solicitation, for those vendors solicited giving due regard to the proper protection of proprietary information. Offerors shall be responsible for monitoring their email for the agency s responses. No information concerning this solicitation shall be provided in response to telephone calls. Prospective Offerors are warned against contacting any Department of Veterans Affairs (DOVA) personnel other than the Contract Specialist prior to award of a contract resulting from this solicitation. If such contact occurs and is found to be prejudicial to competing Offerors, the Offeror making such contact may be excluded from award consideration. Submission of Quotes This solicitation is being issued as a Small Business (SB) set-aside in the Open Market. Quotations shall be received no later than Wednesday, October 16, 2019 at 12:00 P.M. EST. Quotations received after this time may not be considered for award. All quotes shall be emailed to Daniel Johnson Contract Specialist at Daniel.johnson44@va. The Subject Line for email submissions shall state VA Pittsburgh Healthcare System, Resident Wandering System - Offer . Quote Content and Submission Instructions Vendors should review Request for Quote (RFQ) and are ultimately responsible for ensuring that their quotes fully comply with submission requirements for this RFQ.A Each quote shall clearly demonstrate that the Vendor understands both the general and specific technical requirements of the Scope of Work (SOW). Failure to explain Vendor s ability to meet all requirements may result in the Vendor's quote not being considered. Along with their quote and documentation of understanding the vendor must submit the documentation of certification to work on the subject services. Clarity and completeness of quotes are of the utmost importance. Therefore, quotes must be organized in a practical, clear and concise manner. The submission shall not be any more than four (4) pages. For a response to this solicitation to be considered complete Offers must comply with the following requirements: The Offeror shall provide authorized letter from the Original Equipment Manufacturer (OEM), and materials necessary to perform installation and support on the resident wandering system at the VA Pittsburgh Healthcare System (VAPHS) and VAPHS Heinz Campus Community Living Center. The Offeror is required to have the technical skills to maintain and support the resident wandering system listed in the Statement of Work. The Offeror is requested to provide a Base Year plus four (4) Option Year price. Evaluation Criteria Award for this requirement will be made to the offeror who proposes the lowest price technically acceptable to the Government. To be Technically Acceptable must be capable of working on the equipment listed in the SOW as demonstrated by their training documents. A review will be conducted. The DOVA will award to the offeror proposing the best value to the Government, price and other factors considered. The evaluation matrix is as follows but not limited to: 1. Letter from Original Equipment Manufacturer (OEM), authorizing the Offeror to provide the supply/service 2. Detailed written document or brochure of the technical details of the provided product and support. The DOVA will evaluate quotes for award purposes by adding the total price of all Base and Option amounts for each CLIN. Evaluation of options will not obligate the DOVA to exercise the option(s). All optional services must be priced for the proposal to be evaluated. The DOVA may reject a quote as non-responsive if it is materially unbalanced as to price for the base year requirement in relationship to the option years. A quote is unbalanced when it is based on prices significantly less for some work and significantly overstated for other work, or the prices do not reflect market value. Quoters must provide a copy of the authorized distributor letter to verify that they are an authorized distributor. The full text of FAR provisions or clauses may be accessed electronically at http://acquisition.gov/comp/far/index.html. The following solicitation provisions apply to this acquisition: FAR 52.212-1, Instructions to Offerors Commercial Items (Jan 2017) Addendum: (a) Gray market items are Original Equipment Manufacturer s (OEM) goods sold tough unauthorized channels in direct competition with authorized distributors. This procurement is for new OEM medical supplies, medical equipment and/or services contracts for maintenance of medical equipment (i.e. replacement parts) for VA Medical Centers. No remanufactures or gray market items will be acceptable. (b) Vendor shall be an OEM, authorized dealer, authorized distributor or authorized reseller for the proposed medical supplies, medical equipment and/or services contracts for maintenance of medical equipment (i.e. replacement parts), verified by an authorization letter or other documents from the OEM, such that the OEM s warranty and service are provided and maintained by the OEM. All software licensing, warranty and service associated with the medical supplies, medical equipment and/or services contracts for maintenance of medical equipment shall be in accordance with the OEM terms and conditions. (c) The delivery of gray market items to the VA in the fulfillment of an order/award constitutes a breach of contract. Accordingly, the VA reserves the right to enforce any of its contractual remedies. This includes termination of the contract or, solely at the VA s election, allowing the Vendor to replace, at no cost to the Government, any remanufactured or gray market item(s) delivered to a VA medical facility upon discovery of such items. FAR 52.212-3, Offerors Representations and Certifications Commercial Items (Nov 2017) Offerors must complete annual representations and certifications on-line at http://orca.bpn.gov in accordance with FAR 52.212-3, Offerors Representations and Certifications Commercial Items. and its quote if it has not been completed on SAM.gov. The following contract clauses apply to this acquisition: FAR 52.212-4, Contract Terms and Conditions Commercial Items (Jan 2017) FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders (Nov 2017) The following subparagraphs of FAR 52.212-5 are applicable: 52.219-6 Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C. 644) 52.219-14 Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)) 52.219-28 Post Award Small Business Program Representation (Jul 2013) 52.222-3 Convict Labor (Jun 2003) (E.O. 11755) 52.222-19 Child Labor--Cooperation with Authorities and Remedies (Oct 2016) (E.O. 13126) 52.222-21 Prohibition of Segregated Facilities (APR 2015) 52.222-26 Equal Opportunity (Sep 2016) (E.O. 11246) 52.222-36 Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793) 52.222-50 Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627) 52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving (Aug 2011) (E.O. 13513) 52.225-3 Buy American--Free Trade Agreements--Israeli Trade Act (May 2014) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L.) 52.225-13 Restrictions on Certain Foreign Purchases (Jun 2008) 52.232-34 Payment by Electronic Funds Transfer--Other than System for Award Management (Jul 2013) (31 U.S.C. 3332) 52.222-41 Service Contract Labor Standards (Aug 2018)(41 U.S.C. chapter 67) Additional Clauses: 52.202-1 Definitions (Nov 2013) 52.203-7 Anti-kickback Procedures (May 2014) 52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights (Apr 2014) 52.204-7 System for Award Management (Oct 2018) 52.204-19 Incorporation by Reference of Representations and Certifications (Dec 2014) 52.204-25 Prohibition on Contracting for Certain telecommunications and Video Surveillance Services or Equipment (Aug 2019) 52.207-2 Notice of Streamlined Competition (May 2006) 52.211-6 Brand Name or Equal (Nov 1999) 52.216-24 Limitation of Government Liability (Apr 1984) 52.217-8 Option to Extend Services (Nov 1999) 52.217-9 Option to Extend the Term of the Contract (Mar 2000) 52.219-8 Utilization of Small Business Concerns (Oct 2018) 52.225-13 Restrictions on Certain Foreign Purchase (Jun 2008) 52.232-1 Payments (Apr 1984) 52.232-18 Availability of Funds (Apr 1984) 52.232-19 Availability of Funds for the Next Fiscal Year (Apr 1984) 52.232-25 Prompt Payment (Jan 2017) 52.232-39 Unenforceability of Unauthorized Obligations (Jun 2013) 52.233-3 Protest After Award (Aug 1996) 52.233-4 Applicable Law For Breach of Contract Claim (Oct 2004) 52.237-2 Protection of Government Buildings, Equipment, and Vegetation (Apr 1984) 52.244-6 Subcontracts for Commercial Items (Aug 2019) 52.249-2 Termination for Convenience of the Government (Fixed-Price) (Apr 2012) 852.203-70 Commercial Advertising (Jan 2008) 852.219-11 VA Notice of Total Veteran-Owned Small Business Set-Aside (Jul 2016) 852.246-71 Rejected Goods (Oct 2018) 852.203-70 Commercial Advertising (Jan 2008) Additional Provisions: 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (Aug 2019) 52.214-21 Descriptive Literature (Apr 2002) 52.217-5 Evaluation of Options (Jul 1990) 52.219-1 Small Business Program Representations (Oct 2014) 52.225-25 Prohibition on Contracting with Entities Engaging in Certain Activities or Transactions Relating to Iran Representation and Certifications (Aug 2018) 52.233-2 Service of Protest (Sep 2006) All Offerors shall submit the following: One (1) copy and must provide a certificate or a letter from the manufacturer, stating that they are a certified reseller. All quotations shall be sent to the Contract Specialist via e-mail, at Daniel.johnson44@va.gov. This is an open-market combined synopsis/solicitation for, BRAND NAME or EQUAL, Wanderguard Blue patient wandering system as defined herein.A A The government intends to award a purchase order because of this combined synopsis/solicitation that will include the terms and conditions set forth herein. To facilitate the award process, all quotes must include a statement regarding the terms and conditions herein as follows: "The terms and conditions in the solicitation are acceptable to be included in the award document without modification, deletion, or addition." OR "The terms and conditions in the solicitation are acceptable to be included in the award document with the exception, deletion, or addition of the following:" Quoter shall list exception(s) and rationale for the exception(s). Submission shall be received no later than 12:00 P.M. EST, Wednesday, October 16, 2019. Late submissions shall be treated in accordance with the solicitation provision at FAR 52.212-1(f). Only e-mailed quotes will be accepted. Any questions or concerns regarding this solicitation should be forwarded in writing via e-mail to the Contract Specialist, Daniel Johnson, at Daniel.johnson44@va.gov. Point of Contact Daniel Johnson Contract Specialist 717-304-9166 Daniel.johnson44@va.gov STATEMENT OF WORK VA PITTSBURGH HEALTHCARE SYSTEM GENERAL The VA Pittsburgh Healthcare System (VAPHS) has a requirement for all labor, materials, support and travel to provide a Resident Wandering System at its H.J. Heinz campus in O Hara Township, at 1010 Delafield Road, Pittsburgh, PA, 15215. The Contractor shall provide labor, materials, equipment, support, and travel regarding the required services in buildings 50, 51 and 71. The Contractor shall install, test and commission the system in Base Year of the contract and shall provide technical support for the life of the contract, including all Option Years. REQUIREMENTS The wandering system shall be a stand-alone system and shall operate without connection to the VA computer network. Power for all system devices including; door controllers, exciters, gateways and antennas shall be provided from the head end of the system. VAPHS shall provide 120 VAC power receptacles for system work station computers and monitors. The Contractor shall commit to actively pursue approval of their resident wandering system to operate on the VA computer network in accordance with The Department of Veterans Affairs VA Technical Reference Model (VA-TRM). Any RF energy generated during system operation shall not affect existing Wi-Fi, computer and network systems, building control equipment, medical equipment, physical security devices and any other medical center equipment and systems. Leakage of RF energy between floors is not acceptable. The Contractor shall provide and install 73 door controllers including related hardware at locations shown in drawings included in Appendix A. Individual door installations shall include adequate Low Frequency (LF) coverage to detect a resident s tag. Door installations shall also include audible and visual alarms and a password-enabled keypad used to both by-pass door and silence alarms. Individual door controller settings such as schedules, users and event logs shall be configurable from system work stations and from a wireless tablet or other smart device. The Contractor shall provide and install exciters and gateways necessary to cover resident-accessible areas in Buildings 50, 51 and 71, as indicated in drawings included in Appendix A. Resident tags shall be locatable to within twenty-five (25) feet of its location. All building areas shall be included within assigned geo-boundaries with associated textual descriptions. These locations and descriptions shall be used to identify resident tag location at system work stations. Individual resident tags shall be minimally sized and be programmable to a unique user. Tags shall resist cutting and have a tee (3)-year battery life. The system shall include a means to check battery life in tags. The contractor shall provide nine (9) system computer work stations at locations listed below. Building 50- Ground South Nurse Station Building 50- 1 North Nurse Station Building 50- 1 South Nurse Station Building 51- 1A PCC Office Building 51-1A101 VA Security Building 51- 2A Nurse Station Building 51- 2B Nurse Station Building 51- 3A Nurse Station Building 51- 3B Nurse Station The system shall provide visual and audible alarm notifications both locally and at the resident s assigned nurse station when a resident enters predefined areas or zones. The system shall integrate with the buildings elevators to restrict residents from leaving designated areas. Elevator access points shall include a password-enabled keypad to allow elevator operation while a tag is present. The system shall provide an alarm notification when a resident exits buildings 51 and 71 and travels in excess of 35 feet. The system shall be expandable to provide additional coverage. The Contractor shall provide and install all: Plenum CAT 6e cabling. All cables are to be labeled. Head end equipment power supplies, server and software Controllers, keypads, door contacts and antennas Associated hardware, mounting equipment and connectors The Contractor shall program and test each door, area and zone. The Contractor shall supply complete documentation of system infrastructure to correspond to as-built system components and cabling. The Contractor shall provide a minimum of 16 hours of system training for VAPHS nursing staff and eight hours of training for VAPHS Facilities Maintenance and Engineering staff. WORKING HOURS If Contractor is required to be onsite, it must be between the hours of 8:00 A.M. EST 4:00 P.M. EST on Monday Friday (EXCLUDING FEDERAL HOLIDAYS). If one of the planned days were to overlap onto a holiday, it is on the Contractor to reschedule another day/time with the COR, at no additional cost to the Government. PERIOD OF PERFORMANCE Base Year: 10/22/2019 12/21/2019 Option Year One (1): 12/22/2019 12/21/2020 Option Year Two (2): 12/22/2020 12/21/2021 Option Year Tee (3): 12/22/2021 12/21/2022 Option Year Four (4): 12/22/2022 12/21/2023 Installation shall be conducted during the Base Year. Ongoing support and licensing shall be for Option Year One (1) Four (4). INFECTION CONTROL AND SAFETY REQUIREMENTS The Contractor shall adhere to all OSHA, EPA, NFPA Life Safety Codes, and all other regulatory requirements contained in VAPHS Medical Center Requirements (MCR), Sec. 01 01 10. VAPHS MCR outlines general safety, confined space, dust control, permits, hazardous materials handling, environmental protection and other safety and health requirements. In performance of this contract, the Contractor shall follow VAPHS safety policies and standards for safe work practices and take such safety precautions as the VAPHS Safety Officer or designee may determine to be reasonably necessary to protect the lives and health of occupants of the building. The Contractor shall comply with VAPHS smoking policy, which designates all interior space as non-smoking areas. Patient, employee, visitor, and Contractor personnel safety best practices shall be adhered to at all times. The Contractor is responsible for the safety and health of his/her employees. The Contractor shall comply with all applicable OSHA safety and health standards. The Contractor shall replace all safety guards, equipment, devices, etc., removed during service or repair immediately after completion of work or when leaving a job unattended. The Contractor shall submit to the Contracting Officer, prior to the start of the contract, the Material Safety Data Sheets (MSDS) for all potentially hazardous materials (lubricants, cleaners, working fluids, etc.) to be used in the facility during performance of the contract, and will not use in the facility, any materials which have not been cleared in advance with the VAPHS. MSDS for new chemicals shall be furnished concurrently with the arrival of the chemical on site. The Contractor shall maintain a copy of all MSDS at the chemical storage site in a location accessible to VAPHS personnel to assure compliance with all laws and requirements regarding the Right to Know law. The Contractor is responsible for identifying, providing and maintaining all personal protective equipment (PPE) required to perform the duties outlined in the contract. Additionally, the Contractor is responsible for identifying and adhering to all applicable safety program guidelines (lockout/tag out, confined space entry, universal precautions, etc.) required to perform the work. Contractor is responsible for providing and documenting any and all required safety training and proper use of PPE to their employees. Training documentation will be provided to the COR upon request. The Contractor shall obtain a Hot Work Permit from the VAPHS Safety Office whenever soldering, welding, using a cutting torch, or other open flame, spark, or heat producing equipment is required. The Contractor is required to follow all requirements outlined for the issuance of the Hot Work Permit. The Contractor shall be notified of any non-compliance with the provisions of the contract. The Contractor shall, after receipt of such notice, immediately correct the condition and notify the COR/contracting officer in writing that the condition has been corrected. If, in the opinion of the VAPHS Safety Officer or designee, the compliance condition is considered to be life teatening, he/she shall instruct the Contractor to stop work until the condition has been corrected. If the Contractor fails or refuses to comply promptly, the contracting officer may issue an order halting all or any part of the work, and Contractor may be held in default. The Contractor will bear all costs associated with a stoppage of work or time spent correcting any safety hazards. VHA HEALTHCARE DIRECTIVE Flu Vaccination Program - VHA Directive 1192 requires all health care personnel (HCP) to participate in the seasonal influenza prevention program and outlines the key implementation steps. Health care personnel is defined in VHA Directive 1192 as all VA licensed and unlicensed, clinical and administrative, paid and unpaid, full- and part-time employees, intermittent employees, fee basis employees, VA contractors, students, researchers, volunteers, and trainees who work in VHA locations. HCP covered by the policy are expected to receive annual influenza vaccination. Those HCP unable or unwilling to be vaccinated are required to wear a face mask toughout the influenza season. Masks are available at entrances toughout the medical center. It is the responsibility of the contractor to ensure that all contract staff are compliant with the requirements outlined in VHA Directive 1192. The contractor shall maintain the following documentation: Documentation of vaccination, e.g., signed record of immunization from a health care provider or pharmacy, or a copy of medical records documenting the vaccination. Completed Health Care Personnel Influenza Vaccination Form (Attachment B of VHA Directive 1192) if unwilling or unable to receive the vaccine. The contractor is required to submit annual certification to the Contracting Officer s Representative (COR) that all contract staff performing services at VA facilities are in compliance with VHA Directive 1192. Standard Personnel Testing/Infection Control The Contractor shall provide proof of the following tests for their staff within five (5) calendar days after contract award and prior to the first duty shift to the COR and Contracting Officer. Tests shall be current within the past year. TUBERCULOSIS TESTING: Contractor shall provide proof of a negative reaction to PPD testing for all Contractor staff. A negative chest radiographic report for active tuberculosis shall be provided in cases of positive PPD results. The PPD test shall be repeated annually. RUBELLA TESTING: Contractor shall provide proof of immunization for all Contractors staff for measles, mumps, rubella or a rubella titer of 1.8 or greater. If the titer is less than 1.8, a rubella immunization shall be administered with follow-up documentation to the COR OSHA REGULATION CONCERNING OCCUPATIONAL EXPOSURE TO BLOODBORNE PATHOGENS; Contractors shall provide generic self-study training for all Contractors staff; provide their own Hepatitis B vaccination series at no cost to the VA if they elect to receive it; maintain an exposure determination and control plan; maintain required records; and ensure the proper follow-up evaluation is provided following and exposure incident VA Pittsburgh shall notify the Contractor of any significant communicable disease exposures as appropriate. Contractors shall adhere to current CDC/HICPAC Guidelines for Infection Control in healthcare personnel (as published in American Journal for Infection Control- AJIC 1998; 26:289-354. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS: All contractor employees and subcontractor employees requiring unescorted access to VA facilities and/or access to VA Technology resources (network and/or protected data) must complete a Special Agreement Check (SAC) investigation conducted by the FBI National Criminal History Check (NCHC). The following forms are required for a SAC: Fingerprints and OF306 Declaration For Federal Employment. The employee must be fingerprinted as part of the investigation. Electronic fingerprinting can be performed at the VA Pittsburgh Medical Center and will be coordinated tough the COR and Human Resources Office. The Contractor shall bear the expense of the background investigation(s), regardless of the final adjudication determination. A Bill of Collections shall be generated by the VA after final adjudication determination has been received. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. VA INFORMATION CUSTODIAL LANGUAGE Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). SECURITY INCIDENT INVESTIGATION The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. LIQUIDATED DAMAGES FOR DATA BREACH Consistent with the requirements of 38 U.S.C. A5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: (1) Notification; (2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; (3) Data breach analysis; (4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; (5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and (6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. TRAINING All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: (1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems; (2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training; (3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and (4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.] The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete. CONTRACTOR RULES OF BEHAVIOR: This User Agreement contains rights and authorizations regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the Department of Veterans Affairs (VA). This User Agreement covers my access to all VA data whether electronic or hard copy ("Data"), VA information systems and resources ("Systems"), and VA sites ("Sites"). This User Agreement incorporates Rules of Behavior for using VA, and other information systems and resources under the contract. GENERAL TERMS AND CONDITIONS FOR ALL ACTIONS AND ACTIVITIES UNDER THE CONTRACT: I understand and agree that I have no reasonable expectation of privacy in accessing or using any VA, or other Federal Government information systems. I consent to reviews and actions by the Office of Information & Technology (OI&T) staff designated and authorized by the VA Chief Information Officer (CIO) and to the VA OIG regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. These actions may include monitoring, recording, copying, inspecting, restricting access, blocking, tracking, and disclosing to all authorized OI&T, VA, and law enforcement personnel as directed by the VA CIO without my prior consent or notification. I consent to reviews and actions by authorized VA systems administrators and Information Security Officers solely for protection of the VA infrastructure, including, but not limited to monitoring, recording, auditing, inspecting, investigating, restricting access, blocking, tracking, disclosing to authorized personnel, or any other authorized actions by all authorized OI&T, VA, and law enforcement personnel. I understand and accept that unauthorized attempts or acts to access, upload, change, or delete information on Federal Government systems; modify Federal government systems; deny access to Federal government systems; accrue resources for unauthorized use on Federal government systems; or otherwise misuse Federal government systems or resources are prohibited. I understand that such unauthorized attempts or acts are subject to action that may result in criminal, civil, or administrative penalties. This includes penalties for violations of Federal laws including, but not limited to, 18 U.S.C. A1030 (fraud and related activity in connection with computers) and 18 U.S.C. A2701 (unlawful access to stored communications). I agree that OI&T staff, in the course of obtaining access to information or systems on my behalf for performance under the contract, may provide information about me including, but not limited to, appropriate unique personal identifiers such as date of birth and social security number to other system administrators, Information Security Officers (ISOs), or other authorized staff without further notifying me or obtaining additional written or verbal permission from me. I understand I must comply with VA s security and data privacy directives and handbooks. I understand that copies of those directives and handbooks can be obtained from the Contracting Officer's Technical Representative (COTR). If the contractor believes the policies and guidance provided by the COTR is a material unilateral change to the contract, the contractor must elevate such concerns to the Contracting Officer for resolution. I will report suspected or identified information security/privacy incidents to the COTR and to the local ISO or Privacy Officer as appropriate. GENERAL RULES OF BEHAVIOR Rules of Behavior are part of a comprehensive program to provide complete information security. These rules establish standards of behavior in recognition of the fact that knowledgeable users are the foundation of a successful security program. Users must understand that taking personal responsibility for the security of their computer and the information it contains is an essential part of their job. The following rules apply to all VA contractors. I agree to: (1) Follow established procedures for requesting, accessing, and closing user accounts and access. I will not request or obtain access beyond what is normally granted to users or by what is outlined in the contract. (2) Use only systems, software, databases, and data which I am authorized to use, including any copyright restrictions. (3) I will not use other equipment (OE) (non-contractor owned) for the storage, transfer, or processing of VA sensitive information without a VA CIO approved waiver, unless it has been reviewed and approved by local management and is included in the language of the contract. If authorized to use OE IT equipment. I must ensure that the system meets all applicable 6500 Handbook requirements for OE. (4) Not use my position of trust and access rights to exploit system controls or access information for any reason other than in the performance of the contract. (5) Not attempt to override or disable security, technical, or management controls unless expressly permitted to do so as an explicit requirement under the contract or at the direction of the COR or ISO. If I am allowed or required to have a local administrator account on a government-owned computer, that local administrative account does not confer me unrestricted access or use, nor the authority to bypass security or other controls except as expressly permitted by the VA CIO or CIO's designee. (6) Contractors use of systems, information, or sites is strictly limited to fulfill the terms of the contract. I understand no personal use is authorized. I will only use other Federal government information systems as expressly authorized by the terms of those systems. I accept that the restrictions under ethics regulations and criminal law still apply. (7) Grant access to systems and information only to those who have an official need to know. (8) Protect passwords from access by other individuals. (9) Create and change passwords in accordance with VA Handbook 6500 on systems and any devices protecting VA information as well as the rules of behavior and security settings for the particular system in question. (10) Protect information and systems from unauthorized disclosure, use, modification, or destruction. I will only use encryption that is FIPS 140-2 validated to safeguard VA sensitive information, both safeguarding VA sensitive information in storage and in transit regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. (11) Follow VA Handbook 6500.1, Electronic Media Sanitization to protect VA information. I will contact the COR for policies and guidance on complying with this requirement and will follow the COR s orders. (12) Ensure that the COR has previously approved VA information for public dissemination, including e-mail communications outside of the VA as appropriate. I will not make any unauthorized disclosure of any VA sensitive information tough the use of any means of communication including but not limited to e-mail, instant messaging, online chat, and web bulletin boards or logs. (13) Not host, set up, administer, or run an Internet server related to my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA unless explicitly authorized under the contract or in writing by the COR. (14) Protect government property from theft, destruction, or misuse. I will follow VA directives and handbooks on handling Federal government IT equipment, information, and systems. I will not take VA sensitive information from the workplace without authorization from the COR. (15) Only use anti-virus software, antispyware, and firewall/intrusion detection software authorized by VA. I will contact the COR for policies and guidance on complying with this requirement and will follow the COR's orders regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with VA. (16) Not disable or degrade the standard anti-virus software, antispyware, and/or firewall/intrusion detection software on the computer I use to access and use information assets or resources associated with my performance of services under the contract terms with VA. I will report anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages to the COR. (17) Understand that restoration of service of any VA system is a concern of all users of the system. (18) Complete required information security and privacy training, and complete required training for the particular systems to which I require access. ADDITIONAL CONDITIONS FOR USE OF NON- VA INFORMATION TECHNOLOGY RESOURCES When required to complete work under the contract, I will directly connect to the VA network whenever possible. If a direct connection to the VA network is not possible, then I will use VA approved remote access software and services. Remote access to non-public VA information technology resources is prohibited from publicly-available IT computers, such as remotely connecting to the internal VA network from computers in a public library. I will not have both a VA network line and any kind of non-VA network line including a wireless network card, modem with phone line, or other network device physically connected to my computer at the same time, unless the dual connection is explicitly authorized by the COR. I understand that I may not obviate or evade my responsibility to adhere to VA security requirements by subcontracting any work under any given contract or agreement with VA, and that any subcontractor(s) I engage shall likewise be bound by the same security requirements and penalties for violating the same. STATEMENT ON LITIGATION This User Agreement does not and should not be relied upon to create any other right or benefit, substantive or procedural, enforceable by law, by a party to litigation with the United States Government. ***NEXT SECTION SHALL BE SIGNED AT THE TIME OF AWARD BY THE CONTRACTOR*** ACKNOWLEDGEMENT AND ACCEPTANCE I acknowledge receipt of this User Agreement. I understand and accept all terms and conditions of this User Agreement, and I will comply with the terms and conditions of this agreement and any additional VA warning banners, directives, handbooks, notices, or directions regarding access to or use of information systems or information. The terms and conditions of this document do not supersede the terms and conditions of the signatory s employer and VA. __________________________________ ________________________ Print or type your full name Signature __________________________________ ________________________ Last 4 digits of SSN Date __________________________________ _________________________ Office Phone Position Title __________________________________ Contractor s Company Name Please complete and return the original signed document to the COR within the timeframe stated in the terms of the contract. ADDITIONAL SECURITY REQUIREMENT HIPAA-Focused Training" prior to the performance of the contract and annually thereafter. Training must be completed in VA s TMS system (https://www.tms.va.gov/) or via hard copy training documents. POINT-OF-CONTACT COR: TBA Phone: TBA Email: TBA
36C24419Q1204 Department of Veterans Affairs Veterans Health Administration Veterans Integrated Service Network 4
10/11/19, 9:18 AM