2. 36C25623Q1711.pdf

36C25623Q1711

All interested companies shall provide quotations for the following:

Supplies/Services

PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 BASE YEAR

Trackcore Part No.: TC-130 TC-130 25 cu. ft.

(Large) Intelligent Cabinet (One Unit)

1.00 EA

Contract Period: Base POP Begin: 09-01-2023 POP End: 08-31-2024 PRINCIPAL NAICS CODE: 339114 - Dental Equipment and Supplies Manufacturing PRODUCT/SERVICE CODE: 6520 - Dental Instruments, Equipment, and Supplies

MANUFACTURER PART NUMBER (MPN): TC-130

0002 BASE YEAR

Trackcore Part No. RFID Annual Annual Services for RFID Enclosures (One Unit)

POP Begin: 09-01-2023 POP End: 08-31-2024 PRINCIPAL NAICS CODE: 339114 - Dental Equipment and Supplies Manufacturing PRODUCT/SERVICE CODE: 6520 - Dental Instruments, MANUFACTURER PART NUMBER (MPN): RFID ANNUAL

0003 BASE YEAR

Trackcore RFID Implementation On-site RFID Implementation (1-5 Units)

1.00 JB

POP Begin: 09-01-2023 POP End: 08-31-2024 PRINCIPAL NAICS CODE: 339114 - Dental Equipment and Supplies Manufacturing PRODUCT/SERVICE CODE: 6520 - Dental Instruments, Equipment, and Supplies

MANUFACTURER PART NUMBER (MPN): RFID

IMPLEMENTATION

TOTAL AMOUNT BASE YEAR:

1002 OPTION YEAR 1

Trackcore Part No. RFID Annual Annual Services for RFID Enclosures (One Unit)

Contract Period: Option 1 POP Begin: 09-01-2024 POP End: 08-31-2025 PRINCIPAL NAICS CODE: 339114 - Dental Equipment and Supplies Manufacturing PRODUCT/SERVICE CODE: 6520 - Dental Instruments, TOTAL AMOUNT OPTION YEAR 1:

2002 OPTION YEAR 2

Trackcore Part No. RFID Annual Annual Services for RFID Enclosures (One Unit)

Contract Period: Option 2 POP Begin: 09-01-2025 POP End: 08-31-2026 PRINCIPAL NAICS CODE: 339114 - Dental Equipment and Supplies Manufacturing PRODUCT/SERVICE CODE: 6520 - Dental Instruments, TOTAL AMOUNT OPTION YEAR 2:

3002 OPTION YEAR 3

Trackcore Part No. RFID Annual Annual Services for RFID Enclosures (One Unit)

Contract Period: Option 3 POP Begin: 09-01-2026 POP End: 08-31-2027 PRINCIPAL NAICS CODE: 339114 - Dental Equipment and Supplies Manufacturing PRODUCT/SERVICE CODE: 6520 - Dental Instruments, TOTAL AMOUNT OPTION YEAR 3:

GRAND

TOTAL

i. Prior to exercising any option, the Contracting Officer will ensure that it is still in the Government’s best interest, with price and other factors considered.

DELIVERY SCHEDULE

*** FOB Destination. All shipping charges must be included in price of items. ***

ITEM NUMBER DELIVERY DATE

0001-

SHIP TO: Michael E. DeBakey VA Medical Center ATTN: Warehouse, Building 2002 Holcombe Blvd.

Houston, TX 77030

USA

September 1, 2023 – August 31, 2024

1002 SHIP TO: Michael E. DeBakey VA Medical Center ATTN: Warehouse, Building 2002 Holcombe Blvd.

Houston, TX 77030

USA

September 1, 2024 – August 31, 2025

2002 SHIP TO: Michael E. DeBakey VA Medical Center ATTN: Warehouse, Building 2002 Holcombe Blvd.

Houston, TX 77030

USA

September 1, 2025 – August 31, 2026

3002 SHIP TO: Michael E. DeBakey VA Medical Center ATTN: Warehouse, Building 2002 Holcombe Blvd.

Houston, TX 77030

USA

September 1, 2026 – August 31, 2027

IT CONTRACT SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program.

The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance.

National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS).

Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. N/A

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerablity scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor's security control procedures must be equivalent, to those procedures used to secure VA systems.

A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA's network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor's systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government- owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

d. The contractor/subcontractor's system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA's POA&M management process. The contractor/subcontractor must use VA's POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/ subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested and re- authorized per VA Handbook 6500.3. This may require reviewing and updating all of the documentation (PIA, System Security Plan, Contingency Plan). The Certification Program Office can provide guidance on whether a new C&A would be necessary.

e. The contractor/subcontractor must conduct an annual self assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COR.

The government reserves the right to conduct such an assessment using government personnel or another contractor/subcontractor. The contractor/subcontractor must take appropriate and timely action (this can be specified in the contract) to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

f. VA prohibits the installation and use of personally-owned or contractor/ subcontractor-owned equipment or software on VA's network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA-approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned

OE.

g. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/ subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

h. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.)

with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

(1) Vendor must accept the system without the drive;

(2) VA's initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

(a) The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact; and

(b) Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be pre-approved and described in the purchase order or contract.

(c) A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The ISO needs to maintain the documentation.

6. SECURITY INCIDENT INVESTIGATION

a. The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/ subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/ subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. 5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data.

Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

8. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day's notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

9. TRAINING

‘Required course(s)’: Contractor required to complete VA Privacy and Information Security Awareness & Rules of Behavior Training (TMS) COURSE #: 10176 “Privacy and INFOSEC & Rules of Behavior.

a. All Contractor personnel and subcontractor personnel requiring access to VA information and VA information systems shall sign and acknowledge (manually) understanding of and responsibilities for compliance within 1 week of the effective date of award of the contract, before being granted access to VA information and its systems; and annually thereafter, as required by the following:

(1) Sign and acknowledge (manually) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems.

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training.

(3) Successfully complete the appropriate VA Privacy training and annually complete required privacy training; and

(4) N/A

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

(End of Clause)

STATEMENT OF WORK

1. General Information:

The Michael E. DeBakey VA Medical Center (MEDVAMC) located at 2002 Holcombe Boulevard, Houston, Texas 77030 is requesting the purchase of Brand Name: Trackcore RFID Intelligent Cabinet which includes 1) subscription/license, 2) support and 3) software upgrades to be used at MEDVAMC Dental Service Line. Training materials shall be provided for base software upgrades that affect user operation of the base software. The contract shall be Firm- Fixed Price.

2. Equipment Schedule:

Manufacturer: Trackcore

Item

Description/Part Number* Products Qty Period of Performance:

TC-130 25 cu. ft. (Large) Intelligent Cabinet (One Unit 1-EA Base Year: September 1, 2023 – August 31, 2024

Annual Services for RFID Enclosures (One Unit) 1-EA Base Year: September 1, 2023 – August 31, 2024

On-site RFID Implementation (1-5 Units) 1-EA Base Year: September 1, 2023 – August 31, 2024

Annual Services for RFID Enclosures (One Unit) OPTION

YEAR 1

1-YR

Option Year 1:

September 1, 2024 – August 31, 2025

Enclosures (One Unit) OPTION

YEAR 2

1-YR

Option Year 2:

September 1, 2025 – August 31, 2026

Enclosures (One Unit) OPTION

YEAR 3

1-YR

Option Year 3:

September 1, 2026 – August 31, 2027

3. Salient Characteristics: The following supplies are to be purchased:

NAME/DESCRIPTION OF EQUIPMENT: Trackcore RFID Intelligent Cabinet Quantity: 1 each MANUFACTURER: Trackcore MODELS: TC-130 25 cu. ft. (Large) Intelligent Cabinet (One Unit

SERIAL NUMBERS:

4. Specifications of Work: 1) Contractor shall provide the necessary manpower and supervision to properly execute the annual services of the RFID Enclosures (1 unit).

2) A “Field Service Report” (FSR) must be generated, and a copy given to the Michael E DeBakey VA Medical Center’s designated VA POC (Point of Contact) after completion of the annual service no later than five (5) days after service. It shall be preferred that this FSR be provided electronically if possible.

3) Contractor shall furnish all tools and materials (e.g., service manuals, diagnostic software, etc.) required to perform manufacturer recommended preventative maintenance.

4) Contractor may perform annual service concurrently with functional maintenance and, in that event, such maintenance may be unscheduled.

5) All repair work must be pre-approved in writing by the CO and COR/VA POC. The COR/VA POC alone does not have the authority to order services under this contract without written approval from the CO. In the event the Contractor provides services under this contract on the direction of the COR/VA POC without written approval from the CO, the Contractor shall bear the responsibility of this cost. The Contractor shall use commercially reasonable efforts to provide service as quickly as possible and on a priority basis for emergencies. Contractor shall ensure prompt communication with COR or designee.

• Software updates shall occur at a mutually agreeable time.

5. Qualifications: The Contractor shall meet The Joint Commission requirements for proving competency of service provider. To be considered eligible for consideration, offerors shall have a field service representative that has been trained by the OEM on the specific model of equipment he/she shall be asked to work on.

The Contractor shall be Original Equipment Manufacturer (OEM) or an approved authorized vendor, authorized distributor by the OEM with authorization to distribute products, Brand Name: Trackcore RFID Intelligent Cabinet with annual support. Failure to submit proof of an authorization letter on OEM letterhead by the manufacturer with their technical quote shall result in the technical quote as technically unacceptable.

6. Delivery: The Contractor shall deliver all equipment/items to the MEDVAMC, Building 100, 2002 Holcombe Blvd, Houston, Texas 77030. All equipment/items shall meet manufacturer specifications. The Contractor is responsible for any missing equipment, parts, and components not included to carry out the delivery.

6.1 Prior to shipping, Contractor shall notify designated VA point of contact (POC) five (5) calendar days prior including line-by-line details for review of requirements. Contractor cannot make any changes to the delivery schedule without request to the designated VA POC. Delivery shall be arranged with designated VA POC.

6.2 Contractor shall coordinate delivery with designated VA POC before shipment. All shipments, either single or multiple container deliveries, will bear the VA Purchase Order (PO) number on external shipping labels and associated manifests or packing lists.

7. Hours of Coverage:

7.1 All work shall be conducted from Monday through Friday at 8:00a.m. – 4:30p.m., excluding Federal holidays and unless other times are arranged in advance and approved in writing by the delegated VA POC. The government also observes Executive Orders, President’s Proclamation, and days designated by Federal Statute.

7.2 The government hereby provides notice, and the Contractor hereby acknowledges receipt that government personnel observe the listed days as holidays:

New Year’ Day January 01 Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth Day Third Monday in June Independence Day July 04 Labor Day First Monday in September Columbus Day Second Monday in October Veteran’s Day November 11 Thanksgiving Day Fourth Thursday in November Christmas Day December 25

7.3 If the holiday falls on a Sunday, the following Monday will be observed as a national holiday. When a holiday falls on a Saturday, the preceding Friday is observed as a National holiday by U.S. government agencies, and any other day specifically declared by the President of the United States.

7.4 In addition to the days designated as holidays, the government observes the following days:

6.4.1. Any other day designated by Federal Statute.

6.4.2. Any other day designated by Executive Order.

6.4.3. Any other day designated by the President’s Proclamation

7.5 It is understood and agreed between the government and the Contractor that observance of such days by the government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation. In the event the Contractor’s personnel work during the holiday, they may be reimbursed by the Contractor, however, no form of holiday or other premium compensation shall be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked.

8. The following laws, regulations, policies, and procedures, including all subsequent changes or updates apply:

FAR Federal Acquisition Regulation VAAR Veterans Administration Acquisition Regulation Standards All applicable Federal, State, Local and Industry: Laws, Policies and Standards as applicable to the proper performance afore and hereafter described.

9. Glossary:

CO Contracting Officer COR Contracting Officer’s Representative CDR Contract Deficiency Report MEDVAMC Michael E. DeBakey VA Medical Center OEM Original Equipment Manufacturer OSHA Occupational Safety and Health Administration

The Joint Commission Business Day: A business day includes the entire 24-hour period ending at midnight, and a notice required by the regulation is effective even if given outside normal business hours.

10. Parking: It is the responsibility of the Contractor personnel to park at the appropriate designated parking areas. The government does not validate or make reimbursement for parking violations of the contractor personnel under any circumstance.

11. Product Modification, Removal or Recall: If any product awarded under this contract requires modification, is removed or recalled by the Contractor or manufacturer, or if any required modification, removal or recall is suggested or mandated by a regulatory or official agency, the following steps will immediately be taken by the vendor:

a. Notify the Contracting Officer, in writing, by the most expeditious manner possible. Provide two

(2) copies of the notification which shall include, but not be limited to the following:

1) Complete item description and contract number.

2) Reason for modifications, removal or recall.

3) Necessary instructions for return for credit, replacement or corrective action.

b. The Contractor shall be responsible for any costs associated with the above.

12. Communication Services: The Contractor shall provide a call center to be maintained for government assistance Monday – Friday 8:00a.m. – 4:30p.m. Central Standard Time, not including government observed holidays. The Contractor shall provide telephone support service to the designated VA POC within one hour of a call placed by VA POC to the Contractor.

13. The Contractor shall provide software version updates remotely, as they become available, or shipped on CD (Compact Disc) to the designated VA POC (point of contact) and requested service. Any updates to product for software purposes shall be made available to the designated VA POC within 30 days of release by the manufacturer.

14. The Contractor shall provide Contractor software problem identification and enhancements with an amount not to exceed 9 days. This shall be conducted via teleconferences as no travel shall be included.

15. The C&A (Certification and Accreditation (Authorization)) requirements do not apply, and a

Security Accreditation Package is not required.

16. A Contractor Security Control Assessment (CSCA) shall be completed by the designated VA POC within 30 days of contract approval and yearly on the renewal date of the contract.

17. The Contractor shall maintain a RMA (Return Material Authorization) Contact.

18. Copyrighted Materials: The Contractor shall not engage in any unauthorized duplication of copyrighted materials by photocopying or any other means that would expose the government to liability for penalties under existing or future copyright laws.

19. Office Equipment: The MEDVAMC shall provide a server with access for official use only.

20. Safety: Safety precautions shall include, but are not limited to the following requirements:

a) OSHA (Occupational Safety and Health Act)

b) Applicable State and Local Safety Operation Procedures

c) VA Safety Practices and Policies, VAMC standard operating procedures, and any other

Federal, State, and Local regulations pertaining to the equipment listed for this contract.

d) JCAHO (The Joint Commission, formerly, Joint Commission Accreditation of Healthcare

Organizations)

21. Parking: It is the responsibility of the Contractor personnel to park at the appropriate designated parking areas. The government does not validate or make reimbursement for parking violations of the contractor personnel under any circumstance.

22. Gray Market Prevention:

(a) No gray market or remanufactured items will be acceptable. Gray market items are OEM goods sold through unauthorized channels in direct competition with authorized distributors.

This procurement is for a supply contract for the purchase of new medical equipment for the MEDVAMC. No remanufactures or gray market items will be acceptable.

(b) Vendor shall be the OEM (Original Equipment Manufacturer) or an approved authorized distributor for the proposed supply contract for the purchase of new medical equipment to include replacement parts (if applicable), such that the OEM’s warranty and service associated with the equipment and system is in accordance with the OEM terms and conditions.

(c) The delivery of gray market items to the VA in the fulfillment of an order/award constitutes a breach of contract. Accordingly, the VA reserves the right to enforce any of its contractual remedies. This includes termination of the contract or, solely at the VA’s election, allowing the Vendor to replace, at no cost to the government, any remanufactured or gray market item(s) delivered to a VA medical facility upon discover of such items.

23. Confidentiality and Nondisclosure:

23.1 The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by VA which have been generated by the contractor in the performance of this task order are the exclusive property of the U.S.

Government and shall be submitted to the Contracting Officer after the purchase order.

23.2 No information shall be released by the contractor. Any request for information relating to this purchase order presented to the contractor shall be submitted to the Contracting Officer for response.

23.3 Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the Contracting Officer.

24. Invoicing /Billing Requirements:

24.1 The Contractor shall submit requests for payment electronically to the VA’s Tungsten Network (https://www.fsc.va.gov/einvoice.asp ). Payment for services provided under the terms of this contract will be made upon delivery, inspection, and acceptance of all line items. No advance payments will be authorized.

https://www.fsc.va.gov/einvoice.asp

24.2 Invoices shall be properly prepared in accordance with FAR (Federal Acquisition Regulation) 52.212-4. Invoices will be returned when documentation is missing, inaccurate or incomplete. Invoices shall include, at a minimum, the following information:

a) Company Name, Address, and telephone number

b) Invoice Date and Number

c) PO (Purchase Order) number and Task Order Number (if applicable);

d) Description, quantity, unit of measure, unit price and extended price of the items delivered.

e) Name and Title of Contact to notify in event of defective invoice.

24.3 The Contractor shall contact the VA POC and Contracting Officer if they do not receive payment within 45 calendar days of submission of a proper invoice. The VA POC will be responsible to cross reference all shipping/packing slips against invoices submitted for payment for accuracy. The Contracting Officer will contact the Contractor for resolution of any discrepancies.

25. Changes to the SOW (Statement of Work): Any changes to the SOW shall be authorized and approved only through written correspondence from the Contracting Officer. A copy of each change will be kept in the contract file along with all other documentation of the work. Any such change shall be reflected in a written modification to this contract signed by the Contractor and the Contracting Officer. Price/cost incurred by the Contractor through the actions of parties other than the Contracting Officer shall be borne by the Contractor.

END OF SOW

The full text of FAR provisions or clauses may be accessed electronically at http://acquisition.gov/comp/far/index.html.

The following solicitation provisions apply to this acquisition:

1. ADDENDUM FAR 52.212-1, “Instructions to Offerors–Commercial Products and Commercial Services (NOV 2021)” Provisions that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

The following provisions are incorporated into 52.212-1 as an addendum to this solicitation:

FAR 52.212-1 Instructions to Offerors – Commercial Products and Commercial Services (Nov 2021)

INSTRUCTION TO OFFERORS:

This acquisition is being procured for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for Evaluation and Solicitation for Commercial Products and Commercial Services,” as supplemented with additional information. This solicitation is Full and Open Competition, and it includes all contract line item number(s) being requested in this solicitation. The government intends to solicit this requirement and award a subsequent contract without discussions or negotiations. Offerors are encouraged to provide their best offer initially because the opportunity to enter into discussions or to provide a better offer at a later time will not be possible. The government will award a contract on the basis of Lowest Priced Technically Acceptable (LPTA).

SUBMISSION OF QUOTE INSTRUCTIONS:

Quotation shall be received no later than 12:00p.m. Central Standard Time on August 23, 2023.

Quote shall be submitted electronically through email addressed to Jeneice Matthews, Contract Specialist at jeneice.matthews@va.gov .

The Contractor shall be registered in www.sam.gov to receive government contracts to be considered for award.

Offeror shall complete and submit the following:

a. The Contractor shall submit a price for all Contract Line-Item Number (CLIN) of the solicitation.

b. Provide all CLIN items listed in this solicitation that are annotated in the Price/Cost Schedule.

See FAR Clause 52.212-2 Addendum for basis for award. The price quote shall be legible, specific, and complete in every detail. Note: Pricing shall be all inclusive, for example, shipping cost/price must be rolled into the line item of the product and not separated as a separate line item.

c. For the purpose of evaluation of technical acceptability, the Contractor shall provide all of the salient physical, functional, or performance characteristics of the offered product(s), manufacturer sales literature or other product literature which clearly documents that the offered product(s) meet or exceed all of the requirements. The Contractor may include any other information that is deemed necessary.

d. The Offeror shall provide an authorized distributor letter from the Original Equipment Manufacturer (OEM) which demonstrates evidence of being an authorized OEM distributor or reseller for the quoted products.

http://acquisition.gov/comp/far/index.html mailto:jeneice.matthews@va.gov http://www.sam.gov/

e. The Offeror shall return a signed copy of the attached Business Associate Agreement Between the Department of Veterans Affairs Veterans Health Administration, Michael E. DeBakey VA Medical Center, and Contractor.

Note: The VA does not accept gray market item. Gray market items also known as a parallel market, is the trade of a commodity through distribution channels which, while legal, are unofficial, unauthorized, or unintended by the original manufacture.

Unique entity identifier (UEI) is applicable.

The Contractor’s past performance history will be evaluated by the government for the purpose of a responsibility determination.

All quotes shall remain valid for 120 calendar days.

Quoter(s) may, at the discretion of the government, be asked to provide information for clarification purposes regarding their quote. Requests for clarification of information does not constitute discussions. The CO will not notify unsuccessful quoters that responded to this Request for Quotation (RFQ).

The quoter(s) shall be held responsible for the validity of all information supplied in his/her quote, including information provided by potential subcontractors. Should subsequent investigation disclose that the fact and conditions were not as stated, the quote may be rejected and received no further consideration.

An offer shall be considered complete if it includes the technical capability, as specified in the Statement of Work, price quote and required documentation in accordance with instructions provided herein.

The following solicitation provisions apply to this acquisition:

• FAR 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

• FAR 52.204-7 SYSTEM FOR AWARD MANAGEMENT (OCT 2018)

• FAR 52.204-16 COMMERCIAL AND GOVERNMENT ENTITY CODE REPORTING (AUG

2020)

• FAR 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND

VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

• FAR 52.212-1 INSTURCTIONS TO OFFERORS-COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (MAR 2023)

• FAR 52.214-21 DESCRIPTIVE LITERATURE (APR 2002)

• FAR 52.216-1 TYPE OF CONTRACT (APR 1984)

• FAR 52.229-11 TAX ON CERTAIN FOREIGN PROCUREMENTS-NOTICE AND

REPRESENTATION (JUN 2020)

• VAAR 852.239-75 INFORMATION AND COMMUNICATION TECHNOLOGY ACCESSIBILITY

NOTICE (FEB 2023)

2. ADDENDUM FAR 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (NOV 2021)

(a) This solicitation is issued under Simplified Acquisition Procedures in accordance with FAR subpart 12.6 Streamlined Procedures for Evaluation and Solicitation for Commercial Items. This solicitation is to establish a Firm-Fixed Price contract. The Government will award a contract resulting from this solicitation on the basis of lowest price, technically acceptable (LPTA) to the responsive and responsible quoter whose quote, conforms to the solicitation. All quoters must have a current registration in the System for Award Management to be considered for award.

Since this solicitation is LPTA the government will begin by reviewing the lowest priced quote first and if the government determines that this quote is technically acceptable, no other quotes will be reviewed. This quote will have been deemed technically acceptable with the lowest price, so for this reason the award will be made based on FAR guidance.

If no offer is technically acceptable the government will make a determination to re-solicit.

Technical tradeoff will not be made, and no additional credit will be given for exceeding the minimum requirements. In the event an offeror’s quote is determined to be technically unacceptable for any of these factors, the entire quote will be considered technically unacceptable and the quote will be ineligible for award.

Please read each section below carefully for the submittals and information required as part of the evaluation. Failure to provide the requested information below shall result in the Contractor’s quote technically unacceptable. In addition, the government intends to award without discussions.

The government reserves the right to request clarifications.

Past Performance: The government will review past performance for responsibility determination purposes only. The government will review government systems such as Contractor Performance assessment Reporting System (CPARS), Federal Awardee Performance and Integrity Information System (FAPIIS), Past Performance Information Retrieval System (PPIRS) and other government systems. Offerors with no relevant past performance history will not be evaluated favorably or unfavorably.

The following are the decision factors:

i. Technical

ii. Price

The Contractor shall be registered in www.sam.gov to receive government contracts to be considered for award.

To receive credit as a SDVOSB (Service-Disabled Veteran Owned Small Business or VOSB (Veteran Owned Small Business) vendor must be certified in SBA VetCert (Veteran Small Business Certification) by the closing date of the solicitation and prior to award.

The Government will determine the merits of each offer on the basis of (1) its acceptability, and (2) its price reasonableness.

I. Technical – A. Acceptability: An offer is acceptable when quote…