36C10B23R0021-0001.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 59

VA-23-00061369

36C10B

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

36C10B

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way

To all Offerors/Bidders

36C10B23R0021

X

X X

Amendment 0001:

provides further clarification of a question that was answered previously;

posts a question that was asked by industry and the associated answer and response;

updates Section B.3 CONTRACT ADMINISTRATION DATA to show the issuance of Amendment 0001;

revises Section B.4 PRICE SCHEDULE to adjust the Base Period CLIN structure to account for the addition of an Optional Task;

revises Section B.5 PERFORMANCE WORK STATEMENT (PWS) to show that paragraph 5.6 is now an Optional Task and updates Section C – CONTRACT CLAUSES to incorporate FAR 52.217-7 Option for Increased Quantity-Separately Priced Line Item (MAR 1989).

Kendra M. Casebolt Contracting Officer

36C10B23R0021-0001

QUESTIONS AND ANSWERS

Q29 was answered in a previous post – further clarification to the answer is provided in yellow-highlights below

Q29) The RFP mentions “Future Enhancements” such as integration with VistA and Oracle/Cerner. Should {a vendor} include these integration costs in the first year costs or add to year 2?

A29) The VA DSCSA database integration project is in the beginning stages, and is ready to include the vendor as soon as the award is made. The DSCSA VA Integration (to include Vista) is a go for the base year. The Oracle/Cerner integration is being discussed, and is expected to be an option year item however, reference is made to PWS paragraph 5.8.1 in relation to the expected / possible Oracle/Cerner integration. This is meant to involve planning and meetings regarding this integration…not the implementation itself.

Q30) Is FEDRAMP certification required?

A30) After careful review, it has been determined that a vendor should be willing and prepared to move forward with FedRAMP requirements if this is deemed necessary. This is conditional upon the SaaS determination of a FedRAMP certification being required after the vendor is chosen and completes the SaaS assessment. As a result, the Base Period CLIN structure located at Section B.4 PRICE SCHEDULE below has been revised to account for the addition of an Optional Task, PWS paragraph 5.6 - SOFTWARE INFORMATION SECURITY is now listed as an Optional Task and FAR 52.217-7 Option for Increased Quantity-Separately Priced Line Item (MAR 1989) is hereby incorporated into Section C – CONTRACT CLAUSES for this Optional Task.

B.3 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: TBD

b. GOVERNMENT: Contracting Officer 36C10B Kendra M. Casebolt

Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with (IAW):

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award

Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] After Government acceptance of Deliverables in Section B.4 - Price Schedule and IAW Section B.5 - Product Description

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically IAW VA Acquisition Regulation (VAAR) Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

0001 08/23/2024

B.4 PRICE SCHEDULE

NOTE: Offerors are instructed to complete Section B.4 and submit with their quote.

Offerors are cautioned that alterations to the line items as specified below may render quotes unacceptable.

All questions shall be directed to William Waterhouse, Contract Specialist, at william.waterhouse@va.gov and Kendra M. Casebolt, Contracting Officer, at Kendra.Casebolt@va.gov prior to the closing date and time specified in Block 8 on page 1 of the SF 1449.

Inspection and Acceptance: Destination

BASE PERIOD

Period of Performance shall be 12 months from date of award

Line No Description QTY Unit Unit Price Extended Price

0001 Set up and implementation to include all VA dispensing sites, CMOPS and EPS in accordance with (IAW) the Performance Work Statement (PWS) located at Section B.5.

1 YEAR $ $

0002 Subscription Services- Compliance with November 2023 FDA DSCSA requirements, mapping of vendors, maintenance and support, any add-on services IAW the PWS located at Section B.5.

1 YEAR $ $

0003 Future Enhancements to include software support to the Electronic Health Record and VA DSCSA Data Integration Development Project IAW the PWS located at Section B.5.

1 YEAR $ $

0004 Contract Management: Contract Kick-Off Meeting IAW PWS paragraph 5.1.1 and the Deliverables Schedule of the PWS located at Section B.5.

1 LOT NSP NSP

0005 Contract Management: Contractor Project Management Plan IAW PWS paragraph

5.1.2 and the Deliverables Schedule of the PWS located at Section B.5.

1 LOT NSP NSP

0006 Contract Management: Contract Staff Roster IAW PWS paragraph 5.1.2 and the Deliverables Schedule of the PWS located at Section B.5.

mailto:william.waterhouse@va.gov mailto:Kendra.Archbald@va.gov

0007 Contract Management: Number of active existing dispenser clients and years of experience IAW PWS paragraph 5.1.2 and the Deliverables Schedule of the PWS located at Section B.5.

0008 Contract Management: Process to implement and maintain GLNs IAW PWS paragraph 5.1.2 and the Deliverables Schedule of the PWS located at Section B.5.

0009 Reporting Requirements: Monthly Progress Report IAW PWS paragraph

5.1.3 and the Deliverables Schedule of

0010 Implementation: List of VA locations viewable and actionable in software IAW PWS paragraph 5.2 and the Deliverables

0011 Implementation: Visibility of VA data in software by users IAW PWS paragraph

5.2 and the Deliverables Schedule of the

0012 Implementation: List of multi-level user profiles and assigned users’ access IAW PWS paragraph 5.2 and the Deliverables

0013 Implementation: Verification of NABP data exchange IAW PWS paragraph 5.2 and the Deliverables Schedule of the PWS

0014 Implementation: VA Wholesaler mapping IAW PWS paragraph 5.2 and the Deliverables Schedule of the PWS

0015 Implementation: VA Single Sign-on authentication IAW PWS paragraph 5.2

0016 Implementation: GS1 EPCIS 1.2 or higher IAW PWS paragraph 5.2 and the Deliverables Schedule of the PWS located at Section B.5.

0017 Implementation: VA data use for other purposes IAW PWS paragraph 5.2 and

0018 Implementation: End user training material and training IAW PWS paragraph 5.2 and the Deliverables

0019 Subscription Services-Compliance with DSCSA Requirements: Provide Login information, usernames and passwords IAW PWS paragraph 5.2.1 and the

0020 Subscription Services-Compliance with DSCSA Requirements: Process for ATP verification IAW PWS paragraph 5.2.1 and

0021 Subscription Services-Compliance with DSCSA Requirements: Alert mechanism for API failures IAW PWS paragraph 5.2.1

0022 Subscription Services-Compliance with DSCSA Requirements: Audit trail for all transactions IAW PWS paragraph 5.2.1

0023 Subscription Services-Compliance with DSCSA Requirements: PO Processing Capabilities IAW PWS paragraph 5.2.1

0024 Subscription Services-Compliance with DSCSA Requirements: Process for NDC formats and translation IAW PWS paragraph 5.2.1 and the Deliverables

0025 Subscription Services-Compliance with DSCSA Requirements: Data Exchange Processes IAW PWS paragraph 5.2.1 and

0026 Subscription Services-Compliance with DSCSA Requirements: Functionality and Serialization Processes IAW PWS paragraph 5.2.1 and the Deliverables

0027 Data Management and Vendor Mapping:

VA transaction data storage processes IAW PWS paragraph 5.3 and the

0028 Data Tracing/Retrieval: Process for data retrieval IAW PWS paragraph 5.4 and the

0029 Subscription Services-Maintenance and Support: Process for communication regarding system unavailability IAW PWS paragraph 5.5 and the Deliverables

0030 Subscription Services-Maintenance and Support: Customer support phone numbers IAW PWS paragraph 5.5 and the

0031 Subscription Services-Maintenance and Support: End user customer support plan IAW PWS paragraph 5.5 and the

0032 Subscription Services-Maintenance and Support: On-call availability and end user customer support back up plan IAW PWS paragraph 5.5 and the Deliverables

0033 Subscription Services-Maintenance and Support: Process for communicating to ATPs IAW PWS paragraph 5.5 and the

0034 Subscription Services-Maintenance and Support: Process for new vendor mapping IAW PWS paragraph 5.5 and the

0035 Subscription Services-Maintenance and Support: Plan for creating auditing and custom reports IAW PWS paragraph 5.5

0036 Subscription Services-Maintenance and Support: Plan to handle peak usage IAW PWS paragraph 5.5 and the Deliverables

0037 Subscription Services-Maintenance and Support: Standard Operating Procedures IAW PWS paragraph 5.5 and the

0038 Subscription Services-Maintenance and Support: Disaster Recovery Plan IAW PWS paragraph 5.5 and the Deliverables

0039 Subscription Services-Maintenance and Support: Plan and notification process for hacker protection and security controls IAW PWS paragraph 5.5 and the

0040 Subscription Services-Maintenance and Support: Process for providing release/upgrade information and process for working with VA on release development and testing IAW PWS paragraph 5.5 and the Deliverables

0041 Subscription Services-Maintenance and Support: Process for working with VA on release development and testing IAW PWS paragraph 5.5 and the Deliverables

0042 Add-On Services: Pharmaceutical returns process IAW PWS paragraph 5.7 and the

0043 Add-On Services: PO scanning/linking process IAW PWS paragraph 5.7 and the

0044 Add-On Services: Serial Number Decommissioning process IAW PWS paragraph 5.7 and the Deliverables

0045 Add-On Services: Item Borrowing process IAW PWS paragraph 5.7 and the

0046 Add-On Services: Quarantined Item Removal Tracking Process IAW PWS paragraph 5.7 and the Deliverables

0047 Add-On Services: Additional APIs developed IAW PWS paragraph 5.7 and

0048 Future Enhancements: VA DSCSA data base integration development meeting attendance, recommendations and updates IAW PWS paragraph 5.8.1 and

0049 Future Enhancements: VA DSCSA data base Integration Project charter IAW PWS paragraph 5.8.1 and the Deliverables

0050 Future Enhancements: VA DSCSA data base Integration project management plan IAW PWS paragraph 5.8.1 and the

0051 Future Enhancements: Testing and troubleshooting mechanism IAW PWS paragraph 5.8.1 and the Deliverables

0052 Future Enhancements: Item level traceability interface with EHR and required documentation IAW PWS paragraph 5.8.1 and the Deliverables

Base Period Sub-Total $

BASE PERIOD OPTIONAL TASK

This optional task may be exercised only once, at the Government’s discretion, at any time during the Base period IAW FAR 52.217-7, Option for Increased Quantity-Separately Priced Line Item (MAR 1989). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer.

Line No Description QTY Unit Unit Price Extended Price

0053 SOFTWARE INFORMATION SECURITY

- ASSESSMENT, AUTHORIZATION,

AND CONTINUOUS MONITORING,

BASE IAW PWS paragraph 5.6 and the Deliverables Schedule of the PWS located at Section B.5.

1 LOT $ $

0054 Software Information Security- Assessment, Authorization and Continuous Monitoring: Provide documentation of meeting characteristics for Software as a Service (SaaS) by collaborating with DTC IAW PWS paragraph 5.6.1 and the Deliverables

0055 Software Information Security- Assessment, Authorization and Continuous Monitoring: Federal Risk and Authorization Management Program (FedRAMP) System Security Plan (SSP) and supporting documentation IAW PWS paragraph 5.6.1 and the Deliverables

0056 Software Information Security- Assessment, Authorization and Continuous Monitoring: VA Implementation Diagram IAW PWS paragraph 5.6.1 and the Deliverables

0057 Software Information Security- Assessment, Authorization and Continuous Monitoring: 3PAO Security Assessment Plan (SAP) IAW PWS paragraph 5.6.1 and the Deliverables

0058 Software Information Security- Assessment, Authorization and Continuous Monitoring: 3PAO Security Assessment Report (SAR) IAW PWS paragraph 5.6.1 and the Deliverables

Base Period Optional Task Sub-Total $

Base Period and Base Period Optional Task Total

OPTION PERIOD 1

Period of Performance shall be 12 months

This 12-month option period may be exercised in accordance with FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option period shall commence immediately after expiration of the Base Period.

Line No Description QTY Unit Unit Price Extended Price

1001 Set up and implementation to include all VA dispensing sites, CMOPS and EPS in accordance with (IAW) the Performance Work Statement (PWS) located at Section B.5.

1 YEAR $ $

1002 Subscription Services- Compliance with November 2023 FDA DSCSA requirements, mapping of vendors, maintenance and support, any add-on services IAW the PWS located at Section B.5.

1 YEAR $ $

1003 Future Enhancements to include software support to the Electronic Health Record and VistA integration Development Project IAW the PWS located at Section B.5.

1 YEAR $ $

1004 Reporting Requirements: Monthly Progress Report IAW PWS paragraph

1005 Subscription Services-Compliance with DSCSA Requirements, Option Years:

Subscription service support for compliance with DSCSA requirements IAW PWS paragraph 5.2.2 and the

1006 Subscription Services-Maintenance and Support, Option Years: Process for continued system support IAW PWS paragraph 5.5.1 and the Deliverables

1007 Software Information Security- Assessment, Authorization and Continuous Monitoring, Option Years:

Plan for continued meeting of requirements for both SaaS and FedRAMP authorization IAW PWS paragraph 5.6.2 and the Deliverables

1008 Add-On Services, Option Years:

Additional API development IAW PWS paragraph 5.7.1 and the Deliverables

1009 Future Enhancements: VA DSCSA data base integration support IAW PWS paragraph 5.8.2 and the Deliverables

1010 Future Enhancements: VA Oracle/Cerner data base integration support IAW PWS paragraph 5.8.2 and the Deliverables

Option Period 1 Total $

OPTION PERIOD 2

This 12-month Option Period may be exercised in accordance with FAR 52.217-9 Option to formal modification is issued by the Contracting Officer. If exercised, this Option Period shall commence immediately after expiration of Option Period 1.

2001 Set up and implementation to include all

VA dispensing sites, CMOPS and EPS in accordance with (IAW) the Performance Work Statement (PWS) located at Section B.5.

1 YEAR $ $

2002 Subscription Services- Compliance with November 2023 FDA DSCSA requirements, mapping of vendors, maintenance and support, any add-on services IAW the PWS located at Section B.5.

1 YEAR $ $

2003 Future Enhancements to include software support to the Electronic Health Record and VistA integration Development Project IAW the PWS located at Section B.5.

1 YEAR $ $

2004 Reporting Requirements: Monthly Progress Report IAW PWS paragraph

2005 Subscription Services-Compliance with DSCSA Requirements, Option Years:

Subscription service support for compliance with DSCSA requirements IAW PWS paragraph 5.2.2 and the

2006 Subscription Services-Maintenance and Support, Option Years: Process for continued system support IAW PWS paragraph 5.5.1 and the Deliverables

2007 Software Information Security- Assessment, Authorization and Continuous Monitoring, Option Years:

Plan for continued meeting of requirements for both SaaS and FedRAMP authorization IAW PWS paragraph 5.6.2 and the Deliverables

2008 Add-On Services, Option Years:

Additional API development IAW PWS paragraph 5.7.1 and the Deliverables

2009 Future Enhancements: VA DSCSA data base integration support IAW PWS paragraph 5.8.2 and the Deliverables

2010 Future Enhancements: VA Oracle/Cerner data base integration support IAW PWS paragraph 5.8.2 and the Deliverables

Option Period 2 Total $

OPTION PERIOD 3

commence immediately after expiration of Option Period 2.

3001 Set up and implementation to include all

VA dispensing sites, CMOPS and EPS in accordance with (IAW) the Performance Work Statement (PWS) located at Section B.5.

1 YEAR $ $

3002 Subscription Services- Compliance with November 2023 FDA DSCSA requirements, mapping of vendors, maintenance and support, any add-on services IAW the PWS located at Section B.5.

1 YEAR $ $

3003 Future Enhancements to include software support to the Electronic Health Record and VistA integration Development Project IAW the PWS located at Section B.5.

1 YEAR $ $

3004 Reporting Requirements: Monthly Progress Report IAW PWS paragraph

3005 Subscription Services-Compliance with DSCSA Requirements, Option Periods:

Subscription service support for compliance with DSCSA requirements IAW PWS paragraph 5.2.2 and the

3006 Subscription Services-Maintenance and Support, Option Periods: Process for system support IAW PWS paragraph

5.5.1 and the Deliverables Schedule of

3007 Software Information Security- Assessment, Authorization and Continuous Monitoring, Option Periods:

Plan for continued meeting of requirements for both SaaS and FedRAMP authorization IAW PWS paragraph 5.6.2 and the Deliverables

3008 Add-On Services, Option Periods:

Additional API development IAW PWS paragraph 5.7.1 and the Deliverables

3009 Future Enhancements (Option Periods):

VA DSCSA data base integration support IAW PWS paragraph 5.8.2 and the

3010 Future Enhancements (Option Periods):

VA Oracle/Cerner data base integration support IAW PWS paragraph 5.8.2 and

Option Period 3 Total $

OPTION PERIOD 4

commence immediately after expiration of Option Period 3.

4001 Set up and implementation to include all

VA dispensing sites, CMOPS and EPS in accordance with (IAW) the Performance Work Statement (PWS) located at Section B.5.

1 YEAR $ $

4002 Subscription Services- Compliance with November 2023 FDA DSCSA requirements, mapping of vendors, maintenance and support, any add-on services IAW the PWS located at Section

1 YEAR $ $

4003 Future Enhancements to include software support to the Electronic Health Record and VistA integration Development Project IAW the PWS located at Section B.5.

1 YEAR $ $

4004 Reporting Requirements: Monthly Progress Report IAW PWS paragraph

4005 Subscription Services-Compliance with DSCSA Requirements, Option Periods:

Subscription service support for compliance with DSCSA requirements IAW PWS paragraph 5.2.2 and the

4006 Subscription Services-Maintenance and Support, Option Periods: Process for system support IAW PWS paragraph

5.5.1 and the Deliverables Schedule of

4007 Software Information Security- Assessment, Authorization and Continuous Monitoring, Option Periods:

Plan for continued meeting of requirements for both SaaS and FedRAMP authorization IAW PWS paragraph 5.6.2 and the Deliverables

4008 Add-On Services, Option Periods:

Additional API development IAW PWS paragraph 5.7.1 and the Deliverables

4009 Future Enhancements (Option Periods):

VA DSCSA data base integration support IAW PWS paragraph 5.8.2 and the

4010 Future Enhancements (Option Periods):

Oracle/Cerner data base integration support IAW PWS paragraph 5.8.2 and

Option Period 4 Total $

Grand Total:

(Base Period + Option Periods 1 - 4 Totals)

B.5 PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration Pharmacy Benefits Management

Clinical Informatics

Drug Supply Chain Security Act (DSCSA) Solution Provider

Date: July 20, 2023

VA-23-00061369

PWS Version Number: 4.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA) Pharmacy Benefits Management, Clinical Informatics (PBM-CI) strives to provide high quality, effective, and efficient services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on PBM-CI systems to meet mission goals.

This acquisition is for the implementation and subscription service to ensure compliance with the Drug Supply Chain Security Act which requires that drugs be tracked through the supply chain and that their provenance can be established via the ability to trace ownership from the manufacturer to the dispenser on an interoperable data exchange.

Facilities must also be able to furnish data to a trading partner within 24 hours of a request for information and to exchange data on the GS1 Electronic Product Code Information Service (EPCIS). Medications will have a 2D barcode that contains a Global Trade Identification Number (GTIN). The NDC for the item is incorporated within the GTIN, as well as the lot number, the expiration date, and the serial number which will be included in the electronic data exchange for the receipt, verification, storage (for 6 years), tracking and retrieval of this data. This contract includes VA locations including all areas with a pharmacy that receives or stores pharmaceuticals as well as Consolidated Mail Outpatient Pharmacies (CMOPS) and Emergency Pharmacy Services (EPS), (hereto forth “the VA”) as well as provides education on utilization of the system software. The Contractor will share implementation guidelines and instructions to the designated VA administrative users and be available to answer related questions as well as problem solve any issues with the implementation. Included in this contract will be coordination with the National Accreditation for Boards of Pharmacy (NABP), the set up and implementation of service to all VA sites, subscription service with all aspects for DSCSA law compliance, mapping of current wholesalers, maintenance, support and add-on services specific to the vendor award. Future enhancements that include VA DSCSA data integration to be included when these projects are ready for implementation.

The Drug Quality and Security Act (DQSA) was enacted by Congress on November 27, 2013. The second section of this law, Title II of DQSA, is the Drug Supply Chain Security Act (DSCSA). This Act concerns the integrity of the Pharmacy Supply Chain, the purpose of this contract is for PBM CI to find a contractor to provide VA with tools and support in meeting the requirements of the DSCSA.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Drug Supply Chain Security Act (DSCSA), Title II of Drug Quality and Security Act DQSA”, November 27, 2013

2. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

3. “Federal Information Security Modernization Act of 2014”

4. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”, NIST CSRC

5. FIPS Pub 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

6. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 1, 2004

7. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information

Systems,” March 1, 2006

8. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,”

August 2013

9. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,”

January 24, 2022

10. 10 U.S.C. § 2224, "Defense Information Assurance Program"

11. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

12. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of

2006, Title IX, Information Security Matters

13. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

14. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, VA

Publications

15. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016

16. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

17. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

18. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

19. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”

20. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health

Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 23, 2008

21. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

22. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

23. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

24. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA

Information Security Program,” February 24, 2021

25. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI),” March 12, 2019

26. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development

Lifecycle,” March 22, 2010

27. VA Handbook 6500.6, “Contract Security,” March 12, 2010

28. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

29. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

30. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

31. OIT Process Asset Library (PAL), PAL Library. Reference Process Maps at Process

Maps Directory and Artifact templates at PAL Artifacts

32. One-VA Technical Reference Model (TRM) TRM Home Page

33. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact

Assessment,” October 15, 2014

34. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact

Assessment,” July 30, 2015

35. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

36. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

37. VA Directive 6300, “Records and Information Management,” September 21, 2018

38. VA Handbook, 6300.1, “Records Management Procedures, “March 24, 2010 https://csrc.nist.gov/publications/search?sortBy-lg=Number+DESC&viewMode-lg=brief&ipp-lg=all&status-lg=Final%2CDraft&topicsMatch-lg=ANY&controlsMatch-lg=ANY https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.oit.va.gov/services/trm/

39. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 20, 2018,

40. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of December 10, 2020)

41. NIST SP 800-53A Rev, 5, “Assessing Security and Privacy Controls in Information Systems and Organizations,” January 25, 2022

42. NIST SP 800-53B, “Control Baselines for Information Systems and Organizations,” September 23, 2020 (includes updates as of December 10, 2020)

43. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

44. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

45. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

46. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

47. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

48. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture Federal ICAM Architecture Introduction

49. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “June 29, 2018

50. NIST SP 800-63-3, “Digital Identity Guidelines,” updated March 02, 2020

51. NIST SP 800-63A, “Digital Identity Guidelines: Enrollment and Identity Proofing”, December 16, 2022

52. NIST SP 800-63B, “Digital Identity Guidelines: Authentication and Lifecycle

Management”, March 2, 2020

53. NIST SP 800-63C, “Digital Identity Guidelines: Federation and Assertions,” March 02,

54. NIST SP 800-63-4, “Digital Identity Guidelines,” December 16, 2022

55. NIST SP 800-63C-4, “Digital Identity Guidelines: Federation and Assertions,” December

16, 2022

56. NIST SP 800-63B-4, “Digital Identity Guidelines: Authentication and Lifecycle

Management,” December 16, 2022

57. NIST SP 800-63A-4, “Digital Identity Guidelines: Enrollment and Identity Proofing,”

December 16, 2022

58. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 19, 2014

59. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security

Presidential Directive 12 (HSPD-12),” April 29, 2011

60. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference Identity Management Business Requirements Guidance v2_6.pdf

61. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, PIV Logical Access Policy Clarification.pdf

62. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, Trusted Internet Connections (TIC) 3.0 Core Guidance Documents | CISA

63. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

64. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008 https://playbooks.idmanagement.gov/arch/#what-is-the-ficam-architecture file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/Identity%20Management%20Business%20Requirements%20Guidance%20v2_6.pdf file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/Identity%20Management%20Business%20Requirements%20Guidance%20v2_6.pdf file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/PIV%20Logical%20Access%20Policy%20Clarification.pdf https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents

65. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

66. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

67. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

68. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

69. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

70. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,”

January 15, 2014, OIS Memo VAIQ # 7424808 January 15 2014.pdf

71. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

72. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, VIP Guide

4.0.pdf (va.gov)

73. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, Proper Use of Email.pdf (va.gov)

74. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, DevSecOps

PLM L2 Playbook.pdf (va.gov)

75. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

76. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6

(IPv6),” November 19, 2020

77. Social Security Number (SSN) Fraud Prevention Act of 2017

78. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

VA Directive 6066, “Protected Health Information (PHI) and Business Associate Agreements Management,” September 2, 2014

3.0 SCOPE OF WORK

The Contractor shall provide project management and development for the implementation and subscription service to VA locations including all areas with a pharmacy that receives or stores pharmaceuticals as well as Consolidated Mail Outpatient Pharmacies (CMOPS) and Emergency Pharmacy Services (EPS), (hereto forth “VA”) and provide education on utilization of the system software in written handout format, to include training guides with virtual calls for each level of training. The Contractor will share implementation guidelines and instructions to the designated VA administrative users and be available to answer related questions as well as problem solve any issues with the implementation. Specifically, the Contractor shall support VHA in the following areas of need:

1. Implementation

2. Subscription Services - Compliance with DSCSA requirements

3. Subscription Services - Data Management and Storage

4. Subscription Services - Data Tracing and Retrieval

5. Subscription Services - Maintenance and Support

6. Software Information Security

7. Add-ons

8. Future Enhancements

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE OBJECTIVE

The acquisition of this subscription service to:

o VA as a legal entity o Each VA pharmacy site that procures and receives pharmaceuticals identified by DEA license file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/OIS%20Memo%20VAIQ%20#%207424808%20January%2015%202014.pdf file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/VIP%20Guide%204.0.pdf file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/VIP%20Guide%204.0.pdf file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/Proper%20Use%20of%20Email.pdf file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/DevSecOps%20PLM%20L2%20Playbook.pdf file://r04.med.va.gov/V03/EAS/Users/VHAEASWaterW/Documents/DevSecOps%20PLM%20L2%20Playbook.pdf o Physical Locations Medical Centers Dispensing Community Based Outpatient Clinics CMOPs EPS and All Hazard Emergency Caches

4.2 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a twelve (12) month base period with four (4) twelve

(12) month Option Periods, if exercised. The overall PoP shall not exceed 60 months. The project start date shall be within 30 days after contract award.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five (5) are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.3 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.4 TRAVEL

There is no travel required for this effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

Electronic Product Code Information Services (EPCIS) 2D data matrix tracing, storage and retrieval, to include suspect product process and report functionality are described in detail in section 5.0 of this agreement.

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACT KICKOFF MEETING

The Contractor shall participate in contract kick-off meeting with a core group of VA representatives. This meeting will be to discuss the CPMP, training and implementation plans and review the requirements of the contract. Subsequent meetings may be required with a larger group of users for follow up.

Deliverable:

A. Kick-off meeting

5.1.2 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s high-level approach and timeline to be used in execution of the contract, including your licensing/billing approach, (i.e. - by volume of product, number of connections, number of instances, etc.), plan to assist VA with national Standard Operating Procedure (SOP) for using software to ensure DSCSA compliance, implementation and maintainability (sustainment) strategies, timelines and schedules no later than 30 days after the execution of the option. The CPMP shall take the form of both a narrative and/or graphic format that displays the schedule, milestones, resource support and plan to implement and maintain single or multiple VA locations Global Location Number(s) centrally for all VA location shipments. The CPMP shall include the Contractor Staff Roster as described in Section 6. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP. The vendor must have current active traceability accounts with at least 5 dispensers with documented experience in the Track and Trace field (including lot-level product tracing and serialization), and regulatory change management process.

Deliverables:

A. Contractor Project Management Plan B. Contractor Staff Roster C. Number of active existing dispenser clients and years of experience D. Process to implement and maintain VA GLNs

5.1.3 REPORTING REQUIREMENTS

The Contractor shall provide the COR with monthly Progress Reports in electronic form in Microsoft Word formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include “scorecard” information related to API successes and failures, such as in a dashboard, with follow up or updated statuses of each failure, by VA location. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

A. Monthly Progress Report

5.2 IMPLEMENTATION

The Contractor shall perform the following 60 days after award date (unless otherwise stated):

1. Set up of all current 155 VA locations in software for data exchange, storage and retrieval

2. Visibility in vendor software of exchanged and stored DSCSA required data for every VA location that receives or stores pharmaceuticals

a. GS1 EPCIS to and from wholesalers, distributors and repackagers

b. Daily Electronic Data Interchange (EDI) 856 Advanced Shipping Notice (ASN) from wholesalers

3. Create or assist with creation of multi-user profiles and access to include administrative high level to end-user levels. to include VA and ATP Data Access, Login information, usernames and passwords (ex. <Level 1-End User>, <Level 2-Pharmacy Chief>, <Level 3-VPE> and <Level 4 -National Administrator>)

4. Coordination with National Boards of Pharmacy (NABP) for data exchange via their designated API

5. Mapping of existing VA vendors per list provided by VA

6. VA Single Sign-On (SSOi) authentication to validate authorized users as well as fallback authentication when PIV/SSO is unavailable and the system’s ability to add end-users over time.

7. Establish interoperability with and proactively remain updated to, the latest standards for GS1 Electronic Product Code Information Services (EPCIS) (e.g., 1.2 or higher)

8. Explain if VA's data will be used for any other purpose, such as analytics or marketing, sold to any other outside organization or affiliated 3rd party, what formats are supported for VA information and data downloads.

9. Create and provide End User Training 2- to 4- hour curriculum and the Training Material for <Level 1-End User>, <Level 2-Pharmacy Chief>, <Level 3-VPE> and <Level 4 - National Administrator>. The training material should be in written format, to include training guides and virtual calls for each level of training, which includes measurable competencies for:

a. System functionality and usage

b. Overview of available reports and their functionalities

c. Processing/sequestering Illegitimate or Suspect Products

d. System unavailability

e. Identification of grandfathered products or exempt/excepted/waived products

f. Data exchange for drop-shipped items

A. List of VA locations viewable and actionable in software B. Visibility of VA data in software by users C. List of Multi-level user profiles and assigned users’ access D. Verification of NABP data exchange

E. VA wholesaler mapping F. VA Single Sign-On authentication G. GS1 EPCIS 1.2 or higher H. VA data use for other purposes I. End user training material and training

5.2.1 SUBSCRIPTION SERVICES- COMPLIANCE WITH DSCSA REQUIREMENTS,

BASE:

The Contractor shall perform the following 60 days after award date:

1. Shall provide Login information, usernames, and passwords

2. Process for real-time ATP verification, prior to receipt of product

3. Monitor and alert mechanism for API failures

4. Provide an audit trail for Purchase Order (PO) processing requirements

5. Provide PO processing capabilities to include:

a. Receiving only against open PO numbers

b. Ability to open closed POs for editing

c. Manual addition of items not included on ASN

d. Ability to adjust quantity received

e. Ability to adjust expiration date for items requiring monitoring and removal prior to expiration, or extension of expiration date (e.g., Shelf-life extension project, SLEP)

f. Scanning and receiving options at the pallet, case, tote or individual item level using applicable standard (e.g., Standard Shipping Container Code)

6. Process for capability of NDC scanning, receiving, and processing

a. 6-4-2 National Drug Code (NDC) format

b. Eleven (11) and twelve (12) digit NDC numbers

c. Translation of NDC to 14-digit Global Trade Item Number (GTIN), and vice versa

7. Provide data exchange processes to include:

a. EPCIS 1.2 or higher data exchange with all mapped vendors

b. Validation Errors Identification Process

c. Non-compatible Data Exchange Process

d. Data Exceptions Process

e. Full Chain of Custody Records

f. Advanced ship notices repository

g. Product Identification Procedures for grandfathered and exempt/excepted/waved products

8. Provide functionality and processes for serialization to include:

a. Aggregation and inference

b. Linking a PO number to a unique EPCIS (or ASN) file

c. Comparing receipt quantity against EPCIS quantity

d. Setting a percentage or absolute number of items to scan

e. Adding new pharmaceuticals to the system

A. Provide Login information, usernames and passwords B. Process for ATP verification C. Alert mechanism for API failures D. Audit trail for all transactions E. PO Processing capabilities F. Process for NDC formats and translation G. Data exchange processes

H. Functionality and Serialization Processes

5.2.2 SUBSCRIPTION SERVICES- COMPLIANCE WITH DSCSA REQUIREMENTS,

OPTION YEARS:

The Contractor shall perform the following 365 days after award date:

1. VA support process to include:

a. Support for real-time ATP verification, prior to receipt of product

b. Support for monitoring and alert mechanism for API failures

c. Support for audit trail for Purchase Order (PO) processing requirements

d. Support for PO processing capabilities

e. Support for NDC scanning, receiving, and processing

f. Support for data exchange processes

g. Support for functionality and processes for serialization

h. VA transaction data exchange

i. VA transaction data storage

j. VA transaction data retrieval

A. Subscription service support for compliance with DSCSA requirements

5.3 DATA MANAGEMENT and STORAGE

The Contractor shall perform the following 60 Days after award date:

1. VA transaction data storage process to include:

a. Store all data within the United States

b. In accordance with Title II of the Drug Quality and Security Act, Drug Supply Chain

Security, the contractor must store all received transaction data for 6 years from transaction date

c. In accordance with Title II of the Drug Quality and Security Act, Drug Supply Chain Security, the contractor must store all transaction data for any investigated receipt for 6 years from time of investigation request

d. Data remains the property of and accessible, without additional charge, to the VA regardless of contract status (e.g., active, terminated, expired)

e. Data will not include any Protected Health Information (PHI) or Personally Identifiable Information (PII)

A. VA transaction data storage processes

5.4 DATA TRACING/RETRIEVAL

The Contractor shall perform the following 60 Days after award date:

1. VA transaction data retrieval process to include:

a. Respond to request for information

i. Within 24 hours for authorized auditing body (e.g., Office of the Inspector General, Federal Drug Administration)

ii. Within 2 days for an Authorized Trading Partner (ATP) in the event of a recall or investigation into suspected illegitimate product

b. Allow for selecting of multiple POs for the same item search

c. Data remains available for retrieval in the case of Pharmaceutical Prime Vendor

(PPV) contract change, expiration, termination, etc.

d. Data is available to export, manipulate, and process at VA’s sole discretion

e. Data will be available to ATP for use in complying with the DSCSA requests

f. Shall create a Process for data retrieval to meet specified time request

A. Process for data retrieval

5.5 SUBSCRIPTION SERVICES - MAINTENANCE AND SUPPORT, BASE

The Contractor shall perform the following at time of implementation, no later than 30 days after award:

1. Provide process for communication regarding and continuity of operations due to planned or unexpected system unavailability, regardless of cause

2. Provide customer support contact information for utilization during business hours (0800-

1700 Mon-Fri) for VA in all time zones (includes continental US, Alaska, Hawaii, the Philippines Islands, Guam, America Samoa, Puerto Rico, and the Virgin Islands)

3. Provide a plan to perform end-user support, including a support line for VA end-users to call and report missing or inaccurate DSCSA information, providing full-service support of failed or…