36C10G26R0004 Next Gen Dental vFINAL 12.14.25_LC.docx

36C10G26R0004

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS: 524114

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10G26R0004 12-15-2025 Jessica Portillo 3-16-2026 14:00

EST

36C10G U.S. Department of Veterans Affairs OPAL | Strategic Acquisition Center

10300 Spotsylvania Ave | STE 400 Fredericksburg VA 22408-2697

X

$47 Million

N/A

36C10G U.S. Department of Veterans Affairs OPAL | Strategic Acquisition Center

10300 Spotsylvania Ave | STE 400 Fredericksburg VA 22408-2697

VAFSC

Financial Services Center

PO BOX 149971

(see Section B.3 invoicing/payment) Austin TX 78714-8917 1 (877) 489-6135

See CONTINUATION Page This solicitation is for Community Care Network (CCN)Next Generation (Gen) - Dental Network.

This procurement effort is to establish a single-award Indefinite Delivery/Indefinite Quantity (IDIQ) contract.

All initial questions must be in writing and sent to the Contracting Officer no later than 10:00 AM EST on 1/6/2026.

Pre-proposal conference to be conducted on 1/21/2026.

All proposals must be submitted by 2:00 PM EST on 3/16/2026.

See CONTINUATION Page

Jessica Portillo

Contracting Officer

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.1.1 Contract Administration All contract administration matters will be handled by the following individuals:

1. CONTRACTOR:

2. GOVERNMENT: Jessica Portillo, Contracting Officer (CO) 36C10G

OPAL | Strategic Acquisition Center 10300 Spotsylvania Ave | STE 400 Fredericksburg VA 22408-2697

3. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

CONTRACTOR REMITTANCE ADDRESS:

All payments by the Government to the contractor will be made in accordance with:

INVOICES: Payments shall be made upon inspection and acceptance in arrears upon receipt of a properly prepared invoice.

GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

B.1.2 CO and COR Responsibilities

1. The CCN Next Gen - Dental Network CO is responsible for providing overall scope oversight, maintaining communication between the Contractor and VA, ensuring contract compliance, administering the base contract and modifications, and ensuring that annual performance evaluations are completed at the base contract level. The CO will also be responsible for ensuring that task orders are within the scope of the IDIQ base contract, administering all task order awards, overseeing payment or rejection of invoices, and ensuring that annual performance evaluations are completed at the IDIQ level and submitted through the Contractor Performance Assessment and Reporting System (CPARS).

2. The CO will designate a Contracting Officer’s Representative (COR) at the IDIQ contract level and reserves the right to designate a COR at the TO level. The CO will issue a designation letter to the COR and the contractor to ensure that all parties understand the limited authority of the COR. The COR will also be responsible of overseeing payment of invoice or invoice rejection as described in “Attachment 1 – CCN Next Gen - Dental Network PWS” and “Attachment 2 – CCN Next Gen - Dental Network Contractor Manual” after acceptance of work.

B.2 TUNGSTEN ELECTRONIC INVOICE SUBMISSION

FSC e-INVOICE PROGRAM THRU AUSTIN PORTAL

FSC MANDATORY ELECTRONIC INVOICE SUBMISSION FOR AUSTIN PAYMENTS

· Contracting POC: Jessica Portillo

· COR (Contracting Officers Representative): TBD

· Contract/Task Order Number: TBD

· Purchase Order Number: TBD

1. Vendor Electronic Invoice Submission Methods Facsimile, e-mail, and scanned documents are not acceptable forms of submission for payment requests. Electronic form means an automated system transmitting information electronically according to the accepted electronic data transmission methods below.

1. VA’s Electronic Invoice Presentment and Payment System – The FSC uses a third-party contractor, Tungsten, to transition vendors from paper to electronic invoice submission. Please go to this website: http://www.tungsten-network.com/US/en/veterans-affairs/ to begin submitting electronic invoices, free of charge.

2. A system that conforms to the X12 electronic data interchange (EDI) formats established by the Accredited Standards Center (ASC) chartered by the American National Standards Institute (ANSI). The X12 EDI Web site (http://www.x12.org)

b. Vendor e-invoice Set-Up Information:

Please contact Tungsten at the phone number or email address listed below to begin submitting your electronic invoices to the VA Financial Services Center for payment processing, free of charge. If you have questions about the e-invoicing program or Tungsten, please contact the FSC at the phone number or email address listed below.

1. Tungsten e-Invoice Setup Information: 1-877-489-6135

1. Tungsten e-Invoice email: VA.Registration@Tungsten-Network.com

1. FSC e-Invoice Contact Information: 1-877-353-9791

1. FSC e-invoice email: vafsccshd@va.gov See https://www.fsc.va.gov/einvoice.asp for more information See: https://www.fsc.va.gov/einvoice.asp for more information.

B.3 MINIMUM GUARANTEED AMOUNT AND MAXIMUM VALUE

1. The minimum guaranteed amount for this contract is $670,008,794.00, which will be obligated at the time of TO award. The Government has no obligation to award TOs beyond the minimum guaranteed amount.

1. The maximum aggregate value of all awards and task orders under this IDIQ is $30,000,000,000.00.

1. The Government will fund any minimum guarantees at time of award. VA will not reimburse bid and proposal costs in the event a contract is not awarded.

B.4 MODIFICATION ADMINISTRATION INSTRUCTIONS

1. Submission Deadlines: The Contractor shall submit all modification proposals, including but not limited to technical, cost, and management proposals, by the deadlines specified in the contract schedule or as otherwise directed by the Contracting Officer.

2. Notification of Submission: The Contractor shall provide written notification to the Contracting Officer confirming the submission of proposals no later than one (1) business day following the submission.

3. Extension Requests: The Contractor may request an extension of the proposal submission deadline. Such requests shall be submitted in writing to the Contracting Officer no less than 3 business days prior to the original submission deadline. The Contracting Officer may, at their discretion, grant or deny the request for an extension.

4. Mitigating Circumstances: In the event of unforeseen circumstances beyond the control of the Contractor, which prevent timely submission, the Contractor shall notify the Contracting Officer immediately and provide documentation supporting the delay. The Contracting Officer will assess the situation and may provide an extension, at their discretion.

5. Records of Submission: The Contractor is required to maintain accurate records of all proposal submissions, including dates and times, and provide such records to the Contracting Officer upon request.

6. Consequences of Late Submission: Failure to submit proposals by the specified deadlines, without an approved extension from the Contracting Officer, may result in the following:

a) Performance Evaluation: Late submissions may negatively impact the Contractor’s performance evaluation and future contract opportunities with the VA.

b) Termination for Cause: Repeated failure to submit proposals timely may result in termination of the contract for cause in accordance with the contract's termination provisions.

7. The CO reserves the right to issue a Notice to Proceed (NTP) to approve administrative updates to contract attachments. These updates are limited to administrative changes that do not change the scope, cost, or terms and conditions of the contract. Upon the determination of the required administrative update, the CO will issue a written NTP to the Contractor via email. This NTP will authorize the Contractor to implement the identified updates immediately. All outstanding NTP will be definitized through a quarterly administrative modification. In the event that the implementation of the administrative update will result in additional costs, the Contractor is required to notify the CO within two (2) business days of receipt of the NTP and submit the following before proceeding with the update:

a) A detailed explanation of the reasons why the Contractor believes additional costs will be incurred

b) An estimate of the anticipated additional costs

c) Any relevant supporting documentation to substantiate the additional costs.

At the discretion of the CO, a CO Technical Direction (COTD) may be issued to authorize the Contractor to proceed, in part or full, with the implementation of administrative updates. The COTD will provide, at a minimum, details of the approved administrative update, a mutually agreed upon not to exceed (NTE) amount and the timeline to definitize the update via bilateral modification of the contract.

B.5 ADDITIONAL CONTRACT INSTRUCTIONS

B.5.1 Requirement Development The Government reserves the right to seek comments on conceptional approaches from when a potential modification may have complex requirements that require continued development. At the discretion of the CO, the Contractor may be invited to collaborate with the Government to increase understanding of the requirements, provide suggestions for refining requirements, and discuss risk reduction measures.

B.5.2 Multi Agency Language This contract is intended exclusively for use by the Department of Veterans Affairs. The services provided under this contract are specific to the needs and requirements of VHA and are not authorized for use as a mandatory source by other agencies without prior written approval from the IDIQ CO.

The Contractor agrees that this contract is exclusive to the Department of Veterans Affairs, and all orders placed under this contract shall be processed through the designated COs. Any unauthorized use or orders by other agencies will not be binding under the terms of this contract.

All task orders issued under this IDIQ contract must be issued by the designated CO of the Department of Veterans Affairs. No other federal agency or entity shall have the authority to place orders under this contract unless explicitly authorized in writing by the designated IDIQ CO.

B.5.3 VA Payment Hierarchy For dental services provided, where there is a Dental VA Fee Schedule (DVAFS) rate, for the authorized services, the VA reimburses the Contractor for the rate up to the maximum allowable rate as indicated in the DVAFS, which includes geographic adjustments based on the Geozip and the applicable American Dental Association (ADA) Current Dental Terminology (CDT) code(s). The Contractor shall compare the DVAFS rate with the provider’s billed charges and pay the provider. After the Contractor pays the provider, the Contractor shall submit an invoice to VA for reimbursement at the lesser of the DVAFS rate or the provider’s billed charges.

A waiver of the DVAFS rate will apply, as outlined in Section 5.7 - Price Schedule below, if the Contractor submits and VA approves a request.

When there is no rate for the authorized service(s) in the DVAFS, VA shall reimburse the Contractor 50% of the provider’s billed final invoice to the Contractor.

B.5.4 Waivers of Payment Rates The Contractor may submit a waiver of payment rates request to VA when payment to its providers aligned to DVAFS is insufficient to build or retain the network in highly rural areas and/or for scarce resources. A highly rural area is defined as a county with fewer than seven individuals residing per square mile. Scarce resources are defined as situations where the Contractor is unable to meet network adequacy standards for specific dental services due to a lack of capable providers in a specific area as determined through the justification provided by the Contractor in the “Waiver of Payment Rates Request Form” described below.

If a waiver of payment rates is established for a network provider for specific dental services, the approved rates will be used to set the maximum price that the VA will pay the Contractor for authorized specific dental services. Approved rates shall be applied as a percentage of DVAFS. The Contractor shall evaluate the billed charges versus the awarded maximum waiver rate; if the provider's billed charges are lower than the awarded maximum waiver rate specified in the contract, the Contractor shall pay the provider claim based on billed charges and the Contractor shall invoice VA in that amount.

The Contractor shall use the “Waiver of Payment Rates Request Form” provided in Attachment Q, Network Adequacy Rate Waiver Form. A waiver of payment rates request shall specify the localities for which the waiver is being requested, with consideration given for all localities associated with the Taxpayer Identification Number (TIN) and/or National Provider Identifier (NPI). The Contractor shall ensure that the Waiver of Payment Rates Request Form is accurate, complete, and includes all required information related to the justification for the request, to include, but not limited to, the reasoning for submission in terms of network adequacy, the CDT codes to be used with the proposed rate, and whether the Contractor is at risk of not successfully recruiting or retaining the network provider. Waivers of payment rates will only be applicable to active CDT codes, and VA will not reimburse non-active CDT codes nor modify active CDT codes submitted in a waiver request.

Waiver of payment rates requests are not guaranteed to be approved. VA will consider patient needs, market analyses, dental provider qualifications, or other factors. If the waiver request is approved and executed by the VA CO, the Contractor shall pay providers in accordance with the VA approved waiver rate schedule or the provider billed charges, whichever is less. The VA approved waiver rate will be effective for claims with a Date of Service (DOS) on or after VA’s final signature date and will remain in effect for the duration of the contract unless otherwise specified by VA. If VA denies the request, and the Contractor will be informed accordingly.

VA reserves the right to request that a waiver of payment rate be used for a specific provider or a specific specialty of a provider.

B.5.5 Computation of “Lesser Of” Payment Rates Following the hierarchy described above in Section B.4.1, the Contractor must evaluate the provider’s billed charges against the DVAFS rate and submit invoices to VA for claims paid at the lesser of the two amounts. There are no circumstances where VA payment for authorized services will exceed the provider’s billed charges.

If a waiver is approved by the VA CO, the Contractor shall pay providers the lesser of the approved waiver rate or provider’s billed charges for services indicated, and VA shall pay the Contractor the lesser of the approved rate or the provider’s billed charges.

B.5.6 Dental VA Fee Schedule DVAFS rates incorporate geographic adjustments through geozip codes specific to the applicable region. If a DVAFS rate is not established for a procedure or service, the Contractor shall utilize the "By Report" (BR) methodology as outlined in the DVAFS. The Contractor must ensure that all applicable DVAFS rates are integrated into its claims processing platform(s). Dental services will be reimbursed based on the DVAFS, with pricing determined as the lesser of billed charges and the DVAFS rates.

VA-approved dental services are explicitly outlined within the VA-Approved Referral and/or authorization.

The DVAFS will be provided to the Contractor upon award and updated semi-annually based on the period of performance at no cost, although VA may request additional updates throughout the performance period. Upon receiving the updated DVAFS data, the Contractor shall update its claims processing platform within 10 business days to reflect the changes. The Contractor shall ensure that the DVAFS updates are implemented in time to reimburse valid claims with a date of service on or after the effective date of the DVAFS update. Claims with a date of service on or after the Contractor’s revised DVAFS implementation date shall be priced according to the new DVAFS rates. The Contractor shall collaborate with VA to resolve any discrepancies associated with the DVAFS.

The DVAFS includes codes that are not payable. Non-payable is indicated by “N” in the Coverage Flag column in the DVAFS and $0.00 in the Fee Column. Implementation of the no-pay code is based on the effective date of the fee schedule compared to the date of service.

Reference Part 2 of the Dental Manual for additional details on the DVAFS.

B.5.7 Price Schedule The following Price Schedule sets forth the amount VA pays for the services purchased through this contract, specifying the rates and units applicable to each Contract Line-Item Number (CLIN).

Payments for authorized dental services will adhere to the Dental VA Fee Schedule (DVAFS), ensuring consistency and transparency in pricing, unless otherwise stated in the contract or approved through a waiver of payment rate. The Contractor shall price network providers’ claims for authorized dental services to the written terms and conditions outlined in the CCN Next Generation Dental contract. The DVAFS encompasses the costs for dental services based on the associated American Dental Association (ADA) Current Dental Terminology (CDT) code(s) and associated fees. Administrative and other costs are captured separately within the CLIN structure.

Unless otherwise specified, payment rates will not exceed the applicable DVAFS amount for the period in which the service was provided, as defined in the Price Schedule and the Dental Manual, without any changes based on subsequent adjustments or information. The rates within the DVAFS will be effective for claims with a DOS on or after the final signature/approval date of DVAFS updates.

B.6 DENTAL CLIN STRUCTURE

CLIN X001, Dental Services:

Dental Services, VA will pay the Contractor for all authorized dental services provided under the contract. Pricing for this CLIN is determined based on the DVAFS. The Contractor shall reimburse network providers at the lesser of the billed charges or the maximum allowable rate specified in the DVAFS. The lesser of the billed charges means that if the amount billed by the network provider is lower than the maximum allowable rate specified in the DVAFS, the Contractor will reimburse the provider based on the billed amount rather than the DVAFS rate. The Contractor shall ensure that the amount invoiced to VA is a direct pass-through and exactly matches the amount paid to the network providers and does not include any discrepancies or additional charges beyond the actual payment to the network provider.

CLIN X002, Waivers of Payment Rates:

Waiver of Payment Rates, VA compensates the Contractor for authorized services in rural/highly rural areas and/or regions with scarce dental resources by allowing payment at a percentage above the DVAFS. Upon VA approval and execution of a waiver request, the Contractor shall reimburse providers at the lesser of the approved rate or the billed charges for the specified services. The lesser of the billed charges means that if the provider's billed amount is lower than the rate approved through the waiver request, the Contractor will reimburse the provider based on the billed amount rather than the higher approved waiver rate.

CLIN X003, Non-DVAFS Dental Services:

Non-DVAFS Dental Services, VA will pay the Contractor for authorized services when a given dental service or procedure is not included in the DVAFS. VA will reimburse the dental claims based on a rate of 50% of billed charges.

CLIN X004, Administrative Services:

Administrative Services, VA will pay the Contractor for the administrative services required to manage and deliver the services purchased under this contract. These costs are separate from the costs of providing dental services and implementation. Administrative services and activities include, but are not limited to, the following items:

This CLIN is paid following achievement of full healthcare delivery (HCD) based on the monthly Dental eligible Veteran population.

CLIN X005, Implementation Implementation, VA will make a lump sum payment to the Contractor upon satisfactory completion of all start-up/implementation milestones identified in the contractor’s implementation plan and accepted by the CO. The Contractor shall invoice in accordance with the firm-fixed price performance-based milestone (PWS Section 2.3). The Contractor shall not invoice for implementation before full HCD is achieved across the region. CLIN X005 reflects the total lump sum costs of transition, implementation, and administrative services prior to full HCD. Implementation services shall be excluded from CLIN X004, Administrative Services.

OPTIONAL CLIN X006, Dental Appointment Scheduling Dental Appointment Scheduling, VA will pay the Contractor upon completion of appointment scheduling activities for Veterans who have been assigned by the VA Facility Community Care staff as needing scheduling support, including implementation of the scheduling process, initial Veteran contact, scheduling, Veteran notification, Veteran support, quality assurance, VA coordination, reporting, and support to Veteran self-scheduling.

This CLIN is paid based on a fixed price per VA-Approved Referral for appointment scheduling. VA will not reimburse for referrals returned within the two (2) day review period or referrals that are duplicates.

OPTIONAL subCLIN X006AA, Implementation for Dental Appointment Scheduling at the VA Facility:

Implementation for Dental Appointment Scheduling at the VA Facility, VA will pay the Contractor for completion of the implementation of appointment scheduling at a VA facility. VA will pay the awarded price for each VA Facility that orders Appointment Scheduling. The Contractor is only eligible to invoice for one implementation payment per VA Facility during the period of performance of the contract.

OPTIONAL subCLIN X006AB, Implementation for Dental Appointment Scheduling at the Contractor's Site:

Implementation for Dental Appointment Scheduling at the Contractor's Site, VA will pay the Contractor for completion of the implementation of appointment scheduling. VA will pay the awarded price for Appointment Scheduling at the Contractor's site. The Contractor is only eligible to invoice for one implementation payment during the period of performance of the contract.

OPTIONAL subCLIN X006AC, Dental Appointment Scheduling Administration:

Dental Appointment Scheduling Administration VA will pay the Contractor for appointment scheduling at the awarded monthly price for the number of unique Approved Referrals ordered.

OPTIONAL CLIN X007, Software, Process, and Proof of Concept Development:

Software, Process, and Proof of Concept Development, VA will pay the Contractor for software design, customization, development, configuration, interface development, programming changes, and modifications to include system update services and process and proof of concepts changes in accordance with Agile methodologies associated with software solutions, as needed.

This CLIN is paid based on a fixed price for each instance of a software development task aligned to the following task sizes:

Optional subCLIN X007AA Extra-Small (XS) Small modifications to existing functionality. Architecturally insignificant, only involves one team, similar to work done in the past by team, no new technologies involved. An extra small task consists of 1 Sprint, over a 1–4-week period.

Optional subCLIN X007AB Small (S) Small modifications to existing functionality. Architecturally insignificant, few dependencies but only involves one team, similar to work done in the past by team, no new technologies involved. A small task consists of 2 Sprints, over a 1–2-month period.

Optional subCLIN X007AC Medium (M) More significant modifications to existing functionality. Minor architectural changes, few dependencies across 1-2 teams, precedents exist for the work but teams are inexperienced in doing it, may involve new technologies. A medium task consists of 4 Sprints, over a 3–6-month period.

Optional subCLIN X007AD Large (L) No existing functionality to leverage. Major architectural changes required, multiple dependencies across multiple teams, no precedents for the work, no experience on the teams, involves new technologies. A large task consists of 7 Sprints, over a 7–18-month period.

Optional subCLIN X007AE Extra Large (XL) No existing functionality to leverage. Major architectural changes required, multiple dependencies across multiple teams, no precedents for the work, no experience on the teams, involves new technologies. An extra-large task consists of 10 Sprints, over an 18+ month period.

CLIN X008, Transition Out:

Transition Out, VA will pay the Contractor for transition out and residual service tasks, including retroactive processing of referrals and claims adjudication, providing claims, transition of open referrals, providing an inventory of assets, facilitating knowledge transfer, removal of government-furnished information, and customer service transition. This CLIN will be paid as a fixed price upon VA initiation of the transition-out period. Transition-out services shall be excluded from CLIN X004, Administrative Services.

B.7 PERFORMANCE WORK STATEMENT (PWS)

See “Attachment 1 – Dental Network PWS”

B.8 INTEGRATED PRODUCT TEAMS

In order to address evolving technologies or new healthcare services, the Government may develop requirement and program changes that will result in contract, task order, and CCN Contractor Manual modifications or updates through the use of Integrated Product Teams (IPTs) staffed by Government and Contractor personnel. The Government will not establish IPTs for all contract changes but generally will establish them to address system-wide issues impacting all CCN Next Generation contracts. The IPT process required in this section will begin on the date the CO notifies the Contractor in writing of the Government’s intent to establish an IPT. Within 14 days after receiving such written notification, the Contractor shall identify the appropriate personnel (as agreed by the CO and the Contractor) to serve on the IPT to assist in the development and/or improve the technical, business, and implementation approach to any proposed CCN program or contract change.

The Contractor shall participate in all required IPT meetings, as determined by the Government designated team lead, regardless of the mode of meeting (in person or via teleconference, video-teleconference, or another electronic conference mode). The frequency and scheduling of such meetings will vary depending on the topic. The Contractor shall participate with the Government team and provide assistance in the entire process from VA concept development through establishment of the final requirement by VA. The IPT process required in this section may include assisting in the development of the Government’s budgetary cost estimates, identifying requirements, developing associated rough order of magnitude cost estimates, and preparing the final specification/statement of work.

The Government will have sole discretion to decide to implement an IPT’s recommendation based on designed outcomes and budgetary cost estimates.

Unless otherwise determined, on a case-by-case basis, by the Government, the IPT process shall occur as follows:

1. Establish IPT membership

a. Establish full-team and component teams (e.g. technical, cost, etc.)

b. Establish Government-only and Contractor-only teams that allow for issues to be raised on a non-attribution basis.

2. IPT Kick-off Meeting

a. Review of IPT Objectives and resource demands required to support the technical and time needs of the IPT

b. Identify Key Milestones

c. Establish an IPT Schedule, to include a meeting cadence, dates, and times for the full team, component teams, Government-only team(s), and Contractor-only team(s)

d. Discuss method(s) of communication and exchange of information and documentation

3. Contract Change Review Board (CCRB) review

4. Revise/update as necessary based on feedback from CCRB

B.9 IT CONTRACT SECURITY

GENERAL

The Community Care Network Next Gen (CCN NG) contract will require direct access to VA information or VA systems to meet the requirements of the CCN contract. The CCN Contractor will need to send to and receive data from VA internal systems. VA and its partners must exchange data using a standardized format such as HL7, EDI, and consider FHIR as it becomes standardized in the industry. The HL7 FHIR standard allows health apps (like HSRM) to leverage data from any EHR in a standard format. The Contractors shall educate providers to have a FHIR interface as a solution to return information back to VA. VA also encourages implementation of Trusted Exchange Framework and Common Agreement (TEFCA) or SMART on FHIR.

VA will legally disclose a copy of the required sensitive Government Furnished Information to the CCN Contractor under the authority of the Privacy Act System of Records “Non-VA Care (Fee) Records-VA”, 23VA10B3 Routine Use 10 ( 80 FR 146, July 30, 2015), Privacy Act System of Records “Patient Medical Records-VA”, 24VA10P2 Routine Use 43 (79 FR 157, August 14, 2014), 38 U.S.C. 5701, HIPAA Privacy Rule provision 45 CFR § 164.506(c) and The Veterans Choice Program Improvement Act, Public Law 115 26 and 38 U.S.C. 7332(b)(2)(H). The data will be sent via Federal Information Processing Standards (FIPS) 140-2 (or successor) validated encryption transmission. The CCN Contractor will then receive, retain and then be responsible for safeguarding and proper use of that data copy. When the CCN Contractor submits back to VA the agreed upon information, VA will then assume responsibility for that copy. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

The Contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employer. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

INFORMATION CUSTODIAL LANGUAGE

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d). VA information should not be co-mingled with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements. Prior to termination or completion of this contract, the contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

The Contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. The Contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions be taken in accordance with VHA Handbook 1600.05, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. The Contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer to all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the Contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that Contractor/ subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

INFORMATION SECURITY

The CCN Contractor shall be capable of sending and receiving this sensitive data to and from VA using NIST FIPS 140-2 validated encryption. The CCN Contractor must attest that they are capable of protecting Government Furnished Information in accordance with the HIPAA Security Rules. In addition, the CCN contractor shall enforce the privacy and security provisions of HIPAA through the Health Information Technology for Economic and Clinical Health Act [footnoteRef:1] or HITECH Act that incentivizes the meaningful use of EHRs, complies with privacy rule standards, and the new Breach Notification Rule. [1: Health Information Technology for Economic and Clinical Health (HITECH) Act, Pub. L.111-5, 123 Stat. 226,260 (2009), codified at 42 U.S.C. 17932.]

If an Electronic Healthcare Network Accreditation Commission (EHNAC) certification has been obtained, provide the assigned certification number. If a Federal Government Authority to Operate (ATO) has been obtained within the past three years, provide a copy of the ATO obtained, and the agency issuing the ATO). If the CCN Contractor has neither of these, the Contractor must provide a synopsis of their network security controls environment as part of their proposal. Upon contract award the CCN Contractor shall complete a Contractor Security Control Assessment (CSCA) within 30 days of contract award and on a yearly basis thereafter to VA’s COR. The Contractor must fully cooperate and assist in a government-sponsored security controls assessment; including those initiated by the Office of Inspector General. The Government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

INFORMATION SYSTEM DESIGN AND DEVELOPMENT

Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program, and the TIC Reference Architecture). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COTR, and approved by the VA Privacy Service in accordance with Directive 6508, Implementation of Privacy Threshold Analysis and VA Privacy Impact Assessment.

The Contractor/subcontractor shall certify to the COTR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or VA. This includes Internet Explorer 11 configured to operate on Windows 7 and future versions, as required.

The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall VA Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle. The Contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties. The contractor/subcontractor agrees to:

· Comply with the Privacy Act of 1974 (the Act) and the agency rules and…