36C10X23Q0211.docx

Special Notice Special Notice

DESCRIPTION

GENERAL INFORMATION

SET-ASIDE

Department of Veterans Affairs

5202 Presidents Court, Suite 103 Frederick MD 21703

POINT OF CONTACT*

Hermann Degbegni 240-470-4329 Hermann.Degbegni@va.gov

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

The Department of Veterans Affairs, Strategic Acquisition Center –Frederick (SAC-F), intends to issue a sole-source, firm-fixed priced commercial purchase order to provide VHA Rehabilitation Survey Questionnaire for Rehabilitation Programs.

A sole source procurement will be issued to Commission on Accreditation of Rehabilitation Facilities (CARF), 6951 E Southpoint, Tuscon, AZ 85756-9407., in accordance with (FAR) Part 8.405-6(a)(1)(i)(B), Only one source is capable of providing the supplies or services required at the level of quality required because the services are unique or highly specialized.- The NAICS code for this procurement is 541611 – Administrative Management and General Management Consulting Services is most appropriate for this requirement. The size standard is $15 million.

36C10X23Q0211 This notice of intent is not a request for competitive quotes. No solicitation document is available and telephone requests will not be accepted. However, any responsible source may identify their interest and capability to meet the requirements and submit quotations by the closing date/time of this notice.

Responses received will be evaluated; however, a determination by the Government not to compete the proposed procurement based upon responses received to this notice is solely within the discretion of the Government.

Responses to this notice are due on or before July 20, 2023, by 10:00 AM Eastern Daylight Time (EDT) to: Hermann.Degbegni@va.gov.

Special Notice image1.emf

DRAFT_Performance Work Statement_05102023.docx

Rehabilitation Survey Questionnaire PWS

Performance Work Statement (PWS)

Department of Veterans Affairs (VA)

Rehabilitation Survey

1. TITLE OF PROJECT: Rehabilitation Survey Questionnaire for Rehabilitation Programs

2. BACKGROUND:

VA is committed to providing specialized treatment and rehabilitation care to Veterans with disabilities. These populations include, but are not limited to, Veterans with spinal cord injuries and disorders (SCI/D), blindness or severe visual impairment, traumatic brain injury, amputation, other orthopedic conditions, serious mental illnesses, and homeless Veterans. As part of our obligation to monitor and assure high quality care to these groups, a valid survey of patient experiences during rehabilitation was launched in 2011. The rehabilitation survey compliments surveys administered to general VA inpatient and outpatient services that are currently monitored with the Survey of Health Experiences of Patients (SHEP) family of surveys. VA rehabilitation programs currently are using the Commission on Accreditation of Rehabilitation Facilities (CARF) developed uSPEQ survey to obtain valid information from their patients on such key areas as:

1) Service responsiveness;

2) informed choice;

3) respect of individual needs;

4) functional outcomes and community participation;

5) overall perceived value;

6) respondent demographics.

Without continuing such information collection, and the ability to benchmark with leading rehabilitation facilities within and outside of VA, we are limited in our ability to do continuous quality improvement; provide informed programmatic development and evaluation; rapidly identify rehabilitation program strengths and weaknesses, or conform to accreditation agency standards.

VHA recognizes that the continuation of a rehabilitation survey program provides a systems approach and benchmarking capability for patient assessed outcomes of care. Use of a rehabilitation survey in VHA’s rehabilitation populations is in conformance with the requirements of Executive Order 12862, dated September 11, 1993, and entitled "Setting Customer Service Standards," and Executive Order 13571, “Streamlining Service Delivery and Improving Customer Service,” issued on April 27, 2011, which call for agencies to post customer service standards and measure results against those standards.

3. OBJECTIVE: The objective of this effort is twofold:

a. Provide the means to administer a tested, statistically valid and reliable rehabilitation customer experience survey within VA medical and psychosocial rehabilitation programs. This includes access to paper survey forms and web-based surveys as deemed appropriate for the specific patient population served at a program site. Content areas of current surveys include Service Responsiveness, Informed Choice, Respect, Participation, Overall Value, and Demographics. VA programs currently surveyed include Blind Rehabilitation, Homeless Programs, Medical Rehabilitation and SCI/D. Others may be added as the need is determined by the VHA Programs and resources are available.

b. Provide program-specific results, along with internal VA and external non-VA benchmarking comparisons, for medical and psychosocial rehabilitation programs administering the rehabilitation survey.

4. DEFINITIONS AND TERMS:

As used throughout this performance work statement, the following terms shall have the meaning set forth below:

· Rehabilitation Program (hereafter, “program”):

The specialized care, as defined by VHA policy that is provided to a defined group of veterans with specific impairments and rehabilitation needs. Programs that are targeted for rehabilitation survey implementation are subject to the requirement as outlined in VHA Handbook 1170.01, “Accreditation of Veterans Health Administration Rehabilitation Programs”. These include:

· Medical rehabilitation (see VHA Handbook 1170.04- https://www1.va.gov/vhapublications/ViewPublication.asp?pub_ID=3066

· Mental Health Residential Rehabilitation Treatment Programs (see VHA Handbook 1162.02).

· Psychosocial Rehabilitation and Recovery Centers (see VHA Handbook 1163.03)

· Blind rehabilitation programs: These are defined in a series of VHA Handbooks:

· 1174.01 - Blind Rehabilitation Outpatient Specialist Program Procedures

· 1174.03 - Visual Impairment Services Team Program Procedures

· 1174.04 - Blind Rehabilitation Center Program Procedures

· 1174.05 – Outpatient Blind and Vision Rehabilitation Clinic Procedures

· Spinal cord injury and disorders system of care (see VHA Handbook 1176.01 and VHA Directive 1176).

· Homeless Veteran Programs (see VHA Handbooks 1162.01, Grant and Per Diem Program (http://vaww1.va.gov/vhapublications/ViewPublication.asp?pub_ID=1589) and 1162.05 “Housing and Urban Development – Department of Veterans Affairs Supported Housing program (HUD-VASH)” http://vaww1.va.gov/vhapublications/ViewPublication.asp?pub_ID=2040 Healthcare for Homeless Veterans (HCHV) Program VHA Handbook 1162.09

· Program Site: A VA facility that sponsors or houses a rehabilitation program

· VISN – Veterans Integrated Service Networks

· Impairment group: This refers to the disease- or condition-specific functional limitation defining the populations served within the program.

5. Requirements:

The program sites targeted for rehabilitation survey implementation will be selected based on priority, volume, and maturity. The goal of sampling procedures will be to yield an expected number of annual responses between 30 and 150 per program. Expansion of the rehabilitation survey in the Option Years may be considered, based on the experience of the base year as well as program evolution, and will be addressed via Contract Modification pending OMB approval and funding availability.

5.1 Administration:

The Contractor shall provide and administer a survey to an estimated 384 CARF-accredited VA Medical and Psychosocial Rehabilitation Programs, or those programs seeking CARF accreditation. This is to include provision of survey forms, data collection, data entry, data analysis, processing of white-mail (attachments or enclosures returned with the survey) and reporting of summary results. Survey administration methodology will be customized depending on the needs of the particular program. For example, point of service surveys may be required or staff may have to assist blind rehabilitation patients with completing a survey. Additional programs may be added in the future based on available funding and approval of the National Committee.

6. TASKS TO BE ACCOMPLISHED:

The Contractor shall perform specific tasks and provide the specific deliverable as defined herein:

Task 1: Project Work Plan

The Contractor shall present a Project Work Plan (PWP) within 15 business days of the contract award. The contractor shall establish a process for delivering the rehabilitation customer experience surveys.

Deliverable:

The Contractor shall submit a detailed Project Management Plan (PMP) in hard-copy and/or electronic forms to the COR and ACOR within 15 business days after the contract has been awarded, and a kick off meeting within fifteen business days of acceptance of the PMP by VA. Format requirements include letter size paper (8-1/2” x 11”), Arial 12 font, created in a program compatible with Microsoft Office 2010, or higher programs

Task 2: Orientation &Training

The contractor shall provide the materials needed to orient and train staff at each program site that will be involved in survey administration and data collection. Contractor shall provide training and materials. This will include national training for all CARF-accredited, or those seeking accreditation, programs within VHA using appropriate web-based and/or teleconference-based training options. Training and orientation will be provided at the time program sites initiate the survey, as well as whenever a significant change is made to the survey by the contractor. The Contractor shall develop and make available content for “on demand” on-line training. A score of 85% correct answers shall be considered passing.

Task 3: Customization

The contractor shall provide customization of survey instrument and administration methodologies to program site needs using core questions plus additional questions that specify patient demographics, health status, and impairment group. Each survey will include the name of the specific VA facility as well as the specific rehabilitation program or service being assessed, in terms that would be clearly understood by the Veteran. A Spanish version of the survey should be available for those program sites that serve clients for whom Spanish is the preferred language. Other than identification of facility, program or services received, basic demographic and clinical information (including information about impairments), surveys will not include veteran identifiers.

Task 4: Sampling Strategy and Size

The contractor, Contracting Officers Representative (COR) and Assistant Contracting Officers Representative (ACOR) shall agree upon a sampling strategy and sample size that minimizes bias and will ensure between 30 and 150 responses per program site per contract year. The sampling frame and instructions will be designed to ensure that an individual Veteran client is not administered the rehabilitation survey more than once annually. The contractor shall work with the COR and designated VHA staff to develop a specific written sampling plan.

Task 5: Survey Administration Strategy a.) The contractor shall provide appropriate survey administration mode for each program site, to include paper-based and web-based modes, as appropriate with the goal of maximizing response rates.

b.) The contractor shall secure means for survey collection appropriate to the program site and impairment group, e.g. spinal cord injury, blind, homeless.

c.) The contractor shall make available a Spanish language version of the survey for use in rehabilitation programs administered through the San Juan, Puerto Rico VA Medical Center and other centers upon request.

Task 6: Data Processing, Analysis, and Reports

6.1 Contractor shall provide and implement a data quality plan and other tools to minimize errors and missing data within 15 business days of the contract award. The data quality plan will be in place for the life of the contract and updated as necessary. Upon receipt of a completed survey, the contractor shall enter the data using optical scanning or digital image capture, backed up by dual key entry as needed for damaged surveys.

The Contractor shall submit to the COR and ACOR within 15 business days of contract award (electronically and/or hard-copy) the data quality plan.

6.2 The contractor shall provide a detailed quality control plan to include sample management and tracking, scanning and data capture process, capture of marginal comments, whitemail processing, final data disposition process, electronic file production, data backup and storage, disaster recovery, data confidentiality, privacy and security.

6.3 The contractor shall aggregate, summarize, and report results for each program site on a quarterly basis, including a rolling four quarter report when possible, using paper or web-based reporting tools. Reports should be available 15 days at the end of the quarter. This report should also include comparable non-VA benchmark results for comparison, where available.

The Contractor shall provide the report results to the COR (electronically and/or hard-copy) within 15 days at the end of each quarter.

6.4 The contractor shall aggregate, summarize, and report results at the VISN and National levels stratified according to program type or services received, demographics (age group and gender) and clinical variables such as type of impairment on a quarterly basis. This report should also include comparable non-VA benchmark results for comparison, where available.

The Contractor shall submit results to the COR (electronically and/or hard-copy) within 15 days at the end of the quarter.

6.5 The Contractor shall complete benchmark reports that include VA performance as well as non-VA referent populations that resemble, to the greatest extent possible, the clients served by VA program sites, no less than biannually, at mid fiscal year and at the end of the fiscal year. The Contractor shall provide Program specific results with benchmarking comparisons for participating VA Rehabilitation Programs administering the survey. The benchmarking comparisons are used to focus on best practices, provide evidence for improvement, partnering to share information, provide evidence of maintaining a competitive edge. The contractor shall be able to produce established credible benchmarks for comparison to external institutions providing rehabilitative healthcare.

Deliverable: The contractor shall submit electronic and hard copy benchmarking reports twice per fiscal year (biannually). Submission dates will be specified after award.

6.6 The contractor shall provide program reports with rolling data on a monthly basis

The Contractor shall submit electronic copies of the raw and summarized data to the COR 15 days at the end of each quarter.

Task 7: Technical Assistance and Consultation

The Contractor shall provide technical assistance and consultation to VHA Program Office and field based staff. Topics and subject areas include, but are not limited to trouble-shooting issues related to survey-administration, including strategies to maximize response rates, answering questions regarding interpretation of survey results and reporting systems, sharing best practices and improvement strategies, and frequently asked questions. Other topics may present themselves throughout the course of the work. Training and education/consultation are to be made available using appropriate web-based and and/or teleconference-based for new VA staff and refresher training for existing staff and other interested stakeholders throughout the life of the contract.

Task 8: Help Desk

The Contractor shall provide “help desk” (telephonic and web-based) for Veterans and family members that may have questions or concerns about the survey during regular business hours (8:00am thru 8:00pm) Monday through Friday, Eastern Standard Time.

7. Schedule for Deliverables

If for any reason any deliverable cannot be met within the scheduled time frame, the Contractor shall explain why in writing to the COR, including a firm commitment of when the work shall be completed. This notice to the COR shall specify the following:

1. Reason for the delay.

2. Modified delivery date.

3. Impact on the overall project.

4. Remediation plan to address the cause of the delay

5. A revised project plan with adjusted dates.

Deliverables will be provided weekly, quarterly or annually as described for each task. Regarding the electronic updates, once the contractor has transferred the processes to its SharePoint, updates will be continuously provided using the SharePoint site.

8. Performance Period:

The period of performance (POP) shall be for one, twelve month base period, with four twelve month option periods.

Tasks under this PWS shall be performed in Contractor facility OR other location as approved by the Government PM, and contracting office.

The Federal Government recognizes ten (10) National Holidays throughout the year:

New Year’s Day Independence Day

Martin Luther King Day Labor Day

President’s Day Columbus Day

Memorial Day Veterans Day

Juneteenth Thanksgiving Day

Christmas Day

In the event that a holiday should fall on a Sunday, the following Monday will be observed as the legal holiday. In the event that a holiday should fall on a Saturday, the preceding Friday will be observed by US Government agencies.

10. Type of Contract: Firm Fixed Price.

11. Travel: Travel is not anticipated for the completion of this project.

12. Confidentiality and Nondisclosure

a) The preliminary and final deliverables, all associated working papers, and other material deemed relevant by VA, generated by the Contractor in the performance of this contract, are the exclusive property of the U.S. Government and shall be submitted to the COR at the conclusion of the contract.

b) The Contracting Officer will be the sole authorized official to release, verbally or in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining and produced in support of this contract. No information shall be released by the Contractor. Any request for information relating to this contract presented to the Contractor shall be submitted in writing to the Contracting Officer for response.

c) Press releases, marketing material or any other printed or electronic documentation related to this project shall not be publicized without the Contracting Officer’s express written approval.

13. Section 508: The contractor shall comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board), pursuant to Section 508(2) (A) of the Rehabilitation Act Amendments of 1998, established Information Technology accessibility standards for the Federal Government. Section 508(a)(1) requires that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. The Section 508 requirement also applies to members of the public seeking information or services from a Federal department or agency.

Section 508 text is available at:

http://www.opm.gov/HTML/508-textOfLaw.htm https://training.section508.gov/

Quality Assurance Surveillance: (QASP):

The QASP provides a method to evaluate contractor performance, how the work will be administered, who will administer the work and how the work will be evaluated. The contractor must provide rehabilitation survey services using an acceptable, scientifically sound, standardized approach to sampling, data collection, data analysis, reporting and benchmarking.

It is critical that the survey data used in reporting is complete, reliable and secure. Contractor staff will provide program sites with guidance in the distribution and collection of survey forms and/or login information for online survey participation to the veterans. The Contractor will receive the completed questionnaires via the point of contact at each participating facility. The program site will be responsible for submitting the batches of completed surveys to the contractor and providing a mail tracking number for each mailing of the completed surveys. For online surveys, the contractor staff will be responsible for tracking the number of completed surveys per program site.

The contractor will ensure reports containing the completed data will be available electronically within 15 business days following the end of a quarter. VISN and National level reports will be available electronically within 35 business days following the end of each contract year. Electronic copies of raw data will be made available online to the COR 35 business days after each quarter.

The Government may review and revise the QASP on a continual basis. The original QASP as well any updates, changes or edits will be furnished to the Contractor and Government officials implementing surveillance activities and will coordinate changes with the Contractor through the contract modification process. The QASP will not detail how the Contractor will perform the work but on expectation that the Contractor is responsible for management and quality control actions to meet the terms of the contract.

Performance Standards –

The surveys will be a continuous activity and will be ongoing throughout the calendar year. Delivery will be clearly defined as a one base year with four one year options.

Contractor will provide useful and easy to understand management information to subscribers on a timely basis. Reports will be periodic, both standard and customized and must include benchmark reports.

Customized request from Program offices will be reviewed by the National Level Program Director and the COR and processed through the contract modification process based on reasonableness and funding availability.

Content areas will be addressed in a typical quarterly report for a VA program:

Technical notes about the survey; highlights from the survey (strengths and weaknesses of the organization and potential areas of improvement; comparison of survey results over time (current and previous quarters and previous years); respondent demographics for the program site.

Quarterly reports for a program sites will be available as soon as all data are collected, received and processed. To ensure the quarterly reports are prepared and available online on a timely basis, programs will be responsible for mailing completed questionnaires to the contractor office by the end of each quarter.

Survey Respondents will occasionally submit marginal comments or correspondence with their surveys. Comments made on the survey form will be scanned by the contractor and stored with the document. Correspondence provided by the respondent will be forwarded to the COR for appropriate distribution to appropriate program management for action.

The government decision as to whether to exercise each yearly option will be based upon successful performance by meeting all goals set forth during each previous year, continued need and potential funding constraints.

Technical assistance and consultation: Orientation and training will be offered to participating VA program point of contacts and management staff as needed. VA staff may contact contractor via telephone or email on issues related to questionnaire customization, sampling strategies, survey administration, data collection, and survey results, benchmarking comparisons, and reporting systems with no time restrictions.

Each subscriber program may request up to two hours annually of complimentary consultation with contractor staff for data interpretation and quality improvement. These hours do not accrue annually and cannot be used in lieu of payment for other services.

Monthly teleconference calls will be held between the key Contractor staff and VA staff from the Office of Organizational Excellence to provide monthly updates on survey planning and progress, address potential challenges and issues and discuss options and solutions. An electronic copy of the minutes of these calls covering key topics, survey results, and other possible issues pertaining to the survey will be furnished to the COR and ACOR by the Contractor within 15 days of the initial call. Teleconference calls can be reduced to quarterly calls in subsequent option years.

The contractor will offer a designated toll free telephone number for questions related to the surveys. Veterans and their family members may contact the Contractor during regular business hours, Monday through Friday, excluding Federal Holidays.

Surveillance and Performance Measurement

The timely delivery of reports will be available electronically 15 business days following the end of a quarter, aggregate reports at VISN and National levels will be available electronically 35 business days following the end of the quarter and benchmarking reports will be available electronically 35 business days of the end of the contract year.

The contractor is responsible for performance of all terms and conditions of the contract.

Government Roles and Responsibilities:

CO: The CO will ensure that performance of all necessary actions for contracting, ensure compliance with contract terms and safeguard the interests of the United States in the contractual relationship. The CO will also assure that the contractor receives impartial, equitable and fair treatment under this contract and will be ultimately responsible for final determination of the adequacy of the contractor’s performance.

COR- The COR will be responsible for technical administration of the contract and assure proper Government surveillance of the contractor performance. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf.

Data Security

Paper Questionnaires:

The contractor office will maintain designated, secured filing space for completed questionnaires. Once questionnaires are scanned they will be stored securely. Paper questionnaires need to be stored for a period of 12 months and securely disposed of.

Electronic Scanned Questionnaires:

Electronic questionnaires need to be secured with limited contractor staff accessibility. Electronic questionnaires will be maintained securely for a period of five years and then deleted.

Online Questionnaires:

Online questionnaires will be stored with limited access. Online electronic records will be maintained for a period of five years and then deleted.

Data Back up and Storage:

The contractor stores all data and ensures data backups are available upon request.

Disaster Recovery:

The contractor will furnish to the contracting agency a disaster recovery plan to ensure data is available in the event of a disaster.

Data Confidentiality:

The contractor will ensure that collected survey data confidentiality, security and privacy, maintaining the confidentiality and anonymity of respondents within the VA Handbook 6500.6, Appendix A and the HIPPA Compliance Requirements.

Sample Report Types and Requirements:

· Design and Create Quarterly Aggregate Report Templates at VISN and National Levels

· Quarterly Aggregate Report at VISN Level (1 report for each of VISNs per quarter)

· Quarterly Aggregate Report at National Level (1 report per quarter)

· Design and Create Annual Benchmark Report Template at National Level

· Quarterly roll up reports for Program totals

· Annual Benchmark Report at National Level (1 report annually)

· Rolling four quarter report (quarterly)

· Monthly Meetings with VA Staff

· Ad hoc Reports as needed (these are reports that are requested by programs, they are not routine and usually for responses to request from leadership)

Orientation Testing, Analysis, and Reporting

Orientation of VA staff (turn-over), staff is tested on the training they receive from the contractor for their understanding and ability to administer the survey, these are point of service surveys. In addition, contractor personnel are required to maintain VA training on privacy, information security and rules of behavior.

13. SECURITY REQUIREMENTS

13.1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as Department of Veterans Affairs (VA) and VA personnel regarding information and information system security.

13.2. Access to VA Information and VA Information Systems

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. VA does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the United States (US) to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non- US services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the US may be an evaluation factor.

e. The contractor or subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The CO must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

13.3. VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for, or developed by the contractor/subcontractor in, performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractor’s/subcontractor’s information systems or media storage systems in order to ensure that VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure that data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management; and its Handbook 6300.1, Records Management Procedures; applicable VA Records Control Schedules; and VA Handbook 6500.1, Electronic Media Sanitization. Self- certification by the contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 calendar days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations, and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable Federal Information Processing Standard (FIPS) or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, then after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or for cause under Federal Acquisition Regulation (FAR) Part 12.

g. If a Veterans Health Administration (VHA) contract is terminated for cause, the associated Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Handbook 1605.05, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor’s/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA CO for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require Certification and Accreditation (C&A) or memoranda of understanding and interconnection agreements (MOU-ISA) for system interconnection, the contractor/subcontractor must complete a contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the PM/COR.

13.4. Information System Design and Development

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic Personal Health Information (PHI), outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (refer to Appendix D of VA Handbook

6500, VA Information Security Program). During the development cycle, a Privacy Impact Assessment (PIA) must be completed, provided to the PM/COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the PM/COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Microsoft Internet Explorer 7 configured to operate on Microsoft Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA- approved and Federal Desktop Core Configuration (FDCC) configuration. Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems; VA Handbook 6500, Information Security Program; and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974 (as amended); Public Law 93-579, December 31, 1974 (5 U.S.C. 552a); and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to do the following:

1. Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies the following:

a. The Systems of Records (SOR) and

b. The design, development, or operation work that the contractor/subcontractor is to perform;

2. Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation on individuals of a SOR that is subject to the Privacy Act; and

3. Incorporate this Privacy Act clause, including this subparagraph (3), into all subcontracts awarded under this contract that require the design, development, or operation of such SOR.

h. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function; and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency.

1. “Operation of a System of Records” means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

2. “Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history; and that contains the person’s name, identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint, voiceprint, or a photograph.

3. “System of Records” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

i. The contractor/subcontractor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the contractor anywhere in the Systems, including Operating Systems and firmware. The contractor/subcontractor shall ensure that Security Fixes shall not negatively impact the Systems.

j. The contractor/subcontractor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than three days.

k. When the Security Fixes involve installing third-party patches (such as Microsoft OS patches or Adobe Acrobat), the contractor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 business days. When the contractor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within five days.

l. All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 calendar days of discovery or disclosure. Exceptions to this paragraph, i.e., for the convenience of VA, shall only be granted with approval of the CO and the VA Assistant Secretary for Office of Information and Technology (OIT).

13.5. Information System Hosting, Operation, Maintenance, or Use

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching, and change management procedures; and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the PM/COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA, and if these controls are determined not to be in place or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment, or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (i.e., authorization); C&A of the contractor’s systems in accordance with VA Handbook 6500.3, Certification and Accreditation; and/or the VA OCS Certification Program Office. Government-owned (Government facility or Government equipment) contractor-operated systems, as well as third party or business partner networks, require MOU-ISA, which details what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

d. The contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update of the PIA. Any deficiencies noted during this assessment must be provided to the VA CO and the Information Security Officer (ISO) for entry into VA’s POA&M management process. The contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/Subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General (OIG). The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested, and re-authorized per VA Handbook 6500.3. This may require reviewing and updating all of the documentation (PIA, System Security Plan, and Contingency Plan). The Certification Program Office can provide guidance on whether a new C&A would be necessary.

e. The contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Both hard copies and electronic copies of the assessment must be provided to the PM/COR. The Government reserves the right to conduct such an assessment using Government personnel or another contractor/subcontractor. The contractor/subcontractor must take appropriate and timely action (this can be specified in the contract) to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

f. VA prohibits the installation and use of personally owned or contractor/subcontractor-owned equipment or software on VA’s network. If non-VA-owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, PWS, or contract. All of the security controls required for Government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA- approved antivirus (AV) software and a personal (host-based or enclave-based) firewall that is configured with a VA-approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA-owned OE.

g. All electronic storage media used on non-VA-leased or non-VA-owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization, upon…