36C24719Q0422-002.docx

Attachment C PERFORMANCE WORK STATEMENT Aiken/Athens/Statesboro CBOC PHARMACY SERVICES

1. PURPOSE - The intent of this contract is to provide pharmaceutical products and services to VA beneficiaries seen at the Department of Veterans Affairs Community Based Outpatient Clinics (CBOC) in Athens, Georgia, Statesboro, Georgia, and Aiken, South Carolina.

2. PROCEDURES

1. The contractor shall provide pharmaceutical products and services to VA beneficiaries seen at the Department of Veterans Affairs CBOC in Athens, Georgia, Statesboro, Georgia, and Aiken, South Carolina. A Quality Assurance Surveillance Plan (QASP) is attached.

a. These services shall include the dispensing of pharmaceuticals when clinic staff determine that they are emergent and in the best interest of patient care. Pharmacy staff will provide medications to beneficiaries in a timely and courteous manner (QASP 6-9).

b. Only new prescriptions will be filled using the VA National Formulary. A new prescription is defined as a written or telephonic prescription for a drug product and strength that has not been previously dispensed to the beneficiary in the past 12 months. The VA National Formulary* is the only approved formulary to be used for this contract and only medications listed on the VA National Formulary are to be filled unless the prescription is accompanied by a Non-Formulary Consult signed by a VA Pharmacist. Non-Formulary requests can also be approved by the email or telephone contact with the clinic pharmacist. A repeat order for the same drug product within 12 months, even if transmitted as a new prescription order is not considered a new prescription. Exception may be made for second courses of the second courses of antibiotic therapy. (*The National VA Formulary can be found on the Internet at http://www.pbm.va.gov/PBM/NationalFormulary.asp.)

c. Refills will not be authorized. Unless otherwise pre-authorized, prescription fills will be limited to a maximum of a ten-day supply. Schedule II narcotics are limited to a 3 day supply.

d. Prescriptions will also be provided during emergency evacuations due to extreme weather conditions or other emergencies as necessary for patients to fill prescriptions outside the home area. The vendor will be contacted if the facility elects to implement this coverage.

e. Prescriptions shall be filled within one hour of delivery to the pharmacy. The mailing and delivery of prescriptions are not authorized.

f. Only prescriptions from VA authorized practitioners shall be filled under this contract. Prescriptions will be written on a VA prescription form and hand carried by the beneficiary. Each prescription to be filled under this contract will be accompanied by a certification sheet from the CBOC. Prescriptions from non-VA authorized practitioners shall not be filled under the contract. Prescriptions that are non-emergent that the provider wrote for the patient to purchase at his/her own expense shall not be filled under the contract.

g. Prescriptions filled under this contract will be, to the extent permitted by law, the least expensive drug product the pharmacy has in stock and are not restricted by NDC number. Generic drugs will be dispensed whenever possible. A product is not considered a generic equivalent unless the strength, quantity, and dosage are the same as the brand name. The generic name must be displayed on all labels for all medications (see QASP item 5).

h. The authorized pharmacy shall provide the date of filling, quantity provided (if other than the prescribed quantity), prescription number and name or initials of responsible pharmacist (see QASP item 4). Contractor shall perform quality assurance checks of all prescriptions prior to dispensing (see QASP item 1). Beneficiaries will be provided counseling and drug information, as requested (see QASP item 2).

i. All information concerning VA beneficiaries shall be kept confidential and shall not be disclosed to any person, except as authorized in writing and according to all applicable laws.

j. Representatives of the VA are authorized to visit the premises of any pharmacy filling VA prescriptions under the contractor’s plan during business hours for the purpose of auditing and evaluation, which may include the inspection of clinical records.

k. All adverse drug events reported to the contractor’s pharmacies by beneficiaries of the VA shall be reported to the Charlie Norwood VAMC (CNVAMC) at 706-733-0188, extension 3504 (see QASP items 3-8). Adverse drugs events include: dispensing errors, drug allergies and adverse drug reactions.

l. Pharmaceutical care provided to beneficiaries under this contract shall meet all standards applicable to Medicaid recipients in the State where the services are provided and standards set forth in the current Joint Commission accreditation manual for Ambulatory Care/Pharmaceutical Services (see QASP item 7).

m. The contractor shall bill the CNVAMC monthly for services rendered. The VA will randomly audit all billings. All invoices will reference the following information:

· Contract Number

· Patient Name

· Patient's Social Security Number

· Prescription Number

· Date of Fill

· Quantity of fill

· Name of medication, generic or brand designation

· Any other information required by law

· Contractor's charge

n. Contractor shall provide a listing of licensed pharmacies in Athens, Georgia, Statesboro, Georgia, and Aiken, South Carolina that will accept its plan. The VA will designate pharmacy/pharmacies the contractor shall utilize.

o. The contractor shall provide monthly reports providing the list of drugs dispensed by:

· Pharmacy

· Provider

· Patient

· Drug Cumulative monthly, quarterly, and annual report shall be provider to the COR and CBOC Clinical Pharmacist.

3. SERVICES:

a. In accordance with FAR 52.212-4(c), changes in the terms and conditions of this contract may be made only by written agreement of both parties. The services specified in the Sections entitled Schedule of Supplies/Services and Special Contract Requirements may be changed by written modification to this contract. The modification will be prepared by the VA Contracting Officer.

b. Other necessary personnel for the operation of the services contracted for at the VA will be provided by the VA at levels mutually agreed upon which are compatible with the safety of the patient and personnel and with quality medical care programming.

c. The services to be performed by the contractor shall be performed in accordance with VA policies and procedures and the regulations of the medical staff by laws of the VA facility.

4. TERM OF CONTRACT - The contract is effective for one year from date of award plus four one-year renewal periods that may be exercised by the VA. The contract is subject to the availability of VA funds. The contractor shall perform no services after April each year until the contracting officer authorizes such services in writing. The workload is estimated to be:

5. QUALIFICATIONS:

a. Personnel assigned by the Contractor to perform the services covered by this contract shall be licensed in a State, Territory, or Commonwealth of the United States or the District of Columbia. All licenses held by the personnel working on this contract shall be full and unrestricted licenses. The qualifications of such personnel shall also be subject to review by the VA Chief of Staff and approval by the VA Facility Director. Each person assigned to work under this contract shall be licensed in accordance with the requirements of the state in which the services are being provided. The contractor shall comply with all applicable Federal, State and local laws, executive orders, rules and regulations applicable to its performance under this contract.

b. The VA reserves the right to refuse employment under this contract or require dismissal from contract work any contract employee whom, by reason of previous unsatisfactory performance at the V A or unsatisfactory performance.

6. PERSONNEL POLICY:

a. The contractor shall be responsible for protecting the personnel furnishing services under this contract. To carry out this responsibility, the contractor shall provide the following for all personnel furnishing services under this contract:

· workers compensation

· professional liability insurance

· health examinations

· income tax withholding, and

· .social security payments.

b. The parties agree that the contractor, its employees, agents and subcontractors shall not be considered VA employees for any purpose.

7. RECORD KEEPING:

A Comprehensive record keeping systems shall be approved by the Contracting Office and be in place prior to the initiation of the contract. The contractor shall submit with their proposal a sample of their proposed record keeping system. A computerized system is preferred.

8. CONTRACT PERFORMANCE MONITORING - Upon contract award, the Contracting Officer shall appoint a Contracting Officer's Representative (COR) to assist with the contract monitoring requirement. The COR, CNVAMC, Augusta, GA shall be the VA official responsible for verifying contract compliance. After contract award, any incidents of contractor noncompliance as evidenced by the monitoring procedures shall be forwarded immediately to the Contracting Officer.

9. KEY PERSONNEL AND TEMPORARY EMERGENCY SUBSTITUTIONS - The Contractor shall assign to this contract the following key personnel: Program Manager/Contractor Representative

a. The Contractor shall make NO substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer, in writing, within 15 calendar days after the occurrence of any of these events and provide the information required by paragraph (c) below.

b. The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the Contracting Officer. Proposed substitutes shall have comparable qualifications to those of the persons being replaced. The Contracting Officer shall notify the Contractor within 15 calendar days after receipt of all required information of the decision on the proposed substitutes. The contract shall be modified to reflect any approved changes of key personnel.

c. For temporary substitutions where the key person shall not be reporting to work for three (3) consecutive work days or more, the Contractor shall provide a qualified replacement for the key person. This substitute shall have comparable qualifications to the key person. Any period exceeding two weeks shall require the procedure as stated above.

9. DATA SECURITY INFORMATION GATHERED OR CREATED OR CREATED IN PERFORMANCE OF SERVICES

a. Information, including, but not limited to, veteran individually-identifiable information (iii) and personal healthcare information (PHI), gathered or created by the Contractor in the performance of this contract is the exclusive property of VA and must be received, gathered, stored, backed up, maintained, used, disclosed and disposed of in accordance with the terms of this contract and applicable federal and VA information confidentiality and security laws, regulations and policies, including VA Directive and Handbook number 6500.

b. The Contractor shall provide access to VA information only to employees, subcontractors, and affiliates only: (1) to the extent necessary to perform the services specified in this contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of this contract, and (3) only to individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same VA information. These restrictions include the same level of background investigations, where applicable.

c. ALL VA III AND PHI INFORMATION STORED ON BOTH VA AND NON-VA EQUIPAMENT MUST BE ENCRYPTED IN ACCORDANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA). Federal standards established by U.S. Department of Commerce apply, including Federal Information Processing Standard 200 (FIPS200), and National Institute of Standards and Technology Special Publication 800-37, Guide for the Security, Certification and Accreditation. Contractors and subcontractors shall document compliance and make the document available upon request of the Contracting Officer or COTR. Contractor and subcontractors shall allow physical inspection by VA personnel to assess its physical and environmental security controls.

d. Contractor and its subcontractors must ensure that VA III and PHI is secure at all times and will ensure proper security is used on contractor or subcontractor computers with VA III or PHI information is stored. To avoid risk of loss or theft, VA III and PHI shall NOT be transferred by contractor or its subcontractors to paper, diskettes, CDs, DVDs, USB flash drives, external computer drives, computer notebooks, home computers or any other medium, and shall NOT be removed from the contractor for subcontractor site under any circumstances without specific written authorization of the VA Information Security Officer. VA III and PHI shall NOT be transferred between contractor or subcontractor computer unless permission is granted by VA for such transfer of data and secure encrypted transmission methods approved by the VA Information Security Officer are utilized. Contractor employees shall be required to sign VA National Rules of Behavior before they can be authorized access to VA information systems.

e. The Contractor shall immediately (on the date of discovery of the incident) report any incident of theft, loss or comprise of VA sensitive information to the Contracting Officer, the Contracting Officer's Technical Representative and any other VA Official designated by the Contracting Officer. This report shall be in writing and contain the fullest explanation possible and all the details of the incident available to the contractor. VA must receive notice from the contractor on the date contractor discovers incident.

f. HIPAA Compliance. The Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI)

g. Security Considerations: A background investigation will be required for this acquisition.

h. Contractor Access to Federal Facilities: The contractors will not be given access to the facility since work is performed remotely.

10. ACCESS AUTOMATED DATA PROCESSING FILES - In performance of official duties, the Contractor's employee(s) have regular access to printed and electronic files containing sensitive data, which must be protected under the provisions of the Privacy Act of 1974 (5 USC 552a), and other applicable laws, Federal Regulations, Veterans Affairs statutes and policies. The Contractor's employee(s) are responsible for (1) protecting that data from unauthorized release or from loss, alteration, or unauthorized deletion and (2) following all applicable regulations and instructions regarding access to computerized files, release of access codes, etc., as set out in a computer access agreement which the Contractor's employee(s) sign.

11. CONTRACT ADMINISTRATION DATA - The contracting officer is the only person authorized to approve changes or modify any of the requirements under this contract. The Contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer is authorized to make commitments or issue changes, which will affect price, quantity, or quality of performance of this contract. In the event the contractor effects any such change at the direction of any person other than the contracting officer, the change shall be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof

12. DESIGNATION OF CONTRACTING OFFICER'S TECHNICAL REPRESENTATIVE (COTR) - A VA Medical center representative of the Contracting Officer shall be designated to represent the Contracting Officer in furnishing technical guidance and advice regarding the work being performed under this task order. The foregoing is not to be construed as authorization to interpret or furnish advice or information to the Contractor relative to the financial or legal aspects of the task order. Enforcement of these segments is vested and is the sole responsibility of the CNVAMC Contracting Officer.

13. SECURITY REQUIREMENTS FOR CONTRACTOR EMPLOYEES

GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS to VA INFORMATION AND VA INFORMATION SYSTEMS

1. A contractor/subcontrator shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

1. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

1. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL Language

1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

d. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

e. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

f. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

g. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

h. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

i. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

j. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

k. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

l. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

m. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

INFORMATION SYSTEM DESIGN AND DEVELOPMENT

1. The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

o. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than ____ days.

p. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within ____ days.

q. All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g. for the convenience of VA) shall only be granted with approval of the contracting officer and the VA Assistant Secretary for Office of Information and Technology.

SECURITY INCIDENT INVESTIGATION

1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

s. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

t. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

u. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

TRAINING

1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

1. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

1. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

1. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

w. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

DETAILED EVALUATION CRITERIA

1. The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, with price and other factors considered.

2. Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

3. A written notice of award or acceptance of an offer mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

EVALUATION-COMMERCIAL ITEMS

Provide the following, along with your solicitation, for the purpose of determining responsibility:

1. Provide a written statement as to whether or not your company will need to borrow money to begin work on this contract. Additionally, if your company needs to secure funds, state the amount and provide written assurance that it can obtain the necessary funds.

2. Provide documentation that demonstrates your company will be able to meet the delivery schedule in terms of personnel required to perform the services required in the Statement of Work by the effective date of the contract, which is expected to be 05/01/2015.

3. Provide documentation of the most recent past three (3) contracts for providing this type of pharmaceutical service that demonstrate your company has two (2) years of continuous past experience to date. The documentation shall provide sufficient personal contact information for those contracts to allow the Contracting Officer to contact the Customers by phone and make a determination of responsibility.

4. If your company has had any problems with your most recent past three (3) contracts listed in 3 above, state what the problem(s) were, and how your company addressed the problem(s) to prevent them from occurring in the future.

Quality Assurance Surveillance Plan (QASP) Assessment

1. Prescription accuracy - correct dosage and days' supply

2. Low-Dose/High Dose Alert

3. Potential drug interactions

4. Therapeutic duplication

5. Potential drug allergies

6. Potential drug & diet interactions

7. Age/gender appropriate dosing

8. Weight appropriate dosing

9. Pregnancy Interaction

10. Medical condition appropriate dosing