36C24720Q0643.docx

Contract Opportunity Special Notice

PRODUCT SERVICE CODE

SUBJECT

CONTRACTING OFFICE'S

ZIP-CODE

SOLICITATION NUMBER

ARCHIVE

DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS

NAICS CODE

CONTRACTING OFFICE

ADDRESS

POINT OF CONTACT

(POC Information Automatically Filled from User Profile Unless Entered)

DESCRIPTION

See Attachment

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

GENERAL INFORMATION

ADDITIONAL INFORMATION

* = Required Field Contract Opportunity Special Notice U010 Intent to Sole Source USP 797 & 800 Web Based Training 30901 36C24720Q0643 N 611430 Department of Veterans Affairs VISN 7 Network Contracting Activity 501 Greene Street Hatcher Building - Suite 2 Augusta GA 30901 Contract Specialist Chaz D. Bowling chaz.bowling@va.gov

(615) 440-3018

NOTICE OF INTENT TO SOLE SOURCE

The Department of Veterans Affairs intends to issue sole-source firm-fixed priced award contract, to Critical Point LLC, 11B Commerce Way, Totowa, NJ 07512.

A sole source procurement will be issued to Critical Point LLC because they are the only vendor capable of fully performing the service according to Market Research. Critical Point LLC is the owner of the proprietary software ‘Critical Point Subscription Services’ and does not offer or authorize the software to a third-party vendor, this requirement is for Web-Based USP 797 & 800 educational courses for the Augusta VA Medical Center.

Market research has shown there is no other provider of Web-Based USP 797 & 800 Training, a sources sought was previously posted under 36C24720Q0553 on 05/01/2020.

This procurement is being conducted in accordance with FAR Part 6.302-1 Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements. The NAICS code is 611430 “Professional and Management Developing Training’ and has a size standard of $11.0 Million for this procurement.

This notice of intent is not a request for competitive quotes. However, interested parties may identify their interest and capability to respond to the requirement and submit quotations no later than 9:30 AM EST, May 26, 2020 to: chaz.bowling@va.gov. Responses received will be evaluated; however, a determination by the Government not to compete the proposed procurement based upon responses received to this notice is solely within the discretion of the Government.

Disclaimer and Important Notes: This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization's qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation (or combined synopsis) may be published in Federal Business Opportunities. However, responses to this notice will not be considered adequate responses to a solicitation. Determination by the Government not to compete the proposed procurement based upon responses received to this notice is solely within the discretion of the Government.

All interested companies shall provide quotation(s) for the following:

CLIN(S)

STATEMENT OF WORK

Web-Based Sterile Compounding Training and Evaluation Course

A. GENERAL INFORMATION

1. Purpose: Provide a web-based subscription service for all employees to ensure compliance with the United Stated Pharmacopeia (USP) 797/800 requirements.

2. Background: Charlie Norwood VA Medical Center (CNVAMC) is seeking education to be compliant with USP 797/800. A web-based subscription service will assist CNVAMC in remaining compliant and current with changes to USP 797/800. Course will provide documented training for the Joint commission, CMS, FDA and State Boards of Pharmacy that inspect compounding pharmacies.

3. Scope of Work: Contractor shall provide access to subscription software that provides training modules and documents the completed training as specified in section B, General Requirements.

4. Performance Period: The performance period will be one base year with four 1-year options to renew exercisable at the government’s discretion.

5. Hours of Service:

a. Work is to be done between the hours of 8:00a.m. and 4:00p.m., Monday through Friday, excluding holidays.

Federal Holidays

6. Type of Contract: The contract will be a Firm-Fixed-Price contract.

B. GENERAL REQUIREMENTS

C. VA INFORMATION SYSTEM SECURITY/PRIVACY CLAUSE

PER REVIEW OF VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX A- INFORMATION SECURITY AND PRIVACY CHECKLIST:

· “The C&A requirements do not apply, and a Security Accreditation Package is not required.”

· Acquisition of this service does not involve the storage, generating, transmitting, or exchanging of VA sensitive information to the vendor

· There may exist exposure to VA sensitive information, in particular to sensitive personal information (SPI) while implementing contractual services

Minimum Statutory Requirements Prohibition on unauthorized disclosure: Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). See VA Handbook 6500.6, Appendix C, paragraph 3.a.

Requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access, the contractor/subcontractor shall immediately and simultaneously notify the COR, the designated ISO, and Privacy Officer for the contract. The term ‘security incident’ means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a

Requirement to pay liquidated damages in the event of a data breach: Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs (see VA handbook 6500.6, appendix c, paragraph 7.a, 7.d)