Virtual Pharmacist Services Statement of Work.pdf

Statement of Work for Virtual Pharmacist Services Southeast Network VISN 7

Introduction and Scope of Work Pharmacists are needed to complete pending outpatient mail prescriptions from medical centers within VISN 7 and remote clinic sites. These services are needed due to continued staffing shortages related to vacancies, extended sick leave of pharmacists throughout the network, increasing volume of work related to new patient access and national and VISN initiatives for switching patients to a contracted agent.

Requirements of Virtual Pharmacists/Pharmacy Service

1. The prescriptions will be verified by the pharmacists and sent electronically to the centralized mail-out pharmacy (CMOP).

2. The pharmacist will evaluate each prescription for drug-drug interactions, contraindications for recorded drug allergies, appropriate doses, accurate directions and assure the printed label will be understandable to the patient.

3. Using formulary information provided by the VISN 7 Pharmacist Executive (VPE), VISN 7 pharmacy informaticist, and/or pharmacy service of specific sites, the pharmacist will review pending prescriptions for formulary status and process only new, renewed, and refills for formulary medications. New non-formulary prescriptions will not be processed by virtual pharmacist services.

4. Access to the Veterans Health Information Systems and Technology Architecture (VistA) computer system is required and virtual pharmacists will have to meet all information security and privacy requirements as required by the Department of Veterans Affairs.

5. Pharmacists must have knowledge of the VA Formulary and the VistA computer system. Pharmacists must also have a working knowledge of the processing requirements for proper completion of prescriptions and understand and be competent in accessing Computerized Patient Record System (CPRS) to read notes, check labs, etc prior to completing prescriptions that have questionable doses, special needs, etc.

6. The VA will not provide laptops, computers or any electronic equipment to the virtual pharmacist services.

7. The work will be performed remotely.

8. Prescriptions will be verified based on daily backlog (pharmacy pending prescription file).

Delivery

1. Prescriptions will be verified Sunday through Saturday with emphasis on after hours

(after 5:00 pm local time on weekdays) and weekends, to include holidays.

2. Contractor will process a minimum of 10,000 prescriptions per month with a projected maximum of 100,000 prescriptions per month (for all VISN 7 sites combined).

3. Payment will be made upon the verification of the number of prescriptions processed in the prior month.

4. Contract could be expanded to higher number of prescriptions per day if workload growth continues and contractor agrees.

Personnel Qualifications

1. Pharmacists must be citizens of the United States.

2. Graduate of a degree program in pharmacy from an American College of Pharmacy

Education (ACPE) accredited college or university.

3. Full current and unrestricted license to practice pharmacy in a State, Territory, Commonwealth of the United States or the District of Columbia.

4. Pharmacists to have working knowledge of VistA and CPRS and can process pending prescriptions for mail without training. Experience with VistA and CPRS must have been gained within the last three (3) years.

5. Pharmacists are familiar with VA formulary and restrictions including Prior Authorization requirements and Criteria for use of non-formulary drugs.

6. Must be able to provide at least six (6) qualified pharmacists at all times.

7. Pharmacists must provide their own computer equipment and must be able to obtain clearance from the VISN 7 Department Veterans Affairs Medical Center Information Security Officer.

Special Contract Requirements

Provision of Services

The Contractor agrees to provide the services specified in the Statement of Work to the Department of Veterans Affairs, hereinafter called VA, in accordance with the terms and conditions of this contract.

Services

a. The services specified may be changed by written modification to this contract. The modification will be prepared by VA contracting officer, and prior to becoming effective, shall be approved by Under Secretary for Health or designee.

b. The services specified to be performed by the contractor will be under the direction of the delegated Contracting Officer’s Representative.

Term of Contract

This contract will be effective for the period October 1, 2021 through September 30, 2026.

The contract is subject to the availability of VA funds. No service shall be performed by the Contractor after September 30th of each calendar year, until the Contracting Officer authorizes such services in writing.

Qualifications

Personnel assigned by the contractor to perform the services covered by this contract shall be licensed (as applicable) in a State, Territory, or Commonwealth of the United States or the District of Columbia. The qualifications of such personnel shall also be subject to review by VA Service Line Executives, Specialty Care, VA Chief of Staff and approval by the VA Network Director. Pharmacists must be citizens of the United States.

Personnel Policy

The Contractor shall be responsible for protecting the personnel furnishing resources under this contract. To carry out this responsibility, the contractor shall provide the following for these personnel:

o worker’s compensation o professional liability insurance o health examinations o income tax withholding, and o social security payments

The parties agree that such personnel shall not be considered VA employees for any purpose and shall be considered employees of the contractor. Payments for any leave, including sick leave, holiday, or vacation time, are the responsibility of the Contractor.

Payment for Services Rendered

a. The VA agrees to reimburse the Contractor on a monthly basis for services rendered as specified in the statement of work of this contract. Failure to carry out the specified services will result in non-payment and/or at the discretion of the VA a proration of agreed upon reimbursement based on extent of compliance with contract specifications and timeliness of services rendered.

b. The Contractor will be responsible for submitting a bill on a monthly basis for services provided to the OB1-/Tungsten electronic invoice system. The bill for services provided in a month should be received by the Fiscal Office by the 10th of the following month; however, every month of service completed should be billed no later than 90 days from date of service. Failure to comply with these requirements will result in non-payment.

c. Billings rendered by the Contractor to the VA for services furnished a VA beneficiary under the terms of this contract shall be billing in full. Neither the beneficiary, his/her insurer, nor any other third party shall be billed.

Monitoring Procedures

Monitoring will be based on procedures established by the VA Pharmacy Service to ensure services are appropriate, complete and satisfactory. The Contracting Officer’s Representative (COR), to be designated upon contract award, will be responsible for monitoring contract compliance and reporting any noncompliance as evidenced by the established monitoring procedures to the Contracting Officer for necessary action. In addition, the COR may designate appropriate VAMC personnel to monitor Contractor employee(s) work hours/services through one or a combination of the following mechanisms:

a. The COR will be responsible for verifying contract compliance. Any incidents of

Contractor non-compliance as evidenced by the monitoring procedures shall be forwarded immediately to the Contracting Officer.

b. Documentation of services performed shall be reviewed prior to certifying payment.

The COR will perform periodic spot checks and document with the using service to ensure reports monitoring. VAMC will pay only for services actually performed and in strict accordance with the schedule of price/costs. Contract monitoring and record keeping procedures shall be sufficient to ensure proper payment and allow audit verification that services were provided.

c. Contractor’s performance shall be monitored by the COR or his/her designee and reported to the VISN 7 VPE, Pharmacy Chiefs and vendor. The contract Virtual Pharmacy Services shall be monitored through a variety of mechanisms including:

TASK INDICATOR STANDARD ACCEPTABLE

LEVEL

METHOD OF

SURVEILLANCE

RX

Processing

Process Outpatient Rx’s in queue in a timely manner

Process Rx’s to extent to keep backlog in queue less than 72 hours

100% Monthly report of Rx’s processed by pharmacist

Does not process Non-formulary Rx’s without approval

No NF Rx’s processed without approval

95% Review by exception

Drug Information Source

Evaluates lab data, drug interactions, adverse drug events, and screens for allergies when processing Rx

Review of appropriate patient safety monitors when processing Rx

99% Review by exception

Med Error reporting

Rx’s will be processed accurately (correct drug, dose, sig, comments copied appropriately, etc.)

and errors reported and investigated

99% Review by exception

Customer Service

Provides excellent customer service to field and site POC

Will respond to inquiries/questions timely (usually within 24 hours)

99% Review by exception

Security Requirements for Contractor Employees

1. Contractor shall ensure the confidentiality of all patient and employee information and shall be held liable in the event of breech of confidentiality. Any person, who knowingly or willingly discloses confidential information from the Veterans Affairs Medical Center, may be subject to fines of up to $20,000.00.

2. Records: Contractor personnel who obtain access to hardware or media which may manipulate or store drug or alcohol abuse data, sickle cell anemia treatment records, records or tests or treatment for or infection with HIV, medical quality assurance records, or any other sensitive information protected under 38 U.S.C. 4132 or 3305, as defined by the Department of Veterans Affairs, shall not have access to the records unless absolutely necessary to perform their contractual duties. Any individual who has access to these data will disclose them to no one, including other employees of the Contractor not involved in the performance of the particular contractual duty for which access was obtained. Violation of these statutory provisions as stated in department regulations by the Contractor’s employees may involve imposition of criminal penalties.

3. System of Records: The Contractor personnel will have access to The Veterans

Administration system(s) of records in order to maintain patient medical records.

4. Procedures for User Access: Access requirements to VA information systems by Contractors and Contractor personnel shall meet or exceed those required for Veteran’s Health Administration (VHA) employees as described in VistA Directives (and others) and in any subsequent VistA policy statements. A written and signed request for user access by VistA Management, or designee(s), constitutes management approval (sponsorship) to initiate a request for access to any sensitive automated information system. Access shall be granted to non-VA users only if the purpose for access meets criteria of the Privacy Act and VA Confidentiality regulations and transfer.

5. Contractor will be required to sign and abide by the VA Computer Access Security

Agreement and Confidentiality Agreement.

6. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS: All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract, the contractor will be responsible for the actions of those individuals they provide to perform work for VA.

1. Position Sensitivity – The position sensitivity has been designated as a low risk.

2. Background Investigation – The level of background investigation commensurate with the required level of access is National Agency Check with Inquiries.

3. Contractor Responsibilities – The contractor, their personnel, and their subcontractors if applicable shall be subject to the Federal laws, regulations, standards, and VA Directives and handbooks regarding information and information system security as delineated in this contract.

a. The contractor shall bear the expense of obtaining background investigations.

If the investigation is conducted by the Office of Personnel Management (OPM), the contractor shall reimburse VA within 30 days.

b. The contractor shall prescreen all personnel requiring access to the

Computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak and understand the English language.

c. The contractor shall submit or have their employees submit the following required forms to the VA Office of Security and Law Enforcement within 30 days of receipt:

(1) Standard Form 85P, Questionnaire for Public Trust Positions

(2) Standard Form 85P-S, Supplemental Questionnaire for Selected

Positions

(3) FD 258, U.S. Department of Justice Fingerprint Application Chart

(4) VA Form 0710, Authority for Release of Information Form

(5) Optional Form 306, Declaration for Federal Employment

(6) Optional Form 612, Optional Application for Federal Employment

d. The contractor, when notified of an unfavorable determination by the

Government, shall withdraw the employee from consideration from working under the contract.

e. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

4. Government Responsibilities -

a. The VA Office of Security and Law Enforcement will provide the necessary forms to the contractor or to the contractor’s employees after receiving a list of names and addresses.

b. Upon receipt, the VA Office of Security and Law Enforcement will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation.

c. The VA facility will pay for investigations conducted by the Office of

Personnel Management (OPM) in advance. In these instances, the contractor will reimburse the VA facility within 30 days.

d. The VA Office of Security and Law Enforcement will notify the contracting officer and contractor after adjudicating the results of the background investigations received from OPM.

e. The contracting officer will ensure that the contractor provide evidence that investigations have been completed or are in the process of being requested.

5. Property Damage The contractor shall take all necessary precautions to prevent damage to any government property. The contractor shall report any damages immediately and shall be assessed current replacement costs for property damaged by the contractor, unless corrective action is taken. Any damaged material (i.e., shelving, pharmacy equipment, etc.) will be replaced in a timely manner or corrected by the contractor with like materials, at no extra cost to the government, upon approval of the Contracting Officer.

6. Record Retention Upon completion or termination of the applicable contract(s) or agreement(s), return and/or destroy, at Covered Entity’s option, VA information gathered, created, received, or processed during the performance of the contract(s) or agreement(s).

No data will be retained by Business Associate, or contractor, subcontractor, or other agent of Business Associate, unless retention is required by law and specifically permitted by Covered Entity. As deemed appropriate by and under the direction of Covered Entity, Business Associate shall provide written assurance that all VA information has been returned to Covered Entity or destroyed by Business Associate. If immediate return or destruction of all data is not possible, Business Associate shall notify Covered Entity and assure that all VA information retained will be safeguarded to prevent unauthorized Uses or Disclosures.

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information

Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

Termination of contract Note: If the vendor maintains any records whether hardcopy or electronic, they must be returned to the VA per contract and VA regulations by vendor. All files (hardcopy or electronic) shall not be shared with a 3rd party (unauthorized) unless authorized in writing by the COR or contracting Officer. If any disclosures of VA records to any 3rd party, an accounting of the disclosure must be kept by the vendor.

7. PRIVACY and SECURITY The contractor will comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and maintain the minimum necessary protected health information data required for the survey process. The contractor will develop and use proprietary patient satisfaction measurement tools, methodologies, and databases to advise and assist health care providers improve the quality of patient care. The VISN 7 Network and pharmacies are each a health care provider and will engage the contractor to assist with health care operations, specifically to provide services to help the medical center with internal quality oversight review, with conducting quality assessment and improvement activities which include evaluating outcomes, and evaluating practitioner and provider performance. In connection with services to be provided by the contractor, the VISN 7 Network and pharmacies may disclose patient information (as defined below) which the medical centers have obtained or created as part of the patient’s treatment. Under the business relationship between the contractor and the VISN 7 Network and pharmacies, the medical centers will allow the contractor limited access to certain patient information, which is the sole property of the medical centers. The contractor will provide reasonable administrative, technical and physical safeguards to protect the integrity and confidentiality of patient information within its control. The contractor will also prevent reasonably anticipated threats to the security or integrity of such patient information as well as unauthorized uses or disclosures of such patient information and will secure compliance by its representatives.

Definitions:

“Patient information” means any individually identifiable health information which: (a) contains personal identifying demographic information which would, either alone or in combination with other publicly available information, allow identification of an individual, such as the patient’s name, address, phone number, social security number, or other information; and (b) relates to the past or present physical or mental health or condition of an individual.

“The VISN 7 Network and pharmacies’ information” means patient satisfaction measurement data, analyses and reports created for the medical center by the contractor based on data furnished by the medical center and by medical center’s patients and that is readily identifiable to the medical center as the source of the information.

“Representatives” include directors, officers, employees, accountants, attorneys and other agents.

Restrictions on the use and re-release of patient information: The parties agree that the contractor and its representatives may use patient information (a) to do statistical analyses and create reports to be released only to the VISN 7 Network and pharmacies. The contractor will not re-release patient information or the VISN 7 Network and pharmacies’ information to any person other than to the VISN 7 Network and pharmacies and to contractor representatives who have a need to know such information for providing services to the VISN 7 Network and pharmacies in accordance with the underlying agreement between the parties, except with the written consent of The VISN 7 Network and pharmacies. All contractor representatives will be required to sign a non-disclosure agreement as a condition of their employment, a copy of which is available for review upon request by the VISN 7 Network and pharmacies. The vendor will be required to perform background checks on all contractor representatives having access to the VISN 7 Network and pharmacies’ patient information and be able to provide information upon request related as to the information obtained in the background check to the VISN 7 Network and pharmacies.

De-identification of patient information: Within the contractor’s base, any VISN 7 Network and pharmacies’ patient information will be required to be de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient. Data which has been stripped of patient identifying indicators such as patient name and address and incorporated into the contractor’s comparative or benchmark databases shall cease to be patient information creates large comparative or benchmark patient satisfaction databases to help health care providers improve the efficiency and effectiveness of health care delivery. The contractor may include in their database data that has been de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient.

8. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

9. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, VA HANDBOOK 6500.6 APPENDIX D relating to access to VA information and information systems;

(2) Successfully complete the appropriate VA privacy training and annually complete required privacy training: VA Privacy and Information Security

Awareness and Rules of Behavior -VA10176 and Privacy and HIPAA Focused Training-VA10203;

(3) The contractor is to self enroll into TMS via the link:

http://www.tms.va.gov. (See Attachment VHA Mandatory Training for Contractor Course Guide) and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of

Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

d. VHA Mandatory Training for Contractor Course Guide

In order for you to work at VA, you are required to complete mandatory training programs titled VA Privacy and Information Security Awareness and Rules of Behavior (VA10176) and Privacy and HIPAA Focused Training (VA10203) . This training is available through the VA Talent Management System (TMS).

The TMS offers web-based training to VA employees and its partners.

To use the TMS, you must self-enroll and create a profile at http://www.tms.va.gov. Once you are at the TMS website, follow the steps listed below to create your profile, launch the mandatory training course and complete the content prior to your coming to VA to begin your clinical training.

Each TVAMC Contractor Employee will need the following information in order to complete the self-enrollment process in the TMS:

• VA Location Code--

• VA COR First Name –

• VA COR Last Name --

• VA COR Email Address—

• VA COR Phone Number---

Step-by-Step Instructions

1. From a computer, launch a web browser and navigate to http://www.tms.va.gov

2. Click the [Create New User] link located near the SIGN IN button.

3. Select the radio button for “Contractor”

4. Click the [Next] button

5. Complete all required fields and any non-required fields if possible.

a. My Account Information:

http://www.tms.va.gov/ http://www.tms.va.gov/ http://www.tms.va.gov/

i. Create Password

ii. Re-enter Password

iii. Security Question

iv. Security Answer

v. Social Security Number

vi. Re-enter Social Security Number

vii. Date of Birth

viii. Legal First Name

ix. Legal Last Name

x. Email Address (Enter your personal email address. The email address will be used as your UserID when you login)

xi. Re-enter email address

xii. Phone Number (Enter a number where you can be reached by VA staff if issues arise with this self-enrollment process or in other circumstances)

b. My Job Information:

i. VA City –

ii. VA State –

iii. VA Location Code –

iv. VA COR First Name--

v. VA COR Last Name--

vi. VA COR Email Address

vii. VA COR Phone Number--

Once you have entered all of the required data, click the “Submit” button. Your profile will be immediately created. Copy and save the UserID displayed to you on the confirmation page, as you will need this for future logons to the VA TMS.

Once done, click on the “Continue” button and wait until your “To-Do” list is displayed with the title of the mandatory training course.

Launching and Completing the Content

Mouse over the title of the training course VA Privacy and Information Security Awareness and Rules of Behavior (VA10176).

Click the [Go to Content] button in the pop-up window that appears. (Be sure pop-up blocker is off.)

Complete the course content following the on-screen instructions.

Exit the course and a completion of the course will be recorded for your effort.

Click on the “Completed Work” pod on the lower right hand side of your internet browser window.

Move your mouse over the title of the course you just completed and choose to “Print Completion Certificate”.

Print your completion certificate and save it in a pdf file for your records.

Send a copy of your Certificate of Completion for your mandatory training for verification via email:__________________________

Repeats steps 1-8 for Privacy and HIPAA Focused Training (VA10203).

Trouble-shooting and Assistance

The Check System link on the VA TMS is an automated tool that confirms the existence of basic, required software on the computer you are using to complete this training. If one of the components of your computer is not in compliance with the requirements, a red “x’ will appear next to the Check System link.

Should this be the case with your computer, please follow the instructions to bring your computer up to the standards that will work with the VA TMS.

If you do not have a Social Security Number, or if you experience any difficulty creating a profile or completing the mandatory content, contact the VA MSE

Help Desk at 1.888.501.4917 or via email at:_____________________.

* Your SSN is used only as a unique identifier in the system to ensure users do not create multiple profiles. The SSN is stored in a Private Data Table that cannot be accessed anywhere via the VA TMS interface. It is securely transferred to a VA database table inside the VA firewall where it can be confirmed, if necessary, by appropriately vested system administrators and/or Help Desk staff.

The COR/Contracting officer must have copies of Privacy Training Certificate prior to assignment, and as these are updated. The Contractor is to ensure that all employees of the Contractor have the appropriate background investigation

VA HANDBOOK 6500.6 APPENDIX B

VA Handbook 6500.6 Appendix Clause:

VA Acquisition Regulation Solicitation Provision and Contract Clause (October 2008)

SUBPART 839.2 – Information and Information Technology Security Requirements

839.201 Contract clause for Information and Information Technology Security

Due to the threat of data breach or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with federal laws and regulations, VA has developed an Information and Information Technology Security clause. To be used when VA information is used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

In solicitations and contracts where VA Information and/or Information Technology will be accessed or utilized, the contracting officer shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources

852.273-75 - Security Requirements for Unclassified Information Technology Resources (interim- October 2008)

As prescribed in 839.201, insert the following clause:

(a) The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB

Circular A-130, and guidance and standards, available from the Department of Commerce’s National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST’s Web site at:

http://checklists.nist.gov

(b) To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in “VA Information and Information System Security/Privacy Requirements for IT Contracts” located at the following Website:

http://www.iprm.oit.va.gov/Security_and_Privacy_Requirements_for_Contractors.asp

A. VA HANDBOOK 6500.6 APPENDIX C:

VA INFORMATION AND INFORMATION SYSTEMS SECURITY/PRIVACY

LANGUAGE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

http://checklists.nist.gov/ http://www.iprm.oit.va.gov/Security_and_Privacy_Requirements_for_Contractors.asp

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval.

The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a

Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a

System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the contractor/subcontractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and

(3) Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a SOR.

h. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency.

(1) “Operation of a System of Records” means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

(2) “Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

(3) “System of Records” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

i. The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hot-fixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than twenty (20) days.

k. When the Security Fixes involve installing third party patches

(such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within than twenty (20) days.

l. All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g. for the convenience of VA) shall only be granted with approval of the contracting officer and the VA Assistant Secretary for Office of Information and Technology.

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR

USE

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent, to those procedures used to secure VA systems.

A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor’s systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office.

Government-owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

d. The contractor/subcontractor’s system must adhere to all

FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA’s POA&M management process. The contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government.