REV 1 FINAL PWS- Charleston SC Labor Services - Updated.pdf

PERFORMANCE WORK STATEMENT

LABOR SERVICES CONTRACT

GENERAL DESCRIPTION OF SERVICES

The Contractor shall provide labor and moves services to include receiving, inventory, delivery, and installation of furniture, fixtures, and other property of the Charleston VA Health Care System, which includes VA patient care, administrative and other leased space - See list of locations at the end of this document. This service shall include round trips to Ralph H. Johnson VA Medical Center on a regular basis and to outlying Outpatient Clinics on a less frequent, but periodic basis. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility that is secure and insured, which includes loading dock/s.

This contract is an IDIQ (indefinite delivery; indefinite quantity) for the convenience of the Government, and a GSA (General Services Administration) Open market contract soliciting offers from SDVOSB Contractors.

The Contractor shall be responsible for using the proper equipment to ensure efficient and careful transportation of furniture, equipment, and any other received items. Proper equipment shall include, but shall not be limited to, closed moving vans, closed security carriers for transporting equipment, rubber-wheeled dollies (in good condition and free of grease and dirt), aluminum or magnesium ramps of various sizes, cartons and bins, motorized pallet jacks, and a safe jack. The cost for this service shall be included within each Contractor’s profit calculations with respect to its quote.

The requirement of this contract is that the Contractor will provide a full range of services to disassemble/reassemble, repair and remove existing furnishings and related parts from a location, then transport the items to a new location and install/place them according to the direction of the Facility POC or COR.

The Contractor is required to provide design services such as, but not limited to, drafting scaled furniture drawings in ACAD computer programs, redesigning room layouts using specifications and features of standardized furnishings, and preparing inventory lists of furniture, parts and hardware to create full room/space assemblies that meet healthcare commercial furniture standards.

The Contractor is required to be capable of reading floor plans and drawings in AutoCAD and create and manage a professional inventory with photographs, include sizes and descriptions of inventoried items.

The Contractor and Staff must be certified with moving, assembling, disassembling, and reinstalling Commercial Healthcare Furnishings and cubicle workstations of various manufacturers such as Teknion, Herman Miller, Haworth, and capable of performing minor furniture repairs. The contract scope is for base-plus (4) four option year’s beginning at time of award.

The term of the contract shall be for a base one-year length and four option years:

Mobilization/Transition Period May 6, 2026 – May 28, 2026

Base Year May 29, 2026 – May 28, 2027

Option Year 1 May 29, 2027 – May 28, 2028

Option Year 2 May 29, 2028 – May 28, 2029

Option Year 3 May 29, 2029 – May 28, 2030

Option Year 4 May 29, 2030 – May 5, 2031

The Charleston VA Health Care System will provide furniture plans and facility blueprints for areas involved in this contract will be provided after contract award. A single staff point of contact will be provided to ensure efficient and seamless communication of the contract labor service requests. The number of move trips will vary from month to month and facility to facility and there can be no guarantee of the number of move trips required. Once we have a contract and complete some moves, we will have historical data to track and manage to predict moves. The Contractor and Staff that will perform the work must operate within a 50-mile radius of the Ralph H. Johnson (Charleston, SC) VA Medical Center located at 109 Bee Street, Charleston, SC, 29401.

SUBMISSION OF QUOTATION

Quote Submission: The contractors shall submit complete emailed electronic copy portable document format (.pdf) or Microsoft Excel (.xls) format of:

a. Certified Manufacture Letter confirming ability to be certified installer for Teknion, Herman Miller, and/or equal upon request.

b. Price quote with separate lines for 10,000 sq ft storage facility monthly rate, additional

1000 sq ft storage facility monthly rate, labor, local trips, non-local trips, trucking fees and dumpster fees.

Submissions can be sent in multiple emails to avoid computer system email size limitation, to the

Contracting Officer. Quotes submitted by any other method will not be considered. All proprietary information should be clearly marked. The use of hyperlinks in quotes is prohibited. The Contractor is responsible for confirming the Government’s receipt of the Contractor’s quote.

EVALUATION CRITERIA

Proposal will be evaluated on:

a. Furniture Manufacturer Documentation - Proof of Certified Installers; Teknion, Herman Miller, Krug, etc.

b. Quotes with line item breakdown of the service details.

c. RFQ will be based on best value to the Government (NOT lowest price).

d. Preference will be given to Contractor with proven familiarity and performance track record with the Ralph H. Johnson VA Medical Center (Charleston, SC) and the outlying properties.

FACILITIES PROTECTION

1. The Contractor will be required to provide protection for loading dock, storage areas, and any other facility environment where movement is focused to ensure safety and minimize risk of damage to any VAMC property.

2. The Contractor will be required to take all measures necessary to safely move VAMC property (furniture) to and from received locations to final delivery destination. Upholstered items must be protected from dust & environmental elements while being received, delivered, or installed.

3. The Contractor must remove any debris, i.e., specifically, all cardboard, plastic, and packaging, after movement of furniture and equipment.

TRANSPORTATION SERVICES

The Selected Contractor shall:

1. Provide manpower, adequate crew sizes for the scope of work.

2. Respond promptly, (deliver within 24-72 hours), to requests for transportation and delivery of requested furniture, equipment, or other stored items.

3. Supply all necessary tools, dollies, lifters, labels, cartons, bins, and other materials that may be required to perform specified delivery and storage tasks efficiently, at no extra charge.

4. The Contractor must provide manpower to effect transportation of equipment and furniture as necessary.

5. Provide full palletizing and shrink wrapping of all office case good/systems furniture that is being relocated. Additionally, Contractor will need to label each pallet of wrapped office furniture with Building #, Room #, and detail of size and type of desking (every office will be palletized separately).

6. Detailed instruction for labeling method will be directed by the VAMC Interior Design Department.

7. Provide personnel and supplies for minor wood and metal furniture repairs – all such repairs which are necessary due to damage caused in the move are to be at the selected Contractor’s expense and no charge for workload or materials will be allowed; Additionally, in the interest of safety and prevention of damage, the selected Contractor shall ensure that no dollies are loaded in excess of three (3) cartons high, either prior to loading or on the truck.

8. Movement and/or de-installation with potential for re-installation of furnishings that VAMC has slated for relocation including systems furniture, and other assorted furniture, to a location (or locations) designated by VAMC Interior Design Department. There is potential for older furniture to be slated for “Excess” in which VAMC staff will direct the selected Contractor to relocate pieces or to be disposed.

9. Provide a comprehensive, up-to-date Inventory detailing each furnishing deemed as excess for the VAMC Interior Design staff. This should be in an Excel Spreadsheet format.

10. Provide at least one supervisor and/or lead foreman, meeting the qualifications for the respective job title listed in Staffing section below, at each site for the duration of each shift’s work.

11. Contractor should ensure that all staff and crew wear clean, labeled shirts/coats to identify themselves as Contractors as well as meet all requirements for badging and security clearances for the VAMC.

PROJECT STAFFING

The Contractor(s) is expected to furnish a sufficient staff of supervisory and workload personnel to perform all phases of any work resulting from this document in an orderly, timely, and efficient manner.

There will be no excuse for failure of Contractor to perform in a timely manner on specified dates with adequate crew sizes.

The Contractor shall assure that the same supervisory and workload crew will be in attendance throughout the duration of the Work and shall be responsible from the beginning of the project to its completion. This supervisory team must be specifically named individuals. Members of this team can have no other assignments during the work, without the permission of Charleston VAMC and no replacement shall be made without the written approval of Charleston VAMC.

MINIMUM QUALIFICATIONS OF SELECTED LABOR CONTRACTOR’S STAFF

Staff proposed by the Contractor for this contract must meet the following mandatory requirements:

Submit documentation with Contracting proposal package.

1. Worker- General

Minimum six (6) months of commercial and/or biomedical moving experience Full understanding of conduct policy specified below Basic understanding of labeling procedures and implementation Full understanding of Privacy Training policy specified within this document Full understanding of VAMC badge policy specified within this document

Ability to work as directed Ability to use levels, screw guns and other tools required to secure filing cabinets, metal shelving and bookcases, systems and/or other contract furniture de-installation, reinstallation and basic wall mounting of equipment.

2. Driver Minimum two (2) year of commercial and/or biomedical moving experience Minimum four (2) years of commercial driving experience Full understanding of conduct policy specified below Full understanding of Privacy Training policy specified within this document Full understanding of VAMC badge policy specified within this document Basic understanding of labeling procedures and implementation Ability to work as directed Complete knowledge of vehicle and equipment operation Current valid licensing, as required by law

3. Supervisor or Lead Foreman Minimum two (2) years’ experience as a foreman or supervisor for a commercial moving company Full understanding of conduct policy specified below Full understanding of and ability to perform records packing and unpacking Full understanding of facility protection requirements specified within this document and ability to direct crews in their implementation Ability to read, understand, color-code and number floor plans Ability to implement labeling procedures Full understanding of each shift’s assignments and goals Full understanding of overall project goals and schedule Demonstrated ability to direct and manage crews Full understanding of VA Privacy Awareness training specified within this document Full understanding of VAMC badge requirements specified within this document

CODE OF CONDUCT

The following rules of conduct represent a minimum requirement for all employees, sub-contractors, agents, representative, and management of the Contractor(s). It is the responsibility of the Contractor(s) to ensure that each member of its workforce understands and complies with these rules.

1. Courteous and respectful behavior is expected at all times. Use of foul or derogatory language will not be allowed.

2. Meals and breaks will be taken at the same time by all movers in a designated break area. At no time will any mover eat or drink except within the designated break area. Use designated trash receptacles for cups and other garbage. Do not leave meal/break containers behind.

throw them away.

3. The use of MEDAVAHCS’s telephones is forbidden. Exceptions will be made for medical emergencies with the approval of your supervisor and/or a representative of MEDVAMC.

4. Use of electronic devices belonging to MEDVAMC, such as radios or computers, is forbidden.

5. Security personnel are present in each of the buildings. Security has the authority to examine any item being removed from any building at any time.

6. Selected Move Contractor staff will wear company uniforms with ID at all times while on site.

ID must be worn in a clearly visible and appropriate manner. All vendor staff will be required to adhere to AVAHCS’s sign-in and ID protocols.

7. Keep personal belongings together in the area designated by your supervisor. The AVAHCS’s representatives have the right to inspect at will all bags and/or packages brought on or off any VAMC grounds.

VAMC CONTRACTOR BADGES

The Contractor(s) staff is required to have a VA Contractor identification badge issued to each member of the Labor Crew. A VA Contractor Badge Application will be provided to the Contractor after contract is awarded. This will need to be completed before Contractor staff arrives on site to Security Office.

Badges are to be worn at all times while on the premises of the Charleston VAMC and Outpatient Clinics.

Badges will be placed in a visible location, above the waist, clipped to the front of apparel with photo and name clearly visible. Contractor ID badges will be turned in to the assigned VAMC representative (COR) on duty when the contract has expired. The COR will then forward the badges to the VA Police Service within (5) working days.

Contractor must ensure that the following Identification Requirements are followed by each staff member applying for a VA Contractor Badge at the Security Station on campus:

1. Must provide (1) photography ID consisting of either a current Driver’s License, Military ID, U.S. Passport, Student ID which includes a Social Security number (will not except any expired IDs)

2. Must provide either an original Social Security card or Birth Certificate (a copy will not be accepted)

If both valid ID requirements are not present at time of badge processing, the incompliant Contractor staff will not be able to work on Charleston VAMC premises.

The Contractor(s) will be required to complete the VA Identification and Privacy Awareness Training (outlined below) a day prior to scheduled work at the Charleston VAMC.

VA PRIVACY AWARENESS TRAINING

The following procedure for obtaining the required VA Privacy Awareness Training is a mandatory requirement for all employees, sub-contractors, agents, representative and management of the Contractor(s). It is the responsibility of the Contractor(s) to ensure that each member of the Labor Crew understands and complies with the training during the VA Contractor Badge issue process. As all Labor Crew staff process with Security staff (obtain contractor badges), the facility Privacy Officer will provide VA Privacy Awareness Training Literature and a concise education presentation to certify all Contractor staff is compliant with required Privacy Training. All Labor Crew staff working at the Charleston VAMC must provide signatures with facility Privacy Officer confirming their completion of Privacy Training at time of presentation. Any non-compliant Contractor staff will be escorted from job site.

DELIVERY AND PICKUP LOCATIONS FOR CHARLESTON VA HEALTH CARE

SYSTEM:

Local Non-Local Sites Address 1 Address 2 City State Zip

Local: Within a 50-mile radius

Non-Local: Beyond the 50-mile radius

X Beaufort NSF 1 Pinckney Boulevard Beaufort SC 29902

X Brunswick GA Clinic 93 Benchmark Way Brunswick GA 31520

X Charleston Vet Center 3625 West Montague Avenue

North Charleston

SC 29418

X North Charleston Outpatient Clinic 6450 Rivers Avenue Charleston SC 29406

X Community Resource & Referral Center (CRRC)

2424 City Hall Lane Suite B North Charleston

SC 29406

X Fisher House 150 Wentworth Street Charleston SC 26401

X Goose Creek Primary Care Clinic

(JACC)

110 NNPTC Circle Goose Creek SC 29445

X Goose Creek Crowfield Sleep Lab & Eye Clinic, Building A

7 South Alliance Drive Goose Creek SC 29445

X Hinesville GA Outpatient Clinic 500 E. Oglethorpe Hwy. Hinesville GA 3131X

X James Island Admin Building 325 Folly Road 3Rd Floor Suite 300 James Island SC 29412

X Lowcountry Veteran Brain Research Institute

22 Westedge Street Charleston SC 29403

X Montague Admin Building 3355 West Montague Avenue

Charleston SC 29418

X Mt. Pleasant Primary Care & Whole Health Clinics

180 Wingo Way Mt. Pleasant SC 29464

X Myrtle Beach Outpatient Clinic 1800 Airpark Drive Myrtle Beach SC 29577

X Myrtle Beach Vet Center 1101 Johnson Avenue Suite 204 Myrtle Beach SC 29577

X Optometry Clinic Joint Base Charleston

746 Pulaski Street Goose Creek SC 29445

X Savannah GA Outpatient Clinic 1170 Shawnee Street Savannah GA 31419

X Strom Thurmond Research 171 Ashley Avenue Charleston SC 29425

X VA Warehouse 3151 W. Montague Avenue North Charleston

SC 29418

X TeleMental Health 3129 Montague Avenue North Charleston

SC 29418

Invoicing

1. Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor, validated by the Contracting Officer’s Representative (COR), and submitted electronically through OB-10 (https://portal.tungsten-network.com/).

2. A properly prepared invoice will contain:

a) Invoice Number and Date

b) Contractor’s Name and Address

c) Accurate Purchase Order Number

d) Supply or Service provided

e) Total Amount Due

SERVICES: CLIN LINES:

0001: Labor/Moves services to include receiving, inventory, delivery, and installation of furniture, fixtures, and other property of the Charleston VA Health Care System, which includes VA patient care, administrative and other leased space - See list of locations at the end of this document. This service shall include trips to Ralph H. Johnson VA Medical Center on a regular basis and to outlying Outpatient Clinics on a less frequent, but periodic basis. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Total man hours: 5,292 Contract Period: BASE POP Begin: May 29, 2026 POP End: May 28, 2027

0002: Local Truck Trip: 206 round trips Contract Period: BASE POP Begin: May 29, 2026 POP End: May 28, 2027

0003: Non - Local Truck Trip: 103 round trips Contract Period: BASE POP Begin: May 29, 2026 POP End: May 28, 2027

0004: Storage Facility – Minimum 10000 sq ft. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

https://portal.tungsten-network.com/

Per Month Contract Period: BASE POP Begin: May 29, 2026 POP End: May 28, 2027

0005: Storage Facility – Additional 1000 sq ft. The government anticipates that there could be times where additional square footage will be required. The COR will facilitate when and how long this additional space will be required.

Per Month Contract Period: BASE POP Begin: May 29, 2026 POP End: May 28, 2027

0006: Mobilization/Transition Period – The selected Contractor will remove/load all government owned equipment, furniture, supplies, etc. from the current storage facility located at 1159 Cainhoy Road, Dock 1159-C, North Charleston, SC 29492 and transport/unload equipment, furniture, supplies, etc. at the successful contractor’s storage facility.

Period of Performance (Job) Contract Period: Job POP Begin: May 6, 2026 POP End: May 28, 2026

1001: Labor/Moves services to include receiving, inventory, delivery, and installation of furniture, fixtures, and other property of the Charleston VA Health Care System, which includes VA patient care, administrative and other leased space - See list of locations at the end of this document. This service shall include trips to Ralph H. Johnson VA Medical Center on a regular basis and to outlying Outpatient Clinics on a less frequent, but periodic basis. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Total man hours: 5,292 Contract Period: Option Year 1 POP Begin: May 29, 2027 POP End: May 28, 2028

1002: Local Truck Trip: 206 round trips Contract Period: Option Year 1 POP Begin: May 29, 2027 POP End: May 28, 2028

1003: Non - Local Truck Trip: 103 round trips Contract Period: Option Year 1 POP Begin: May 29, 2027 POP End: May 28, 2028

1004: Storage Facility – Minimum 10000 sq ft. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Per Month Contract Period: BASE POP Begin: May 29, 2027 POP End: May 28, 2028

1005: Storage Facility – Additional 1000 sq ft. The government anticipates that there could be this additional space will be required.

Per Month Contract Period: BASE POP Begin: May 29, 2027 POP End: May 28, 2028

2001: Labor/Moves services to include receiving, inventory, delivery, and installation of furniture, fixtures, administrative and other leased space - See list of locations at the end of this document. This service shall include trips to Ralph H. Johnson VA Medical Center on a regular basis and to outlying Outpatient Clinics on a less frequent, but periodic basis. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Total man hours: 5,292 Contract Period: Option Year 2 POP Begin: May 29, 2028 POP End: May 28, 2029

2002: Local Truck Trip: 206 round trips Contract Period: Option Year 2 POP Begin: May 29, 2028 POP End: May 28, 2029

2003: Non - Local Truck Trip: 103 round trips Contract Period: Option Year 2 POP Begin: May 29, 2028 POP End: May 28, 2029

2004: Storage Facility – Minimum 10000 sq ft. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Per Month Contract Period: BASE

2005: Storage Facility – Additional 1000 sq ft. The government anticipates that there could be this additional space will be required.

Per Month Contract Period: BASE

3001: Labor/Moves services to include receiving, inventory, delivery, and installation of furniture, fixtures, administrative and other leased space - See list of locations at the end of this document. This service shall include trips to Ralph H. Johnson VA Medical Center on a regular basis and to outlying Outpatient Clinics on a less frequent, but periodic basis. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Total man hours: 5,292

Contract Period: Option Year 3 POP Begin: May 29, 2029 POP End: May 28, 2030

3002: Local Truck Trip: 206 round trips Contract Period: Option Year 3 POP Begin: May 29, 2029 POP End: May 28, 2030

3003: Non - Local Truck Trip: 103 round trips Contract Period: Option Year 3 POP Begin: May 29, 2029 POP End: May 28, 2030

3004: Storage Facility – Minimum 10000 sq ft. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Per Month Contract Period: BASE

POP End: May 28, 2030

3005: Storage Facility – Additional 1000 sq ft. The government anticipates that there could be this additional space will be required.

Per Month Contract Period: BASE

POP End: May 28, 2030

4001: Labor/Moves services to include receiving, inventory, delivery, and installation of furniture, fixtures, administrative and other leased space - See list of locations at the end of this document. This service shall include trips to Ralph H. Johnson VA Medical Center on a regular basis and to outlying Outpatient Clinics on a less frequent, but periodic basis. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Total man hours: 5,292 Contract Period: Option Year 4 POP Begin: May 29, 2030 POP End: May 28, 2031

4002: Local Truck Trip: 206 round trips Contract Period: Option Year 4 POP Begin: May 29, 2030 POP End: May 28, 2031

4003: Non - Local Truck Trip: 103 round trips Contract Period: Option Year 4 POP Begin: May 29, 2030 POP End: May 28, 2031

4004: Storage Facility – Minimum 10000 sq ft. The selected Contractor must provide a clean, temperature and humidity controlled receiving facility which includes loading dock/docks.

Per Month Contract Period: BASE

POP Begin: May 29, 2030 POP End: May 28, 2031

4005: Storage Facility – Additional 1000 sq ft. The government anticipates that there could be this additional space will be required.

Per Month Contract Period: BASE POP Begin: May 29, 2030 POP End: May 28, 2031

Security

PER REVIEW OF VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX A- INFORMATION

SECURITY AND PRIVACY CHECKLIST:

• “The C&A requirements do not apply, and a Security Accreditation Package is not required.”

• Acquisition of this service does not involve the storage, generating, transmitting, or exchanging of VA sensitive information to the vendor

• There may exist exposure to VA sensitive information, in particular to sensitive personal information (SPI) while implementing contractual services.

Minimum Statutory Requirements

Prohibition on unauthorized disclosure: Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). See VA Handbook 6500.6, Appendix C, paragraph 3.a.

Requirement for data breach notification

Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access, the contractor/subcontractor shall immediately and simultaneously notify the COR, the designated ISO, and Privacy Officer for the contract. The term ‘security incident’ means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a

Requirement to pay liquidated damages in the event of a data breach.

Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access).

(2) Description of the event, including:

(a) date of occurrence.

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

(3) Number of individuals affected or potentially affected.

(4) Names of individuals or groups affected or potentially affected.

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text.

(6) Amount of time the data has been out of VA control.

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons).

(8) Known misuses of data containing sensitive personal information, if any.

(9) Assessment of the potential harm to the affected individuals.

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification.

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports.

(3) Data breach analysis.

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible.

And.

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs (see VA handbook 6500.6, appendix c, paragraph 7.a, 7.d).

VA INFORMATION SYSTEM SECURITY/PRIVACY CLAUSE

PER REVIEW OF VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX A- INFORMATION

SECURITY AND PRIVACY CHECKLIST:

“The C&A requirements do not apply, and a Security Accreditation Package is not required. “Acquisition of this service does not involve the storage, generating, transmitting, or exchanging of VA sensitive information to the vendor. There may exist exposure to VA sensitive information, in particular to sensitive personal information (SPI) while implementing contractual services.

Minimum Statutory Requirements

Prohibition on unauthorized disclosure: Information made available to the contractor or subcontractor by

VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data -

General, FAR 52.227-14(d) (1). See VA Handbook 6500.6, Appendix C, paragraph 3.a.

Requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access, the contractor/subcontractor shall immediately and simultaneously notify the COR, the designated ISO, and Privacy Officer for the contract. The term ‘security incident’ means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook

6500.6, Appendix C, paragraph 6.a

Requirement to pay liquidated damages in the event of a data breach: Consistent with the requirements of

38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security

Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access).

(2) Description of the event, including:

(a) date of occurrence.

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

(3) Number of individuals affected or potentially affected.

(4) Names of individuals or groups affected or potentially affected.

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text.

(6) Amount of time the data has been out of VA control.

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons).

(8) Known misuses of data containing sensitive personal information, if any.

(9) Assessment of the potential harm to the affected individuals.

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount determined as industry standard rate per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification.

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis.

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs (see VA handbook 6500.6, appendix c, paragraph 7.a, 7.d).

INVOICES

Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor, validated by the Contracting Officer’s Representative (COR), and submitted electronically through OB-10 on a monthly basis.

A properly prepared invoice will contain:

Invoice Number and Date

Contractor’s Name and Address

Accurate Purchase Order Number

Supply or Service provided

Total amount due

NON-PERSONAL SERVICES CONTRACT

No employer-employee relationship is created by an agency’s use of private sector contractor-employees under these regulations. Services furnished by contractor-employees shall be performed by their employees who shall not be considered or treated as Federal employees for any purpose, shall not be regarded as performing a personal service, and shall not be eligible for civil service employee benefits, including retirement. Further, to avoid creating any appearance of such a relationship, agencies shall observe the following requirements:

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes Ralph H. Johnson VA Health Care Systems records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their contract.

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as

National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter

XII Subchapter B, and those policies associated with the safeguarding of records covered by the

Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of

44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for

Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. [Agency] and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of [Agency] or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to [Agency]. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to [Agency] control or the Contractor must hold it until otherwise directed. Items returned to the

Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the

Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is

EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The

Contractor (and any sub-contractor) is required to abide by Government and [Agency] guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with [Agency] policy.

8. The Contractor shall not create or maintain any records containing any non-public [Agency] information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The [Agency] owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which [Agency] shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take [Agency]-provided records management training. The

Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

D. Flow down of requirements to subcontractors

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the

Contractor.

END