Amendment 0002 - 36C24726Q0605.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 19

0002 09-06-2026

None

36C247

Department of Veterans Affairs

VISN 7 Network Contracting Office

LaVista Business Park - Bldg A

2008 Weems Road

Tucker GA 30084

36C247

Department of Veterans Affairs

VISN 7 Network Contracting Office

LaVista Business Park - Bldg A

2008 Weems Road

Tucker GA 30084

To all Offerors/Bidders

36C24726Q0605

X

X X x 1

SUBJECT: SUBJECT: Amendment 0002 - 36C24726Q0605 - Virtual Pharmacy Services

PURPOSE: Revised Responses to Q&A, Statement of Work (SOW), and Clause 52.216-19

1. Responses to questions 5, 20, and 21 have been revised. - See Page 2

2. SOW has been revised to include Tuscaloosa VA Medical Center. - See Page 3

3. Clause 52.216-19 has been revised. – See Page 2

4. Attachment 4 has been revised and will be uploaded in SAMS.GOV as an attachment.

There are no other changes pertaining to this amendment. Nothing Follows.

Leonard Robinson

Contract Officer

Questions and Answer Revised

5. Please confirm whether the required prescription processing is limited to clinic and outpatient prescriptions. SOW

§2.1 also refers to remote prescription order review/order entry services for “inpatient pharmacy services,” while the remaining workflow and pricing language describes outpatient prescription processing. (Reference: SOW

§2.1, p. 5; §§2.2–2.3, pp. 5–6)

Answer: The prescription processing services required under this SOW are limited to outpatient prescriptions.

This has been corrected in the SOW.

20. SOW §2.1 states that the contractor shall provide technical support personnel, and the personnel-vetting clause references pharmacy technicians, but the staffing qualification and evaluation sections require only pharmacists.

Are pharmacy technicians or other technical support personnel required contract labor? If so, please provide the required staffing levels, duties, qualifications, and pricing treatment. (Reference: SOW §2.1, p. 5; VAAR

852.204-72 table, pp. 35–36)

Answer: No, only remote pharmacists are required for this requirement. The verbiage has been changed in section

2.1 of the SOW.

21. Outpatient vs. Inpatient Scope.

Section B.2 primarily describes the requirement as processing pending clinic and outpatient prescriptions, including outpatient prescriptions sent to CMOP or suspended for local mail. However, Section 2.1 also states that pharmacists will perform remote prescription order review/order entry services for “inpatient pharmacy services.”

Please confirm whether the required scope is limited to outpatient prescription processing and verification, or whether any inpatient prescription-processing services are also included. If inpatient services are included, please identify the anticipated inpatient scope and estimated volume.

Answer: This verbiage has been revised on the Statement of Work. This is for outpatient services only. Inpatient verbiage has been removed from the SOW. All services requested are remote.

C.5 52.216-19 ORDER LIMITATIONS (OCT 1995)

(a) Minimum order. When the Government requires supplies or services covered by this contract in an amount of less than $2,500.00, the Government is not obligated to purchase, nor is the Contractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The Contractor is not obligated to honor—

(1) Any order for a single item in excess of $7,400,00.00;

(2) Any order for a combination of items in excess of $7,400,00.00; or

(3) A series of orders from the same ordering office within 365 days that together call for quantities exceeding the limitation in paragraph (b)(1) or (2) of this section.

(c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-21 of the Federal

Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the

Contractor if that requirement exceeds the maximum-order limitations in paragraph (b) of this section.

(d) Notwithstanding paragraphs (b) and (c) of this section, the Contractor shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within 10 days after issuance, with written notice stating the Contractor's intent not to ship the item (or items) called for and the reasons. Upon receiving this notice, the Government may acquire the supplies or services from another source.

(End of Clause)

STATEMENT OF WORK

1.0 GENERAL INFORMATION

1.1 Title: VISN Virtual Pharmacy Services

1.2 Background: Virtual pharmacy services are required to process pending outpatient mail prescriptions for VISN 7 medical centers and remote clinics. This support addresses ongoing regional staffing shortages caused by personnel vacancies and extended sick leave. Additionally, it helps manage increased workloads driven by expanding patient access and national/VISN initiatives to transition patients to contracted agents.

1.3 Type of Contract: VISN 7 intends to establish a five 1-year Indefinite Delivery, Indefinite Quantity (IDIQ) contract

1.4 Participating Facilities: Tasks under this SOW shall be provided for VISN 7 VAMCs remotely at Contractor facility(ies). The VISN 7 VAMCs to be included for coverage are, but not limited to, the following:

FACILITIES ADDRESS

Joseph Maxwell Cleland Atlanta

VA Medical Center 1670 Clairmont Road

Decatur, GA 30033

Charlie Norwood VA Medical

Center One Freedom Way

Augusta, GA 30904-6258

Birmingham VA Medical Center 700 South 19th Street

Birmingham, AL 35233

Carl Vinson VA Medical Center 1826 Veterans Blvd.

Dublin, GA 31021

Central Alabama Veterans

Healthcare System 215 Perryhill Road

Montgomery, AL, 36109

Ralph H. Johnson VA Medical

Center 109 Bee Street

Charleston, SC 29401

William Jennings Bryan Dorn

VA Medical Center 6439 Garners Ferry Road

Columbia, SC 29209-1638

Tuscaloosa VA Medical Center 3701 Loop Road East

Tuscaloosa, AL 35404

1.5 IDIQ Pricing Periods:

TABLE 2: ESTIMATED PRICING PERIODS

ORDERING

PERIODS

DATES

1 October 01, 2026 to September 30, 2027

2 October 01, 2027 to September 30, 2028

3 October 01, 2028 to September 30, 2029

4 October 01, 2029 to September 30, 2030

5 October 01, 2030 to September 30, 2031

Six Month

Extension

(52.217-8)

October 01, 2031 to March 31, 2032

1.6 Yearly Estimated Outpatient Prescriptions: 1,800,000 (150,000 Per Monthly)

1.7 Applicable Laws, Regulations and Policies: The Contractor shall comply with all applicable federal, state, and local laws, regulations, directives, and Department of Veterans Affairs (VA) policies, including, but not limited to, the following:

1.7.1 Health Insurance Portability and Accountability Act (HIPAA)

1.7.2 Federal Information Security Management Act (FISMA)

1.7.3 Privacy Act of 1974

1.7.4 VA Handbook 6500 and VA Directive 6500

1.7.5 Department of Veterans Affairs Acquisition Regulation (VAAR)

1.7.6 Section 508 of the Rehabilitation Act

1.7.7 21st Century Integrated Digital Experience Act (IDEA)

1.7.8 National Institute of Standards and Technology (NIST) Special Publications (e.g., NIST SP 800-53, NIST SP 800-

171)

1.7.9 Americans with Disabilities Act (ADA) Title III

1.7.10 All other federal and state laws and regulations

2.0 SCOPE, REQUIREMENTS, AND DELIVERABLES

2.1 Scope: Contractor shall provide professional virtual pharmacy services to complete pending clinic and outpatient prescription orders for the Department of Veterans Affairs, VISN 7 located in Georgia, Alabama, and South

Carolina. Contractor shall provide enough licensed Pharmacists to perform remote prescription order review/order entry services for outpatient pharmacy services. This includes the professional review and problem-solving needed to ensure safe and appropriate medication processing. The contractor shall provide pharmacists, equipment, and supervision necessary to perform and implement virtual pharmacy services to meet the needs of VINS 7. The contractor must be a U.S. based corporation capable of providing remote pharmacy services to be completed via secure web-based system provided by the contractor.

2.2 Requirements of Virtual Pharmacists/Pharmacy Service

2.2.1 The prescriptions will be verified by the pharmacists and sent electronically to the centralized mail-out pharmacy

(CMOP) or suspended for local mail.

2.2.1 The pharmacist will evaluate each prescription for drug-drug interactions, contraindications for recorded drug allergies, appropriate doses, accurate directions and assure the printed label will be understandable to the patient.

2.2.2 Using formulary information provided by the VISN 7 Pharmacist Executive (VPE), VISN 7 pharmacy informaticist, and/or pharmacy service of specific sites, the pharmacist will review pending prescriptions for formulary status and process only new, renewed, and refills for formulary medications. New non-formulary prescriptions will not be processed by virtual pharmacist services.

2.2.3 Access to the Veterans Health Information Systems and Technology Architecture (VistA) computer system is required and virtual pharmacists will have to meet all information security and privacy requirements as required by the Department of Veterans Affairs.

2.2.4 Pharmacists must have knowledge of the VA Formulary and the VistA computer system, including outpatient prescription processing/verification workflows for pending outpatient prescriptions (i.e., completing pending outpatient prescriptions in VistA Outpatient Pharmacy, conducting required clinical screening such as allergy and drug interaction checks, using CPRS as needed to review relevant notes/labs, and dispositioning prescriptions to

CMOP or suspending for local mail, as applicable). Pharmacists must also have a working knowledge of the processing requirements for proper completion of prescriptions and understand and be competent in accessing

Computerized Patient Record System (CPRS) to read notes, check labs, etc. prior to completing prescriptions that have questionable doses, special needs, etc.

2.2.5 The VA will not provide laptops, computers or any electronic equipment to the virtual pharmacist services.

2.2.6 The work will be performed remotely

2.2.7 Prescriptions will be verified based on daily backlog (pharmacy pending prescription file).

2.3 Deliverables:

2.3.1 Prescriptions will be verified Sunday through Saturday with emphasis on after hours (after 5:00 pm local time on weekdays) and weekends, to include holidays.

2.3.2 Contractor will process and verify approximately 120,000 to 150,000 pending outpatient prescriptions per month

(this estimation is subject to change depending on workload and local staffing).

2.3.3 Payment will be made upon the verification of the number of prescriptions processed in the prior month.

2.4 Personnel Qualifications:

2.4.1 Pharmacists must be citizens of the United States.

2.4.2 Graduate of a degree program in pharmacy from an American College of Pharmacy Education (ACPE) accredited college or university.

2.4.3 Full current and unrestricted license to practice pharmacy in a State, Territory, Commonwealth of the United States or the District of Columbia.

2.4.4 Pharmacists must have recent experience using VistA and CPRS to process and verify outpatient prescriptions

(including processing pending outpatient prescriptions for mail). For purposes of this SOW, “outpatient prescription processing/verification” includes reviewing and completing pending outpatient prescriptions in VistA Outpatient

Pharmacy, performing required clinical screening (e.g., allergies, drug-drug interactions, contraindications, dose/directions appropriateness), using CPRS as needed to review relevant notes/labs, and dispositioning prescriptions appropriately (e.g., releasing electronically to CMOP or suspending for local mail). The VA will not provide training on VistA/CPRS or outpatient prescription processing workflows; pharmacists must be able to perform these duties upon start. Experience with VistA/CPRS outpatient prescription processing must have been gained within the last three (3) years and must include a minimum of twelve (12) months cumulative experience processing outpatient prescriptions in the VA during the past three (3) years.

2.4.5 Pharmacists are familiar with VA formulary and restrictions including Prior Authorization requirements and Criteria for use of non-formulary drugs.

2.4.6 Must be able to provide at least six (6) qualified pharmacists at all times.

2.4.7 Pharmacists must provide their own computer equipment and must be able to obtain clearance from the VISN 7

Department Veterans Affairs Medical Center Information Security Officer.

2.5 Qualifications: Personnel assigned by the contractor to perform the services covered by this contract shall be licensed (as applicable) in a State, Territory, or Commonwealth of the United States or the District of Columbia.

The qualifications of such personnel shall also be subject to review by VA Service Line Executives, Specialty Care, VA Chief of Staff and approval by the VA Network Director. Pharmacists must be citizens of the United States.

2.6 Hours of Operation

2.6.1 General Requirement: The Contractor shall furnish the services covered under this contract as defined herein.

Except in cases of emergency, the Contractor shall be required to provide the services described below in accordance with the SOW.

2.6.2 Work Schedule: The Contractor shall provide virtual pharmacist coverage seven (7) days per week, Sunday through

Saturday, from 5:00 p.m. (midnight) to 8:00 a.m., inclusive of the federal holidays identified in Section 2.6.3

(referenced as Section 3.3 herein).

2.6.3 Federal Holidays: The Department of Veterans Affairs observes the following federal holidays:

❖ New Year's Day

❖ Washington's Birthday (Presidents' Day)

❖ Martin Luther King Jr.'s Birthday

❖ Memorial Day

❖ Juneteenth National Independence Day

❖ Independence Day

❖ Labor Day

❖ Columbus Day

❖ Veterans Day

❖ Thanksgiving Day

❖ Christmas Day

In addition to the holidays listed above, any day specifically declared by the President of the United States to be a national holiday shall also be observed.

2.6.4 Emergencies: The Chief of Pharmacy or representative will contact the vendor to request additional support from the clinical pharmacy services outside of the established hours in times of emergency/disaster (e.g. weather – blizzards). If emergency services are provided, the vendor will be paid at the same rate.

2.6.5 Cancellations: Contractor cancellation is not acceptable. Unless a state of emergency has been declared or services are otherwise canceled by the VA FARHCS, the Contractor shall be responsible for providing services.

2.7 Contingency Plan: Continuity of care is essential to the delivery of medical services within VISN 7; accordingly, the Contractor shall maintain a contingency plan to ensure uninterrupted performance in the event that the contract

Clinical Pharmacist(s) separates from the Contractor's employment or is otherwise unable to continue performance in accordance with the terms and conditions of the resulting contract.

2.8 Transition Phase: A transition period, not to exceed three (3) months, shall be provided for the incoming Contractor to assume full responsibility for virtual pharmacy services, ensuring continuity of care and uninterrupted service delivery. During this period, the incoming Contractor shall coordinate with the outgoing Contractor and the COR to complete all necessary training, credentialing, systems access, and knowledge transfer activities required to achieve full operational capability. The transition period shall conclude no later than three (3) months from the contract start date, or sooner upon the Government's determination that the incoming Contractor is fully capable of independently performing all requirements of this contract.

2.6 Payment for Services Rendered

2.6.1 The VA agrees to reimburse the Contractor on a monthly basis for services rendered as specified in the statement of work of this contract. Failure to carry out the specified services will result in non-payment and/or, at the discretion of the VA, a proration of agreed upon reimbursement based on extent of compliance with contract specifications and timeliness of services rendered.

2.6.2 The Contractor will be responsible for submitting a bill on a monthly basis for services provided to the OB1-

/Tungsten electronic invoice system. The bill for services provided in a month should be received by the Fiscal

Office by the 10th of the following month; however, every month of service completed should be billed no later than 90 days from date of service. Failure to comply with these requirements will result in non-payment.

2.6.3 Billings rendered by the Contractor to the VA for services furnished to a VA beneficiary under the terms of this contract shall be billed in full. Neither the beneficiary, his/her insurer, nor any other third party shall be billed.

2.7 Acceptable Quality Level: Monitoring will be based on procedures established by the VA Pharmacy Service to ensure services are appropriate, complete and satisfactory. The Contracting Officer’s Representative (COR), to be designated upon contract award, will be responsible for monitoring contract compliance and reporting any noncompliance as evidenced by the established monitoring procedures to the Contracting Officer for necessary action. In addition, the COR may designate appropriate VAMC personnel to monitor Contractor employee(s) work hours/services through one or a combination of the following mechanisms:

2.7.1 The COR will be responsible for verifying contract compliance. Any incidents of Contractor non-compliance as evidenced by the monitoring procedures shall be forwarded immediately to the Contracting Officer.

2.7.2 Documentation of services performed shall be reviewed prior to certifying payment. The COR will perform periodic spot checks and document with the using service to ensure monitoring reports. VAMC will pay only for services actually performed and in strict accordance with the schedule of price/costs. Contract monitoring and record keeping procedures shall be sufficient to ensure proper payment and allow audit verification that services were provided.

2.7.3 Contractor’s performance shall be monitored by the COR or his/her designee and reported to the VISN 7 VPE, Pharmacy Chiefs, and vendor. The contract Virtual Pharmacy Services shall be monitored through a variety of mechanisms including:

TASK INDICATOR STANDARD ACCEPTABLE

LEVEL

METHOD OF

SURVEILLANCE

RX

Processing

Process Outpatient

Rx’s in queue in a timely manner

Process Rx’s to extent to keep backlog in queue less than 72 hours

100%

Monthly report of

Rx’s processed by pharmacist

Does not process non-formulary Rx’s without approval

No non-formulary Rx’s processed without approval

95% Review by exception

Drug

Information

Source

Evaluates lab data, drug interactions, adverse drug events, and screens for allergies when processing Rx

Review of appropriate patient safety monitors when processing Rx

99% Review by exception

Med Error reporting

Rx’s will be processed accurately (correct drug, dose, sig, comments copied appropriately, etc.) and errors reported and investigated

99% Review by exception

Customer Provides excellent Will respond to 99% Review by exception

Service customer service to field and site POC inquiries/questions timely (usually within

24 hours)

3.0 CONTRACT OFFICER REPRESENTATIVE (COR)

3.1 The Contracting Officer’s Representative (COR) will serve as the primary technical point of contact for this contract.

The COR is responsible for overseeing contractor performance, ensuring compliance with contract requirements, and verifying that services and deliverables meet the standards outlined in the Statement of Work (SOW).

3.2 The COR’s responsibilities include, but are not limited to, the following:

3.2.1 Monitoring the contractor’s progress and performance.

3.2.2 Providing technical guidance and clarifications regarding contract requirements.

3.2.3 Reviewing and approving invoices and deliverables.

3.2.4 Ensuring project milestones, timelines, and specifications are adhered to.

3.2.5 Communicating any issues or concerns to the Contracting Officer (CO) for resolution.

3.2.6 Ensuring compliance with VA regulations, policies, and information security requirements.

3.3 No Government personnel, other than the Contracting Officer, have the authority to change or alter these requirements. The COR shall clarify technical points or supply relevant technical information, but no requirements in this scope of work may be altered as a sole result of such verbal clarification.

3.4 COR and designees' contact information will be provided upon award. If there are any changes pertaining to the appointed COR, the contractor will be notified by the CO and/or the previous COR.

4.0 INVOICES

Payment will be made upon receipt of a properly prepared, detailed invoice, prepared by the Contractor, validated by the Contracting Officer’s Representative (COR), and submitted electronically through OB-10

(https://portal.tungsten-network.com/).

4.1 A properly prepared invoice will contain:

4.2.1 Invoice Number and Date

4.2.2 Contractor’s Name and Address

4.2.3 Accurate Purchase Order Number

4.2.4 Supply or Service provided

4.2.5 Total Amount Due

4.2.6 CLIN, Description, Unit price, quantity, and CLIN Total

4.3 Invoices shall be submitted and paid monthly, in arrears. Invoices shall be submitted within the 1st week of the month. This will also apply to final invoices following the contract expiration date. Any invoices submitted for https://portal.tungsten-network.com/ supplies and services performed beyond the contract expiration date and/or not covered under the contract will be refused and identified as unauthorized commits (UAC).

5.0 SECURITY REQUIREMENTS FOR CONTRACTOR EMPLOYEES

1. Contractor shall ensure the confidentiality of all patient and employee information and shall be held liable in the event of breach of confidentiality. Any person who knowingly or willingly discloses confidential information from the Veterans Affairs Medical Center may be subject to fines of up to $20,000.00.

2. Records: Contractor personnel who obtain access to hardware or media which may manipulate or store drug or alcohol abuse data, sickle cell anemia treatment records, records or tests or treatment for or infection with HIV, medical quality assurance records, or any other sensitive information protected under 38 U.S.C. 4132 or 3305, as defined by the Department of Veterans Affairs, shall not have access to the records unless absolutely necessary to perform their contractual duties. Any individual who has access to these data will disclose them to no one, including other employees of the Contractor not involved in the performance of the particular contractual duty for which access was obtained. Violation of these statutory-provisions as stated in department regulations by the

Contractor’s employees may involve imposition of criminal penalties.

3. System of Records: The Contractor personnel will have access to The Veterans Administration system(s) of records in order to maintain patient medical records.

4. Procedures for User Access: Access requirements to VA information systems by Contractors and Contractor personnel shall meet or exceed those required for Veteran’s Health Administration (VHA) employees as described in VistA Directives (and others) and in any subsequent VistA policy statements. A written and signed request for user access by VistA Management, or designee(s), constitutes management approval (sponsorship) to initiate a request for access to any sensitive automated information system. Access shall be granted to non-VA users only if the purpose for access meets criteria of the Privacy Act and VA Confidentiality regulations and transfer.

5. Contractor will be required to sign and abide by the VA Computer Access Security Agreement and

Confidentiality Agreement.

6. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS: All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract, the contractor will be responsible for the actions of those individuals they provide to perform work for VA.

Position Sensitivity – The position sensitivity has been designated as a low risk.

Background Investigation – The level of background investigation commensurate with the required level of access is

National Agency Check with Inquiries.

Contractor Responsibilities – The contractor, their personnel, and their subcontractors if applicable shall be subject to the Federal laws, regulations, standards, and VA Directives and handbooks regarding information and information system security as delineated in this contract.

a. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the contractor shall reimburse VA within 30 days.

b. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a

U.S. citizenship and are able to read, write, speak and understand the English language.

c. The contractor shall submit or have their employees submit the following required forms to the VA Office of

Security and Law Enforcement within 30 days of receipt:

(1) Standard Form 85P, Questionnaire for Public Trust Positions

(2) Standard Form 85P-S, Supplemental Questionnaire for Selected Positions

(3) FD 258, U.S. Department of Justice Fingerprint Application Chart

(4) VA Form 0710, Authority for Release of Information Form

(5) Optional Form 306, Declaration for Federal Employment

(6) Optional Form 612, Optional Application for Federal Employment

d. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

e. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

Government Responsibilities

f. Perform a suitability assessment of each contract pharmacist nominated by the contractor to perform under this contract, to include:

(1) Background Investigation and Personnel Security Adjudication Center (PSAC) adjudication completed with a favorable decision

(2) Complete VetPRO enrollment for verification and tracking of professional licensure.

g. Upon successful adjudication, the issuance of a Personal Identity Verification (PIV) card to log into the Citrix

Access Gateway (CAG).

(1) If pharmacist is a moonlighter (i.e., current VA employee outside VISN 7), a PIV will not be issued and account will be granted 2FA exemption

h. Local sites will provide login credentials into the electronic health record environment (e.g., VistA, CPRS, or any future EHR).

Property Damage

The contractor shall take all necessary precautions to prevent damage to any government property. The contractor shall report any damages immediately and shall be assessed current replacement costs for property damaged by the contractor, unless corrective action is taken. Any damaged material (i.e., shelving, pharmacy equipment, etc.) will be replaced in a timely manner or corrected by the contractor with like materials, at no extra cost to the government, upon approval of the Contracting Officer.

Record Retention

Upon completion or termination of the applicable contract(s) or agreement(s), return and/or destroy, at Covered

Entity’s option, VA information gathered, created, received, or processed during the performance of the contract(s) or agreement(s). No data will be retained by Business Associate, or contractor, subcontractor, or other agent of

Business Associate, unless retention is required by law and specifically permitted by Covered Entity. As deemed appropriate by and under the direction of Covered Entity, Business Associate shall provide written assurance that all

VA information has been returned to Covered Entity or destroyed by Business Associate. If immediate return or destruction of all data is not possible, Business Associate shall notify Covered Entity and assure that all VA information retained will be safeguarded to prevent unauthorized Uses or Disclosures.

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive

6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA

Contracting Officer within 30 days of termination of the contract.

Termination of contract Note: If the vendor maintains any records whether hardcopy or electronic, they must be returned to the VA per contract and VA regulations by vendor. All files (hardcopy or electronic) shall not be shared with a 3rd party (unauthorized) unless authorized in writing by the COR or contracting Officer. If any disclosures of

VA records to any 3rd party, an accounting of the disclosure must be kept by the vendor.

Privacy and Security

The contractor will comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and maintain the minimum necessary protected health information data required for the survey process. The contractor will develop and use proprietary patient satisfaction measurement tools, methodologies, and databases to advise and assist health care providers improve the quality of patient care. The VISN 7 Network and pharmacies are each a health care provider and will engage the contractor to assist with health care operations, specifically to provide services to help the medical center with internal quality oversight review, with conducting quality assessment and improvement activities which include evaluating outcomes, and evaluating practitioner and provider performance.

In connection with services to be provided by the contractor, the VISN 7 Network and pharmacies may disclose patient information (as defined below) which the medical centers have obtained or created as part of the patient’s treatment. Under the business relationship between the contractor and the VISN 7 Network and pharmacies, the medical centers will allow the contractor limited access to certain patient information, which is the sole property of the medical centers. The contractor will provide reasonable administrative, technical and physical safeguards to protect the integrity and confidentiality of patient information within its control. The contractor will also prevent reasonably anticipated threats to the security or integrity of such patient information as well as unauthorized uses or disclosures of such patient information, and will secure compliance by its representatives.

Definitions:

“Patient information” means any individually identifiable health information which: (a) contains personal identifying demographic information which would, either alone or in combination with other publicly available information, allow identification of an individual, such as the patient’s name, address, phone number, social security number, or other information; and (b) relates to the past or present physical or mental health or condition of an individual.

“The VISN 7 Network and pharmacies’ information” means patient satisfaction measurement data, analyses and reports created for the medical center by the contractor based on data furnished by the medical center and by medical center’s patients and that is readily identifiable to the medical center as the source of the information.

“Representatives” include directors, officers, employees, accountants, attorneys and other agents.

Restrictions on the use and re-release of patient information: The parties agree that the contractor and its representatives may use patient information (a) to do statistical analyses and create reports to be released only to the

VISN 7 Network and pharmacies. The contractor will not re-release patient information or the VISN 7 Network and pharmacies’ information to any person other than to the VISN 7 Network and pharmacies and to contractor representatives who have a need to know such information for providing services to the VISN 7 Network and pharmacies in accordance with the underlying agreement between the parties, except with the written consent of

The VISN 7 Network and pharmacies. All contractor representatives will be required to sign a non-disclosure agreement as a condition of their employment, a copy of which is available for review upon request by the VISN 7

Network and pharmacies. The vendor will be required to perform background checks on all contractor representatives having access to the VISN 7 Network and pharmacies’ patient information and be able to provide information upon request related as to the information obtained in the background check to the VISN 7 Network and pharmacies.

De-identification of patient information: Within the contractor’s base, any VISN 7 Network and pharmacies’ patient information will be required to be de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient. Data which has been stripped of patient identifying indicators such as patient name and address and incorporated into the contractor’s comparative or benchmark databases shall cease to be patient information creates large comparative or benchmark patient satisfaction databases to help health care providers improve the efficiency and effectiveness of health care delivery. The contractor may include in their database data that has been de-identified and stripped of indicators such that one skilled in administering medical records could not link medical information to a specific patient.

Security Controls Compliance Testing

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

9. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, VA HANDBOOK

6500.6 APPENDIX D relating to access to VA information and information systems;

(2) Successfully complete the appropriate VA privacy training and annually complete required privacy training: VA Privacy and Information Security Awareness and Rules of Behavior -

VA10176 and Privacy and HIPAA Training-VA10203;

(3) The contractor is to log into TMS and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special

Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

6.0 VA INFORMATION AND INFORMATION SYSTEMS SECURITY/PRIVACY LANGUAGE

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any

Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract.

This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer

(CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in

Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor

Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government

Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA

Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security

Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information

Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with

National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and

Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. §

5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the

VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information

Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control

Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive

6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing

VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the

COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access

VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human

Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special

Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National

Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall…