36C24818Q0453-003.docx

STATEMENT OF WORK

Vocera Clinical Systems Service Maintenance

A. GENERAL INFORMATION

1. Title of Project: Vocera Clinical System Service and Maintenance with On-Site System Administrator.

2. Scope of Work: The contractor shall provide Service and Maintenance for existing Vocera Clinical Systems, with Integration of the Early Sense® Clinical Alarm Solutions. Service and Maintenance for Premier Technical Support for Vocera, and Premier Plus Support Services for Vocera Communications and Vocera Engage Solutions with On-Site System Administrator. Hereafter, the deliverables associated and described in this scope of work shall be delineated and distinguished as CLIN 001, CLIN 002 where

(A) CLIN 001 Vocera System Integration with Early Sense® Clinical Alarm Solutions; To be completed during Base Year

(B) CLIN 002 Premier Maintenance and Technical Support for Vocera Communications and Vocera Engage Solutions (Base Year plus four (4) option years)

a. CLIN 001 Services to integrate Early Sense® Clinical Alarm Notification System to the existing Vocera Engage event response solution at James A. Haley VA Medical Center SCI area with approximately60 Beds.

Services implementation service shall include

(1) Project management services

(2) Clinical design services

(3) System configuration and end-to-end testing services

(4) User acceptance testing services

(5) Engage Mobile Readiness Assessment

(6) Super user training services

(7) Go-live support service.

b. CLIN 002 Premier Support Services for Vocera and Engage to include preventive and technical system maintenance; new Vocera releases, service packs, and hot fixes; emergency coverage 24x7, and onsite Administration; and a named support technical engineer among other features.

Vocera Communication and Engage Systems with up to a 700 Enterprise Voice License serving end users. The following six (6) servers shall be supported:

Location of performance will be the Main Campus of the James A. Haley VA Hospital

1. Vocera Application Server Cluster (X 2 server array)

2. Vocera SIP Telephony Server

3. Vocera Staging Server

4. Vocera Report Server

5. Vocera Engage Server.

The Premier Plus On-Site System Administrator hours of availability shall be hours 0730-1600 Monday through Friday excluding federal holidays. The services shall be delivered for one year from the start date for a total of 1,800 hours. In the 52-week period of performance contractor absences shall not exceed 2 consecutive calendar weeks. If extended time off is required under Family Medical Leave Act (FMLA) or other reasons, the contractor shall notify customer and offer temporary or permanent replacement to minimize disruption to the VA operations. Premier Plus Administrator should complete annual Communication and Engage Certification Training provided by Vocera Inc. and other technical certifications required by Vocera, Inc. Required technical competence training hours shall not be included in 1,800 hours of professional on-site administration service time, however annual government training requirements shall be included in 1,800 hours of professional on-site administration service time. The contractor shall provide all supplies, materials, parts, equipment, labor, supervision, management and transportation to perform all tasks as identified below. The VA will provide a desk, telephone, desktop computer and network access for the Premier Plus Administrator. The Contractor shall hold and save the Government, its officers and agents, free and harmless from liability of any nature occasioned by the Contractor’s performance. Working space and space available shall be as determined by the COR.

(C) Background:

Just-in-time communication and proper clinical alarm notification and escalations are vital elements for safe and timely delivery of patient care for our veterans. The Vocera Communications software is used with Vocera hands-free communication badges and integrates into our land-line phone systems. The platform has grown across service sections and now integrates varying clinical solutions. External factors have shifted Office of Information and Technology (OIT) and technical resources. Vocera solutions are in high demand and are expected to scale up to expand facility-wide rapidly.

(D) Work Description:

Services shall provide a comprehensive and systematic delivery of best practices in the use, maintenance, and on-going design support of the Vocera communication and Engage system solutions. Primary deliverables for this award are as follows:

4.1 CLIN 001 Integration with EarlySense®

System planning and implementation services to be rendered by the professional services team and project scope requirements for Early Sense® Integration with Vocera Engage, departments and/or functional groups are outlined below.

a. Project Management and Deployment Planning Services

i. A project manager shall be assigned to this project at the acceptance of the order. The project manager will be responsible for coordinating all scheduling requests for all engagement related activities. All aspects of the Vocera Engage deployment will be communicated to, and agreed upon by, the project manager and facility POC.

ii. The project manager will schedule a project kick-off meeting with the customer to officially initiate the project, review the scope of services to be delivered, introduce team members, set expectations and develop a communication plan.

iii. The implementation team for this project shall consist of three lead members: Project Manager (PM), Implementation Engineer (IE) Clinical Practice Manager (CPM)

b. Clinical Design Workshop Services

i. Clinical Informaticist will conduct a clinical design workshop for each care unit included in the scope of this project.

ii. The Clinical Informaticist will meet with key stakeholders and unit members to define current unit workflows (clinical workflow analysis) and recommend opportunities for improvement leveraging the solution.

iii. The clinical workflow analysis is an onsite evaluation of each unit’s current workflow, including communication and/or alarm systems. It is performed by the clinical practice manager in collaboration with customer’s nursing team. The CPM will round on each of the units deploying the Vocera solution. The unit evaluation will include testing the current system, observing staff performance of various tasks to identify gaps or breaks in communication.

iv. The clinical workflow analysis should be scheduled for up to one hour per nursing unit

v. Government Point of Contact (Contracting Officer Representative COR) (or designee) will serve as clinical escort for each nursing unit during the clinical workflow analysis.

vi. The deliverable from this process will be the clinical design workbook document summarizing the clinical discovery data gathered from the customer team along with the diagrams depicting the enhanced clinical workflows.

c. Installation and Testing

i. Vendor will deliver hardware (if applicable) and software to the James Haley VA. Once in place, the implementation engineer will remotely build the custom configuration based on the governments agreed upon clinical design.

ii. When the configuration is complete, the implementation engineer will coordinate with the customer to test the system remotely and onsite to ensure that appropriate connections are being made and information is flowing correctly to end devices.

d. User Acceptance Testing

i. Vendor will conduct testing with clinical and technical stakeholders for each care unit included in the scope of this project.

ii. Both technical and clinical teams shall participate to verify messages and alarms to phones and to obtain government approval prior to the general deployment.

iii. Clinical User Acceptance Test (CUAT) is planned per nursing unit and will focus on a sampling of patient rooms to be tested rather than all rooms being tested.

iv. All alerts that are chosen by the customer to dispatch through Engage will be demonstrated, providing the alert can be generated by the alarm system used to facilitate alarm generation.

v. Once the system has been verified and approved by the government’s clinical leadership team, Vendor will obtain signed approval of CUAT. Vendor will debrief the hospital team (PM, clinical leadership, system admin) with the final analysis of the CUAT and discussions will focus on any issues/concerns, technical hurdles, validation of the system and next steps. A signed copy of the document will be left with each unit’s clinical leadership representative.

e. Training Services

i. Vendor shall educate a group of super users who shall be in turn responsible for educating the remainder of the staff and assisting with support during go live.

ii. One (1) day-shift end user training shall be included for CLIN 001.

iii. A day shift is defined as a consecutive eight-hour period delivered between the hours 7:00am – 7:00pm, local time Monday thru Friday.

iv. Clinical Practice Manager (CPM) will work with the clinical educator to develop a site-specific training plan and schedule.

v. Classes in accordance with industry practices will be scheduled within an 8-hour shift with scheduled 15 min breaks between classes.

vi. Training shall be coordinated for other project dependencies such as wireless phone and nurse call systems if said systems are new to the nursing staff. If trained separately, nurses should have a good working knowledge of these systems prior to receiving Vocera Engage training.

vii. Vendor will deliver clinical training near the time of the clinical user acceptance test.

viii. Training will primarily be performed onsite.

ix. Vendor will provide electronic training material relevant to workflows and use models being deployed.

f. Go-Live Support

i. The implementation team will work with the hospital project manager to set-up a go-live process to coordinate communications support for the project go-live.

ii. In-person, on-site go-live support for Early Sense® Integration shall be provided by Vendor. Go-live support shall be provided as two (2) eight-hour periods for day-shift and two (2) eight-hour period for evening/night shift.

iii. A day shift is defined as a consecutive eight-hour period delivered between local time 7am - 7pm Monday- Friday. After-hours shift is defined as 7pm to 7am, Monday through Friday and all hours of weekends and holidays.

iv. Go-Live support will primarily be performed onsite.

g. Care Units:

i. The Engage solution for Early Sense® will be deployed for up to 60 beds in up to three (3) care units at James Haley VA Hospital in Tampa Florida.

h. Summary of Integrated Systems

i. Vendor will integrate the following input systems for alert/alarm data with existing Vocera Engage Solutions: Early Sense®

ii. Engage will deliver alerts/alarms to the following wireless device types: Vocera VOIP Devices

i. Deployment Phases

i. The Early Sense® Clinical Alarm Integration professional services shall be completed in a single deployment phase.

4.2 CLIN 002 Premier Maintenance and Technical Support for Vocera

a. Preventative Maintenance (effective upon Kick-off meeting) Preventive maintenance inspection(s) will be performed during regular administrative working hours unless specifically authorized by the Contracting Officer. The Contractor will be required to furnish a complete checklist of items that are to be accomplished under the preventive maintenance service. During this maintenance period, the equipment will be set to manufacturer’s specifications in performance aspects. The Contractor will take corrective action on equipment all defects. This includes software updates and unlimited technical support.

b. Emergency Repair The Contractor shall provide emergency repair service within four (4) hours after notification by the Contracting Officer or the COR during regular administrative working hours. Emergency repair service between preventive maintenance inspections will be performed at no additional charge to the Government. The Contractor shall provide a 24-hour emergency telephone number for repair service. For emergency incidents, there is 24 hour 7 days a week support.

c. Repair Personnel Personnel performing maintenance and repair must be fully qualified, competent Field Service Technicians. “Fully Qualified” is based upon training and on experience in the field. The Contractor shall provide written assurance of the competency of their personnel and a list of credentials of approved Field Service Technicians for each make and model the Contractor services at the VAMC upon request by the Contracting Officer. The Contracting Officer and/or the COTR specifically reserves the right to reject any of the Contractor’s personnel and refuse them permission to work on the VAMC equipment. If subcontractor(s) are used, they must be approved by the Contracting Officer; the Contractor shall submit any proposed change in subcontractor(s) to the Contracting Officer for approval/disapproval. The number of designated support contacts for this contract is 2-5. There will be one designated contact for RMA and one named technical support engineer.

d. Parts This contract includes unlimited parts replacement as required on a new parts basis. Replacement parts include all items except for consumable supplies as listed below. All parts included and installed under this contract shall be factory authorized replacement parts, unless reconditioned or refurbished parts are authorized by the COR and meet manufacturer’s specifications and quality assurance.

e. System Upgrades The Contractor will provide engineering changes to improve reliability and precision as they become available from the manufacturer. Upgrades will be installed and operational on the system within (30) thirty days after notification by the Government or manufacturer.

f. Response Time

i. For an emergency (System is completely down) Vendor will contact End User within 1-hour of receipt of notice of the incident to collect information and work with end user’s designated support contact to attempt to restore usage of the Vocera\Engage \Engage software. Restoration of the software may require changes to the end users hardware or network configuration, and may involve loss of data. If Vendor determines that the system outage is due to an Error in Vocera\Engage software, Vocera\Engage will engage their development staff to attempt to deliver an emergency fix on a mutually agreeable timetable. Contractor will check in with the COR or using service before commencement of work.

ii. For a time-critical issue (Vocera\Engage system is functioning inconsistently and with such limited capabilities that the end user’s usage and productivity are impaired, including periodic work stoppage and feature loss, and no work-around is available) Vendor will contact end user within 4 hours of notice of the incident to collect information and work with end user’s designated support contact to attempt to restore usage of the Vocera\Engage software. Restoration of the software may require changes to the end users hardware or network configuration. Vocera\Engage will engage their development staff to attempt to deliver a fix with the next available service pack.

iii. For a standard issue (Vocera\Engage system is functioning inconsistently and with such limited capabilities that the end user’s usage and productivity are slightly impaired but end user can reasonably work around such inconsistency or impairment. Incidents include “How to” questions and issues impacting individual users. Vendor will contact end user within 24 hours of receipt of the incident to collect information and to work with end user’s designated support contact to verify the problem.

g. Reports Upon completion of the preventive maintenance inspection and/or emergency repair, the Contractor shall submit to the Engineering Service or the COR, a service report indicating what repairs, service, calibration, etc. were performed. This report shall be signed by the using service designee attesting that the equipment is in satisfactory working order and is functioning at an acceptable level of performance. NOTE: If the ticket is not signed and/or submitted, payment may be withheld pending resolution.

h. Items Covered Vocera Premier Support Services for 3-Port VMI Module License Vocera Premier Support Services for 300-User Enterprise License Vocera Premier Support Services for Digital Telephony License Vocera Premier Support for SIP Telephony License 24 ports Vocera Premier Support Services for 400-User Enterprise add-on Licenses Engage, Premier Support, 526 Enterprise Licenses Engage, Premier Support, 2 1u Appliances

i. Premier Plus Administrator (On site Administrator to be on site within 90 days after award)

Premier Plus Administrator shall act as the primary point of contact for James A. Haley VAMC as it relates to Vocera Communication and Engage solutions. Premier Plus Administrators are employees of contractor and deployed under the supervision and direction of contractor, however contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to all relevant local and national governing policies and procedures (ex: VHA Handbook/Directive 7002 Logistics Management Policy and Procedures, local infection control policies, Reusable Medical Equipment (RME) standard operating procedures, codes of conduct, environmental cleanliness, parking, etc.) such is the same for VA and VA personnel. Premier Plus Administrators shall complete all mandatory orientation training as a contractor and be trained and focused on deliverables inclusive of the attributes described below. Premier Plus Administrators shall perform the following tasks:

a. Data & Device Management

i. Establish, update and maintain and optimize processes for submitting data and device changes to Vocera database.

ii. Add/delete/update users, groups and address book entries as requested by using departments.

iii. Export user, group and address book information for review by using departments for accuracy and currency (every 6 months).

iv. Maintain device management data in cooperation with local Logistics Department.

v. Develop, update and maintain and optimize processes for changes in badge ownership, ordering new equipment, troubleshooting equipment, repairing equipment, requesting and processing RMA’s, reporting damage and budget trends, maintaining spares pool, coaching on replacement budget, planning, training users and leadership on device management best practices, scheduling reports, and aiding with finding lost equipment.

vi. Notify designated VA point of contact of suspected lost or stolen equipment.

b. Software Management

i. Apply Vocera service packs and hot fixes.

ii. System health analysis (every 6 months).

c. Deployment Optimization

i. Make rounds no less than monthly on each unit to coach staff, learn workflow, uncover issues, resolve issues and develop relationships.

ii. Refine deployment call flows to improve usability of the Vocera system. Optimize workflow for existing units having deployed Vocera communications solution.

iii. Premier Plus Administrator may provide limited Project Management services for future Vocera expansions and deployments at James A. Haley VA Medical Center at the customer’s request. However, if such activity is expected to compromise other contractor duties described in this scope of work, the contractor shall advise the COR or designee thereof. Customer acknowledges that Project Management duties may compromise or defer remaining Premier Plus deliverables described herein. COR or designee reserves the right to direct Premier Plus Administrator activity according to organizational need and within the scope of this Statement of Work.

iv. Should workflow optimization assistance be required for changes involving units / departments not already designed and implemented when the Vocera Systems Administrator Service begins, this VA reserves the right to amend this contract to accommodate any new Vocera deployments/ expansion for additional Vocera Professional Services engagement.

d. Training and Orientation Management

i. Develop, update, and deliver training for new employee orientation for Vocera users.

ii. Maintain and refine processes for on-boarding of new Vocera users.

iii. Establish process for reviewing Vocera reports to identify and coach users experiencing less than optimal performance.

iv. Maintain training materials and make easily available to staff for self-review and refresher.

v. Maintain at least a 10% Super User population across all units and shifts; providing training to keep the Super User population competent and constant.

vi. Provide training for upgrades and changes in functionality affecting end users.

e. Issue Escalation Management

i. Develop, update and maintain process for end users to report Vocera issues.

ii. Address and resolve issues regarding Vocera equipment, database, and users.

iii. Escalate issues regarding network or servers to the appropriate customer contact.

iv. Escalate issues with the Vocera product to Vocera Technical Support.

v. Track and trend Vocera issues to institute process improvements where possible to reduce issue escalations.

vi. Follow up with issue reporter to provide update status and resolution.

vii. Premier Services Response times shall prevail for system outages and time critical issues.

f. Report Management

i. Set up scheduled reports as requested by end user unit leaders.

ii. Provide consultation to units regarding the reports available.

iii. Review reports and provide consultation to end user units, network staff and other key support staff and stakeholders regarding actions needed to optimize Vocera system and user performance. (Monthly)

iv. End User Satisfaction

v. Per organization’s preference and barring any union or other legal barriers, develop User Satisfaction Survey.

vi. Survey using departments once a year to collect formal feedback and quantifiable measures of satisfaction.

vii. Facilitate user group meetings to discuss issues, lessons learned and process improvements. (Monthly)

viii. Deploy changes to program management as approved by senior level Customer representatives.

g. Engage Server Administration

i. Vocera Engage Server Monitoring

ii. Proactively monitor the Engage server for any issues.

iii. Escalate identified server issues, as appropriate, to Vocera Technical Support.

iv. Refine deployment call flows to improve usability of the Vocera system. Optimize workflow for existing units having deployed Vocera communications solution.

v. Should workflow optimization assistance be required for changes involving units / departments not already designed and implemented when the Systems Administrator Service begins, this VA reserves the right to amend this contract to accommodate any new deployments/ expansion for additional Professional Services engagement.

h. Engage Deployment Optimization

i. Provide guidance to JAH as relates to the Engage workflow improvement.

ii. Integration workflow optimization for existing units and departments having deployed Vocera Engage solution and those areas pending integration in accordance with Extension Healthcare Memorandum of Understanding Letter of Intent dated 09-12-2016 for Engage solution deployment at James A Haley of Nurse Call, STAT and PRN Effectiveness workflows.

iii. Should workflow optimization assistance be required for changes involving units / departments not already designed and implemented when the Systems Administrator Service begins, this VA reserves the right to amend this contract to accommodate any new deployments/ expansion for additional Professional Services for Vocera Engage.

i. Engage Training and Orientation Management

i. Develop and deliver training for new employee orientation for Vocera Staff Assignment, Alarm-to-Device, and Electronic Health Record-to-Device users.

ii. Maintain training materials and make easily available to staff for self-review and refresher.

iii. Provide upgrade training for changes in functionality affecting end users.

j. Engage Issue Escalation Management

i. Develop process for end users to report Vocera Engage issues and concerns.

ii. Respond to end-user issue/concerns via email or voice communication within 1-2 business days.

iii. Manage escalated Engage issues with Vocera Technical Support.

iv. Track and trend Vocera issues to institute process improvements where possible to reduce issues escalations.

v. Follow up with issue reporter to provide update status and resolution.

vi. Premier Services Response times shall prevail for system outages and time critical issues.

(E) Performance Period: CLIN 001 The period of performance shall not exceed 2 months. Work at the government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). CLIN 002/CLIN 003The period of performance is 1-year. Work at the government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

(F) Warranty and Support: CLIN 002/CLIN 003 Support and Warranty of the Service will be provided for one (1) year upon receipt and acceptance of contract. James Haley designee must sign off on acceptance before the warranty cycle begins.

(G) Service reports shall be sent to all appropriate points of contact with quarterly aggregate reports.

VA Engineering and OI&T will have full access to the hardware and software that constitute the system, including any diagnostic software features and general administration rights. The VA Engineering and Technical designee must be briefed, by the vendor, on all software upgrades and changes, and agree to each prior to installation. The vendor shall provide and install manufacturer recommended software upgrades and changes at no additional charge during warranty/contract period.

(H) Operations and Storage Areas: The Contractor shall confine all operations on Government premises to areas authorized and approved by the Contracting Officer. The Contractor shall hold and save the Government, its officers and agents, free and harmless from liability of any nature occasioned by the Contractor's performance. Working space and space available shall be as determined by the COR. Contractors are subject to rules of the Medical Center applicable to their conduct. All personal automobiles shall be parked in designated parking areas or offsite of the VA premises. Execute work so as to interfere as little as possible with normal functioning of the Medical Center as a whole, including operations of utility services, fire protection systems and any existing equipment, with work being done by others. Do not store materials and equipment in other than the designated contractor storage areas.

(I) Type of Contract: Firm-Fixed-Price

B. CONTRACT AWARD MEETING

The contractor shall not commence performance on the tasks in this SOW until the CO has conducted a kick off meeting or has advised the contractor that a kick off meeting is waived.

C. SCHEDULE FOR DELIVERABLES

CLIN 003 The contractor shall provide day to day support (via email and phone) during business hours as identified in paragraph A.2. If for any reason any deliverable cannot be met, the contractor is required to explain why (include the original deliverable due date) in writing to the COR and CO, including a firm commitment of when the work shall be completed. This notice to the CO shall cite the reasons for the delay, and the impact on the overall project. The CO will then review the facts and issue a response in accordance with applicable regulations.

D. CHANGES TO STATEMENT OF WORK

Any changes to this SOW shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor.

E. REPORTING REQUIREMENTS

1. CLIN 003 The contractor shall provide the COR or designee with monthly written progress reports. These are due to the COR or designee by the end of each month throughout the period of performance.

2. CLIN 003 The progress report will cover all work completed during the preceding month and will present the work to be accomplished during the subsequent month. This report will also identify any problems that arose and a statement explaining how the problem was resolved. This report will also identify any problems that have arisen but have not been completely resolved with an explanation.

F. TRAVEL

CLIN 001, CLIN 002, CLIN 003 Travel expenses incurred by contractor to and from James Haley VA to complete the work outlined in this SOW shall be borne by the contractor. Anticipated travel and per diem expenses shall be included in the “firm fixed price” and accepted by JAHVA. Travel and per diem shall be reimbursed in accordance with VA/Federal Travel Regulations

G. BILLING AND INVOICE PAYMENTS

In accordance to contract terms.

H. GOVERNMENT RESPONSIBILITIES

1. CLIN 001 the government shall:

a. Provide a single point of contact to manage the project implementation, obtain resources, schedule government personnel, and review and approve project deliverables.

b. Schedule all government personnel as necessary for implementation activities, and review and approve project deliverables.

c. Ensure that all necessary government IT and clinical personnel as identified by Vendor are available at mutually agreed upon times and dates and for the duration of the project.

d. Ensure that all necessary government IT and clinical personnel as identified by Vendor review and sign off on deliverables. Any changes to deliverables after sign off will be handled through a change order process. Change Order request may be initiated by either the Government or by Vendor.

e. Schedule all on-site services between the hours 12pm - 7pm, local time Monday, 7am - 7pm Tuesday through Thursday, and 7am - 12pm Friday. The government acknowledges Vendor has a 20% premium for services delivered outside of these hours. Vendor training services are performed in 8-hour “days”.

f. Assign technical resources that have access and adequate permissions on the Vocera servers and configuration computers.

g. Provide remote access via VPN (site-to-site or government-based) for remote configuration, testing and support with full security access for Implementation Engineer to the Engage server as necessary to complete this statement of work.

h. Changes in functionality or any of the project deliverables requested by the customer will require a Change Order

i. Coordinate and make available all 3rd party implementation resources necessary to deliver project.

j. Provide access to all locations required for system installation, configuration and training.

k. All work, except for user acceptance testing (UAT), training, and go-live support may be provided remotely. Additional on-site visits may be requested by the customer for an additional cost.

l. Work with Vendor to establish goals and priority with 3rd party vendor(s) for data interface integration

m. Unless otherwise noted in this document, escalation protocols for alert/alarm notifications will be built in the Engage solution. Up to 10 different alarm types from each integrated input system are included with the quoted professional services.

n. Ensure all integrated systems and devices that impact the Engage platform should be live and stable for a minimum of 30 days prior to going live with the Engage platform.

o. Ensure government wireless network will provide adequate coverage to facilitate the reliable delivery of life critical alerts and alarms.

p. Ensure wi-Fi-only smartphones have a validated VoIP dialer such as Cisco Jabber, Zebra Workforce Connect, or the device’s native SIP dialer be used for voice functionality with the Engage platform.

2. CLIN 002 the government shall:

a. Provide a single point of contact to manage annual preventative maintenance, obtain resources, schedule government personnel, and review and approve engagement deliverables.

b. Assign technical resources that have access and adequate permissions on the Vocera servers and configuration computers.

c. Provide remote access via VPN (site-to-site or government-based) for remote configuration, testing and support. Provide Implementation Engineer full security access to the Engage server as necessary to complete this statement of work.

d. Provide space for vendors to complete on-site work located at James Haley VA Hospital, 13000 Bruce B Downs Blvd, Tampa, FL, 33612.

e. Provide a knowledgeable JAH employed point of contact for the Premier Plus Administrator to aid with the processing of the James A. Haley VA Hospital security paperwork and IT systems access.

f. Provide a single point of contact to manage the on-site set-up and annual preventative maintenance, obtain resources, schedule government personnel, and review and approve engagement deliverables.

g. The Government shall provide a desk, telephone, desktop computer, network access, lockable storage area to store Vocera inventory.

h. The Government shall provide access to the Vocera servers, access to James Haley policy and procedure information, and security access to all implemented areas/floors with a few exceptions (narcotics areas, medication rooms, etc.).

i. A Government email account will be provided. A knowledgeable James Haley employed point of contact will ensure Premier Plus Administrator has access/introduction to clinical engineering, infection control, telecom, applications and network staff as well as key clinical stakeholders.

j. This point of contact shall serve to facilitate relationship with clinicians and access to clinical flows.

k. Government shall require new users attend training session as mandatory.

l. Provide timely information regarding employee additions, changes and removals to support effective administration of the Vocera database.

m. Provide organizational security standards regarding the number of days inactive accounts are allowed.

n. Provide a Vocera badge configuration computer with a dedicated access point and access to it.

o. Provide access to a high-quality color printing for training materials.

p. Ensure the access points, network infrastructure, hardware and systems software support the requirements for the Vocera Communications System.

I. CONTRACTOR EXPERIENCE REQUIREMENTS – KEY PERSONNEL

CLIN 002 Skilled experienced professional and/or technical personnel are essential for successful contractor accomplishment of the work to be performed under this contract and subsequent task orders and option. These are defined as key personnel and are those persons whose resume’s and names are submitted as on-Site Administrator. The contractor agrees that the key personnel shall not be removed, diverted, or replaced from work without approval of the CO and COR.

CLIN 002 Any personnel the contractor offers as substitutes shall have the ability and qualifications equal to or better than the key personnel being replaced. Requests to substitute personnel shall be approved by the COR and the CO. All requests for approval of substitutions in personnel shall be submitted to the COR and the CO within 30 calendar days prior to making any change in key personnel. The request shall be written and provide a detailed explanation of the circumstances necessitating the proposed substitution. The contractor shall submit a complete resume for the proposed substitute, any changes to the rate specified in the order (as applicable) and any other information requested by the CO needed to approve or disapprove the proposed substitution. The CO will evaluate such requests and promptly notify the contractor of approval or disapproval thereof in writing.

J. CONFIDENTIALITY AND NONDISCLOSURE

CLIN 001, CLIN 002, it is agreed that:

1. The preliminary and final deliverables, and all associated working papers, application source code, and other material deemed relevant by VA which have been generated by the contractor in the performance of this task order, are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the contract.

2. The CO will be the sole authorized official to release, verbally or in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this requirement. No information shall be released by the contractor. Any request for information relating to this requirement, presented to the contractor, shall be submitted to the CO for response.

3. Press releases, marketing material, or any other printed or electronic documentation related to this requirement, shall not be publicized without the written approval of the CO.

K. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

1. CLIN 001, CLIN 002, Contractor Responsibilities

a. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship, and are able to read, write, speak and understand the English language.

b. Vendor personnel assigned to this project to be credentialed by one of the following credentialing agencies: RepTrax, Symplr, or Vendormate.

2. CLIN 002, Contractor Responsibilities

a. Background investigations from investigating agencies other than OPM are permitted if the agencies possess an OPM and Defense Security Service certification. The Vendor Cage Code number must be provided to the Security and Investigations Center (07C), which will verify the information and advise the contracting officer whether access to the computer systems can be authorized.

b. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship, and are able to read, write, speak and understand the English language.

c. The contractor shall submit or have their employees submit the required forms (SF 86 or SF 85P, SF 85P-S, FD 258, Contractor Fingerprint Chart, VA Form 0710, Authority for Release of Information Form, and Optional Forms 306 and 612) to the VA Office of Security and Law Enforcement within 30 days of receipt.

d. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the affected employee from working under the contract.

e. Failure to comply with contractor personnel security requirements may result in termination of the contract for default.

3. CLIN 001, CLIN 002, Government Responsibilities

a. The VA Office of Security and Law Enforcement will provide the necessary forms to the contractor, or to the contractor’s employees, after receiving a list of names and addresses.

b. Upon receipt, the VA Office of Security and Law Enforcement will review completed forms for accuracy, and forward the forms to the office of Personnel Management (OPM) to conduct background investigations.

c. The VA Office of Security and Law Enforcement will notify the CO, and contractor, of adjudication results received from OMB.

d. Upon being notified about a favorable determination, the CO may issue a notice to proceed to the contractor.

L. VA INFORMATION CUSTODIAL LANGUAGE

1. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

3. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

4. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

M. SECURITY REQUIREMENTS

CLIN 002 All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (07C) prior to contract performance. This requirement is applicable to subcontractor personnel requiring the same access. If the security clearance investigation is not completed prior to the start date of the contract, the employee may work on the contract while the security clearance is being processed, but the contractor will be responsible for the actions of those individuals they provide to perform work for the VA.

1. Position Sensitivity The position sensitivity for this effort has been designated as moderate risk.

2. Background Investigation The level of background investigation commensurate with the required level of access is Background Investigation (NACI).

3. Information System Security

The contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard contract language, conditions laws, and regulations. The contractor’s firewall and web server shall meet or exceed the government minimum requirements for security. All government data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA project manager and VA Information Security Officer as soon as possible. The contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation.

4. Security Training

All contractor employees and subcontractors under this contract or order are required to complete the VA's on-line Security Awareness Training Course and the Privacy Awareness Training Course annually. The Privacy Awareness Training requirement may be fulfilled under additional privacy awareness training options, based on the prerogative of the Contracting Officer, pending assigned VA duties of the contractor employees and subcontractors under this contract. Contractors must provide signed certifications of completion to the CO during each year of the contract. This requirement is in addition to any other training that may be required of the contractor and subcontractor(s).

N. SECURITY INCIDENT INVETSTIGATION:

1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

2. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

3. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

4. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

O. LIQUIDATED DAMAGES FOR DATA BREACH:

1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

2. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

P. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

Q. TRAINING (PRIVACY/SECURITY)

1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training before being granted access to VA information and its systems.

a. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior before being granted access to VA information and its systems.

2. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

3. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

4. The Certification and Accreditation (C&A) requirements do not apply and a Security Accreditation Package is not required for this SOW.

R. RECORDS MANAGEMENT

The following standard items relate to records generated in executing the contract and should be included in a typical Electronic Information Systems (EIS) procurement contract:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply…