36C24819Q0397-003.pdf

Attachment - Contractor Personnel Security Supplement – Suitability Assessment

(1) Contractor Personnel Security Requirement: All persons performing under this contract who require physical or logical access to the Department of Veterans Affairs computer systems, Protected/Patient Health Information (PHI) or VA Protected Information (VAPI) shall be the subject of a suitability determination and shall have received a favorable adjudication from the VA Office of Security and Law Enforcement (OS&LE) prior to performing under the contract. This requirement is applicable to all subcontractor personnel requiring logical or physical access. The required investigation(s) shall be initiated prior to contract performance. If the investigation has not been completed prior to the start date of the contract, the contractor is responsible for the actions of the individuals whom the Contractor provides. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default or cause.

(2) Contractor Responsibilities

Upon receipt of all required documentation, the VA will initiate the required investigation(s).

The contractor bears the costs of the personnel suitability determination irrespective of outcome of the adjudication. The contractor shall reimburse the VA facility within 30 days of the initiation of any suitability determination at the following rates. A Bill of Collection may be issued if the contractor does not timely remit the fee.

Note: All rates and fees are subject to change without notice.

Low Risk (NACI) - $243 – The case is only open for 30 days except in rare occasions when something in the person’s background requires an extension.

This investigation is done by mail therefore the paper documentation is stringent.

The average turn around on these cases is 45 days.

Moderate Risk (MBI) - $866 – The case has no set amount of time and is done by an actual investigator. They may be completed in 45 days or take as long as six months depending on the background of the subject.

High Risk (BI) - $3,638 – The case has no set amount of time and is done by an actual investigator. They may be completed in 60 days and take as long as a year depending on the background of the subject. The year time frame is rare.

PERIOD REINVESTIGATION: - $1,115

Note: There may be a cost to the contractor for fingerprinting that is not foreseeable. Contractors can be fingerprinted at their local VA if they are close enough, or they may have to go to the local police department or sheriff’s office. If they choose to use the fingerprint cards, the contractor can only use the FD 258, which they can request from the Security Investigation Center (SIC). Fingerprint cards are not mailed unless a request is directed by the contractor to SIC.

(3) Investigation initiation, completion and adjudication:

1. The Contracting Officer initiates the Suitability determination by opening a case with the Security and Investigations Center (SIC).

2. The results of the required employee investigations will be forwarded to the VA, Office of Security and Law Enforcement (OS&LE) for adjudication. Investigation conducted by the VA, through OPM will be forwarded to OS&LE.

3. The VA Office of Security and Law Enforcement will notify both the contracting officer and contractor after adjudicating the results of the background investigations.

4. Unfavorable investigation results:

The Contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee performing under this contract.

(4) Process:

The Contracting Officer will set forth in the RFQ/RFP the position sensitivity of the labor categories in the contract.

(a) Position Sensitivity: Example position sensitivities are as follows:

All Medical Records Technicians (Transcriptionist, Typist, Word Processor) Low Risk All Physicians: Low Risk Business Manager Moderate Risk Administrative Manager Moderate Risk All IT (Information Technology) High Risk

Other:

The lowest sensitivity applied to any person having access to PHI or VAPI is:

Low Risk

[THESE CATEGORIES ARE SAMPLES ONLY. ALL POSITIONS ARE

SUBJECT TO CLASSIFICATION BY THE REQUIRING SERVICE,

CONCURRENCE OF THE INFORMATION SECURITY OFFICER (ISO)

PRIVACY OFFICER AND CONTRACTING OFFICER.]

The Contractor shall utilize the best practices and guidance available at the VA Law Enforcement Training Center/Security Investigations Center (LETC/SIC), at:

http://www1.va.gov/VABackground_Investigations/ or http://www1.va.gov/VABackground_Investigations/indextext.cfm http://www1.va.gov/VABackground_Investigations/ http://www1.va.gov/VABackground_Investigations/indextext.cfm

At the direction of Security Investigations Center (SIC) paper forms have been superseded by Electronic Questionnaires for Investigations Processing (e-QIP) or any other method.

NOTE THAT EFFECTIVE DECEMBER, 2010, THE SECURITY

INVESTIGATIONS CENTER HAS IMPLEMENTED E-QIP. THEREFORE, THE

PRECEEDING STEP SHALL BE ACCOMPLISHED ELECTRONICALLY AND

NO FORMS WILL BE ISSUED. ALL CONTRACTOR PERSONNEL MUST

SUBMIT AN INDIVIDUAL EMAIL ADDRESS.

(d) Contractor Responsibilities

Upon award of a contract, The contractor shall initiate the proper level of pre-screening for contractor employees, agents or independent contractors who are to perform under this contract.

The Contractor shall submit to the Contracting Officer a Roster of Personnel and Medical Practitioner Sheet (see Attachment – Roster of Personnel and Medical Practitioners) for each person nominated to perform under this contract. This Roster is to be continuously maintained by the contractor and is submitted on demand of the Contracting Officer, COTR or ISO.

On the basis of the information in the Roster the Contracting Officer opens a case for adjudication .

Contractor personnel, within seven (7) days of the opening of the case (VA LETC Worksheet), shall submit to VA LETC at the address below the (1) forms that SIC requires:

VA Law Enforcement Training Center/SIC 2200 Fort Roots Drive, Bldg. 104/Contractor North Little Rock, AR 72114

The Security Investigations Center (SIC), may in its discretion, based on the content, accuracy and completeness of the information, advise the Contracting Officer and ISO that interim access may be granted.

The Contracting Officer and ISO, pending final favorable adjudication, may grant interim access to the person.

OPM and LETC adjudicate the case and issue a final determination. The person requesting access will be issued the results of the final adjudication.

The Contractor will be notified of the result of the adjudication.

(f) Government Responsibilities

1. The VA Office of Security and Law Enforcement/SIC will provide the necessary electronic e-QIP access to the contractor or to the contractor's employees after receiving a list of names and addresses.

2. Upon receipt, the VA Office of Security and Law Enforcement/SIC will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation.

3. The VA Office of Security and Law Enforcement/SIC will notify the contracting officer and contractor after adjudicating the results of the background investigations received from OPM.

(g) The cost of suitability determinations is borne by the contractor and the costs of are borne by the contractor irrespective of the outcome of the adjudication. In the case of a subject who does not prosecute an application, abandons it or does not see it to conclusion, there is no credit, refund or offset. During the time required to conduct the appropriate investigation, the contractor will be responsible for the actions of its employees until official notification of a favorable determination is received from the Office of Security and Law Enforcement

(h) Unfavorable adjudication or any interim or preliminary finding pending an adjudication which in the judgment of the Contracting Officer, COTR, OPM, or LETC that is sufficient to rescind any interim or preliminary grant of access shall result in the immediate removal of the person from performance under this contract.

(i) Failure to comply with the contractor personnel security requirements may result in termination of the contract for cause or default.

(j) The Contractor shall provide the following information for all staff working under this contract prior to their beginning work on this contract and prior to any new staff starting work on this contract. Once a year all persons shall sign an electronic security statement in VISTA or LMS, or as prescribed by the ISO shall and take Annual VHA Privacy and Annual VHA Cyber Security Training. Failure to comply shall result in the termination of the employee logical or physical access to VISTA.

i. Automated Information System (AIS) Security Statement

ii. Background checks

iii. Privacy Training Certificate

iv. Rules of Behavior (signed)

v. Computer Access and Confidentiality Statement

vi. Cyber Security Training Certificate

The COTR or ISO may direct that the training be completed and documented via Learning Management System (LMS) or in any manner prescribed.