36C24822Q0172.docx

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

36C24822Q0172 11-19-2021 Joseph Boudreau 407-646-4287 11-29-2021 11:00 am

EST

36C248 Department of Veterans Affairs Network Contracting Office 8 (NCO 8) Orlando VA Healthcare System 13800 Veterans Way Orlando

FL

32827 X X 518210 $35 Million N/A X Department of Veterans Affairs Orlando VA Healthcare System 13800 Veterans Way Orlando

Fl

32827 00675 Department of Veterans Affairs Network Contracting Activity 8 (NCO 8) Orlando VA Medical Center 13800 Veterans Way Orlando

FL

32827

Department of Veterans Affairs Financial Services Center P.O. Box 149971 Austin

TX

78714-9971 See CONTINUATION Page See CONTINUATION Page X X Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C248 Joseph Boudreau Department of Veterans Affairs Network Contracting Office 8 (NCO 8) Orlando VA Healthcare System 13800 Veterans Way Orlando FL 32827

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs Financial Services Center

P.O. Box 149971 Austin TX 78714-9971 ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

Performance Work Statement (PWS) Tumor Registrar services Orlando VA medical Center, 13800 Veterans Way, Orlando, FL 32727

The Contractor shall provide all necessary staffing and resources needed to properly maintain Orlando VA Healthcare System Cancer Registry database in accordance with 100% of the current American College of Surgeons Commission on Cancer Registry standards and Veterans Health Administration (VHA) Cancer Registry requirements. The Contractor shall have current experience managing an accredited Cancer Registry program within the last twelve months and have recent experience as a consultant with the American College of Surgeons (ACOS) Commission on Cancer (CoC). The duties and responsibilities of the Contractor shall include:

a. Case finding – The Contractor shall electronically screen and accept all reportable cases into the Cancer Registry database IAW standard setter rules, shall flag all cases as “suspense” with demographics and ensure cases are primary site coded, include date 1st contact, preliminary diagnosis date, histology, date last contact, case finding source, and preliminary class of case. Responsible for monthly review of disease indices, pathology reports, radiology reports, treatment logs, and other computerized methods to identify reportable cancer cases. Responsible to curate, document and interpret information from patient records regarding treatment provided to an estimated 300 - 400 new cancer patients annually using the VHA approved Cancer Registry database software. The cancer patient’s medical record is reviewed and abstracted on an ongoing basis in compliance with the industry standards of the North American Association of Central Cancer Registries (NAACCR), National Cancer Institute Surveillance, Epidemiology and End Results Program (SEER), World Health Organization International Classification of Diseases for Oncology (ICDC), American Joint Commission on Cancer (AJCC) Staging Manual Criteria, VA Central Cancer Registry (VACCR) Reportable List, American College of Surgeons / Commission on Cancer (ACOS / CoC), and the Florida State Cancer Registry (FCR). The contractor will be an experienced Certified Tumor Registrar (CTR), and produce proof of current credential status, to provide case ascertainment and abstracting services. Cases must be ascertained and accessioned within 90 days of first contact or diagnosis ; existing backlog will be systematically addressed once current standards are met.

b. Rejected Non-reportable Case – The Contractor shall delete those cases in the database that need to be purged because the case does not meet the requirements for a reportable case and provide documentation why case was found to not be reportable. Contractor will provide a non-reportable list at each billing cycle.

c. Case Abstracting and Coding – Abstracting is defined as coding and entering patient and disease specific information into the VHA approved Cancer Registry database software or other databases as identified within this statement of work, e.g. the Rapid Cancer Reporting System (RCRS) if CoC accredited. The Contractor shall utilize approved codes as indicated, i.e. ICD-O, ICD-9-CM, ICD-10-CM, etc. as appropriate. The Contractor shall abstract reportable conditions as indicated by the current VA reportable list with minimum 90% accuracy. Contractor shall ensure that all CoC requirements/standards for timely submission, data quality and completeness are met. The Contractor shall ensure that all cases are cleared (within pre-established timeframes) in terms of passing all edits required by the VA Central Cancer Registry or by the CoC e.g. .National Cancer Database edits as applicable, Gen-edits Program edits, etc. Responsible to curate and interpret information from patient records regarding work up and treatment provided to cancer patients annually using the approved Veterans Administration (VA) cancer registry database software program. The cancer patient’s medical record is reviewed and abstracted in compliance with the industry standards of NAACCR, National Cancer Institute SEER, World Health Organization International Classification of Diseases for Oncology (ICDC), American Joint Commission on Cancer (AJCC) Staging Manual Criteria, VA Central Cancer Registry (VACCR) Reportable List, CoC, VHA Directive and the Florida Cancer Registry. Cases must be abstracted within 4-6 months of the cancer diagnosis or date of first contact once facility backlog is up to date.

d. Follow-up – The Contractor shall complete data entry to include all required CoC and all VA specifics fields for surveillance, including but not limited to text substantiating last cancer status, recurrence, subsequent treatment, new primary cancers, and required death information fields. Data quality edits derived at surveillance intervals must be cleared and set case to complete status when applicable. Responsible for tracking the care all patients received in the years following their cancer diagnosis at the Orlando VA Healthcare System, and at other health care institutions. Contractor shall provide follow-up services as described above and in the CoC current standards manual edition. Contractor shall provide follow-up of living cancer patients in compliance with accepted industry standards, posting information on recurrence, subsequent therapy, date of last contact, vital status, cancer status, any comments supporting the findings. Follow-up shall be maintained at a minimum of 90% on all analytic patients from last 5 years and 80% of patients in the registry data base to the facility reference date. This is required to use registry data for survival (outcome) analysis. Cases are delinquent (lost) if the follow-up interval exceeds 15 months. Contractor shall provide a list of patients (facility ACCN number) completed follow-up along with monthly invoice.

e. Consult Hours: The Contractor shall provide Consult Hours that shall include time spent working with Health Information Managers, the Cancer Committee and the Cancer Program/Hospital Administrator in preparation or to maintain CoC accreditation standards. Consult hours shall also include ensuring that all current ACOS and related Cancer Registry standards pertaining to the Orlando VA Healthcare System Cancer Registry are met, that all data entered into the Cancer Registry is greater than 90% accurate and that all pre-established timeframes related to the Cancer Registry are met. Consult hours shall also include producing reports as requested, ensuring that the VA Cancer Registry Policy and Procedure Manual meets the Commission on Cancer Standards and is up to date, and assisting and advising all Cancer Program staff and related staff with Commission on Cancer survey readiness and preparation. Consult hours shall also include preparation of data for transmission to the VA CCR Office and any other entity as required by the VA or American College of Surgeons. The contractor will provide consultative services both by telephone, virtual conferencing platforms and on site to assist in the Commission on Cancer approval process as indicated.

f. Central Cancer Registry Database Submissions: The Contractor shall conform to all CoC requirements relating to the National Cancer Database (NCDB) if facility is CoC accredited and VHA Directives, including but not limited to, timely and accurate case ascertainment and suspense submissions, timely accurate case completion rates, correcting edits, and monitoring CoC webinars and newsletters to ensure compliance with all Cancer Registry updated reporting rules, and related deadlines, etc. Cancer Registry data submitted by the Contractor to the state central registry and VACCR shall meet the established quality criteria 100% of the time, as outlined by CoC, Florida State and the VA Cancer Registry policy.

g. Cancer Staging QA – At the time of case finding and/or case completion, the Contractor shall send an email to the attending physicians confirming the completion of the current edition staging form required by the American Joint Commission on Cancer. The Contractor shall carbon copy the Chief and Assistant Chief, Health Information management on all email messages sent from the Contractor to VA staff. Contractor will query key providers on the cancer care team for staging inconsistencies or clarification for QA purposes.

i. Quality Assurance Surveillance Plan (QASP) – The contractor will provide quality work, timely and complete work, and accuracy as evidenced by meeting Commission on Cancer, National Cancer Data Base, Florida Cancer Registry, National Cancer Registrars Association (NCRA), and VA Central Cancer Registry standards and requirements. Contractor shall perform a 100% quality assurance review on all newly abstracted cases for compliance noting any deficiencies or non-deficiencies. A list shall be forwarded to the COTR via e-mail monthly noting any deficiencies or non-deficiencies at least once monthly preferably with monthly invoices. List will include accn number, date accessioned, date 1st contact and date completed vs accn number and date last contact for f/u only cases.

The Contractor will Institute a Cancer Registry Quality Assurance Surveillance Plan/Program to evaluate the quality of 100% of their staff’s Cancer Registry data and 100% of their staff’s Cancer Registry activities done on behalf of the Orlando VA Healthcare System. The Contractors’ quality assurance plan does the following:

1. Sets the review criteria

2. Sets the quality control timetable

3. Specifies the quality control methods, sources, and individuals involved »» Required activities •• Random sampling of annual analytic caseload

Identifies the activities to be evaluated:

QASP required activities »» Case finding »» Abstracting timeliness »» Accuracy of abstracted data •• Class of Case •• Primary Site •• Histology •• AJCC Stage •• Site Specific Disease Indicators (SSSDIs) •• First Course of Treatment •• Follow-up information, including Date of First Recurrence, Type of First Recurrence, and Cancer Status »» The percentage of information coded as unknown (usually coded as 9 or a string of 9s) »» Cancer Registry data submitted to the VACCR and state meet the established quality criteria for case load stability, timeliness, case completion rates, and data quality.

**All other standards as outlined in the most current edition of the ACOS Commission on Cancer manual are met or exceeded.

Contractor monitoring must be conducted at least once monthly and the Contractor will send their Quality Assurance Surveillance Plan (QASP) report findings to the COTR and Cancer Program Administrator monthly, at a minimum. The QASP should also include your process for conducting monthly random case finding audits and include a sample of the audit findings to demonstrate that all eligible analytical cases were reviewed and processed; Contractor will send report findings back to the facility’s COTR and Cancer Program Administrator monthly and/or upon request. In addition, the QASP will include monthly abstracting quality control audit checks on 100% of cases abstracted by your staff to ensure that abstracts are 100% edit free prior to invoicing. The QASP will reflect your process for error corrections for all tasks performed by the Contractors’ staff and all tasks as required by the American College of Surgeons-Commission on Cancer for full accreditation; all errors identified either by you or by the facility’s COTR or by the facility’s Certified Tumor Registrar or any representative of the Orlando VA Healthcare System will be will be corrected by the Contractor within one working day. The Contractor monitors each area of Cancer Registry activity, ensures that all duties performed e.g. case finding, accessioning, follow up, edit corrections, data submissions, abstracting, etc. (i.e. all Cancer Registry tasks required by the American College of Surgeons- Commission on Cancer) are performed by a current Certified Tumor Registrar with validated credentials. The Contractor provides written reports upon request and at least once monthly to the COTR and Cancer Program Administrator and takes corrective action on any area(s) that falls below the measures specified in the QASP (the QASP must be submitted with the Contractors’ proposal for approval prior to award of contract). The Contractor’s Cancer Registry Quality Assurance Surveillance Plan ensures that:

· 100% of cases are abstracted within 4 - 6 months of the patient’s first contact with the program. (

· 80% follow-up rate is maintained on all patients from the Cancer Registry reference date.

· 90% follow-up rate is maintained on all patients diagnosed within the last 5 years.

· complete error free data is properly submitted annually (or as required by the NCDB) for the National Cancer Database (NCDB) call for data.

· Submits data to the VA, FCR, Cancer Committee and to the VA Central Cancer Registry upon request prior to or within deadlines.

· Data re-submitted, e.g. to the NCDB and to all other requestors, e.g. VA Central Cancer Registry on cases diagnosed on or after the Cancer Registry reference date meet the quality criteria and resubmission deadline specified in the VA Central Registry or the Florida State Cancer Registry.

· Monthly, reviews the quality of Cancer Registry abstracting through of 100% of the annual analytic caseload. The plan identifies the activities to be evaluated and sets the benchmarks for required accuracy to meet all ACOS cancer program standards; the review of all pathology/radiology/Computerized Patient record System (CPRS) and Vista Imaging reports is included in the plan.

I. Education/CTR Certification: The contractor will show proof that those providing abstracting services are Certified Tumor Registrars through the National Cancer Registrars Association with current credential (validation cycle certificate).. Contractor shall verify its personnel’s’ current certification status with the National Cancer Registrars Association and shall provide evidence of certification along with their proposal submission. Ongoing cancer-related education enhances knowledge and skills; monthly continuing education will be provided to support efforts to maintain high quality data through training certified by NCRA (e.g. training conducted by NAACCR, SEER, NCRA etc).

•• Hold a current Certified Tumor Registrar (CTR) credential. The CTR credential is granted through the National Cancer Registrars Association, which provides details on eligibility, testing, and recredentialing. High-quality Cancer Registry data are essential to accurately access treatment outcomes and patient survival. Successful operation of the Cancer Registry requires credentialed staff that is trained and knowledgeable in all aspects of oncology data collection and case abstracting. Abstracting is defined as coding and entering patient- and disease specific information into the Cancer Registry data base. Certified Tumor Registrars apply knowledge obtained from formal education and work experience to correctly interpret and code cancer diagnosis, stage, treatment, and outcomes information for each case that is seen at the Orlando VA Healthcare System that meets CoC reporting requirements.

The case abstracting responsibilities of the CTR are documented by the Contractor.

During the on-site visit, upon Contract award and upon request, the Contractor provides the following:

•• Confirmation of a valid CTR credential for all certified staff working on this contract.

•• Verification of the date of hire to perform case abstracting in the Cancer Registry

To facilitate accurate data collection and to gain or maintain their credentials, all members of the Cancer Registry staff participate in ongoing cancer-related education at the local, state, regional, or national level. Full-time and part-time registry staff for whom annual education is required are:

•• CTR staff •• Contract CTR staff who are contracted to work for 3 or more consecutive months during the calendar year, regardless of the number of hours worked This education includes, but is not limited to, topics in the following areas:

•• Advances in cancer diagnosis and treatment •• Changes in cancer program standards •• Changes in data collection requirements

In addition, the Contractor shall provide documentation upon request and annually that all members of their Cancer Registry staff participate in one cancer-related educational activity other than cancer conferences. Certified Tumor Registrar (CTR) Contractor staff participate in at least one cancer related educational activity other than cancer conferences at the local, state or national level; this education includes but is not limited to topics in the following areas: Advances in cancer diagnosis and treatment, changes in cancer program standards and changes in data collection requirements. Each year, all Contractor staff that work on this contract participate in 1 cancer-related educational activity other than cancer conferences ; all members of the Contractors’ Cancer Registry staff participate in ongoing cancer-related education at the local, state, regional, or national level. All Contractor Cancer Registry staff participates in a cancer related educational activity each year. All CTR staff attend a national or regional cancer related meeting once during the 3-year survey cycle.

Per the Commission on Cancer Standards, Full-time and part-time registry staff for whom annual education is required are:

•• CTR staff •• Contract CTR staff who are contracted to work for 3 or more consecutive months during the calendar year, regardless of the number of hours worked •• Management or supervisory personnel This education includes, but is not limited to, topics in the following areas:

•• Advances in cancer diagnosis and treatment •• Changes in cancer program standards •• Changes in data collection requirements Educational activities that can be used to fulfill the standard include, but are not limited to, the following:

•• A cancer-related lecture offered by the program (local activity) •• A face-to-face meeting or workshop •• Local—involves 1 program or facilities located in 1 city (local activity) •• State—involves 1 state (state activity) •• Regional—involves more than one state organization working collaboratively to develop the workshop. Agendas and meeting notices indicate the collaborative effort (regional activity) •• National—is sponsored by a national organization and targeted to a national audience (national meeting) •• A video conference (local activity) •• A webinar (local activity) •• A Web-based training module (local activity) •• Journal-based articles that offer continuing education credits (local activity)

Educational activities exclude patient management cancer conferences in any format. National organizations that sponsor national meetings include, but are not limited to:

•• American Health Information Management Association (cancer-related educational activities) •• Association of Community Cancer Centers •• Commission on Cancer •• National Cancer Registrars Association •• National Comprehensive Cancer Network •• North American Association of Central Cancer Registries

Organizations that sponsor regional meetings include, but are not limited to;

•• State Cancer Registrars Association

Additionally, the Contractor shall be responsible for completing and providing all Background Investigation, Information Security, Rules of Behavior, and Privacy Training documentation, and completing all other requirements needed for the Contractor’s employees to access the Orlando VA Healthcare System network.

J. Policy and Procedure manual - The contractor is responsible for maintaining current Cancer Registry policies and procedures in compliance with CoC, NCDB, Florida Cancer Registry and VACCR standards and submitting them to the COTR at the Orlando VA Healthcare System annually (or upon request) for review. The Contractors’ Cancer Registry policy and procedure manual must be specific to the Orlando VA Healthcare System and specify that current CoC data definitions and coding instructions are used to describe all reportable cases. The Contractor uses the data standards defined by the CoC appropriate for the year of diagnosis for any specific case. The Contractors’ Cancer registrars may be required to comply with additional mandates pertaining to case and data reporting established by the Veterans Administration, federal or state government or by the Orlando VA Healthcare System’s cancer committee. The Cancer Registry policy and procedure manual must include, but is not limited to, the following:

•• Abstracting •• American Joint Committee on Cancer (AJCC) and SEER Stage staging policies •• Cancer Registry reference date •• Case eligibility •• Case finding •• Case accessions •• Confidentiality and release of information •• Computer operations •• Dates of implementation or changes in policies for registry operations •• Disaster recovery policy **Documentation of first course of treatment •• Follow-up •• Job descriptions •• Maintaining and using the suspense system •• CoC and VACCR reporting requirements and mechanisms •• Operational requirements for facility-based cancer registries •• Quality control of registry data •• Registry purpose •• Required coding manuals •• State registry reporting requirements and mechanisms

For the Policy and Procedure Cancer Registry manual, the Contractor provides a table of contents in accordance to Commission on Cancer standards.

l. Corrections: Contractor will correct any mistakes in the registry cases made by them at no cost to the VA. This includes any data corrections as a result of edit error reports received from the NCDB, MCR or VACCR or records rejected because they lack supporting English text and/or have missing data elements. Contractor shall correct all inconsistencies found through any quality assurance review within 1 month (or sooner if it impacts adversely on accreditation of the cancer program) of submission of inconsistencies, errors, warnings, or any other data quality problems at no additional cost to the VA.

m. Other - The Contractor shall ensure that all American College of Surgeons Commission on Cancer Registry standards, requirements and initiatives are implemented and met. If abstract are inadvertently re-opened after being in the completed status (e.g. software patches are put in for example) , Contractor will maintain thorough documentation as to the reason the case reopened on 100% of the cases entered into by the Contractor, will resolve the issue within one working day and will re-close the case and send the documentation to the COTR or designee (monthly with the monthly invoice (this documentation may be reviewed by the ACOS Surveyor during the accreditation process).

n. Facility Communication/ Feedback: The contractor will also provide phone consultation about Cancer Registry issues to the Orlando VA Healthcare System upon request during normal working hours, Mondays through Fridays, 8:00am -4:30pm. Eastern Standard Time.

o. Reporting Cancer Data / Transmission of Data: Responsible for transmitting required submissions / resubmissions to the VA Center Cancer Registry (VACCR), NCDB (if CoC accredited) and the Florida Cancer Registry within prescribed timeframes. Requests / maintains the required software for the transmissions. Submits complete and accurate reports, and makes corrections, as required. Demonstrates knowledge of the VACCR, NDCB, and Florida State Cancer Registry reporting requirements. Completes required privacy reports and submits them to the privacy officer in collaboration with the Orlando VA Healthcare System Registry contact.

p Data User Agreement with Veterans Administration and the State of Florida: Ensures that a current BAA/Data User Agreement or any other paperwork required by VA/VHA policy is in force with the State of Florida prior to submitting or transmitting requested data.

q. Continuing Education / Competency: The contractor should show proof of attendance at monthly continuing education activities including state Cancer Registry trainings and Cancer Registry association education meetings certified by NCRA. The contractor will maintain competency / training folders and make them available as requested. The contractor and contractor staff should have a working knowledge of VA abstracting software programs and computer hardware. If the COTR has a concern about competency, the contractor staff may be requested to take the NCRA Cancer Registrar Employment Screening or equivalent at the contractor’s cost to evaluate competency, or request a VA CTR review a specified number of abstracts to evaluate competency and ensure required elements are being completed. If the National VA Central Cancer Registrar documents continued uncorrected errors and quality problems from the contractor, this will be considered adequate documentation to terminate the contract due to quality concerns.

r. VA-Specific / Privacy Training - The contractor will complete the VHA Privacy Policy Training and Cyber Security training, and any other mandated training, at their own cost before access is given, at no cost to the government.

s. Computerized Patient Record System (CPRS) in VISTA. VA will provide contractor with electronic access to CPRS for use by the Certified Tumor Registrars. Contractor employees are responsible to access the system a minimum of once every ninety (90) days. Failure to access VA system at least once every ninety (90) days will result in the contractor’s employees being locked out of the VA system. If necessary, VA will provide Contractor with remote access to the Computerized Patient Record System (CPRS) in VISTA. It is expected that electronic access will be done monthly. Contractor’s abstracting personnel may perform the abstracting functions from remote locations by computer modem and shall comply with the VA standard of case completion of four to six (6) months after date of diagnosis. A list of cases completed shall be provided to the Contracting Officer’s Technical Representative (COTR) along with monthly invoices. Abstracting shall encompass the full and complete data set (required, optional and supplemental fields) to present a complete patient summary in the VA approved cancer registry software. Text field shall be utilized to document finds on Physical Exam, Scans, Scopes, Labs, Diagnostic OPS and Pathology. AJCC TNM, SEER and CoC staging shall be performed on all cases meeting the criteria as established by SEER and the American Joint commission on Cancer, latest Manual for the Staging of Cancer, in conjunction with accepted principles. All required abstract fields must be completed with 100% accuracy.

INFORMATION MANAGEMENT

Documentation and record keeping shall be in accordance with VA policies and procedures. The Contractor shall adhere to all timeframes required by Orlando VA Healthcare System policies and procedures for documentation and authentication in electronic medical records.

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE FOR

INCLUSION INTO CONTRACTS, AS APPROPRIATE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S.

to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R.

Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COTR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COTR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration.

Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the contractor/subcontractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and

(3) Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a

SOR.

h. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is an employee of the agency.

(1) “Operation of a System of Records” means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

(2) “Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

(3) “System of Records” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

i. The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than ____ days.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within ____ days.

l. All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g. for the convenience of VA) shall only be granted with approval of the contracting officer and the VA Assistant Secretary for Office of Information and Technology.

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent, to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COTR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or…