36C24918Q0353-001.docx

36C24918Q0353

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME b.

TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB

DESTINA

TION

UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS

(15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

614-19-1-025-0002 36C24918Q0353 06-8-2018 David Milner 615-225-6543 06- -2018 12:00 90C Department of Veterans Affairs Network Contracting Office 9 1639 Medical Center Parkway Suite 400 Murfreesboro TN 37129 X X 492110 1500 Employees N/A X Department of Veterans Affairs Memphis VAMC 1030 Jefferson Ave Memphis TN 38104 90C Department of Veterans Affairs Network Contracting Office - 9 1639 Medical Center Parkway Suite 400 Murfreesboro TN 37129

90C FSC e-Invoice Payment http://www.fsc.va.gov/fsc/einvoice.asp Invoice Setup Information 1-877-489-6135 Invoice must be submitted electronically

Setup 1-877-489-6135 The Memphis VAMC requires courier services to deliver laboratory specimens from the Memphis Community Based Outpatient Clinics (CBOCs) to the Memphis VAMC laboratory per the Statement of Work in Section B.3.

Please Note: THIS REQUIREMENT IS A SDVOSB SET ASIDE.

THE CONTRACTOR MUST BE REGISTERED IN VETBIZ.GOV TO BE

CONSIDERED FOR AWARD.

See Addendum to 52.212-1 for instructions on submitting questions and quotes. Quoters shall address Limitations on Subcontracting and provide past performance history.

X Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C249 Christina B. Smith Department of Veterans Affairs Network Contracting Office 9 1639 Medical Center Parkway Suite 400 Murfreesboro TN 37129

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

FSC e-Invoice Payment http://www.fsc.va.gov/fsc/einvoice.asp Invoice Setup Information 1-877-489-6135 Invoice must be submitted electronically

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 LIMITATIONS ON SUBCONTRACTING-- MONITORING AND COMPLIANCE (JUN 2011)

This solicitation includes VAAR 852.219-10 VA Notice of Total Service- Disabled Veteran-Owned Small Business Set-Aside. Accordingly, any contract resulting from this solicitation will include this clause. The contractor is advised in performing contract administration functions, the CO may use the services of a support contractor(s) retained by VA to assist in assessing the contractor's compliance with the limitations on subcontracting or percentage of work performance requirements specified in the clause. To that end, the support contractor(s) may require access to contractor's offices where the contractor's business records or other proprietary data are retained and to review such business records regarding the contractor's compliance with this requirement. All support contractors conducting this review on behalf of VA will be required to sign an “Information Protection and Non-Disclosure and Disclosure of Conflicts of Interest Agreement” to ensure the contractor's business records or other proprietary data reviewed or obtained in the course of assisting the CO in assessing the contractor for compliance are protected to ensure information or data is not improperly disclosed or other impropriety occurs. Furthermore, if VA determines any services the support contractor(s) will perform in assessing compliance are advisory and assistance services as defined in FAR 2.101, Definitions, the support contractor(s) must also enter into an agreement with the contractor to protect proprietary information as required by FAR 9.505-4, obtaining access to proprietary information, paragraph (b). The contractor is required to cooperate fully and make available any records as may be required to enable the CO to assess the contractor's compliance with the limitations on subcontracting or percentage of work performance requirement.

B.3 STATEMENT OF WORK

LAB SPECIMEN COURIER SERVICES

1. INTRODUCTION AND SCOPE OF WORK

The contractor shall provide to the Department of Veterans Affairs Medical Center, Memphis COURIER SERVICES to include personnel, equipment and transportation for the delivery of Laboratory Specimens from the Community Based Outpatient Clinics (CBOCs) listed below to the main Laboratory at the Department of Veterans Affairs Medical Center, 1030 Jefferson Ave, Memphis TN. Laboratory specimens/samples shall be picked up not earlier than the times indicated below. Contractor’s delivery of specimens/samples to the Department of Veteran’s Affairs Medical Center shall not exceed 1 - 3 hours after scheduled pick up time on the same day depending on location and distance of CBOC. If the contractor fails to deliver within the specified delivery time of scheduled pick-up, the Veteran Administration reserves the right to obtain service from another source and to charge the contractor with any excess cost that may result. The contractor shall notify the Contracting Officer’s Representative (COR), Clarence Hale @ 901-523-8990 ext. 5099 or lab staff @ 901-523-8990 ext. 5514 or 5549 immediately by phone of any unforeseen delays of unusual events (traffic, road construction, road detour, etc.) regarding delivery of specimens that shall delay to the Department of Veterans Affairs Medical, Memphis, TN laboratory. Delays must be considered beyond the control of the contractor. If specimens arrive after scheduled delivery time from the CBOC, the VA may send the specimens to an outside Reference laboratory at the courier’s expense. If lateness is due to unforeseen circumstances, the decision to charge will be made by the contracting officer or designee. It shall be the contractor’s responsibility to show proof that the delay was due to circumstances beyond the control of the contractor. Failure to respond to scheduled service requests within the specific times may be grounds for terminating the contract. The contractor shall ensure the confidentiality of all patient information on laboratory samples being transported. The contractor shall be required to sign a Business Associates Agreement.

2. REQUIREMENTS

A. SPECIMEN PICKUP

Specimens shall be picked up and delivered from all CBOCs, Monday through Friday excluding government holidays and holidays observed by each clinic.

The Department of Veterans Affairs Medical Center will provide the tube rack, specimen bags and dry ice pack for transport. The contractor shall provide the insulated refrigerated chest with a lock and return all laboratory supplies to each CBOC with each return visit. The insulated chest provided by the contractor must have a lock, and must be capable of accommodating refrigerated and frozen samples (dry ice) and be used for pick-up and delivery of specimens. Contractor must maintain proper temperature in vehicles to preserve specimens. Temperature in the insulated chest must be maintained at no more than 5° C for refrigerated samples and -20°C for frozen specimens. All specimens must be transported in accordance with local, state, and federal regulations.

CBOC personnel will place specimens upright in a tube rack into an appropriately labeled, fluid-proof secondary container (e.g. a plastic bio hazardous labeled specimen bag). Allow only 10 tubes (50 ml) per plastic specimen bag. Place enough absorbent material (i.e. 1-2 paper towels) inside to absorb all contents being shipped. NOTE: This is a safety precaution just in case the specimen tubes break, leak or open during transport.

CBOC personnel will place specimen bags in a 1-gallon (12”x16”) plastic bio hazardous labeled specimen bag. The contractor shall make sure all plastic bags are sealed.

CBOC personnel will make sure that all paperwork is separated from the specimen container.

CBOC personnel will place specimens upright in an insulated refrigerated chest (ice pack) for transportation to the main laboratory at the Department of Veterans Affairs Medical Center, Memphis, TN.

A transportation receipt shall be filled out at the Pick-Up Location and shall include the facility name and phone number and attached to the Clinic Manifest and signed and timed by originating location and then by the courier. The receiving location must also sign and document the Transportation receipt. This receipt and the manifest documents the number of specimens received.

The contractor shall notify the Contracting Officer’s Representative (COR) Clarence Hale @ 901-523-8990 ext. 5099 or lab staff @ 901-523-8990 ext. 5514 or 5549 immediately by phone of any unforeseen delays or unusual events (traffic, road construction, road detours, etc.) regarding delivery of specimens that shall cause delay to the Department of Veterans Affairs Medical Center, Memphis, TN laboratory. Delays must be considered beyond the control of the contractor. If specimens arrive after scheduled delivery time from each clinic, the specimens may be sent to an outside Reference Laboratory and paid at the courier’s expense. If the lateness is due to unforeseen circumstances, the decision to charge will be made by the contracting officer or designee. It shall be the contractor’s responsibility to show proof that the delay was due to circumstances beyond the control of the contractor.

B. SPECIMEN TRANSPORTATION

When transporting specimens the contractor shall follow procedures to prevent any exposure, contamination, or release while in transport. Each specimen must be transported in a leak proof primary container, placed within a secondary container. Absorbent material shall be placed in the transport container sufficient to absorb all liquid contents. The transport container shall be secured by lock and labeled with the biohazard symbol. In the event that specimens transported are lost, broken, the Contractor shall be required to submit a written report to the Contracting Officer’s Representative the same day at 901-523-8990 ext. 5099 or 901-523-8990 ext. 5514 or 5549 in the absence of the COR or after normal working hours.

C. QUALITY CONTROL

The contractor shall develop and maintain a quality control program that ensures courier services are performed in accordance with these specifications. The contractor shall develop and implement procedures to track, identify, prevent, remedy and ensure non-recurrence of defective services. The contractor shall provide a method to accept and resolve customer complaints and notify the customer of the resolution. The contractor shall immediately notify the COR upon receipt of a customer complaint so joint validation may be accomplished. The contractor is responsible for quality control and specification compliance.

D. UNIVERSAL PRECAUTIONS

The contractor’s employees/couriers transporting test specimen must be trained in “Universal Precautions” in the handling of biohazard materials (specimens). Training must include utilizing clinical procedures in case of biohazard spills and accidents. The contractor must furnish a record of all required training for each employee transporting specimens.

E. RECORD OF PICK-UP

The Contractor must maintain a record and log of daily courier pick-ups and deliveries indicating time and date of pick-up, delivery, number of specimens and signatures.

F. CONTRACTOR COURIERS/DRIVERS

1. All contractor employees must maintain a valid driver’s license for the type of —vehicle operated as required by the States operating therein. Contractor personnel shall wear visible identification at all times while on the premises of any Federal property. It is the responsibility of the Contractor to park in the appropriate designated parking areas (Laboratory entrance, Jefferson Avenue side of hospital). A record of each driver as to character and physical capabilities for performing as a courier must be maintained and made available to the Department of Veterans Affairs Medical Center upon request for inspection.

2. The contractor personnel performing services shall always conduct themselves in a professional manner, present a neat appearance and be easily recognized as a contract employee by having the company name, and employee name affixed to the uniform. The Contractor shall be responsible for furnishing all vehicles, personnel, equipment and supplies, vehicle fuel, uniforms, name tags and/or badges for performance of services under this contract. Employee identifications shall be worn in clear view above the waist. All contractor employees responsible for transporting specimens must have been trained and certified in accordance with DOT (US Department of Transportation), IATA (International Air Transport Association), CDC (Centers for Disease Control), and OSHA (Occupational Safety and Health Organization) requirements

3. The Government reserves the right to restrict any contractor employee from performing services under this contract who do not meet the required qualifications, or who violate Federal regulations or are identified as a potential threat to the security, safety, health and/or operational mission of VA and its veteran population. The restriction of such contractor personnel shall not relieve the contractor from performing all the required services in accordance with all terms, conditions, and schedules contained herein.

4. Taking of Photographs/Videos/Recordings are Prohibited while on VA premises."

G. CONTRACTOR VEHICLES

The vehicles used in the performance of this contract must be licensed and meet the minimum requirements by the States and cities operated therein, Contractor’s vehicle shall have the company name/logo prominently displayed.

H. TRAINING

1. Vendor must ensure all contractors who shall be working on the contract complete mandatory training programs titled VA Privacy and Information Security Awareness Training and Rules of Behavior (VA 10176) and VHA Privacy and HIPAA Training (VA 10203). The training is offered through the VA Talent Management System (TMS), a system that offers web-based training to VA employees and its partners. He/she must ensure each contract employee self-enrolls for a profile on the VA TMS by visiting https://www.tms.va.gov/plateau/user/login.jsp

2. Once there, employees should follow the steps to create a profile, launch the mandatory training, and complete the content prior to their next day at VA. (Please List the COR, Clarence Hale, 901-523-8990 ext. 5099 as the supervisor when prompt). Certificate of completion will be provided prior to assignment and annually thereafter. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

a. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

b. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

c. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

d. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access

3. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

4. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

I. RECORDS MANAGEMENT

Records management standard Items relate to records generated in executing this contract and must be followed:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C. Chapter 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government ‘IT’ equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

10. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information

3. DELIVERY SPECIMEN PICK-UP AND DELIVERY LOCATIONS

The Contractor shall be responsible specimen pick-up at the following Community Based Outpatient Clinic locations. Specimens shall be delivered to the Department of Veterans Affairs Medical Center, Memphis, TN main laboratory, Room CW-192. All times listed are Central Time. All pick up times are not earlier than times. All delivery times are not later than times.

A. JONESBORO, ARKANSAS- 2 pickups (11:30 AM and 5:00 PM) Lab Delivery- 1:30 PM and 7:00 PM 2908 S. Caraway Road Jonesboro, AR 72401

B. JACKSON, TENNESSEE - 2 pickups (11:30 and 4:30PM) Lab Delivery- 12:30 and 5:30 PM

VA CBOC

180 Old Hickory Blvd Jackson, TN 38305 C. NORTH MEMPHIS, TENNESSEE - 2 pickups (12:00 PM and 4:00 PM) Lab Delivery- 1:00 PM and 5:00 PM VA North Primary Care Clinic Laboratory Section 3461 Austin Peay Highway Memphis, TN. 38127 D. NONCONNAH, TENNESSEE - 2 pickups (11:30 AM and 4:30 PM) Lab Delivery- 12:30 PM and 5:30 PM VA Nonconnah Primary Care Clinic 1689 Nonconnah Parkway Memphis, TN. 38116

E. DYERSBURG, TENNESSEE - 1 pickup (4:30 PM) Lab Delivery- 6:30 PM Dyersburg CBOC 433 East Parkview St Dyersburg, TN 38024

F. SAVANNAH, TENNESSEE- 1 pickup (4:30 PM) Lab Delivery- 7:00 PM Hardin County Regional Health Center 765 Florence Road Savannah, TN 38372

G. HOLLY SPRINGS, MISSISSIPPI — 1 pickup (4:00 PM) Lab Delivery- 5:30 PM 1700 Crescent Meadows Dr.

Holly Springs, MS 38635

H. HELENA, ARKANSAS — 1 pickup (4:30 PM) Lab Delivery- 7:30 PM 131 Quarles Lane Helena, AR 72342

I. TUPELO, MISSISSIPPI — 1 pickup (5:00 PM) Lab Delivery- 8:00 PM 1114 Commonwealth Blvd.

Tupelo, MS 38804

4. SECURITY

This acquisition does not require services that involve connection of one or more contractor-owned IT devices (such as a laptop computer or remote connection from a contractor system) to a VA internal trusted (i.e., non-public) network. The Authorization requirements do not apply and a Security Accreditation Package is not required

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE FOR INCLUSION INTO CONTRACTS, AS APPROPRIATE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor’s rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term ‘data breach’ means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

6. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With a 10 working-day notice at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time

B.4 PRICE/COST SCHEDULE

Quoters shall complete the attached Microsoft Excel Price/Cost Schedule included in Section D (Attachment D.1) of this Request for Quotes. Quoters shall only modify those sections which are shaded YELLOW; all other fields are to remain unaltered. Any alteration of the fields not shaded in YELLOW, excluding the Pricing Notes tab, will render the quote unacceptable and the quote shall be automatically rejected. Please include Company Name at the Top.

Items not quoted shall be priced at $0.00. Any fields left blank will automatically be considered not offered by the Quoter. Quoters should note that all TRIPS/YEAR are estimates and in no way are to be interpreted as a guarantee. If necessary, Quoter shall provide any pricing notes on the NOTES Column of the worksheet. Unit prices are to be firm-fixed price.

Any changes made to the price/cost schedule may only be made by a written modification which is formally executed by the vendor and the Contracting Officer. Only NCO 9 Contracting Officers may issue orders under this agreement.

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL ITEMS (JAN 2017)

(a) Inspection/Acceptance. The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services that have been tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or reperformance of nonconforming services at no increase in contract price. If repair/replacement or reperformance will not correct the defects or is not possible, the Government may seek an equitable price reduction or adequate consideration for acceptance of nonconforming supplies or services. The Government must exercise its post-acceptance rights—

(1) Within a reasonable time after the defect was discovered or should have been discovered; and

(2) Before any substantial change occurs in the condition of the item, unless the change is due to the defect in the item.

(b) Assignment. The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727). However, when a third party makes payment (e.g., use of the Governmentwide commercial purchase card), the Contractor may not assign its rights to receive payment under this contract.

(c) Changes. Changes in the terms and conditions of this contract may be made only by written agreement of the parties.

(d) Disputes. This contract is subject to 41 U.S.C. chapter 71, Contract Disputes. Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause at FAR 52.233-1, Disputes, which is incorporated herein by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

(e) Definitions. The clause at FAR 52.202-1, Definitions, is incorporated herein by reference.

(f) Excusable delays. The Contractor shall be liable for default unless nonperformance is caused by an occurrence beyond the reasonable control of the Contractor and without its fault or negligence such as, acts of God or the public enemy, acts of the Government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, unusually severe weather, and delays of common carriers. The Contractor shall notify the Contracting Officer in writing as soon as it is reasonably possible after the commencement of any excusable delay, setting forth the full particulars in connection therewith, shall remedy such occurrence with all reasonable dispatch, and shall promptly give written notice to the Contracting Officer of the cessation of such occurrence.

(g) Invoice.

(1) The Contractor shall submit an original invoice and three copies (or electronic invoice, if authorized) to the address designated in the contract to receive invoices. An invoice must include—

(i) Name and address of the Contractor;

(ii) Invoice date and number;

(iii) Contract number, line item number and, if applicable, the order number;

(iv) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered;

(vii) Name and address of official to whom payment is to be sent;

(viii) Name, title, and phone number of person to notify in event of defective invoice; and

(ix) Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice only if required elsewhere in this contract.

(x) Electronic funds transfer (EFT) banking information.

(A) The Contractor shall include EFT banking information on the invoice only if required elsewhere in this contract.

(B) If EFT banking information is not required to be on the invoice, in order for the invoice to be a proper invoice, the Contractor shall have submitted correct EFT banking information in accordance with the applicable solicitation provision, contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer—System for Award Management, or 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management), or applicable agency procedures.

(C) EFT banking information is not required if the Government waived the requirement to pay by EFT.

(2) Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR part 1315.

(h) Patent indemnity. The Contractor shall indemnify the Government and its officers, employees and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark or copyright, arising out of the performance of this contract, provided the Contractor is reasonably notified of such claims and proceedings.

(i) Payment.—

(1) Items accepted. Payment shall be made for items accepted by the Government that have been delivered to the delivery destinations set forth in this contract.

(2) Prompt payment. The Government will make payment in accordance with the Prompt Payment Act (31 U.S.C. 3903) and prompt payment regulations at 5 CFR part 1315.

(3) Electronic Funds Transfer (EFT). If the Government makes payment by EFT, see 52.212-5(b) for the appropriate EFT clause.

(4) Discount. In connection with any discount offered for early payment, time shall be computed from the date of the invoice. For the purpose of computing the discount earned, payment shall be considered to have been made on the date which appears on the payment check or the specified payment date if an electronic funds transfer payment is made.

(5) Overpayments. If the Contractor becomes aware of a duplicate contract financing or invoice payment or that the Government has otherwise overpaid on a contract financing or invoice payment, the Contractor shall—

(i) Remit the overpayment amount to the payment office cited in the contract along with a description of the overpayment including the—

(A) Circumstances of the overpayment (e.g., duplicate payment, erroneous payment, liquidation errors, date(s) of overpayment);

(B) Affected contract number and delivery order number, if applicable;

(C) Affected line item or subline item, if applicable; and

(D) Contractor point of contact.

(ii) Provide a copy of the remittance and supporting documentation to the Contracting Officer.

(6) Interest.

(i) All amounts that become payable by the Contractor to the Government under this contract shall bear simple interest from the date due until paid unless paid within 30 days of becoming due. The interest rate shall be the interest rate established by the Secretary of the Treasury as provided in 41 U.S.C. 7109, which is applicable to the period in which the amount becomes due, as provided in (i)(6)(v) of this clause, and then at the rate applicable for each six-month period as fixed by the Secretary until the amount is paid.

(ii) The Government may issue a demand for payment to the Contractor upon finding a debt is due under the contract.

(iii) Final decisions. The Contracting Officer will issue a final decision as required by 33.211 if—

(A) The Contracting Officer and the Contractor are unable to reach agreement on the existence or amount of a debt within 30 days;

(B) The Contractor fails to liquidate a debt previously demanded by the Contracting Officer within the timeline specified in the demand for payment unless the amounts were not repaid because the Contractor has requested an installment…