36C24919R0049-000.docx

36C24919R0049 Attachments

1. SOLICITATION NUMBER

2. TYPE OF SOLICITATION

3. DATE ISSUED

PAGE OF PAGES

4. CONTRACT NUMBER

5. REQUISITION/PURCHASE REQUEST NUMBER

6. PROJECT NUMBER

7. ISSUED BY

CODE

8. ADDRESS OFFER TO

a. NAME

b. TELEPHONE NUMBER (Include area code) (NO COLLECT CALLS)

10. THE GOVERNMENT REQUIRES PERFORMANCE OF THE WORK DESCRIBED IN THESE DOCUMENTS (Title, identifying number, date) 12a. THE CONTRACTOR MUST FURNISH ANY REQUIRED PERFORMANCE AND PAYMENT BONDS?

(If "YES," indicate within how many calendar days after award in Item 12B.)

12b. CALENDAR DAYS

13. ADDITIONAL SOLICITATION REQUIREMENTS:

STANDARD FORM 1442 (REV. 8/2014)

STANDARD FORM 1442

Prescribed by GSA-FAR (48 CFR) 52.236-1(d)

SOLICITATION, OFFER,

AND AWARD

(Construction, Alteration, or Repair)

SOLICITATION

SOLICITATION

IMPORTANT - The "offer" section on the reverse must be fully completed by offeror.

9. FOR INFORMATION

CALL:

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SEALED BID (IFB)

NEGOTIATED (RFP)

11. The Contractor shall begin performance within ____________ calendar days and complete it within calendar days after receiving award, notice to proceed. This performance period is mandatory negotiable. (See _____________________________).

YES

NO

a.

Sealed offers in original and ___________________copies to perform the work required are due at the place specified in Item 8 by _____________ (hour) local time _____________________ (date). If this is a sealed bid solicitation, offers must be publicly opened at that time. Sealed envelopes containing offers shall be marked to show the offeror's name and address, the solicitation number, the date and time offers are due.

b.

An offer guarantee is, is not required.

c.

All offers are subject to the (1) work requirements, and (2) other provisions and clauses incorporated in the solicitation in full text or by reference.

d.

Offers providing less than _______________________ calendar days for Government acceptance after the date offers are due will not be considered and will be rejected.

36C24919R0049 X 01-29-2019 626-19-1-4209-0001 626-19-201 90C Department of Veterans Affairs Network Contracting Office 9 1639 Medical Center Parkway Suite 400 Murfreesboro

TN

37129 Same as Block

Brain Garven 615-873-6219 Tennessee Valley Health System (TVHS) VA Medical Center Request for Proposals - Comply with Legionella Directive Nashville Project #626-16-301.

Project Location: TVHS Nashville Campus VA Medical Center, 1310 24th Avenue, South, Nashville, TN 37212 Magnitude of Project Construction: Between $100,000.00 and $250,000.00 Construction NAICS Code: 236220, Small Business Size Standard $36.5 Million Contract Type: Firm Fixed Price Wage Determination Applicable for this Project: General Decision Number: TN190083 01/04/2019 TN83

Site Visit is scheduled for Tuesday, February 5, 2019 at 1:00 PM Central Standard Time (CST), in Main Building, Room D73. Site visit POC will be Brian Garvin at Brian.Garven@va.gov, or 615-873-6219.

To obtain clarifications and/or additional information concerning the contract requirements, specifications, and/or drawings, submit a written request to the contract specialist for this project, Daniel Tibitoski, via FBO

No RFI's will be answered after 3:00PM CST, Feburary 8, 2019 unless determined to be in the best interest of the Government as deemed by the Contracting Officer.

Proposal Due Date: The deadline for submitting the proposalis March 1, 2019 at 2:00PM CST.

Proposals shall be submitted through the FED BIZ OPPS.

Basis for Award: Award will be based onthe lowest reasonable and realistic price received. No discussions are expected to be necessary however discussions are reserved to be conducted at the discretion of the CO.

A bid bond is required if proposal exceeds $150,000. A Performance Bond is required if proposal exceeds $150,000.

A Payment Bond is required if proposal exceeds $35,000. Bonding is in accordance with FAR 28.102-1.

ALL PROPOSALS MUST BE BROKEN DOWN INTO DIVISIONS AND SUB-DIVISIONS AS IT PERTAINS TO THE PRICE BREAKDOWN, NO EXCEPTIONS.

All contractors must have a current VETS 4212 report on file with the Department of Labor, registered in SAM, and must be CVE verified in VetBiz when proposals are received,and for the awardee at time of award.

The Contracting Officer's Representative (COR) for this project is Brian Garven.

The contractor shall furnish all labor, material, equipment, transportation and supervision necessary for Improvent for Surgical Clinics in accordance with the Statement of Bids, specifications, and drawings.

x x 52.211-10 (April 1984) X

FED BIZ OPPS

2:00PM CST

01-22-2019 X

14. NAME AND ADDRESS OF OFFEROR

15. TELEPHONE NUMBER

16. REMITTANCE ADDRESS

CODE

FACILITY CODE

17. The offeror agrees to perform the work required at the prices specified below in strict accordance with the terms of the solicitation, if this offer is accepted by the Government in writing within __________ calendar days after the date offers are due.

AMOUNTS

18. The offeror agrees to furnish any required performance and payment bonds.

19. ACKNOWLEDGMENT OF AMENDMENTS

AMENDMENT

NUMBER

DATE.

20a. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER 20b. SIGNATURE 20c. OFFER DATE

21. ITEMS ACCEPTED:

22. AMOUNT

23. ACCOUNTING AND APPROPRIATION DATA

24. SUBMIT INVOICES TO ADDRESS SHOWN IN

ITEM

25. OTHER THAN FULL AND OPEN COMPETITION PURSUANT TO

10 U.S.C. 2304(c)( 41 U.S.C. 3304(a) (

26. ADMINISTERED BY

27. PAYMENT WILL BE MADE BY

PHONE:

FAX:

28. NEGOTIATED AGREEMENT

29. AWARD

Your Contractor agrees offer on this solicitation is hereby accepted as to the items listed. This to furnish and deliver all items or perform all work requirements identified award consummates the contract, which consists of (a) the Government on this form and any continuation sheets for the consideration stated in solicitation and your offer, and (b) this contract award. No further cont-this contract. The rights and obligations of the parties to this contract ractual document is necessary.

shall be governed by (a) this contract award, (b) the solicitation, and (c) the clauses, representations, certifications, and specifications incorporated by reference in or attached to this contract.

30a. NAME AND TITLE OF CONTRACTOR OR PERSON AUTHORIZED 31a. NAME OF CONTRACTING OFFICER

TO SIGN

30b. SIGNATURE 30c. DATE 31b. UNITED STATES OF AMERICA 31c. AWARD DATE

BY

OFFER

AWARD

STANDARD FORM 1442 (REV. 8/2014) BACK

(Include ZIP Code) (Include area code) (Include only if different than Item 14.)

(Insert any number equal to or greater than the minimum requirement stated in Item 13d. Failure to insert any number means the offeror accepts the minimum in Item 13d.)

(The offeror acknowledges receipt of amendments to the solicitation -- give number and date of each) (Type or print) (4 copies unless otherwise specified) (Type or print) (Type or print) (Contractor is required to sign this document and return _______ copies to issuing office.)

(Contractor is not required to sign this document.)

(Must be fully completed by offeror) (To be completed by Government)

CONTRACTING OFFICER WILL COMPLETE ITEM 28 OR 29 AS APPLICABLE

Base Bid:________________________________________________

626-3690162-4209-854200-3220 23NRNR000

90C Department of Veterans Affairs Network Contracting Office - 9 1639 Medical Center Parkway Suite 400 Murfreesboro

TN

37129 90C FSC e-Invoice Payment http://www.fsc.va.gov/fsc/einvoice.asp Invoice Setup Information 1-877-489-6135 Invoice must be submitted electronically

Setup 1-877-489-6135 X Shawn Hendricks Contracting Officer

Table of Contents

SCOPE OF WORK

The Tennessee Valley Healthcare System (TVHS), at the Nashville VA medical center in Nashville, TN, has a requirement for continuous water monitoring service to meet the requirements of VHA Directive 1061.

· The contractor shall install and provide monthly service for the PWA Advance Monitoring Service Systems in accordance with the SOW.

· The contractor shall provide a web-based data management in accordance with the SOW to collect, analyze, and store data collected. It will store WMP documents, verification activities, corrective actions, and validation test results in addition to data recorded from PWA systems.

· Contractor shall provide as-built drawings with PE approved stamps for the location of the monitoring system and sensors prior to construction

STATEMENT OF WORK

1. Background Directive 1061 calls for the implementation of a monitoring and prevention of the system healthcare associated disease Legionnaires. This project will focus on the monitoring of the water quality. Sample collection and field testing for Legionella bacteria, temperature, free chlorine, and pH in the hot and cold domestic water is to be conducted by the contractor to ensure proper analytical techniques are utilized for compliance

2. Monthly Service for PWA Systems The PWA systems must be properly calibrated and maintained to ensure accurate and reliable performance on an ongoing basis. The monthly services required are:

· Training

· Monthly calibration and supply of calibration solution for ORP probes

· Monthly refreshment of test reagents for the chlorine analyzer

· All consumable parts for system components

· Chlorine Analyzer – reagents, tubing/cuvette kits, replacement cuvettes, check valve sets and check valve flushing kits

· Replacement probes for ORP

· Labor, travel and expenses

3. Equipment Characteristics The Advance Monitoring Service Systems (or equivalent) and water temperature sensors are as follows:

NASHVILLE

Return Loops (3) Phigenics WME-2910 Water Temperature Sensors with Thermowell (6) or Equal

1. Phigenics PWA Advanced Monitoring System 2.0 (or approved equivalent) Panel mounted system for automatic monitoring of free or total chlorine residuals, pH, temperature, pressure, and dissolved solids. The system must continuously monitor these sensors and make the data available securely using any Internet connected device.

The chlorine monitor must meet the following minimum requirements:

· Measure free residual oxidant (FRO) or total residual oxidant (TRO) in potable water systems using the EPA accepted DPD colorimetric test method for measuring chlorine.

· Measure chlorine residuals at configurable frequencies as short as 110 seconds.

· Support water sample temperatures directly of up to 131°F, and up to 150°F using a sample cooler.

· Comply with US EPA regulation 40 CFR 140.74, Standard Method 4500-CLG, and US EPA Method 334.0 “Determination of Residual Chlorine in Drinking Water Using an Online Chlorine Analyzer.”

· Support a Modbus interface.

· 4-20mA output that is proportional to the Chlorine measurement.

· 2 Alarm Relays that are configurable to activate based on the Chlorine measurement

The water temperature sensors must meet the following minimum requirements:

· Compact temperature sensor with built-in transmitter

· Signal output: 4 to 20 mA

· Probe length: 30, 50, 100 or 150-mm

· Connection: ¼” or ½” NPT male

· Body must be stainless steel AISI 316L

· Temperature range: -58 to 302°F

· Pressure rating: 300 PSI

· M12 connector with pre-cut cord lengths for hard wiring to PWA system

· Sensor accuracy class A

The pH sensors must meet the following minimum criteria:

· Range: 0-14 pH

· Response: 95% in less than 5 seconds

· Operating Pressure: 100 PSI

· Temperature Range: 50 - 212°F

The dissolved solids sensors must meet the following minimum criteria:

· Conductivity Range: 0 – 30,000 uS

· Pressure Rating: 0 – 150 PSI

· Cell Constant: 1.0

· Thermsistor: 10k ohm

· Temperature Range: 32 – 140°F

The pressure sensors must meet the following minimum criteria:

· Programmable pressure sensor with analog and switching output

· ¼” NPT male or female connection size

· Measurement Range: -14.6 – 145 PSI

· Temperature Range: -13 – 176°F

· M12 connector with pre-cut cord lengths for hard wiring to PWA system

· LED Display

· Body must be stainless steel AISI 316L with IP 65 & 67 protection

· Accuracy range: ± 0.4%

The data logging device must meet the following minimum criteria:

· Automatically collect and log data at user selected intervals.

· Log device data date/time stamps and store in non-volatile memory.

· Store interval data locally until the next scheduled upload.

· Support a Modbus interface plus eight additional analog or pulse input signals.

· Capable of transporting data securely to servers owned and operated by the equipment supplier over a cellular, Ethernet Wide Area Network (WAN), or WiFi connection, as required.

· Capable of providing secure data access and analysis using any Internet connected device.

· NEMA 4X rating

Install Parameters

· Dimensions: 43"W X 40"H X 9"D

· Weight: 75 lb

· Must be mounted to a flat surface

Installation requirements

· One water tap to provide a sample point from the water supply line.

· One water drain for the sample line

· One 110V electrical outlet

The total system must be pre-wired and pre-plumbed on a panel to ensure high quality and a simple installation. Installation must require only one tap from the main water line to provide a continuous sample stream of water to the monitoring system. The system must be fully powered by a single 110V power supply.

2. Installation Services for Potable Water Analytics Systems

· General Requirements

· Surge protection

· 12-ft power cord with a standard 3-prong plug

· Single 110V outlet

· Power consumption is less than 2A

· Minimum spacing of 1 ft on either side and above the PWA for connections

· Water System Requirements

· Requires at least 5 PSI to operate

· Water temperatures greater than 130°F at 30 PSI MUST have a sample cooler

· Water pressures greater than 90 PSI at 70°F MUST have a pressure regulator

· Minimum flow rate to the PWA is 0.25 GPM

· Sample Line Installation

· Sample line should be ¼” flexible copper

· Drain Line Installation

· There are 2 drain lines, both with ½” NPT female connection

· Drain line should be ½” copper or CPVC

· Drain line must be sloped down to drain with an air gap

3. Technical Support/Startup of Equipment The contractor will provide technical support during installation and conduct system startup.

· Provide input for location of PWA

· Provide input for location of chlorine injection (if applicable) and water sample tap

· Provide technical guidance to installer during installation

· Conduct system startup

· Verify that all applicable parameters are recording correctly and being transferred to the web-based data management system

4. Web-based Data Management System The software platform must meet the following minimum criteria:

· Software-as-a-Service (SaaS) enterprise-class platform specialized for building water systems.

· Capable of monitoring all sensor data from the potable water quality monitoring system.

· Tables and graphs that can be plotted based on user selected time intervals and system parameters

· Supports manual data entry via computer and mobile devices, automatic uploading of all water and microbiological test results, documentation of water management plans and activities, and automated sensor monitoring, as specified in VA directive 1061

· Administrative functionality to control user access rights, and automated alert notifications

· Data storage for a minimum of five years.

· Exportable data to excel and other formats

The software platform must meet the following Infrastructure Reliability and Information Security Management requirements:

· The web application host will provide a service level agreement (“SLA”) with a service commitment to a monthly uptime percentage of at least 99.95%. Provide Host Documentation.

· The web application will be hosted at a datacenter compliant with FedRAMP requirements at the moderate impact level and in accordance with the Federal Cloud Computing Strategy. Provide Host Documentation.

· The database will be securely backed up hourly for disaster recovery purposes and provide a minimum durability of 99.999999999% and uptime of 99.999%. Provide Host Documentation.

· The web applications will be hosted as a Software-as-a-Service (SaaS) data delivery model. This will enable easy access to all data in a highly secure environment via the Internet using any internet connected device including personal computers and mobile devices.

· The web application will employ at a minimum TLS 1.2 with 128-bit AES encryption and authentication.

· The web application will be delivered by way of a secure login-protected environment with registered HTTPS security provisions.

The software platform must meet the following minimum Application-Level Security requirements:

· A user account and password of adequate complexity will be required for each individual user who accesses the system. New user accounts may only be created by administrators with the appropriate level of authorization.

· Administrators shall have the ability to easily remove access from users no longer authorized to use the application.

· All edits, deletions, or changes to existing data will be logged with the date and time, user committing the change, and all original data will be preserved. This audit trail will be available to users with the appropriate level of access.

· The web application shall have varying levels of access for data collectors, operators, site managers, water management team members, and administrators.

· Users can be restricted by region or facility. A user restricted to a specific facility shall only be able to view data and information pertaining to that facility.

The software platform must meet the following minimum Data Collection requirements:

· Administrators will be able to add, edit, or remove sample points in the system as needed.

· A web page will be available in the application for data collectors to enter test results.

· The required testing frequency of each sample point can be configured as daily, weekly, or monthly. Alerts can be issued if required sample is missing.

· The system will allow data to easily be exported to a suitable format for offline use.

· Time-series charts will be provided in real-time for all data recorded in the system. Charts will show alert limits and can be easily customized based on predefined specifications.

· A daily summary report will be generated in real-time by the web application, indicating total number of samples tested by region and facility, total number of samples out of specification for chlorine and temperature, as well as chlorine range and average temperature for each facility.

· The web application will allow for the storage of electronic documents online. The storage capability will include automated document versioning and all versions of all documents will be retained.

· The web application data will be time-stamped with the time it was entered as well as the time the user records it. Edits or changes to the data are logged so the original values can always be recovered.

· The web application will have the ability to track customer service requests. Requests can be entered by plant personnel or by authorized contractors/vendors and tracked through the system until they are completed which makes it easy to marry equipment operations with equipment repair and maintenance.

· Viewer rights will be determined based on the direction set forth by the client so those who have access can only see or do what they are authorized to see or do, and no one will have a view into areas that are outside the scope of their roles and responsibilities.

· The client may reclassify any properties, as and when required, from high risk to low risk or vice versa.

The software platform must meet the following minimum Mobile requirements:

· A mobile application will be available for data entry on modern smartphones, including Apple IOS, Google Android, and Windows Phone operating systems.

· Data can be entered, viewed, and edited on the mobile application by users with the appropriate level of access.

· To enable resilient operation in the field, the mobile application will operate with or without an active internet connection. In the absence of an internet connection, data will be stored on the local device and synchronized with the remote server upon restoration of internet access.

· The mobile application will be capable of reading QR codes (barcoding) affixed to sample points to identify the sample and minimize data input errors. The web application will be capable of printing QR codes for the associated sample points.

The software platform must meet the following minimum Alerts requirements:

· Alert levels can be set for each individual parameter at every sample point in the system. Alert levels can be easily adjusted at any time by users with the appropriate authorization.

· Alerts shall be issued electronically, by email, upon entry of any data exceeding predefined alert limits.

· Each user account can be configured to receive alert emails by region or facility.

· Alerts will be clearly indicated when viewing data in the web application.

· The web application will incorporate a work order system that will allow alerts to be prioritized and corrective actions to be logged. Users will be able to view the alert and work order history by region or facility for which they are authorized, down to the individual sample points.

The software platform must meet the following minimum Remote Data Acquisition requirements:

· A system will be provided to allow rapid deployment of remote sensors throughout the facility. The sensors will upload data at regular intervals to the remote servers and the data will be easily accessible in the web application.

· The system will be capable of acquiring data from sensors with the following outputs types; current, voltage, resistance, and pulse.

· The data acquisition system will be capable of both Ethernet and 3G cellular connectivity.

· The data acquisition system will issue alerts electronically, by email, when a sensor reading exceeds predefined alert limits.

The software platform must meet the following minimum Laboratory Integration requirements

· All Legionella and water chemistry test results will be available online immediately upon completion of the test.

· An executive summary dashboard will be provided in the web application to graphically display Legionella test results and trends.

5. Place of Performance Place of performance will be the Nashville VA Medical Center as part of the Tennessee Valley Healthcare System located at the corner of Pierce Ave and 24th Ave in Nashville, TN 37212. .

6. Period of Performance Period of performance shall be 60 days for installation of the equipment and 1 year for service post installation.

7. Qualifications The contractor selected to perform this work must be an independent provider of water management services engaged in the development and ongoing management of facility and corporate water management programs. To be deemed “independent” and thus avoid commercial conflict of interest, neither the prime contractor, nor any partners, subcontractors nor subsidiary companies may sell treatment chemicals, disinfection devices or remediation services. The sale of water testing services and diagnostic equipment related to determining the safety and quality of the water does not void independence.

Prime contractor must demonstrate (with references and explanation of SOW) experience with overseeing the operation (via Safe Drinking Water Act compliance) of secondary disinfection systems in a healthcare environment. Provide references and SOW for chlorine, chlorine dioxide and chloramination.

The laboratory must be certified by the Centers for Disease Control and Prevention (CDC) Environmental Legionella Isolation Techniques Evaluation (ELITE) Program as proficient at performing the culture of Legionella from environmental samples. The laboratory should also have environmental microbiology accreditation by a nationally recognized accrediting body (e.g., EMLAP, NELAP).

8. Evaluation Process Award will be made to the best value, as determined to be the most beneficial to the Government. Please read each section below carefully for the submittals and information required as part of the evaluation. Failure to provide the requested information below shall be considered non-compliant and your quote could be removed from the evaluation process.

(a) Offeror quotes shall be evaluated under FAR Part 13.106-2(b) -- Evaluation of Quotations or Offers. Therefore, the Government is not obligated to determine a competitive range, conduct discussions with all contractors, solicit final revised quotes, and use other techniques associated with FAR Part 15. The Contracting Officer has broad discretion and may compare quotes to each other.

Technical and past performance, when combined, are significantly more important than price.

(b) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

1. Price:

0. Offeror will complete Price Schedule, with offeror’s proposed contract line item prices inserted in appropriate spaces.

0. If your representations and certifications are not completed in SAM (as preferred) you must fill out 52.212-3 of this solicitation and submit back with your quote. The preference is that all offerors have filled out this section of SAM.

1. Past Performance:

1. Provide three (3) references of work, similar in scope and size with the requirement detailed in the Performance Work Statement where your company was the prime contractor and performed 50% of the relevant work. References must include contact information, brief description of the work completed, and contract number (if relevant). References may be checked by the Contracting Officer to ensure your company is capable of performing the Performance Work Statement. The Government also reserves the right to obtain information for use in the evaluation of past performance from any and all sources. This will include a check of the past performance information retrieval system (PPIRS).

1. Technical: The offeror’s quote shall be evaluated to determine if the organization has the experience and capabilities to provide the requested services in a timely efficient manner.

2. Contractor shall demonstrate their corporate experience and approach to meet all requirements stated in the Performance Work Statement by providing:

0. The contractor’s laboratory must be certified by the Centers for Disease Control and Prevention (CDC) Environmental Legionella Isolation Techniques Evaluation (ELITE) program or the Public Health England (PHE) Legionella External Quality Assessment (EQA) scheme as proficient at performing the culture of Legionella from environmental samples. Information about CDC ELITE certified laboratories can be found at https://wwwn.cdc.gov/elite/Public/MemberList.aspx.

0. Proof that you are familiar with VHA Directive 1061.

0. The contractor shall submit a narrative statement, describing your experience in performing the type of work identified in the SOW. Include the number of years your company has been in this type of business.

0. The contractor shall provide the resume of a site manager for this project who shall possess a Bachelor’s degree or higher in science or engineering and who shall be a certified NSF HACCP (Hazard Analysis Critical Control Point) for Building Water Systems Manager.

0. The contractor shall be a small business and hold GSA Schedule 03FAC-Facility Maintenance and Management, SIN 871-210.

0. The prime contractor selected to perform this work must be an “independent” third party provider of water management services. To be deemed “independent” and thus avoid commercial conflict of interest, neither the prime contractor, nor any partners, subcontractors nor subsidiary companies may sell water treatment chemicals or remediation services.

0. Any other qualification statements, marketing material, or items demonstrating understanding of the best practices mentioned in the PWS. The Government is looking to leverage your knowledge base as the Contractor.

9. Contractor Personnel Security Requirements

All Contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract, the Contractor will be responsible for the actions of those individuals they provide to perform work for VA.

VAAR 852.273-75 SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (Interim - October 2008)

(a) The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce's National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST's Web site at:

http://checklists.nist.gov

(b) To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in "VA Information and Information System Security/Privacy Requirements for IT Contracts" located at the following Web site:

http://www.iprm.oit.va.gov

Position Sensitivity – The position sensitivity has been designated as Low Risk.

Background Investigation – The level of background investigation commensurate with the required level of access is National Agency Check with Written Inquiries (NACI). Non-citizen contract personnel appointed to Low Risk or Nonsensitive positions will be subject to a National Agency Check with Law Enforcement and Credit Check (NACLC).

Contractor Responsibilities:

The Contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the Contractor shall reimburse VA within 30 days after receipt of a Bill of Collection. The estimated cost of the NACI or NACLC is $200.00 per person.

The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they are able to read, write, speak, and understand the English language.

The Contractor employees shall download, complete, and mail the documents required for a Low Risk Position within twenty (20) calendar days of receipt of e-mail notification from the VA Security Investigations Center (SIC). Documents shall be downloaded from the following website:

http://www.va.gov/vabackground_investigations

Electronic fingerprinting can be performed at the Human Resources Office (See COR for assistance).

The Contractor, when notified of an unfavorable determination by the Government, will withdraw the employee from consideration from working under the contract.

Failure to comply with the Contractor personnel security requirements may result in termination of the contract for default.

Government Responsibilities:

Upon receipt, the VA Office of Security and Law Enforcement will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation.

The VA facility will pay for investigations conducted by the Office of Personnel Management (OPM) in advance. In these instances, the Contractor will reimburse the VA facility within 30 days after receipt of a Bill of Collection.

The VA Office of Security and Law Enforcement will notify the Contracting Officer and Contractor after adjudicating the results of the background investigations received from OPM.

The Contracting Officer will ensure that the Contractor provides evidence that investigations have been completed or are in the process of being requested.

Contractor personnel performing work under this contract shall satisfy all requirements for appropriate security eligibility in dealing with access to sensitive information and information systems belonging to or being used on behalf of the Department of Veterans Affairs. The Contractor will be responsible for the actions of those individuals they provide to perform work for the VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor will be responsible for all resources necessary to remedy the incident. Printed output containing sensitive VHA data will be stored in a secured area, and disposed of properly by shredding or similar methods. Under the provisions of the Privacy Act of 1974 as amended, personnel performing work under this contract have an obligation to protect VA information indefinitely. Furthermore, it is the Contractor's responsibility to notify the Information Management staff when access to Information Management systems is no longer needed by personnel performing work under this contract.

Contractor employees are required to complete the online training classes entitled “VA Cyber Security Awareness” and “VHA Privacy Policy.” The necessary link and instructions to gain access are found at http://www.vcampus.com/cciivv/valo/index.html. A Certificate of successful completion will be generated. The certificate shall be mailed to Judy Buccini, Information Security Officer, internal mail routing symbol 003I-H or faxed to 412-365-4614.

The Contractor will provide health care to patients seeking such care from or through VA. As such, the Contractor is considered part of the Department health activity for purposes of the following statutes and the VA regulations implementing these statutes: the Privacy Act, 5 U.S.C. § 552a, and 38 U.S.C. §§ 5701, 7705 and 7332. Contractor and its employees may have access to patient medical records to the extent necessary for the contract or to perform this contract. Notwithstanding any other provision of this agreement, the Contractor and its employees may disclose patient treatment records only pursuant to explicit disclosure authority from VA. Contractor and its employees are subject to the penalties and liabilities provided under statutes and regulations for unauthorized disclosures of such records and contents.

The VA may provide Contractor and subcontractor employees with access to VA automated patient records maintained on VA computer systems only to the extent and under the same conditions and requirements as VA provides access to these records to its own employees.

All Contractor personnel and any subcontracted employees, if applicable, accessing the VISTA system will be required to sign and abide by all VA security policies, and applicable VA confidentiality statutes, 38 U.S.C. §5701, 38 U.S.C. §7332, and the Privacy Act, 5 U.S.C. §552a. The VA will provide access applications and security agreements. Contractor shall ensure the confidentiality of all patient information and shall be held liable in the event of the breach of confidentiality. Due to the confidential nature of medical reports, all transcription must be completed in areas that provide reasonable security. All documents are confidential and are protected under the Privacy Act of 1974, as amended. All vendor personnel shall be required to observe the requirements imposed on sensitive data by law, federal regulations, VA statutes and policy, DM&S policy and the associated requirements to insure appropriate screening of personnel.

The database utilized by the Contractor under this agreement, the adverse drug event reports provided to the Contractor by VA, and documents created from analyzing this database, the adverse drug event reports, and patient medical records are medical quality assurance records protected by 38 U.S.C. § 5705, its implementing regulations at 38 U.S.C. §§ 17.500-.511 and VHA Directive 2002-043, Quality Management (QM) And Patient Safety Activities That Can Generate Confidential Documents. These records may be disclosed only as authorized by § 5705 and the VA regulations. Disclosure of these records in violation of § 5705 is a criminal offense under 38 U.S.C. § 5705(e).

The treatment and administrative patient records created by, or provided to, the Contractor under this agreement are covered by the VA system of records entitled "Patient Medical Records - VA (24VA136).

Records created by the Contractor in the course of treating VA patients under this agreement are the property of the VA and shall not be accessed, released, transferred or destroyed except in accordance with applicable federal law and regulations. Upon expiration of this contract or termination of the contract, the Contractor will promptly provide the VA with any individually identified VA patient treatment records.

All portable media (including but not limited to thumb-drives, CD-ROMs, etc) utilized by the Contractor under this contract must be encrypted in accordance with the security requirements identified in FIPS 140-2. Only thumb drives and encryption software explicitly approved by the VA may be used.

No VA data is permitted to be stored on a desktop or laptop computer hard drive. Any portable computer used under this contract must have the hard drive encrypted in accordance with FIPS 140-2.

PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL

All personnel employed by the Contractor must comply with Homeland Security Presidential Directive 12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201, which requires all federal employees, Contractors and affiliates to have a Personal Identity Verification (PIV) identification card. The PIV process will be initiated and completed by the VA Medical Center. The Contractor will be responsible for all costs associated with transportation of the employee to the VA Medical Center to initiate the fingerprinting and overall process. The COTR will ensure all Contractor employees are informed of procedures for obtaining proper Identification cards.

Supplemental Agreement

Contract is modified to include the VA Information and Information System Security/Privacy Requirements for IT Contracts dated Aug 2008 (provided) and following statement and clause VAAR 852.273-75:

"To monitor and enforce these media sanitization requirements the VA will require the vendor to maintain an active inventory of all media used to store VA information including hard drives in workstations, servers, or RAID sets; CD/optical drives; USB Flash drives; backup tapes; or any other device used for storage of VA information. Each storage device must be specified by description (for example: “Quantity 8: HP 72.8 GB Hard drive – 320 MBps” or “Quantity 75: Sony LTX-200G Ultrium backup tapes”). If feasible the serial number physically attached or marked on the device by the manufacturer must also be included in the inventory. The inventory will be continuously updated as new storage media is added. Disposal of any media used to store VA information without prior approval from the VA is prohibited. "

A.1 VAAR 852.273-75 SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (Interim - October 2008)

(a) The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce's National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST's Web site at:

http://checklists.nist.gov

(b) To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in "VA Information and Information System Security/Privacy Requirements for IT Contracts" located at the following Web site:

http://www.iprm.oit.va.gov

(End of Clause)

Department of Veterans Affairs Office of Information & Technology

VA Information and Information System Security/Privacy Requirements for IT Contracts

Prepared by:

The Office of the Assistant Deputy Director for Information Protection and Risk Management (IPRM)

August 2008

Page 1 of

VA Information and Information System Security/Privacy Requirements for IT Contracts

General

All contractors and contractor personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA, and VA personnel, regarding information and information system security. Contractors must follow policies and procedures outlined in VA Directive 6500, Information Security Program and its handbooks to ensure appropriate security controls are in place.

Access to VA Information and VA Information Systems

A contractor shall request logical (technical) and/or physical access to VA information and VA information systems for employees, subcontractors, and affiliates only to the extent necessary: (1) to perform the services specified in the contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the contract, and (3) for individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same type of VA information.

All contractors and subcontractors working with VA Sensitive Information are subject to the same investigative requirements as those of regular VA appointees or employees who have access to the same types of information. The level of background security investigation will be in accordance with VA Directive 0710, Handbook 0710, which are available at: http://www1.va.gov/vapubs/ and VHA Directive 0710 and implementing Handbook 0710.01 which are available at: http://www1.va.gov/vhapublications/index.cfm. Contractors are responsible for screening their employees. The following are VA’s approved policy exceptions for meeting VA’s background screenings/investigative requirements for certain types of contractors:

· Contract personnel not accessing VA information resources such as personnel hired to maintain the medical facility grounds, construction contracts, utility system contractors, etc.,

· Contract personnel with limited and intermittent access to equipment connected to facility networks on which no VA sensitive information is available, including contractors who install, maintain, and repair networked building equipment such as fire alarm; heating, ventilation, and air conditioning equipment; elevator control systems, etc. If equipment to be repaired is located within sensitive areas (e.g. computer room/communications closets) VA IT staff must escort contractors while on site.

· Contract personnel with limited and intermittent access to equipment connected to facility networks on which limited VA sensitive information may reside, including medical equipment contractors who install, maintain, and repair networked medical equipment such as CT scanners, EKG systems, ICU monitoring, etc. In this case, Veterans Health Administration facilities must have a duly executed VA business associate agreement (BAA) in place with the vendor in accordance with VHA Handbook 1600.01, Business Associates, to assure compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in addition to the contract. Contract personnel, if on site, should be escorted by VA IT staff.

Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry safeguards the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. Defense Security Service (DSS) administers the NISP on behalf of the Department of Defense and 23 other federal agencies within the Executive Branch. VA will verify clearance through DSS.

VA Information Custodial Requirements

Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the contracting officer. This clause expressly limits the contractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d)(1).

Information generated by a Contractor as a part of the contractor’s normal business operations, such as medical records created in the course of providing treatment, is subject to a review by the Office of General Counsel (OGC) to determine if the information is the property of VA and subject to VA policy. If the information is determined by OGC to not be the property of VA, the restrictions required for VA information will not apply.

VA information will not be co-mingled with any other data on the contractors/subcontractors information systems/media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. VA also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization procedures to ensure they are in compliance with VA policy requirements.

Prior to termination or completion of this contract, contractor will not destroy information received from VA or gathered or created by the contractor in the course of performing this contract without prior written approval by the VA contracting officer. Any data destruction done on behalf of VA by a contractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, and applicable VA Records Control Schedules.

The contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies.