36C24921Q0073.docx

Sources Sought 36C249-21-AP-0299 Contract Opportunity Sources Sought Notice

PRODUCT SERVICE CODE

SUBJECT

CONTRACTING OFFICE'S

ZIP-CODE

SOLICITATION NUMBER

RESPONSE DATE/TIME/ZONE

ARCHIVE

DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS

SET-ASIDE

NAICS CODE

CONTRACTING OFFICE

ADDRESS

POINT OF CONTACT

(POC Information Automatically Filled from User Profile Unless Entered)

DESCRIPTION

See Attachment

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

GENERAL INFORMATION

PLACE OF PERFORMANCE

* = Required Field Contract Opportunity Sources Sought Notice Q999 36C249-21-AP-0299 - Tumor Registry Services Louisville (Robley Rex) Veterans Affairs Medical Center 37129 36C24921Q0073 02-12-2021 14:00

CENTRAL TIME, CHICAGO, USA

N 541611 Department of Veterans Affairs Network Contracting Office 9 (90C)

NCO 9

1639 Medical Center Parkway, Suite 400 Murfreesboro TN 37129 Contract Specialist Olonzo Haynes Olonzo.Haynes@va.gov 615-225-6959 Department of Veterans Affairs Robley Rex Louisville Veterans Affairs Medical Center 800 Zorn Ave Louisville

KY

40206-1433

USA

https://www.va.gov/ Department of Veterans Affairs Olonzo.Haynes@va.gov Contract Specialist Email Address This is a Sources Sought notice. This is NOT a solicitation for proposals, proposal abstracts, or quotations. The purpose of this notice is to obtain information regarding the availability and capability of all qualified sources (small and other than small) to perform a potential requirement. The Department of Veterans Affairs, Network Contracting Office 9, hereby provides notice of its anticipated award of a Service Contract to a qualified source. This Contract is expected to be awarded under FAR Part 13. The period of performance shall be for a period of performance consisting of one (1) base year with four (4) one (1) year options at the discretion of the Government beginning upon anticipated award date of 7/22/2021 through 7/31/2026. (See Section 5 of the Statement of Work for anticipated Period of Performance) This Contract will provide for the services of a Certified Tumor Registrar that meets the qualifications outline in Section 2 of the Statement of Work. This requirement is for the Louisville (Robley Rex) Veterans Affairs Medical Center located at 800 Zorn Avenue, Louisville, KY 40206.

THIS SOURCES SOUGHT NOTICE IS NOT A REQUEST FOR COMPETITIVE QUOTES. However, interested parties may identify their interest and capabilities by responding to this requirement no later than February 12, 2021 at 2:00PM, Central Standard Time (CST).

Purpose and Objectives: Your responses to the information requested will assist the Government in determining the appropriate acquisition method. A determination not to compete this requirement, based upon responses to this notice, is solely within the discretion of the Government. Information received will normally be considered solely for determining whether to conduct a competitive procurement.

The Department of Veterans Affairs will NOT be responsible for any costs incurred by interested parties in responding to this notice. Only written responses will be considered. All responses from responsible sources will be fully considered. As a result of analyzing responses to this notice, the Government shall determine if a solicitation will be issued. Any prospective contractor must be registered in the System for Award Management (SAM) to be eligible for award.

Interested parties are encouraged to furnish information by email only with “RESPONSE TO SOURCES SOUGHT NOTICE “36C249-21-AP-0299 TUMOR REGISTRY SERVICES” in the subject line. All documents submitted, will not be returned. All interested parties shall submit clear and convincing documentation demonstrating their capabilities to satisfy the requirements listed within this notice to Contract Specialist, Olonzo Haynes by email at Olonzo.Haynes@va.gov . The capability documentation should include general information and technical background describing in detail, the prospective contractor's capabilities, any reelevate experience that will demonstrate your ability to successfully perform this requirement, and your company’s business size.

Point of Contact: Olonzo Haynes, Contract Specialist e-mail above.

NAICS code: 541611 and SBA Sized Standard is $ $16.5M. PSC Q999 NOTE: Any respondent claiming SDVOSB and VOSB status must be registered and CVE verified in VetBiz Registry https://www.vip.vetbiz.va.gov/.

STATEMENT OF WORK (SOW)

Certified Tumor Registry Services

1. GENERAL: This is a service requirement for Contractor to provide Certified Tumor Registry Services for the Robley Rex, Veterans Affair Medical Center(VAMC), Cancer Registry, located at 800 Zorn Avenue, Louisville, KY 40206.

2. CONTRACTOR QUALIFICATIONS:

The Contractor shall meet the following qualifications:

· Contractor personnel shall be proficient in written and spoken English.

· Contractor personnel shall be computer literate as patient documentation has been directly inputted into an electronic medical record.

· Contractor shall have at least 3 years of experience; with two of the three years past performance within the Veteran’s Health System.

· Contractor shall provide past performance experience with VAMC name, contract number, and contact phone number.

· Contractor shall be proficient with Oncotrax, CPRS, and Vista Imaging for certain reports, i.e. MRIs, etc.

· Contractor shall be a Certified Tumor Registrar (CTR) and provide a copy of certification. In addition, Contractor shall have full time CTRs on staff and provide documentation of their certification also.

· Contractor shall be available to consult with providers regarding registry data and pull custom reports. At times, providers may request specific registry data for a research project, workload data, track/trend treatments vs outcomes, etc. The Contractor shall be available to discuss with providers during business hours and pull/send data.

· Contractor shall have experience with American College of Surgeons accreditation standards.

· Contractor is required to stay current with VA registry changes and information sent out by the VA Central Cancer Registry (VACCR).

3. DESCRIPTION OF SERVICES:

a. Abstracting: Contractor is responsible to transcribe and interpret information from patient records regarding treatment provided to new cancer patients.

· Analytical – Cases that were either diagnosed and/or treated at the Robley Rex VAMC (i.e., Class 10, 13,14, 20, 21, 22)

· Non-Analytical – Cases that may be picked up at the request of the facility that would not usually qualify for abstracting and would not be considered eligible for sending to the National Cancer Registry or not subject to follow-up requirements (i.e., severe cervical dysplasia, non-malignant oncocytomas of the kidneys, prostate PIN, and Class of Cases 30-34)

· Quality Control - Completed abstracts are reviewed by the Contracting Officer’s Representative (COR). Contractor shall correct any mistakes in the registry cases at no cost to the VA.

b. Follow-Up: Contractor is responsible for tracking the care that all patients received in the years following their cancer diagnosis at the Robley Rex VAMC, Louisville, KY and/or at other health care institutions.

c. Case finding/Suspense: Customer shall generate a suspense list by the VA VISTA OncoTrax Program which indicates possible cancer diagnosis. Contractor shall review this list for possible reporting to the National Cancer Registry and report as necessary including the addition of the appropriate AJCC Stage form.

Contractor shall perform all contract services via remote connection to the VA system. Contractor is responsible to provide all equipment and supplies including work areas and computer workstations necessary to complete services required under this contract. Contractor shall be required to ensure set-up with PKI.

VA currently uses a Computerized Patient Record System (CPRS) in VISTA. VA will provide Contractor with electronic access to CPRS for use by the Certified Tumor Registrar. Contractor employees are responsible to access the system a minimum of once every thirty (30) days. Failure to access VA system at least once every thirty (30) days will result in the Contractor’s employees being locked out of the VA system.

Contractor shall assign a project manager to this contract. VA will assign a COR to this contract. The Contractor’s project manager will be available to the VA COR for dealing with the day-to-day issues of the contract.

4. SERVICES

a. The services specified herein may be changed only by written modification to this contract. The VA Contracting Officer will prepare this modification (reference FAR clause 52.212-4(c), Changes).

b. The services to be performed by the Contractor will be performed in accordance with the VA’s policies, procedures, and regulations.

c. This is a non-personal services contract. There is no employer-employee relationship between the VA and the Contractor or the Contractor’s employee(s).

d. Contractor is required to maintain professional liability insurance for the duration of the contract. Contractor must indemnify the Government for any liability producing act or omission by the contract, its employees and agents occurring during contract performance.

5. PERIOD OF PERFORMANCE

Base Year: 07/22/2021 through 07/31/2022 Option Year 1: 08/01/2022 through 07/31/2023 Option Year 2: 08/01/2023 through 07/31/2024 Option Year 3: 08/01/2024 through 07/31/2025 Option Year 4: 08/01/2025 through 07/31/2026

6. DESIGNATION OF CONTRACT REPRESENTATIVE

The Contracting Officer will designate a Contracting Officer Representative by delegation. The COR shall furnish technical guidance and advice regarding the work being performed under this contract. The COR’s primary duties is to evaluate performance on this contract based on the performance standards outline in the Quality Assurance Surveillance Plan(QASP). The foregoing is not to be construed as authorization to interpret or furnish advice and information to the Contractor relative to the financial or legal aspects of the contract.

7. PERSONNEL POLICY

a. The Contractor shall assume full responsibility for protection of the personnel furnishing services under this contract. To carry out this responsibility, the Contractor shall provide the following for these personnel:

· Workers compensation

· Professional liability insurance

· Health examinations

· Income tax withholding, and

· Social security payments.

b. Payments for any leave including sick leave, holiday or vacation time are the responsibility of the Contractor.

c. The Contractor or Sub-contractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Sub-contractor’s employment. The contracting Officer must also be notified by the Contractor or Sub-contractor prior to an unfriendly termination.

8. KEY PERSONNEL AND TEMPORARY EMERGENCY SUBSTITUTIONS

The Contractor shall assign to this contract the following key personnel: Tumor Registrar

a. During the first ninety (90) days of performance, the Contractor shall make NO substitutions of key personnel unless the substitution is necessitated by the individual’s illness, death, or termination of employment. The Contractor shall notify the contracting officer, in writing, within 5 calendar days after the occurrence of any of these events and provide the information required by paragraph (b) below. After the initial 90-day period of the contract, the Contractor shall submit the information required by paragraph (b) to the contracting officer at least 5 days prior to making any permanent substitutions. The contracting officer must approve all substitutions.

b. The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the contracting officer. Proposed substitutes shall have comparable qualifications to those of the persons being replaced. The contracting officer will notify the Contractor after receipt of all required information of the decision on the proposed substitutes. The contract will be modified to reflect any approved changes of key personnel.

9. PAYMENT

The VA agrees to reimburse the Contractor on a monthly basis for resources furnished at the price(s) listed in the Schedule of Items for services rendered and accepted, less any deductions provided in this contract. Amounts due the Contractor will be paid monthly upon receipt of a properly prepared invoice submitted by the Contractor. All invoices shall reference the current contract number. Monthly invoices shall be submitted to the VA no later than 10 days past the last day of each month.

10. VA MONITORING/RECORD KEEPING

The COR will designate appropriate VA personnel to monitor Contractor employee work hours/services through one or a combination of the following mechanisms:

a. Departments being served will monitor Contractor employee work hours through time and attendance logs similar to VA staff positions, to ensure that services called for in the contract have been received by VAMC. The COR will be responsible for verifying contract compliance. Any incidents of Contractor noncompliance as evidenced by the monitoring procedures will be forwarded immediately to the contracting officer.

b. Chief of Staff's office reviews monitoring data. An internal time-keeping form is maintained and reviewed for total number of hours worked per month against monthly average of hours. Part-time personnel's cards are reviewed against their VA tour-of-duty to verify that the services were received.

c. Documentation of services performed will be reviewed prior to certifying payment. The COR will perform periodic spot checks and document with the using service to ensure records monitoring. VA will pay only for services performed at VA, and in strict accordance with the schedule of prices/costs shown in the Schedule of Items. Contract monitoring and recordkeeping procedures will be enough to ensure proper payment and allow audit verification that services were provided.

d. Monthly invoices are generated to VA Fiscal Service who forwards to service's administrative assistant for review. The administrative assistant verifies services were performed against the schedule and logs. Only after verification are invoices certified for payment.

e. The using service, through the COR, will provide a written statement annually to the contracting officer to include a summary of Contractor actions and a statement that all requirements of the contract have been fulfilled as agreed. This summary evaluation will be submitted 60 days prior to expiration of contract (and/or prior to election of option year renewals, if applicable).

f. A Contractor's employee shall not certify bills for payment.

11. HEALTH & HUMAN SERVICE (HHS) / OFFICE OF INSPECTOR GENERAL (OIG)

To ensure that the individuals providing services under the contract have not engaged in fraud or abuse regarding Sections 1128 and 1128A of the Social Security Act regarding federal health care programs, the Contractor is required to check the Health and Human Services - Office of Inspector General (HHS/OIG), List of Excluded Individuals/Entities on the OIG Website (www.hhs.gov/oig) for each person providing services under this contract. Further the Contractor is required to certify in its proposal that all persons listed in the Contractor’s proposal have been compared against the OIG list and are NOT listed. During the performance of this contract the Contractor is prohibited from using any individual or business listed on the List of Excluded Individuals/Entities.

12. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)

Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). As required by HIPAA, the Department of Health and Human Services (HHS) has promulgated rules governing the security and use and disclosure of protected health information by covered entities, including the Department of Veterans Affairs (VA).

13. MEDICAL RECORDS

Clinical or other medical records of VA beneficiaries transcribed by Contractor under this contract are VA records and will be forwarded to the VA. VA medical records MUST BE PROTECTED at all times from loss, misuse, or unauthorized reproduction.

14. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

NOTE: Failure to comply with the Contractor personnel security requirements may result in termination of the contract for default.

All Contractor employees who require access to the Department of Veterans Affairs' Contractors computer systems or have access to sensitive information shall be the subject of a background investigation. The VA obtains the Background Investigation through the Electronic Questionnaires for Investigations Process (e-QIP). Upon receiving a request for the investigation from the Contracting Officer, the Contractor’s employee will be initiated into e-QIP for the Background Investigation followed by an e-mail with instructions to log into e-QIP. A Contractor’s employee shall not commence working at VA under contract until the Contractor and the contracting officer receive notification from the VA Office of Security and Law Enforcement (OSLE) that the contract employee’s application was received complete. A favorable adjudication from the VA Office of Security and Law Enforcement must be received in order for a Contractor employee to continue contract performance. This requirement is applicable to all Sub-contractor personnel.

a. Position Sensitivity - The position sensitivity has been designated as Low Risk.

b. Background Investigation - The level of background investigation commensurate with the required level of access is National Agency Check with Written Inquiries (NACI).

c. Contractor Responsibilities

1. The Contractor shall bear the expense of obtaining background investigations. If the Office of Personnel Management (OPM) conducts the investigation, the Contractor shall reimburse VA within 30 days. If timely payment is not made within 30 days from date of bill for collection, then VA shall deduct the cost incurred from the Contractor’s 1st month’s invoice(s) for services rendered.

2. It is imperative for the Contractor to provide, at the request of VA, a listing of Contractor personnel performing services under the contract in order for the background investigation process to commence. This list will include name (first, middle, last); social security number; date of birth; city, state, country of birth; employee email address; and employee occupation.

3. The Contractor or their employees shall submit a complete background investigation packet through the Electronic Questionnaires for Investigations Process (e-QIP). Additional guidance and information will be provided through e-mail from the VA Office of Security and Law Enforcement.

4. The following required forms must be submitted through the e-QIP System to the VA Office of Security and Law Enforcement before contract performance begins:

i. e-QIP Signature Pages (two) (print, sign and submit)

ii. Optional Form 306, Declaration for Federal Employment

iii. Electronic Fingerprint Form (FD 258) or electronic fingerprints

5. Fingerprinting is required with the background investigation. Fingerprinting can be done at the local VA Facility. The Electronic Fingerprint Verification Form must be submitted with the above required forms.

6. The Contractor shall inform the contract employee that when filling out the application, that there should be no gaps in employment history. Any gaps in employment history on Standard Form 85 may result in OPM rejecting the documentation for investigation and delay contract performance.

7. The Contractor, when notified of an unfavorable determination by the government, shall withdraw the employee from consideration from working under the contract, and at the request of the VA, submit another employee for consideration.

8. All Contractor employees and Sub-contractors are required to complete VA’s Privacy training annually. All Contractor employees and Sub-contractors requiring access to VA computer network are required to complete Information Security Training Cyber Security training courses annually either on-line or hard copy. Documented proof must be provided to the Contracting Officer.

9. The Contractor will notify the VA Information Security Officer and Contracting Officer immediately when their employee(s) no longer require access to VA computer systems.

d. Government Responsibilities

1. The contracting officer will request the Contractor employee’s background investigation by the Office of Security and Law Enforcement.

2. The Office of Security and Law Enforcement will notify the Contractor with instructions for the Contractor's employees, coordinate the background investigations, and notify the contracting officer and Contractor of the results of the investigations.

3. The VA facility will pay for requested investigations in advance. A bill for collection will be sent to the Contractor to reimburse the VA facility. The Contractor will reimburse the VA facility within 30 days. If timely payment is not made within 30 days from date of bill for collection, then VA shall deduct the cost incurred from the Contractor’s 1st month’s invoice(s) for services rendered.

e. The current fees associated with background investigations are $267.00 each for low level investigation, $825.00 each for medium level investigation, and $3,015.00 each for high level investigation.

15. REQUIREMENTS FOR REMOTE SYSTEM ACCESS

The Contractor will be allowed remote access to VA computer systems in the performance of the contract. VA has stringent policies and procedures covering remote computer access therefore, the following responsibilities are outlined below.

a. Government Responsibilities

1. VA will provide secure and reliable remote access to systems, applications, and information on the VA network to the Contractor.

2. VA will provide firewall and antiviral software with updates to the Contractor.

3. VA will provide security training to Contractor’s current employees and new employees as needed.

4. After contract award, VA reserves the right to inspect Contractor’s facilities, installations, operations, documentation, computers, records and databases.

b. Contractor Responsibilities

1. The Contractor will ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and contract terms and conditions.

2. The Contractor shall install VA provided firewall and antiviral software on all networks and/or individual computers accessing VA network. The Contractor is responsible for the installation and testing of all required patches to ensure the security of the system.

3. Contractor will report any security violations or attempted violations or any unanticipated threats or hazards immediately to the COR.

4. Contractor will house their computers in such a way that reduces the risks from environmental threats and hazards. Contractor will protect their computers from unauthorized access, use or removal. Contractor’s computers will be configured to provide protection from malicious code and unauthorized access.

5. All remote connections to VA network must be through Office of Cyber and Information Security (OCIS) authorized configurations and access points. Contractor’s remote access sessions through the internet or other networks must be conducted using VPN Client.

6. Upon termination or expiration of contract, Contractor will sanitize all computer equipment used in performance of this contract according to VA standards and guidelines. Contractor equipment will also be sanitized when transferred or disposed of. Sanitization will ensure that all confidential information is rendered totally unrecoverable.

7. Contractor will notify the COR immediately when their employee(s) no longer require access to VA computer systems.

8. Contractor will not publish or disclose in any manner details of any safeguards either designed or developed by the Contractor and/or Sub-contractors under this contract or otherwise provided by the VA without prior written approval by the contracting officer.

9. The Contractor will require that employees sign VA Computer Access Agreements, follow VA guidelines to create strong passwords, do not divulge access codes or passwords, safeguard all sensitive information, and follow all privacy requirements.

10. The Contractor will notify the contracting officer in writing of any Sub-contractors performing work under this contract that will require remote access to VA computer systems. Contractors will be held responsible for their Sub-contractors. All of the security and privacy provisions of this contract will extend to any Sub-contractors.

11. The Contractor will adhere to the remote access requirements and ensure that systems are properly configured, and appropriate security mechanisms and monitoring devices are up to date with best practices and technical standards.

12. VA information including identifiable health information may not reside on Contractor’s systems or devices unless specifically designated and approved as appropriate under the terms of the contract.

c. VA routinely reviews and updates policies and procedures regarding remote computer access. Therefore, this contact may be modified to reflect new policies and procedures implemented during the term of this agreement.

16. SPECIAL SECURITY TRAINING REQUIREMENTS

a. All Contractor employees and Sub-contractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems

2. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training

3. Successfully complete the appropriate VA privacy training and annually complete required privacy training

4. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access (to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.)

b. The Contractor shall provide to the contracting officer and the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within one (1) week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

17. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Sub-contractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Sub-contractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Sub-contractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the Contractor/Sub-contractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Sub-contractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Sub-contractor’s employ. The Contracting Officer must also be notified immediately by the Contractor or Sub-contractor prior to an unfriendly termination.

18. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the Contractor or Sub-contractor by VA for the performance or administration of this contract or information developed by the Contractor/ Sub-contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the Contractor/Sub-contractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the Contractors/Sub-contractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of Contractor and Sub-contractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, Contractor/Sub-contractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a Contractor/Sub-contractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The Contractor/Sub-contractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The Contractor/Sub-contractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Sub-contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Sub-contractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. The Contractor/Sub-contractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

h. The Contractor/Sub-contractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

i. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Sub-contractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The Contractor/Sub-contractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

j. Notwithstanding the provision above, the Contractor/Sub-contractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Sub-contractor is in receipt of a court order or other requests for the above-mentioned information, that Contractor/Sub-contractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

k. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the Contractor/Sub-contractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

19. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/Sub-contractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Sub-contractor has access.

b. To the extent known by the Contractor/Sub-contractor, the Contractor/Sub-contractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Sub-contractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. d. In instances of theft or break-in or other criminal activity, the Contractor/Sub-contractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The Contractor, its employees, and its Sub-contractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Sub-contractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

20. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the Contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the Contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

21. REQUIRED REGISTRATION WITH CONTRACTOR PERFORMANCE ASSESSMENT REPORTING SYSTEM (CPARS)

a. As prescribed in Federal Acquisition Regulation (FAR) Part 42.15, the Department of Veterans Affairs (VA) evaluates Contractor past performance on all contracts that exceed the thresholds outlined in FAR Part 42.15, and shares those evaluations with other Federal Government contract specialists and procurement officials through the Past Performance Information Retrieval System (PPIRS). The FAR requires that the Contractor be provided an opportunity to comment on past performance evaluations prior to the posting of each report. To fulfill this requirement VA uses an online database, the Contractor Performance Assessment Reporting System (CPARS). The CPARS database information is uploaded to the Past Performance Information Retrieval System (PPIRS) database, which is available to all Federal agencies.

b. Each Contractor whose contract award is estimated to exceed the thresholds outlined in FAR Part 42.15 is required to provide to the contracting officer contact information for the Contractor’s representative with their response to the solicitation. The Contractor is responsible to notify the contracting officer of any change to the Contractor’s representative during the contract performance period. Contractor’s representative contact information consists of a name and email address.

c. The Government will register the contract within thirty days after contract award. For contracts with a period of one year or less, the contracting officer will perform a single evaluation when the contract is complete. For contracts exceeding one year, the contracting officer will evaluate the Contractor’s performance annually. Intermediate reports will be filed each year until the last year of the contract, when the final report will be completed. Each report shall be forwarded in CPARS to the Contractor’s designated representative for comment. The Contractor’s representative will have thirty days to submit any comments and return the report to the VA contracting officer. Failure by the Contractor to respond within those thirty days will result in the Government’s evaluation being placed on file in PPIRS without Contractor’s comments.

22. CONTRACTOR CERTIFICATION

a. The Contractor certifies that the Contractor shall comply with any and all legal provisions contained in the Immigration and Nationality Act of 1952, As Amended; its related laws and regulations that are enforced by Homeland Security, Immigration and Customs Enforcement and the U.S Department of Labor as these may relate to non-immigrant foreign nationals working under contract or subcontract for the Contractor while providing services to Department of Veterans Affairs patient referrals.

b. While performing services for the Department of Veterans Affairs, the Contractor shall not knowingly employ, contract or subcontract with an illegal alien; foreign national non-immigrant who is in violation their status, as a result of their failure to maintain or comply with the terms and conditions of their admission into the United States.

c. If the Contractor fails to comply with any requirements outlined in the preceding paragraphs or its Agency regulations, the Department of Veterans Affairs may, at its discretion, require that the foreign national who failed to maintain their legal status in the United States or otherwise failed to comply with the requirements of the laws administered by Homeland Security, Immigration and Customs Enforcement and the U.S Department of Labor, shall be prohibited from working at the Contractor’s place of business that services Department of Veterans Affairs patient referrals; or other place where the Contractor provides services to veterans who have been referred by the Department of Veterans Affairs; and shall form the basis for termination of this contract for breach.

d. The Contractor agrees to obtain a similar certification from any Sub-contractor that furnishes services to the VA on behalf of the Contractor under this contract.

Signature: _______________________________________________________

Date: ___________________________________________________________

Typed Name and Title: _____________________________________________

Company Name and Address: ________________________________________

This certification concerns a matter within the jurisdiction of an agency of the United States and the making of a false, fictitious, or fraudulent certification may render the maker subject to prosecution under 18 U.S.C. 1001.

END OF SOURCES SOUGHT NOTICE

Option Year 3: __________-______________ Option Year 4: __________- ______________