36C24923Q0443 0001.docx

36C24923Q0443 - 0001 36C24923Q0443 - 0001

5. PROJECT NUMBER (if applicable)

CODE

7.

ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF

PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE

OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERE

D CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendmen t, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED

STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF

CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF

SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer) Department of Veterans Affairs Network Contracting Office 9 (90C)

NCO 9

1639 Medical Center Parkway, Suite 400 Murfreesboro TN 37129 Network Contracting Office 9 Department of Veterans Affairs Network Contracting Office (90C) 1639 Medical Center Parkway Suite 400 Murfreesboro TN 37129 To all Offerors/Bidders

36C24923Q0443 07-26-2023

X X X

See CONTINUATION Page This amendment is set forth as follows:

1). Contractor Questions and the Government's Response to date are found on the attached pages.

2). The questions submission period in the solicitation remains unchanged.

3). The updated SOW has been included to reflect a change in the delivery time for the Jackson location (refer to question #6). The lab delivery times have been changed to 1:00pm and 6:00pm to allow for sufficient commute ti me.

Shawn M. Hendricks Contracting Officer

NCO915L2-4043

CONTINUATION PAGE

Vendor Questions/Government Answers

We have a few questions regarding this Request for Proposal. We are asking these questions to better understand the nature of the requirement so that we can provide the best possible value to the Government. Please see below:

Government Response: For Clarification the solicitation was issued as a Request for Quote in accordance with FAR Part 13 – Simplified Acquisition Procedures. There is no Request for Proposals for this acquisition. Request for Proposals pertain to FAR Part 15 – Contracting by Negotiation. FAR Part 15 procedures will not be used for this requirement.

1. What was the cost of the final full option year of the previous contract?

Government Response: $241,823.40 for Period of Performance 10/01/2022 through 09/30/2023

1. How many drivers/vehicles are currently used to service the current contract?

Government Response: This information will not be provided

1. What is the vehicle size currently servicing this location?

Government Response: This information will not be provided

1. Do you accept CPARs evaluations as additional Past Performance information?

Government Response: Yes, any information pertaining to past performance will be accepted.

1. Regarding specific employees information: It is common practice for small businesses that the drivers, cars and other equipment used for a contract are not sourced until after an award has been made, for cost effectiveness and to reduce loss. However, we will be forwarding our standard Training Certificates-Procedures for your reference, is this information acceptable?

Government Response: Training certificates and procedures are not required to be submitted with a quote. This will be required only after contract award.

1. Vendor Question: I am writing to inquire about the pick-up times and drop off times. Is the client absolutely set on those? Thank you.

For example: CBOC 180 Old Hickory Blvd A Jackson, TN 38305 NORTH MEMPHIS, TENNESSEE - 2 pickups (12:00 PM and 4:00 PM) Lab Delivery- 1:00 PM and 5:00 PM VA North Primary Care Clinic Laboratory Section 3461 Austin Peay Highway Memphis, TN. This route at this time according to google maps would take about 1hr 10 mins to 1hr 30 mins via I40 and an additional 10min via TN-14

Government Response: The Statement of Work will be changed to read as follows concerning the Jackson route.

JACKSON, TENNESSEE - 2 pickups (11:30 & 4:30PM) Lab Delivery- 1:00 & 6:00 PM

VA CBOC

180 Old Hickory Blvd Jackson, TN 38305

1. Do all routes need to start at the VAMC?

Government Response: No. Routes would begin at pickup sites

1. Will the couriers be transporting anything other than medical specimens and the associated paperwork?

Government Response: Specimen and associated paperwork and some occasional testing supplies (Tubes, specimen transport devices)

1. Does the VA anticipate any location changes and or clinic closures or new additions?

Government Response: Yes. The North Clinic will relocate eventually to a new location in the Millington area, not sure when yet.

1. Is this a new requirement?

Government Response: No

1. Who is the previous incumbent?

Government Response: JAI ALEXIA CONSULTING INC

1. How much was the previous Award Amount if it is not a new requirement?

Government Response: An award was made to JAI ALEXIA CONSULTING INC on 10/1/2018 at $1,210,047.09 which had a period of performance of 10/01/2018 to 09/30/2023.

1. How many drivers are completing this work currently?

Government Response: This information will not be provided

1. How big are the pickups currently, will a compact car be enough for the pickup loads?

Government Response: No information will be provided concerning the process used by the contractor currently performing the services. It is the sole discretion of the contractor to select the vehicle size to be used during the performance of the contract. The COR however can comment on the general average load size.

COR Response: Average load may consist of 2 – 6 racks containing up to approximately 50 tubes each

1. I see that the VA will be providing coolers so will there be a cooler rotation or will these need to be roundtrip?

Government Response: The VAMC will provide the tube rack, specimen bags and ice packs for transport. The contractor must provide the insulated refrigerated chest with a lock.

1. Will there ever be a need for roundtrips?

Government Response: No

1. Will the courier need to start at the VA to transport supplies or will they start at the clinic?

Government Response: They will start at the clinics

1. Are all of the listed Clinics up and running?

Government Response: Yes

1. Will the VA be proving the refrigerants or Dry ice that is needed?

Government Response: Each site should have ice packs to load specimen

1. If they are not proving the refrigerants or Dry Ice can you give an amount that will be required per pickup?

Government Response: There should be enough refrigerant to keep specimen at the proper temperature during transport that is provided by the clinic.

1. HELLO, I WAS TRYING TO SEE IF YOU WERE STILL ACCEPTING QUOTES FOR THE CONTRACT FOR MEDICAL COURIER

Government Response: The deadline for quote submissions is August 4th, 2023 11:00AM CST.

1. What is the recommended size of the cooler the contractor needs to supply?

Government Response: At least 18’W x 9”D x 13”H

1. Can the same cooler contain both refrigerator and frozen specimens?

Government Response: Under routine conditions frozen specimen will not need to be transported by courier from CBOC.

1. How many cooler(s) will each CBOC require?

Government Response: Generally there is 1-2 coolers per CBOC

1. Are there any outside labeling requirements for the coolers?

Government Response: The coolers must be marked with the appropriate marking to identify the transport of medical specimen in accordance with DOT, CDC, OSHA and IATA standards

1. Will the CBOC supplies fit into the return cooler?

Government Response: Yes. If supplies are to be transported to the CBOC from the hospital, the hospital staff will package for delivery

1. Once the contract is awarded how many weeks will the contractor be given to ramp up?

Government Response: The estimated timeline of events are as follows: quotes are due by 11:00CST on August 4, 2023. Depending on the number of quotes received, award evaluations are estimated to be completed by August 25th, 2023. An award notice would be sent out by August 31st, 2023. The expectation of the government is that the contractor would be prepared to begin services on October 1, 2023. In this example the successful contractor would have approximately one month to begin making preparations. However, this is only an estimated timeline which may be moved by several days in either direction.

1. Are passenger cars/mini-SUVs acceptable vehicles?

Government Response: It is the sole discretion of the contractor to select the vehicle size to be used during the performance of the contract

1. Will magnetic signs with the company logo and name on the courier’s vehicle suffice?

Government Response: Yes.

1. Are there any scheduled locations listed scheduled to close or relocate during the course of the contract.

Government Response: The North Clinic is scheduled to re-locate in the future. Some of the clinics are contracted and depending on the timeline of that contract the contracted clinic location may change slightly

1. Please confirm the CBOCs are responsible for securely packing the specimens and locking the transport coolers.

Government Response: Yes the CBOC must package and lock cooler. Cooler is opened by hospital lab staff upon arrival of courier to facility

1. Who is responsible of unlocking the transport cooler and inspecting the specimens at the VAMC?

Government Response: Hospital lab staff is responsible for unlocking and verifying cooler items are accounted for.

1. Will there be any leeway with the pickup and delivery times?

Government Response: It is important to maintain the pickup and delivery times as the lab staffs according to the expected increase volume of specimen to be processed. Leeway may be provided due to weather conditions and traffic.

1. When the courier arrives will the coolers be packed and ready to go?

Government Response: It is the CBOCs responsibility to have all specimen ready at the appointed time for pickup and delivery to the main hospital lab.

1. Will the couriers be transporting any narcotics and/or prescriptions?

Government Response: No.

Revised SOW

1. (1) INTRODUCTION AND SCOPE OF WORK

The contractor shall provide to the Department of Veterans Affairs, Lt. Col. Luke Weathers, Jr., VA Medical Center, Memphis, TN COURIER SERVICES to include personnel, equipment and transportation for the delivery of Laboratory Specimens from the Community Based Outpatient Clinics (CBOCs) listed below to the main Laboratory at the Lt. Col. Luke Weathers Jr. VA Medical Center (VAMC)Department of Veterans Affairs Medical Center, 1030 Jefferson Ave, Memphis TN. Laboratory specimens/samples shall be picked up at not earlier than the times indicated for delivery at the times indicated below. Contractor’s delivery of specimens/samples to the Department of Veteran’s Affairs Medical CenterVAMC shall not exceed two 1-3 (2) hours after schedule pick up time on the same day depending on location and distance of CBOC. If the contractor fails to furnish specimen transport servicedeliver within a reasonable time (within two (2) hour under usual circumstanceshe specified delivery time ) of scheduled pick-up times, the Veteran Administration reserves the right to obtain service from another source and to charge the contractor with any excess cost that may result. The contractor shall notify the Contracting Officer’s Representative (COR), Clarence Hale @ 901-523-8990 ext. 5099 or lab staff @ 901-523-8990 ext. 5514 or 5549 immediately by phone of any unforeseen delays of unusual events (traffic, road construction, road detour, etc.) regarding delivery of specimens that shall delay to the Department of Veterans Affairs Medical, Memphis, TN laboratory. Delays must be considered beyond the control of the contractor. If specimens arrive after scheduled delivery time from the CBOC, the VA may send the specimens to an outside Reference laboratory at the courier’s expense. If lateness is due to unforeseen circumstances, the decision to charge will be made by the contracting officer or designee. It shall be the contractor’s responsibility to show proof that the delay was due to circumstances beyond the control of the contractor. Failure to respond to scheduled service requests within the specific times may be grounds for terminating the contract. The contractor shall ensure the confidentiality of all patient information on laboratory samples being transported. The contractor shall be required to sign a Business Associates Agreement.

2.

3. (2) REQUIREMENTS

a. SPECIMEN PICKUP for CBOC’s

1. Specimens shall be picked up and delivered from all CBOCs, Monday througthrough h Friday excluding government holidays and holidays observed by each clinic.

2.

3. The VAMCDepartment of Veterans Affairs Medical Center will provide the tube rack, specimen bags and dry ice pack for transport. The contractor shall provide the insulated refrigerated chest with a lock and return all laboratory supplies to each CBOC with each return visit. The insulated chest provided by the contractor must have a lock, and must be capable of accommodating refrigerated and frozen samples (dry ice) and be used for pick-up and delivery of specimens. Contractor must maintain proper temperature in vehicles to preserve specimens. Temperature in the insulated chest must be maintained at no more than 5° C for refrigerated samples and -20°C for frozen specimens. All specimens must be transported in accordance with local, state, and federal regulations.

4.

5.

6. CBOC personnel will place specimens upright in a tube rack into an appropriately labeled, fluid-proof secondary container (e.g. a plastic bio hazardous labeled specimen bag). Allow only 10 tubes (50 ml) per plastic specimen bag. Place enough absorbent material (i.e. 1-2 paper towels) inside to absorb all contents being shipped. NOTE: This is a safety precaution just in case the specimen tubes break, leak or open during transport.

7.

8. CBOC personnel will place specimen bags in a 1-gallon (12”x16”) plastic bio- hazardous labeled specimen bag. The contractor shall make sure all plastic bags are sealed.

9.

10. CBOC personnel will make sure that all paperwork is separated from the specimen container.

11.

12. CBOC personnel will place specimens upright in an insulated refrigerated chest (ice pack) for transportation to the main laboratory at the Department of Veterans Affairs Medical Center, Memphis, TN.

13.

14. A transportation receipt shall be filled out at the Pick-Up Location and shall include the facility name and phone number and attached to the Clinic Manifest and signed and timed by originating location and then by the courier. The receiving location must also sign and document the Transportation receipt. This receipt and the manifest documents the number of specimens received.

15.

16. The contractor shall notify the Contracting Officer’s Representative (Contracting Officer’s Representative (COR) David E. HuhmanOR) @ 901-523-8990 ext. 2775 Clarence Hale @ 901-523-8990 ext. 5099 or lab staff @ 901-523-8990 ext. 5514 or 5549 immediately by phone of any unforeseen delays or unusual events (traffic, road construction, road detours, etc.) regarding delivery of specimens that shall cause delay to the VAMCDepartment of Veterans Affairs Medical Center, Memphis, TN laboratory. Delays must be considered beyond the control of the contractor. If specimens arrive after scheduled delivery time from each clinic, the specimens may be sent to an outside Reference Laboratory and paid at the courier’s expense. If the lateness is due to unforeseen circumstances, the decision to charge will be made by the contracting officer or designee. It shall be the contractor’s responsibility to show proof that the delay was due to circumstances beyond the control of the contractor.

b. SPECIMEN TRANSPORTATION When transporting specimensspecimens, the contractor shall follow procedures to prevent any exposure, contamination, or release while in transport. Each specimen must be transported in a leak proof primary container, placed within a secondary container. Absorbent material shall be placed in the transport container sufficient to absorb all liquid contents. The transport container shall be secured by lock and labeled with the biohazard symbol. In the event that specimens transported are lost, broken, the Contractor shall be required to submit a written report to the Contracting Officer’s RepresentativeCOR on the same. day at 901-523-8990 ext. 5099 or 901-523-8990 ext. 5514 or 5549 in the absence of the COR or after normal working hours.

c. QUALITY CONTROL The contractor shall develop and maintain a quality control program that ensures courier services are performed in accordance with these specifications. The contractor shall develop and implement procedures to track, identify, prevent, remedy and ensure non-recurrence of defective services. The contractor shall provide a method to accept and resolve customer complaints and notify the customer of the resolution. The contractor shall immediately notify the COR upon receipt of a customer complaint so joint validation may be accomplished. The contractor is responsible for quality control and specification compliance.

d. UNIVERSAL PRECAUTIONS The contractor’s employees/couriers transporting test specimen must be trained in “Universal Precautions” in the handling of biohazard materials (specimens). Training must include utilizing clinical procedures in case of biohazard spills and accidents. The contractor must furnish a record of all required training for each employee transporting specimens.

e. RECORD OF PICK-UP The Contractor must maintain a record and log of daily courier pick-ups and deliveries indicating time and date of pick-up, delivery, number of specimens and signatures.

4. CONTRACTOR COURIERS/DRIVERS

1. All contractor employees must maintain a valid driver’s license for the type of —vehicle operated as required by the States operating therein. Contractor personnel shall wear visible identification at all times while on the premises of any Federal property. It is the responsibility of the Contractor to park in the appropriate designated parking areas (Laboratory entrance, Jefferson Avenue side of hospital). A record of each driver as to character and physical capabilities for performing as a courier must be maintained and made available to the VAMCDepartment of Veterans Affairs Medical Center upon request for inspection.

1. The contractor personnel performing services shall always conduct themselves in a professional manner, present a neat appearance and be easily recognized as a contract employee by having the company name, and employee name affixed to the uniform. The Contractor shall be responsible for furnishing all vehicles, personnel, equipment and supplies, vehicle fuel, uniforms, name tags and/or badges for performance of services under this contract. Employee identifications shall be worn in clear view above the waist. All contractor employees responsible for transporting specimens must have been trained and certified in accordance with DOT (US Department of Transportation), IATA (International Air Transport Association), CDC (Centers for Disease Control), and OSHA (Occupational Safety and Health Organization) requirements

1. The Government reserves the right to restrict any contractor employee from performing services under this contract who do not meet the required qualifications, or who violate Federal regulations or are identified as a potential threat to the security, safety, health and/or operational mission of VA and its veteran population. The restriction of such contractor personnel shall not relieve the contractor from performing all the required services in accordance with all terms, conditions, and schedules contained herein.

1. Taking of Photographs/Videos/Recordings are Prohibited while on VA premises."

4. CONTRACTOR VEHICLES

The vehicles used in the performance of this contract must be licensed and meet the minimum requirements by the States and cities operated therein, Contractor’s vehicle shall have the company name/logo prominently displayed.

TRAINING

a. Vendor must ensure all contractors who shall be working on the contract complete mandatory training programs titled VA Privacy and Information Security Awareness Training and Rules of Behavior (VA 10176) and VHA Privacy and HIPAA Training (VA 10203). The training is offered through the VA Talent Management System (TMS), a system that offers web-based training to VA employees and its partners. He/she must ensure each contract employee self-enrolls for a profile on the VA TMS by visiting HYPERLINK "https://www.tms.va.gov/plateau/user/login.jsp" https://www.tms.va.gov/plateau/user/login.jsp Once there, employees should follow the steps to create a profile, launch the mandatory training, and complete the content prior to their next day at VA. (Please List the COR, Clarence Hale, 901-523-8990 ext. 5099 as the supervisor when prompt). Certificate of completion will be provided prior to assignment and annually thereafter. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

Records Management Records management standard Items relate to records generated in executing this contract and must be followed:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C. Chapter 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government ‘IT’ equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

10. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information

(3)5. DELIVERY SPECIMEN PICK-UP AND DELIVERY LOCATIONS

The Contractor shall be responsible specimen pick-up at the following Community Based Outpatient Clinic locations. Specimens shall be delivered to the VAMCDepartment of Veterans Affairs Medical Center, Memphis, TN main laboratory, Room CW-192. All times listed are Central Time. All pick up times are not earlier orthan times. All delivery times are not later than listed below.times.

JONESBORO, ARKANSAS- 2 pickups (11:30 AM and 5:00 PM) Lab Delivery- 1:30 PM and 7:00 PM 2908 S. Caraway Road Jonesboro, AR 72401

JACKSON, TENNESSEE - 2 pickups (11:30 & 4:30PM) Lab Delivery- 1:00PM2:30 & 6:005:30 PM

VA CBOC

180 Old Hickory Blvd Jackson, TN 38305

NORTH MEMPHIS, TENNESSEE - 2 pickups (12:00 PM and 4:00 PM) Lab Delivery- 1:030 PM and 5:030 PM VA North Primary Care Clinic Laboratory Section 3461 Austin Peay Highway Memphis, TN. 38127 NONCONNAH, TENNESSEE - 2 pickups (11:30 AM and 4:30 PM) Lab Delivery- 12:30 PM and 5:30 PM VA Nonconnah Primary Care Clinic 1689 Nonconnah Parkway Memphis, TN. 38116

DYERSBURG, TENNESSEE - 1 pickup (4:30 PM) Lab Delivery- 6:30 PM Dyersburg CBOC 433 East Parkview St Dyersburg, TN 38024

SAVANNAH, TENNESSEE- 1 pickup (4:30 PM) Lab Delivery- 7:00 PM Hardin County Regional Health Center 765 Florence Road Savannah, TN 38372

HOLLY SPRINGS, MISSISSIPPI — 1 pickup (4:00 PM) Lab Delivery- 5:30 PM 1700 Crescent Meadows Dr.

Holly Springs, MS 38635

HELENA, ARKANSAS — 1 pickup (4:30 PM) Lab Delivery- 7:30 PM 131 Quarles Lane Helena, AR 72342

TUPELO, MISSISSIPPI — 1 pickup (5:00 PM) Lab Delivery- 8:00 PM 1114 Commonwealth Blvd.

Tupelo, MS 38804

(4) INFORMATION SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE FOR INCLUSION INTO CONTRACTS, AS APPROPRIATE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor’s rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term ‘data breach’ means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

6. SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With a 10 working-day notice at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time

The purpose of this RFQ amendment is to post contractor questions with the Government’s response.