S02 36C24924Q0420 Sources Sought Notice.pdf

Sources Sought Notice

*= Required Field Sources Sought Notice

SUBJECT* FY25- Peer Review Svc (RAD)

GENERAL INFORMATION

CONTRACTING OFFICE’S ZIP CODE* 37129

SOLICITATION NUMBER* 36C24924Q0420

RESPONSE DATE/TIME/ZONE 08-30-2024 10 AM CENTRAL TIME, CHICAGO,

USA

ARCHIVE 10 DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS N

SET-ASIDE SBA

PRODUCT SERVICE CODE* Q522

NAICS CODE* 541690

CONTRACTING OFFICE ADDRESS Department of Veterans Affairs

Network Contracting Office 9 (90C)

NCO 9

1639 Medical Center Parkway, Suite 204

Murfreesboro TN 37129

POINT OF CONTACT*

Contract Specialist

Michael McCarthy michael.mccarthy5@va.gov

615-225-6889

PLACE OF PERFORMANCE

ADDRESS VA Medical Center Memphis l030 Jefferson Avenue

Memphis TN

POSTAL CODE 38104-2127

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

DISCLAIMER

This RFI is issued solely for information and planning purposes only and does not constitute a solicitation. All information received in response to this RFI that is marked as proprietary will be handled accordingly. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI.

Performance Work Statement

Radiation Oncologist Peer Review Services

The Contractor shall furnish all necessary travel, labor, material, supplies, tools, equipment, documentation, and qualified personnel to provide on-site medical physics and peer review support or services for the Veterans Health Administration (VHA) located at the Lt. Col. Luke Weathers, Jr. VA Medical Center, 116 N Pauline Street, Memphis, TN 38105, under the terms and conditions stated herein.

The Period of Performance (PoP) will have Five, One Year Ordering Periods (OP).

OP 1 - October 1, 2024, thru September 31, 2025 OP 2 - October 1, 2025, thru September 31, 2026 OP 3 - October 1, 2026, thru September 31, 2027 OP 4 - October 1, 2027, thru September 31, 2028 OP 5 - October 1, 2028, thru September 31, 2029

The C&A requirements do not apply, and a Security Accreditation Package is not required.

1. Performance – Radiation Oncologist

All radiation oncologist peer review work shall be performed by a qualified radiation oncologist quarterly. A qualified radiation oncologist is a person who is certified by the American Board of Radiology (ABR) of a physician who confines his/her professional practice to radiation oncology or certification in Radiation Oncology or Therapeutic Radiology by the ABR, the American Osteopathic Board of Radiology, or the Royal College of Physicians and Surgeons of Canada. Experience with Stereotactic Body Radiation Therapy (SBRT), therapy (IGRT), (VMAT) procedures is required.

The estimated quantity of records requiring a radiation oncologist review is between forty

(40) and sixty (60) annually.

During the follow-on quarterly reviews, the contractor shall review a minimum of ten (10) cases or ten (10) percent of the total population of new patient treatment records regarding a radiation oncologist peer review.

2. Performance - Medical Physicist

All physicist peer review work shall be performed by a qualified medical physicist quarterly. A qualified medical physicist is a person who is certified in the appropriate subfield (s) by the American Board of Radiology (ABR), the Canadian College of Physicists in Medicine, or by the American Board of Medical Physics (ABMP). The appropriate subfield of medical physics for this guideline is Therapeutic Medical Physics. (Previous medical physics certification categories including Radiological Physics and Therapeutic Radiological Physics are also acceptable.)

The estimated quantity of records requiring a medical physicist review is between five (5) each quarter for a total of twenty (20) annually.

During the follow-on quarterly reviews, the contractor shall review five (5) new patient treatment records regarding a medical physics peer review.

All dosimetry peer review work shall be performed by a qualified medical physicist quarterly.

A qualified medical physicist is a person who is certified in the appropriate subfield (s) by the American Board of Radiology (ABR), the Canadian College of Physicists in Medicine, or by the American Board of Medical Physics (ABMP). The appropriate subfield of medical physics for this guideline is Therapeutic Medical Physics. (Previous medical physics certification categories including Radiological Physics and Therapeutic Radiological Physics are also acceptable.)

The estimated quantity of records requiring a dosimetry review is between five (5) each quarter for a total of twenty (20) annually.

During the follow-on quarterly reviews, the contractor shall review five (5) new patient treatment records regarding a dosimetry peer review.

3. Mandatory Services to be Performed - Deliverables

A. The qualified radiation oncologist shall perform a peer review of the Radiation Oncology Department records as they pertain to the radiation oncologist documents no greater than 90 days from the last review and no sooner than 30 days from the last review.

1. Components of Peer Review – Radiation Oncologist

a. Patient Care that is appropriate and effective.

b. Medical Knowledge of the natural history of cancer and the established and evolving biomedical understanding of radiation delivery and the application of this knowledge to patient care.

c. Practice-based learning and improvement, which includes results of relevant clinical investigation as it pertains to their own patient care.

d. Interpersonal and communication skills reflected in documentation of patient care and patient consent.

e. Professionalism, as manifested through a commitment to carrying out professional responsibilities, adherence to ethical principles as reflected by treatment management.

f. Systems based practice, as manifested by actions that demonstrate an awareness of responsiveness to the larger context and system of health care and the ability to effectively call on system resources to provide care that is of optimal value.

B. The qualified medical physicist shall perform a peer review of the Radiation

Oncology Department records as they pertain to the medical physicist documents and dosimetry documents no greater than 90 days from the last review and no sooner than 30 days from the last review.

1. Components of Peer Review – Medical Physics

a. Independent check of treatment machines’ output calibrations. For the LINACs, the reviewer may alternatively verify that independent thermoluminescent dosimeter (TLD) output verifications have been performed during the past year, and that the results are within 5%, the RPC's criterion of acceptability in its mailed TLD program.

b. Chart audit of a minimum of five randomly selected recently completed treatment charts, for patients treated during the review period. The charts should be representative of the most common disease types treated in the clinic. The chart audit should include the following components.

1. Verify that the dosimetry calculations were checked by a second person or second method, before the lesser of three fractions or 10% of the total dose was delivered.

2. Verify that the chart was reviewed by the physics staff on a weekly basis.

3. Verify that the physicist reviewed the chart at the completion of treatment.

4. Assess whether the treatment plan documents, at a minimum, localization of target and relevant normal organs, beam geometry, use of beam modifiers, beam margins around the target, choice of treatment modality and energy, choice of dose reference point and normalization, and evaluation of normal organ doses.

c. Review of the quality control and quality assurance program, using AAPM's TG-40 as a guideline (as well as other Task Group reports as appropriate for specialty procedures).

d. Assessment of whether the clinical physics program is adequately documented such that another physicist could readily continue the clinic's physics services in the event of an unplanned extended absence. Clear documentation should exist for clinical dose calculations, treatment machine calibrations and routine quality control, and dosimetry equipment quality control.

e. Verification that the clinical physics program is in compliance with applicable state and federal radiation safety regulations (e.g., radioactive materials licenses, RSO designation, occupational dose limits, and review of radiation surveys for any new construction).

f. Review of whether service agreements and software updates for major equipment (including, but not limited to, accelerators, imaging equipment, treatment-planning computers, and patient management computer systems) are adequate to ensure patient safety and service continuity, and assessment of additional equipment needs consistent with the scope of clinical services being provided and/or in the process of implementation.

g. Review of the most recent peer review report, with particular focus on the report's recommendations.

3. Components of Peer Review – Dosimetry

A. Evaluation of contour accuracy

a. Tumor volumes and margins

b. Treatment Technique

c. Appropriate beam alignment

d. Adequate tumor coverage

e. Critical structure dose limitations

f. Physician Prescription documented.

g. Dose Distributions

h. DVH (Dose Volume Histogram)

i. Proper documentation in Eclipse and ARIA

B. Any deficiencies or non-conformances discovered during the peer review process of data consisting of Protected Health Information (PHI) shall be verbally communicated to the Chief Medical Physicist and to the Chief of Radiation Oncology Service prior to the Contractor leaving the facility. This is how VA sensitive information will be protected.

C. A report of the peer review will be supplied to the Chief of Radiation Oncology and the Contracting Officer within 30 days after the review.

D. The security impact of the IT system is low, since the contractor will not be connecting any device to any VA IT system.

E. Any contractor that works on station must complete the VHA Privacy and HIPAA training prior to arriving on station and provide documentation of completed training. In order for any contractor to engage in work at VA, he/she is required to ensure all contractors who will be working on the contract complete a mandatory training program titled VA Privacy and Information Security Awareness Training and Rules of Behavior (VA10176) as well as VHA Privacy and HIPAA Training (VA20939). This training is offered through the VA Talent Management System (TMS), a system that offers web-based training to VA employees and its partners. He/she must ensure each contract employee self-enrolls for a profile on the VA TMS by visiting https://www.tms.va.gov/plateau/user/login.jsp. Once there, employees should follow the steps to create a profile, launch the mandatory training, and complete the content prior to their next day at VA. Upon completion by all employees, the contractor shall provide their Contracting Officer Representative with each employee’s printed certificate of completion from the TMS. This certificate displays the employee’s TMS User ID. The COR shall be contacted if further instructions on completion of this training are needed.

https://www.tms.va.gov/plateau/user/login.jsp

F. The Contractor (or representative), upon arrival, will be given a badge and will wear his or her issued VA ID badge at all times while on duty. In addition, no photographs, videos, or recordings will be made while on VA premises.

G. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in the performance of administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA contracting officer.

H. If the VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

I. Except for used and discourse of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court or competent jurisdiction, or

(ii) with VA’s prior written approval. The contractor must refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA contracting officer for response.

J. VA prohibits the installation and use of personally owned or contractor owned equipment or software on the VA’s network.

4. Information Security Considerations The Assessment and Authorization (A&A) requirements do not apply, and a Security Accreditation Package is not required.

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSPs) and Authorities to Operate (ATOs) for all systems/Local Area Networks accessed while performing the tasks detailed in this PD.

A. A prohibition on unauthorized disclosure: “Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” See VA handbook 6500.6, Appendix C, paragraph 3.a. which can be accessed via the following link:

http://www.va.gov/vapubs/viewPublication.asp?Pub_ID=471&FType=2

B. A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access, the contractor/subcontractor shall immediately and simultaneously notify the Contracting Officer’s Representative (COR) (if assigned) the designated Information Security Officer, and Privacy Officer for the contract. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive http://www.va.gov/vapubs/viewPublication.asp?Pub_ID=471&FType=2 information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

C. A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” See VA handbook 6500.6, Appendix C, paragraph 7.a., 7.d.

D. A requirement for annual security/privacy awareness training: “Before being granted access to VA information or information systems, all contractor employees and subcontractor employees requiring such access shall complete on an annual basis either: (i) the VA security/privacy awareness training (contains VA security/privacy requirements) within one (1) week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the contractor. If the contractor provides their own training that conforms to VA’s requirements, they will provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in the VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained.

See VA Handbook 6500.6, Appendix C, paragraph 9.

E. A requirement to sign VA’s Rules of Behavior: “Before being granted access to VA information or information systems, all contractor employees and subcontractor employees requiring such access shall sign on annual basis an acknowledgement that they have read, understand, and agree to abide by VA’s Contractor Rules of Behavior which is attached to this contract.” See VA Handbook 6500.6, Appendix C, paragraph 9, Appendix D. Note: If a medical device vendor anticipates that the services under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by the vendor’s designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing VA’s information and information systems.

F. Due to the threat of data breach, compromise or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with Federal laws and regulations, VA has developed an Information and Information Technology Security clause to be used when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media). In solicitations and contracts where VA Sensitive Information or Information Technology will be accessed or utilized, the CO shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources.

G. The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

H. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

I. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

J. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

K. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

L. Custom software development and outsourced operations must be located in the U.S.

to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

M. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

5. VA Information Custodial Language A. Citations to pertinent laws, codes and regulations such as 44 U.S.C. Chapter 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a);

36 CFR Part 1222 and Part 1228.

B. Contractor shall treat all deliverables under the contract as the property of the U.S.

Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

C. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government ‘IT’ equipment and/or Government records.

D. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

E. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

F. The Government Agency owns the rights to all data/records produced as part of this contract.

G. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

H. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

I. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation.

Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

J. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

6. Performance Standards

A. Performance standards define desired services. The Government performs surveillance to determine if the Contractor exceeds, meets, or does not meet these standards. The Government shall use these standards to determine Contractor performance and shall compare Contractor performance to the Acceptable Quality Level (AQL). The Quality Assurance Surveillance Plan (QASP) method of surveillance will be by random inspection and monthly monitoring. At the end of each option year, A Contractor Performance Assessment Reporting System (CPARS) will be sent to the contractor. The contractor has the right to either agree or respond. This reporting applies to this contract. https://www.cpars.gov/, https://www.acquisition.gov/.

7. Records Management Obligations https://www.cpars.gov/ https://www.acquisition.gov/

A. Applicability This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes Department of Veterans Affairs (VA) (Lt. Col. Luke Weathers Jr. VA

Medical Center) records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their VA (Lt. Col. Luke Weathers Jr. VA Medical Center) contract.

4. may include deliverables and documentation associated with deliverables.

8. Requirements

A. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a).

These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

B. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

C. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

D. The VA (Lt. Col. Luke Weathers Jr. VA Medical Center) and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of the VA (Lt. Col. Luke Weathers Jr. VA Medical Center) or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the VA (Lt. Col. Luke Weathers Jr. VA Medical Center). The agency must report promptly to NARA in accordance with 36 CFR 1230.

E. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the Statement of Work (SOW) or Performance Work Statement (PWS). The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to the VAs (Lt. Col. Luke Weathers Jr. VA Medical Center) control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the Statement of Work (SOW) or Performance Work Statement (PWS). Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

F. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and the VAs (Lt. Col. Luke Weathers Jr. VA Medical Center) guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

G. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with the VAs (Lt. Col. Luke Weathers Jr. VA Medical Center) policy.

H. The Contractor shall not create or maintain any records containing any non-public VA (Lt. Col. Luke Weathers Jr. VA Medical Center) information that are not specifically tied to or authorized by the contract.

I. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

J. The VA (Lt. Col. Luke Weathers Jr. VA Medical Center) owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which the VA (Lt. Col. Luke Weathers Jr. VA Medical Center) shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

K. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VA-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training. [Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

9. Flow Down Of Requirements To Subcontractors

A. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this Statement of Work (SOW) or Performance Work Statement (PWS) and require written subcontractor acknowledgment of same.

B. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

10. TMS Training

The contractor will go to TMS website (www.tms.va.gov) to self -enroll for the following training.

A. Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior Training #20939.

B. (Successfully complete the appropriate VA Privacy and HIPAA Focused Training #10203 and;

https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.tms.va.gov%2F&data=04%7C01%7C%7C71a2d99ee9da463954d308da0789334b%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637830583088139521%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=oK8MxNSHmFuplgNCtEaZJk1u%2F3HoUSKidNv35G9tShI%3D&reserved=0

C. successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

D. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

E. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.