Attachment 2 RMD Courier Services PWS Amended.pdf

Attachment 2, RMD Courier Services PWS - Amended

Performance Work Statement Reusable Medical Devices (RMD) Courier Services

626-25-3-2066-0192

Description of Requirement

The Vendor shall provide courier services to transport reusable medical devices (RMD) to and from the Veteran Administrative (VA) Community Based Outpatient Clinics (CBOCs) listed below to the designated services at the VA Tennessee Valley Healthcare System (TVHS) Alvin C. York Medical Center, 3400 Lebanon Pike, Murfreesboro, TN 37129 main campus. The RMD Courier Service process must be in accordance with ANSI/AAMI Standard 79, appropriate Department of Transportation (DOT) regulations, Veteran Health Administration (VHA) Directive 1116, and TVHS, Sterile Processing Service, Standard Operating Procedure (SOP) in the most current posting, in accordance with this Performance Work Statement (PWS).

Period of Performance

TVHS seeks a long-term Courier Service contract. See Section B.3 for exact dates/times.

Places of Performance

Main Campuses

Alvin C. York VA Medical Center 3400 Lebanon Pike Murfreesboro, TN 37129

Community Based Outpatient Clinics

Charlotte Avenue VA Clinic 1919 Charlotte Avenue, Suite 100 Nashville, TN 37203

Charlotte Avenue VA Clinic 1919 Charlotte Avenue, Suite 300 Nashville, TN 37203

Chattanooga VA Clinic 6401 Shallowford Road Chattanooga, TN 37421

Clarksville VA Clinic 782 Weatherly Drive Clarksville, TN 37043

Taylor VA Dental Clinic

5580 Desert Storm Avenue Fort Campbell, KY 42223

Definitions and Acronyms:

CBOC: Community Based Outpatient Clinic

CDC: Centers for Disease Control and Prevention

CDR: Contract Discrepancy Report

Contracting Officer (CO) – The person executing this contract on behalf of the Government with the authority to enter and administer contracts and make related determinations and findings.

Contracting Officer’s Representative (COR) – A person appointed by the CO to take necessary action to ensure the Vendor performs in accordance with and adheres to the specifications contained in the contract and to protect the interest of the Government. The COR shall report to the CO promptly any indication of non-compliance in order that appropriate action can be taken.

CPARS: Contractor Performance Assessment Reporting System, which is the official Government reporting system for Vendor past performance on awards.

DOT: U.S. Department of Transportation

HIPAA: Health Insurance Portability and Accountability Act

OSHA: U.S. Occupational Health and Safety Administration

POP: Period of Performance

QASP: Quality Assurance Surveillance Plan

VA: Veteran Administration, Department of Veteran Affairs

PWS: Performance Work Statement

Scope of Work

VA TVHS requires reusable medical device courier services. The Vendor shall provide all necessary management, labor, equipment, vehicles, transportation, information security (HIPAA), and insurance to provide courier services to and from the TVHS Alvin C. York Medical Center to and from the CBOC addresses cited under “Places of Performance.”

The VHA Community Based Outpatient Clinics provide a variety of outpatient primary care and specialty care services in communities closer to where eligible veterans reside, thus improving convenience, equity of access in rural/underserved areas, efficiency and effectiveness of care, and access to care for all eligible veterans. These outpatient services may include primary care, preventive care, immunizations and vaccinations, prescription of medications, social work, dental, radiology, mental health counseling and group therapy, laboratory testing, women’s care, physical therapy, and referral to specialists. It should be noted that the type of medical services available at a CBOC can vary from clinic to clinic.

All work is to be performed in accordance with applicable federal, state, and local regulations or ordinances bio-hazardous materials.

Record Keeping

The Vendor shall be responsible for supplying, completing, and submitting all reports required and/or requested by any federal, state, and/or local government agency, as required by law, ordinance, and/or regulations that pertain to the supplies and services provided under this contract.

The COR will provide the Vendor with copies of any reference documents and/or materials within fifteen (15) business days upon receipt of a written request.

GOVERNMENT RESPONSIBLILITES:

The government will work in concert with the Contractor to help enable completion of the work contract.

Adequate parking for loading and unloading items.

All containers used for transporting reusable medical devices.

All transport containers used to transport RMDs will be locked by SPS or clinical personnel using a secure seal.

A transportation receipt shall be filled out at the Pick-Up Location and shall include the facility name and phone number. This shall be attached to the Clinic Manifest, signed with date, and timed noted by originating location and then by the courier. The receiving location must also sign and document the Transportation receipt.

Training on Standard Operating Procedures related to proper transport of RMD. Awarded contractor must work with the COR to schedule training after contract award.

Daily Courier Service

Daily RMD Courier services include but are not limited to the transportation of sterile and contaminated instruments. Items will be secured (locked) at-all-times while in the possession of the Vendor.

Daily RMD Courier services between the TVHS Alvin C. York Veteran’s Administrative Healthcare System and CBOCs shall be provided Monday through Friday, except for federal holidays or any day specifically declared by the President of the United States to be a federal holiday. The ten federal holidays observed by the Federal Government are: New Year’s Day;

Martin Luther King, Jr.’s Birthday; Washington’s Birthday; Memorial Day; Juneteenth;

Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day; Christmas

Day, and any other day specifically declared by the President of the United States to be a federal holiday.

Daily RMD Courier services shall be to and from the designated Reusable Medical Devices pickup and delivery points as specified below between the TVHS Alvin C. York VA Medical Center and Community Based Outpatient Clinics:

(1) TVHS Alvin C. York VA Medical Center, 3400 Lebanon Pike, Murfreesboro, building 1/ Ground floor / Room G02 for daily 9 AM (Monday through Friday) pickup of RMD clean, sterile items and totes to deliver to designated CBOC(s).

(2) Chattanooga VA Dental Clinic: 6401 Shallowford Rd, Chattanooga, TN for daily 9:30 AM and 4 PM (Monday through Friday) delivery and pickup of RMD(s). Delivery time for Chattanooga is 1130.

(3) Charlotte Avenue VA Women’s Clinic: 1919 Charlotte Avenue, Suite 300, Nashville, for Wednesday and Thursday only, 9:30 AM and 4 PM delivery and pickup of RMD(s).

Delivery time is 1500.

(4) Dalton Drive VA Dental Clinic: 2291 Dalton Drive, Suite F, Clarksville, for daily 10 AM and 4 PM (Monday through Friday) delivery and pickup of RMD(s). Delivery time is 1130.

(5) Taylor VA Dental Clinic: 5580 Desert Storm Ave Fort Campbell, KY 42223. Clinic requires two drop off/pickups daily, @ 1130 and 1600 – 1630.

(6) TVHS Alvin C. York VA Medical Center, 3400 Lebanon Pike, Murfreesboro, TN, building 1 / Ground floor / Room G03 for daily 2:30 PM and 5:30 PM (Monday through Friday) delivery of RMD(s) from the designated CBOCs.

TVHS VA Medical Center normal hours of operation are Monday through Friday, 8:00 AM to 4:30 PM Local Standard Time. TVHS VA Sterile Processing Service is open 7 a.m. to 12 midnight. Delivery Driver has 30 minutes flexibility for unforeseen circumstances and must communicate with facility POC.

The Vendor shall be required to make pickups and deliveries at all Community Based Outpatient Clinics Monday through Friday between 8:00 a.m. and 4 PM Local Time, excluding Federal holidays or any additional Federal holiday that is declared by the President of the United States.

Due to the geographical region coverage and proximity of certain CBOCs, it is anticipated that some deliveries and pickups to the VA Medical Center will occur after normal business hours.

Most exterior entrances to the Medical Centers are locked between 6 PM and 6 AM the next day; outside normal business hours, decreasing access. The vendor shall use the facility’s Urgent Care Center entrance to access the Alvin C. York Medical Center. The Vendor personnel shall limit their movement within TVHS facilities to necessary and designated areas.

Anticipate daily maximum transport requirements for each CBOC are:

• RMD – up to three (3) loaded totes per CBOC

• An equivalent number of empty totes and bags will travel from the main campus back to each CBOC daily.

• Totes are approximately 16 inches high x 30 inches long x 20 inches wide. They may vary in size. Routine delivery totes shall not exceed forty-nine pounds.

Due to the time-sensitive nature of soiled Reusable Medical Devices, the TVHS VA Medical Center requires the following same day delivery timeframe from the following CBOCs.

• Reusable Medical Device deliveries to TVHS VA Medical Centers from the designated CBOCs must be delivered within four hours the same day as it is picked up.

• Logistics and other small deliveries must arrive no later than 3:30 PM to the Logistics Shipping and Receiving dock at each main campus.

The Vendor shall provide the COR with a copy of delivery routes within five (5) business days of award. Additionally, the Vendor shall provide the COR with updated copies of delivery routes five (5) business days prior to the effective date of any changes to the established delivery routes.

Additional courier services shall be required Monday through Friday, excluding federal holidays, between 8:00 AM to 5:00 PM LOCAL TIME, must be completed within three (3) hours of the request from VA.

Mileage Reimbursement

The Vendor shall provide the COR with a copy of delivery routes within five (5) business days of award. Additionally, the Vendor shall provide the COR with updated copies of delivery routes five (5) business days prior to the effective date of any changes to the established delivery routes.

Mileage shall be calculated based on the routes submitted and approved by the COR. Mileage shall be invoiced and reimbursed on a per mile basis. Reimbursement rate shall not exceed published GSA Privately Owned Vehicle (POV) mileage reimbursement at the time the mileage occurred.

Mileage shall not be reimbursed for:

• Mileage from the employee’s home to the normal work site;

• Mileage from personal errands;

• Mileage from non-contracted related trips.

Mileage Logs shall be completed daily and contain the following information:

• Date

• Mileage at beginning of work shift

• Route Mileage (Starting and Stopping mileage at Medical Facilities/Clinics)

• Mileage at end of work shift.

• Employee initial certifying mileage accrued in Contracted tasks.

Mileage logs shall be submitted monthly to the COR via email.

Additional Courier Requirements

The Vendor shall deliver and pick-up empty containers for each location and deliver and pick-up a fully packed container for the return trip. Reusable Medical Devices will be properly packaged by the VA personnel for transportation.

The Vendor is responsible for any material handling equipment (dollies, carts) for any items being carried. Intermittently, there may be a requirement for items exceeding fifty pounds. The assigned Contracting Officer’s Representative (COR) will provide the Vendor with a twenty-four

(24) hour advanced notice to determine if special handling is required.

Some containers/packages may require special handling and will be marked “Fragile” or “This Side Up.” The Vendor shall comply with all special handling instructions marked on containers/packages.

Pickups and deliveries cannot be completed more than 15 minutes from scheduled time. If courier is earlier than schedule pick up time they must wait until scheduled time to depart from pickup location. If courier is running late, the courier must contact the receiving location before the scheduled delivery and pickup time with an ETA. The COR is to be notified daily by the vendor of any deliveries made outside of the scheduled time.

Environmental Controls

The Vendor shall be responsible to maintain a temperature and humidity-controlled environment between 66 to 72 degrees Fahrenheit and a relative humidity level between 30 to 60 percent in all vehicles or storage areas.

The cargo area is required to be cooled to 66-72 degrees prior to loading the VA property RMD

(s) and the cargo area air conditioner must remain on during the entity of the delivery in order to maintain specified environmental conditions. The Vendor’s couriers shall not leave vehicles in extreme heat or cold while sterile supplies, and pharmaceuticals are being transported without continuous temperature and humidity control in operation. The Vendor shall maintain the temperature and humidity log for every vehicle on every tip and submit the log to the COR for contract and provide a copy to Sterile Processing Service monthly as required by Office of Sterile Processing regulations.

Items must be kept out of contact with environmental hazards such as dust, snow, and rain.

The Vendor shall be responsible for failures by the Vendor’s personnel to ensure established environmental controls are maintained, and for any damage or deterioration of RMD.

Should transported items be lost, broken, or otherwise damaged, the Vendor shall be required to submit a preliminary summary incident report to the COR within 24 hours of the incident. The Vendor shall provide a written incident report explaining the details of the incident; specifically, what caused the incident (who, what, where, when, and how) within seventy-two hours of the incident. The vendor shall be responsible for the replacement cost of any equipment, containers or reusable medical devices that are lost or damaged while in the Vendor’s custody.

Bloodborne Pathogens

The Vendor and the Vendor personnel shall comply with the effective VA Medical Center Policy (and Occupational Health requirements in accordance with OSHA Blood Borne Pathogens (BBP) Law and the OSHA Tuberculosis Compliance Directive, enforceable under OSHA’s General Duty Clause) governing healthcare workers infected with a blood borne pathogen. If the Vendor obtains information that a person providing services under this contract may be infected with a blood borne pathogen, the Vendor shall immediately advise the COR.

The vendor is responsible for training transport personnel in appropriate safety and transporting procedures suitable to biological specimen types and distances transported.

RMD must be transported in accordance with all local, state, and federal regulations, including and specified regulations for bio-hazardous materials.

The RMD cargo will be loaded in a manner that protects the devices from shift damage during transportation.

The vehicle interior must be terminally cleaned (i.e., intermediate level disinfected) after each RMD delivery. Cleaning and disinfecting shall be conducted on all cargo space surfaces to include vehicle floor, walls and ceiling and clean/soiled area separation barrier. The Vendor shall maintain the cleaning log for every vehicle on every tip and submit the log to the COR for contract and provide a copy to Sterile Processing Service monthly as required by Office of Sterile Processing regulations.

The vendor shall be responsible for complying with all regulations that define appropriate transportation of RMD and shall supply in writing that all drivers have been adequately trained on an annual basis. The vendor’s employees/couriers transporting RMD (s) must be trained in “Universal Precautions” in the handling of biohazard materials. Training must include utilizing clinical procedures in case of biohazard spills and accidents. The vendor must furnish a record of all required training to the COR before a contract employee begins work on this contact and annually thereafter.

HIPAA Compliance

The Vendor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). In addition, all VA security policies and applicable confidentiality statues such as 38 U.S.C. §5701 (VA Claims Confidentiality), 38 U.S.C. §5705 (Confidentiality of Healthcare Quality Assurance Review Records), 38 U.S.C.

§7332 (Confidentiality of certain medical records), as well as 45 C.F.R. Parts 160, 162, and 164 (Health Insurance Portability and Accountability Act) should be followed.

As required by HIPAA, HHS has promulgated rules governing the use and disclosure of protected health information by covered entities. The covered entity component of VA is the Veterans Health Administration (VHA). In accordance with HIPAA, the Vendor shall be required to enter into a Business Associate Agreement (BAA) with VA upon award. Please see attached Business Associate Agreement Template for reference.

Quality Control

The vendor shall develop and maintain a quality control program that ensures courier services are performed in accordance with these specifications. The vendor shall develop and implement procedures to track, identify, prevent, and remedy and ensure non-recurrence of defective services.

The vendor shall provide a method to accept and resolve customer complaints and notify the customer of the resolution.

The vendor shall immediately notify the COR upon receipt of a customer complaint in order that joint validation may be accomplished. The vendor is responsible for quality control and specification compliance.

Contingency Plan

1) Inclement weather. The Vendor shall develop a contingency plan within five (5) business days after award to address possible inclement weather conditions. The vendor is expected to make all deliveries on time during inclement weather if VA facilities are open for business. The COR will notify the Vendor of facility closures due to inclement weather as soon as they are aware, to allow Vendor to plan their staffing. In case a delivery cannot occur due to total road closures by Tennessee, Georgia or Kentucky DOT, the Vendor shall notify all CBOCs and Sterile Processing staff and the COR. This notification must occur as early as possible to allow VA to notify veteran patients that procedures need to be rescheduled.

2) The Vendor shall develop a contingency plan within five (5) business days to ensure timely, uninterrupted daily scheduled courier services for VA to all listed locations. This plan shall be reviewed annually by the Vendor and the COR This includes backup vehicle(s), if needed, in case of vehicle breakdown.

Vendor Vehicle

The contractor is responsible for all travel cost.

Within five (5) business days after award, the vendor shall provide the following:

1) Number of vehicles, including make, model, and license plates.

Vendor vehicles and storage areas used in the performance of this contract must be licensed and meet the minimum requirements as mandated by the States of Tennessee or Kentucky.

Vendor must own or lease every vehicle used in the performance of this contract. Under no circumstances are personally owned vehicles to be used nor are Vendor vehicles to be used for transport of any items other than VA property covered by this contract while in the performance of this contract.

Vehicles shall have the company name/logo prominently displayed.

Each vehicle used in the performance of this contract shall be adequately stocked with at least one current/up-to-date complete “Spill Kit” for a bio-hazard clean-up in case of leakage or accidental discharge from container.

Each vehicle must be equipped with necessary supplies to clean cargo areas after each transport of VA property, per the regulations cited.

The Vendor shall provide comprehensive automobile liability insurance required by the States of Tennessee and Kentucky. Upon request, the Vendor shall provide certified proof of automobile liability insurance for all vehicles used by the Vendor in the performance of this contract.

Vendor vehicles must be maintained in a sanitary clean condition, absent of foreign debris and contaminants.

All vehicles must be in good working condition with all doors and trunks able to fully close and lock. Unattended vehicles with VA contents shall be locked at all times.

The following types of vehicles are prohibited from use under the contract:

a) Bicycles

b) Motorcycles

c) Vehicles without a secure cargo area, such as convertibles

d) Pickup trucks without fully enclosed and lockable bed cover unless cargo is secured in the driver’s cab.

The driver section must be completely separated from the cargo area carrying the RMD (s).

To avoid cross contamination, vehicles used to transport RMD between health care facilities shall provide for the physical separation of clean sterile items from biologically dirty/soiled items, per ANSI/AAMI ST79, Section 6.5.

Vendor Drivers/Personnel

Within five (5) business days after award, the vendor shall provide the following to the COR:

1) Number of drivers, including names and states of licensure

The Vendor shall review the HHS OIG List of Excluded Individuals/Entities on the HHS OIG web site at http://oig.hhs.gov/exclusions/index.asp to ensure all proposed Vendor employee(s) are not listed.

A background investigation must be performed by the Vendor, at the Vendor’s expense, to ensure Vendor staff are of good character, have no felony convictions and are able to gain access to all locations of the contract, which includes two Department of Defense bases.

Vendor drivers must maintain a valid driver’s license for the type of vehicle operated as required by Tennessee and Kentucky.

The Vendor shall be licensed by the state and/or local health authority in those localities where licenses are required.

Vendor personnel must be able to communicate clearly in speech and writing in English. This is required to allow effective and efficient pass down communication during normal transport and during emergent situations / delays.

Vendor personnel, while performing the services of this contract, shall conduct themselves in a professional business-like manner.

The Contracting Officer, upon discussion with the COR, reserves the right to exclude vendor staff members from providing services under the contract or task order based upon breaches of conduct, including conduct that jeopardizes patient care or interferes with the regular and ordinary operation of the facility. Breaches of conduct include intoxication or debilitation resulting from drug use, theft, patient abuse, dereliction, or negligence in performing tasks, or other conduct resulting in formal complaints by Veterans or other staff members to designated government representatives. The vendor and COR shall address issues raised concerning vendor personnel conduct. The Contracting Officer shall be the final decision on questions of acceptability and in validating complaints.

Smoking is not permitted on any Federal property including any VA campuses and CBOCs.

Smoking is not allowed within vehicles at any time or by Vendor staff while transporting VA property.

The vendor’s drivers shall observe and abide by all signage, speed limits, pedestrian right-of-way, emergency vehicle right-of-way, and designated roadways.

The vendor shall supply his/her employees with uniforms that shall be worn at all times while performing the services of the contract and while vendor employees are on government property and in government buildings. These uniforms shall contain the vendor’s company name and employee name upon the shirt. Consistency is necessary for identification purposes when the vendor or vendor’s personnel are on site at XYZ VA Health Care System or CBOC facilities.

http://oig.hhs.gov/exclusions/index.asp

Vendor will provide employees with an identification card including company name, employee name and a recent picture of the employee which shall always be visibly worn.

The vendor’s drivers, shall be required to maintain a record log of courier pick-ups and deliveries, indicating times and dates of pick-ups and deliveries, number of containers/totes and/or loose items.

The vendor’s drivers are required to notify the assigned COR during normal business hours of any unusual events that impede him/her in making delivery as required by the BPA.

Under no circumstances shall any animal or person other another qualified Vendor employee in the vehicle or handle items being transported.

The Vendor shall provide and maintain training for its employees in appropriate safety and packaging procedures suitable to specimen type and distances transported. This should include issues such as adherence to regulations for transport of biohazards, use of rigid containers where appropriate, temperature control, notification, and immediate action procedures in case of accident or spills, etc. Upon request by the COR, the Vendor shall provide documentation certifying that training has been provided to Vendor’s personnel. Used Health Care Products ANSI/AAMI Standard 79.

The Government reserves the right to refuse acceptance of any Vendor personnel at any time after performance begins, if personal or professional conduct jeopardizes patient care or interferes with the regular and ordinary operation of the facility. Breaches of conduct include intoxication or debilitation resulting from drug use, theft, patient abuse, dereliction, or negligence in performing directed tasks, or other conduct resulting in formal complaints by patient or VA staff members to designated Government representatives. Standards for conduct shall mirror those prescribed by current federal personnel regulations. The CO and COR shall deal with issues raised concerning vendor employee(s) conduct. The final arbiter on questions of acceptability is the CO.

Indemnification

The Vendor shall be liable for and shall indemnify and hold harmless the Government against all actions or claims for loss of or damage to property or the injury or death of persons, arising out of or resulting from the fault, negligence, or act or omission of the Vendor, its agents, or employees.

Vendor Support for Employees

This is not a personal services contract. The vendor shall be responsible for supervision of its employees under this contract.

The Vendor shall be responsible for protecting vendor employee furnishing services. To carry out this responsibility, the vendor shall provide or certify that the following is provided for all their staff providing services under the resultant BPA:

a. Workers’ compensation

b. Professional liability insurance

c. Health examinations

d. Income tax withholding

e. Wages in compliance with Service Contract Labor Standards (see Solicitation Attachments)

f. Social security payments.

Problem Resolution

The CO, upon discussion with COR and VA personnel, will resolve complaints concerning vendor relations with Government employees and/or patients. The CO is final authority on validating complaints. In the event the vendor is involved and named in a validated complaint, the Government reserves the right to refuse acceptance of the services being rendered. This does not preclude refusal in the event of incidents involving physical or verbal abuse by vendor personnel towards VA personnel, CBOC personnel, COR, and other vendor personnel while performing services as specified in this BPA.

Reports and Deliverables

The Vendor shall be responsible for complying with all reporting and deliverable requirements established by the BPA. Vendor shall be responsible for assuring the accuracy and completeness of all reports and other documents as well as the timely submission of each.

Vendor shall comply with BPA requirements regarding the appropriate reporting formats, instructions, submission timetables, and technical assistance as required. All reports and deliverables are to be sent by electronic mail unless otherwise specified by the CO or COR.

The following are brief descriptions of required documents that must be submitted by Vendor:

What Submit as noted Submit To

List of Vendor Vehicles, including number of vehicles, make/model, and license plates

Within five (5) business days after award

COR

List of Vendor drivers, including names and states of licensure

Within five (5) business days after award

COR

Provide contingency plan Within five (5) business days after award

COR

Provide delivery routes Within five (5) business days after award

COR

For Background Investigations and Special Agreement Checks, complete forms provided by CO

Within five (5) business days after award

CO with cc to

COR

Insurance Certificate Within five (5) business days after award

CO with cc to

COR

Quality Control Plan: Description and reporting reflecting the Vendor’s plan for meeting of BPA requirements and performance standards

Within 10 business days after award

CO with cc to

COR

Final list of proposed percentages and businesses to subcontractor

Within 10 business days after award

CO with cc to

COR

Proposed Updates to Delivery Routes Within five (5) business days of effective date of proposed change

COR

Completion of Required Training Within five (5) business days after receiving notice to proceed on cleared Vendor personnel from CO

CO and COR

Quality Assurance Surveillance Plan (QASP)

The Vendor will be evaluated in accordance with the QASP.

The QASP provides a systematic method to evaluate performance for the stated BPA.

This QASP explains the following:

• What will be monitored?

• How monitoring will take place.

• Who will conduct the monitoring?

• How monitoring efforts and results will be documented.

This QASP does not detail how the vendor accomplishes the work. Rather, the QASP is created with the premise that the vendor is responsible for management and quality control actions to meet the terms of the BPA. It is the Government’s responsibility to be objective, fair, and consistent in evaluating performance.

This QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the vendor through BPA modification. Copies of the original QASP and revisions shall be provided to the vendor and Government officials implementing surveillance activities.

Government Roles and Responsibilities:

The following personnel shall oversee and coordinate surveillance activities.

a) Contracting Officer (CO) – The CO shall ensure performance of all necessary actions for effective contracting, ensure compliance with the BPA terms, and shall safeguard the interests of the United States in the contractual relationship. The CO shall also assure that the Vendor receives impartial, fair, and equitable treatment under this BPA. The CO is ultimately responsible for the final determination of the adequacy of the Vendor’s performance.

b) Contracting Officer’s Representative (COR) – The COR is responsible for technical administration of the BPA and shall assure proper Government surveillance of the Vendor’s performance. The COR shall keep a quality assurance file. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf.

Performance Standards:

The Vendor is responsible for performance of ALL terms and conditions of the BPA. CORs will provide BPA progress reports quarterly to the CO reflecting performance on this plan and all other aspects of the resultant BPA. The performance standards outlined in this QASP shall be used to determine the level of vendor performance in the elements defined. Performance standards define desired services. The Government performs surveillance to determine the level of vendor performance to these standards.

Methods of QA Surveillance:

Various methods exist to monitor performance. The COR shall use the surveillance methods listed below in the administration of this QASP.

• Direct observation: 100% surveillance

• Periodic inspections: inspections scheduled and periodically) reported quarterly per COR delegation or as needed.

• Validated user/customer complaints: data will be collected from actual patient complaints. Complaints will be investigated and verified.

• Random sampling: random samples of specific documents will be required and reviewed by COR for compliance.

• Verification and/or documentation provided by vendor: vendor provided information on services provided to COR.

Performance Requirements:

The Performance Requirements are listed below. The Government shall use these standards to determine vendor performance and shall compare vendor performance to the standard and assign a rating. At the end of the performance period, these ratings will be used, in part, to establish the past performance of the vendor on the BPA and for purposes of providing the CO with information for inclusion on CPARS:

Measures Performance

Requirement

Acceptable Quality Level

Surveillance

Method

1. Trained / Insured drivers

In accordance with

SOW

100% Random sampling (random inspection by

COR)

2. Vehicles Operational vehicles in accordance with SOW

100% Direct observation (random inspection by

COR)

3. Regular deliveries: as required for soiled RMD within 4 hours of CBOC pickup

Vendor to meet delivery timelines (SOW under “Daily Courier Service”)

95% Random sampling (Review of Logbook)

4. User/Customer Complaints

Vendor has a plan in place for handling complaints and all complaint responses are submitted to the COR or CO within two

(2) business days of complaint referral

100% Verification provided by vendor/Validated user and customer complaints (response and documentation from vendor)

5. Temperature and Humidity controls

Vendor shall ensure compliance and document performance

100% Direct observation (Random inspection by COR and Review of Logbook)

6. Cross Contamination Measures

Vendor shall ensure compliance

100% Random sampling (Random inspection by COR and Review of Logbook)

7. Vendor shall submit accurate invoices

Vendor to submit accurate invoices

95% Direct observation (review of invoices in Tungsten)

If vendor performance does not meet the Acceptable Quality level, the CO shall inform the Vendor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the CO shall document the discussion and place it in the contract file. When the COR and the CO determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR), and present it to CO. The CO will in turn review and will present to the vendor's program manager for corrective action.

The Vendor shall acknowledge receipt of the CDR in writing. The CDR will specify if the Vendor is required to prepare a corrective action plan to document how the Vendor shall correct the unacceptable performance and avoid a recurrence.

The CDR will also state how long after receipt the Vendor is required to present this corrective action plan to the CO. The Government shall review the Vendor's corrective action plan to determine acceptability. The CO is ultimately responsible for the final determination of the adequacy of the vendor’s performance and the acceptability of the vendor’s corrective action plan. Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO or for purposes of reporting vendor past performance on CPARS.

MANAGEMENT LANGUAGE FOR CONTRACTS:

The following standard items relate to records generated in executing the contract and should be included in a typical Electronic Information Systems (EIS) procurement contract:

1.1. Citations to pertinent laws, codes, and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

1.2. Contractor shall treat all deliverables under the contract as the property of the U.S.

Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

1.3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

1.4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

1.5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

1.6. The Government Agency owns the rights to all data/records produced as part of this contract.

1.7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

1.8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

1.9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

VA INFORMATION AND SYSTEM SECURITY/PRIVACY REQUIREMENTS:

GENERAL: Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS to VA INFORMATION AND VA INFORMATION SYSTEMS

A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. No access to VA information is expected with this contract. The transport devices will be secured with a lock or tamper evident seal by VA personnel prior to being received by the contractor.

All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

INFORMATION CUSTODIAL LANGUAGE

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

If the contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, use of VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated is required.

The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the aforementioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

The contractor/subcontractor agrees to comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies.

SECURITY INCIDENT INVESTIGATION

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO, and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

THE LIQUIDATED DAMAGES FOR DATA BREACH

1.9.1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

1.9.2. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

1.9.3. Each risk analysis shall address all relevant information concerning the data breach, including the following:

1.9.3.1. Nature of the event (loss, theft, unauthorized access);

• Description of the event, including date of occurrence, data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

1.9.3.2. Number of individuals affected or potentially affected;

1.9.3.3. Names of individuals or groups affected or potentially affected;

1.9.3.4. Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text;

1.9.3.5. Amount of time the data has been out of VA control;

1.9.3.6. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

1.9.3.7. Known misuses of data containing sensitive personal information, if any

1.9.3.8. Assessment of the potential harm to the affected individuals;

1.9.3.9. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

1.9.3.10. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

1.9.4. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of

$37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1.9.4.1. Notification;

1.9.4.2. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

1.9.4.3. Data breach analysis;

1.9.4.4. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

1.9.4.5. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

1.9.4.6. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General.