36C24926Q0266.docx

36C24926Q0266

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

596-26-3-950-0180 36C24926Q0266 Dawn Collins 423-979-3640 07-06-2026 11:00

EDT

Department of Veterans Affairs Network Contracting Office 9 (90C)

NCO 9

1639 Medical Center Parkway, Suite 204 Murfreesboro

TN

37129 X 513210 $47 Million Net 30 Days N/A X Department of Veterans Affairs Franklin R. Sousley Campus 2250 Leestown Road Lexington

KY

40511 90C Network Contracting Office 9 Department of Veterans Affairs Network Contracting Office (90C) 1639 Medical Center Parkway Suite 204 Murfreesboro

TN

37129

90C FSC e-Invoicing Payment http://www.fsc.va.gov/fsc/einvoice.asp Invoice Setup Information 1-877-489-6135 Invoice must be submitted electronically

Setup 1-877-489-6135 See CONTINUATION Page Lexington Veterans' Medical Center wishes to enter into an agreement to purchase Hospital Communication System / Nurse Call Information Data Management Software System with an authorized vendor for supply and delivery of the items located at B.1 and subsequent services required to assemble, test, install, integrate, warranty, and/or maintain new items for the Lexington VA campuses located at 2250 Leestown Road, Lexington KY, 40511 and 1101 Veterans Drive, Lexington

KY, 40502.

This RFQ is posted in accordance with (IAW) Revolutionary FAR Overhaul (RFO) Part 12.

>>Complete box 12, 17, 30 and any amendments posted.

Complete Prices for Price/Schedule and Dates for Delivery schedule.

Return completed solicitation with or without vendor's own System-generated offer NLT July 6, 2026 at 11:00 AM EST.

See CONTINUATION Page 596-3660160-950-824100-3131 0100C10X2 X X Delaney Dickey Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 PRICE/COST SCHEDULE

ITEM INFORMATION

Enhncd Pillowspkr-2lgt-digivol Contract Period: Base POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'350202 LOCAL STOCK NUMBER: Rauland-'350202

Feature Bed Control Module V2

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-350304 LOCAL STOCK NUMBER: Rauland-350304

Power Supply W/batt. Backup

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'351003 LOCAL STOCK NUMBER: Rauland-'351003

8 Port Ethernet Switch W/poe

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'351004 LOCAL STOCK NUMBER: Rauland-'351004

Fiber Optic Adapter Module

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'351006 LOCAL STOCK NUMBER: Rauland-'351006

Branch Regional Controller V5

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-351008 LOCAL STOCK NUMBER: Rauland-351008

L-net Term Resistor (10)

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'350003 LOCAL STOCK NUMBER: Rauland-'350003

Voip Nurse Console V3

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-351206 LOCAL STOCK NUMBER: Rauland-351206

Corridor Light-4 Pos V4

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-352012 LOCAL STOCK NUMBER: Rauland-352012

Domeless Controller V3

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-352022 LOCAL STOCK NUMBER: Rauland-352022

Head-end Equipment Cabinet

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-NC2828 LOCAL STOCK NUMBER: Rauland-NC2828

L-net T-tap Module (25)

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'350002 LOCAL STOCK NUMBER: Rauland-'350002

8pn Inline Con Cat5 Cat6(100)

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'350018 LOCAL STOCK NUMBER: Rauland-'350018

Enhanced Single Patient Stn

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'353001 LOCAL STOCK NUMBER: Rauland-'353001

Button Cover For Staff Stn10pk

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-350029 LOCAL STOCK NUMBER: Rauland-350029

Duty Station

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'353100 LOCAL STOCK NUMBER: Rauland-'353100

Pull-cord Station With Audio

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'354000 LOCAL STOCK NUMBER: Rauland-'354000

Staff Assist / Code Station 354025

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-'354015 LOCAL STOCK NUMBER: Rauland-'354015

R5 Feature Bed Recep - 37 Pin

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-NCBED5 LOCAL STOCK NUMBER: Rauland-NCBED5

Voip Staff Terminal V3

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-351311 LOCAL STOCK NUMBER: Rauland-351311

Clear Station Cover 10-pk V2

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): Rauland-350037 LOCAL STOCK NUMBER: Rauland-350037

Enterprise Software 5 year-1st year

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

MANUFACTURER PART NUMBER (MPN): RAU-381005

LOCAL STOCK NUMBER: RAU-381005

Enterprise Test System (370017)-1st year

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

MANUFACTURER PART NUMBER (MPN): RAU-381017

LOCAL STOCK NUMBER: RAU-381017

Misc, Cable, Connectors, Consumables

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

Tripp Lite

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

MANUFACTURER PART NUMBER (MPN): PS-606-HG

LOCAL STOCK NUMBER: PS-606-HG

Custom Insert

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

MANUFACTURER PART NUMBER (MPN): 2828-BP

LOCAL STOCK NUMBER: 2828-BP

4 PAIR 24 AWG SOLID CAT 6 CMP

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): WestPenn-254246 LOCAL STOCK NUMBER: WestPenn-254246

25226 Wire

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): WestPenn-25226 LOCAL STOCK NUMBER: WestPenn-25226

25241 power wire

POP Begin: 08-13-2026 POP End: 08-12-2027 PRINCIPAL NAICS CODE: 513210 - Software Publishers PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software) MANUFACTURER PART NUMBER (MPN): WestPenn-25241 LOCAL STOCK NUMBER: WestPenn-25241

Programming/IT Production-Need Assessment/Training/Go live

POP Begin: 08-13-2026 POP End: 08-12-2027

PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

Programming IT/ Test system

POP Begin: 08-13-2026 POP End: 08-12-2027

PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

Labor

POP Begin: 08-13-2026 POP End: 08-12-2027

PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

Project Management

POP Begin: 08-13-2026 POP End: 08-12-2027

PRODUCT/SERVICE CODE: 7B22 - IT and Telecom - Compute: Servers (Hardware and Perpetual License Software)

B.2 DELIVERY SCHEDULE

2250 Leestown Road Lexington, KY 40511

USA

B.3 STATEMENT OF WORK

STATEMENT OF WORK

RAULAND RESPONDER ENTERPRISE SOFTWARE, TEST ENVIRONMENT, AND SUPPORT SERVICES

FOR

LEXINGTON VA HEALTH CARE SYSTEM (LVAHCS)

LEXINGTON, KY

1) Introduction

The Lexington VA Health Care System is soliciting for a contract to provide the latest version of the Rauland Responder Enterprise software, implementation services to connect the Responder Enterprise software to the existing Responder 5 hardware, and integration services to integrate the Responder Enterprise software with the existing Vocera Engage middleware. Proposals will provide the LVAHCS with all requisite software licenses, programming services, integration services, education services, and quality assurance services, 3rd party software/hardware integration services, for a fully operational system.

Base Year – August 13, 2026 to August 12, 2027 Option Year 1 – August 13, 2027 to August 12, 2028 Option Year 2 – August 13, 2028 to August 12, 2029 Option Year 3 – August 13, 2029 to August 12, 2030 Option Year 4 – August 13, 2029 to August 12, 2031

2) Definitions

2.1) COR – Contracting Officer’s Representative 2.2) VoIP – Voice over Internet Protocol 2.3) PHI – Personal Health Information 2.4) PII – Personal Identification Information 2.5) EHR – Electronic Health Record 2.6) GA – Generally Available 2.7) BME – Biomedical Engineering

2.8) Federal holidays are defined as the following:

3) Objective

The objective of this contract is to implement the Responder Enterprise software in a manner that increases efficiency of patient care and operational staff through voice or text alerts and calls from patients and staff terminals to Vocera users or user groups. Staff assignment will be completed in the Vocera Engage middleware unless otherwise directed by the LVAHCS Project Manager. The calls and messages to users and user groups would follow a call flow that would escalate to other users as designated by the service staffing coordinator or system administrator.

4) Background

The LVAHCS has identified the opportunity to improve patient safety, patient satisfaction, and overall operational efficiency through implementation of companion software to the already installed Rauland Responder Enterprise hardware. This technology would integrate with the existing VoIP communication system in-use at the LVAHCS, the Vocera Communications Platform.

5) Scope

5.1) The contractor shall provide to the Government implementation of the latest GA version of the Responder Enterprise software that is compatible with the Rauland Responder 5 hardware used onsite at the LVAHCS. This implementation would include all software and associated licenses to utilize the Responder Enterprise software. This system will be utilized throughout 2 campuses (Bowling and Sousley). Additionally, the contractor will provide project management, deployment, integration, and quality assurance services.

5.2) Once the system goes live, the contractor will offer support and maintenance services will be available during business hours and on a 24/7 basis for severe malfunctions of the Responder Enterprise software. These services are being sought for a base year and four option years.

5.3) The addresses for the LVAHCS campuses are as follows:

Troy Bowling Campus 1101 Veterans Dr Lexington, KY 40502

Franklin Sousley Campus 2250 Leestown Rd Lexington, KY 40511

6) Tasks or Requirements

The contractor will execute deployment of the Responder Enterprise solution. The contractor will assign a project manager that will be the primary point of contact for the CO, COR, Nursing Informatics, and where applicable the Biomedical Engineering/HTM and VA OIT teams. This project manager should coordinate planning, scheduling, and execution of project services with the COR and designated LVAHCS system administrator/project manager. The following should be included in the project deliverables:

· Project kick-off & Walk-through

· Needs assessment

· Installation and configuration of Responder Enterprise software

· Delivery & establishment of test environment

· End user training

· System adoption support services

6.1) Installation and implementation shall not be complete until the LVAHCS designated system administrator has verified that the system is fully functional and available for use without further configuration by LVAHCS BME or VA OIT.

6.1.1) Change orders, modifications, or any deviation from this SoW cannot be authorized by LVAHCS staff. Such actions should be presented to the LVAHCS COR for submission to the assigned contracting officer for approval/authorization.

6.2) The Contractor must comply with national and local VA policies regarding on-site work, including (but not limited to) as applicable: online training, contractor orientation, obtaining PIV or other credentials.

6.2.1) Contractors that will be working on-site at the LVAHCS will need to attend LVAHCS contractor orientation offered every week on Mondays & Tuesdays, excluding federal holidays, at 0830 Eastern time at the Franklin Sousley campus building 2, room 206. Date & time is subject to change.

6.2.2) Contractors will bring 2 forms of government approved ID, and OSHA 10 documentation to the orientation.

6.3) Project Kick-off & Walk-through

6.3.1) The contractor team will coordinate with the LVAHCS designated COR/project manager to schedule kick-off meeting(s) with designated LVAHCS staff to introduce the contractor team, review the scope of the project, set expectations, and identify communication standards. A summary of these meetings will be provided to the LVAHCS COR, project manager, and system administrator(s).

6.3.2) The contractor team will conduct a “walk-through” with designated LVAHCS contacts to review LVAHCS equipment features/locations and verify test environment requirements.

6.4) Needs Assessment

The contractor will conduct needs assessment meeting(s) with LVAHCS stakeholders. The planning, scheduling, and execution of the needs assessment should be confirmed with the LVAHCS designated COR. The contractor should provide a report of the assessment to the COR/project manager/system administrator. This report should include the following:

· System configuration

· Integration configuration

· Workflow design

· Go-live/training support recommendations

6.5) Installation & Configuration of Responder Enterprise Software

6.5.1) The contractor in coordination with the LVAHCS system administrator and/or LVAHCS BME will install and configure the latest GA version of the Responder Enterprise software onto VA servers that utilize a VA approved and supported operating system.

6.5.2) If the latest version of the Responder Enterprise software is not currently approved for use within the VA, the contractor will coordinate on as needed basis with VA OIT supporting LVAHCS and LVAHCS system administrator throughout any approval process required in order to install or utilize the software within the VA.

6.5.3) The contractor shall configure the software in high availability configuration and provide guidance on load balancing configuration and requirements.

6.6) Delivery & establishment of test environment

6.6.1) The Contractor will provide hardware to create a test environment and configure the software as needed to demonstrate nurse calls and staff terminal functionality.

6.6.2) The contractor will assist in configuring the test environment to demonstrate call flows via the designated staff assignment.

6.7) End User Training

6.7.1) The contractor shall provide a training plan for the implementation. This training plan must provide either direct or train-the-trainer training to ensure that all end users are adequately trained in the new functionality.

6.7.2) The contractor shall provide system administrator training for at minimum 2 system administrators.

6.8) System implementation support services

6.8.1) The contractor shall provide a plan to assess and address concerns with implementation of the system and provide continuous feedback for the first year of usage.

6.8.2) The design and configuration documentation should be provided to the COR, system administrator(s) and LVAHCS BME.

6.9) Responder Enterprise Software Support & Maintenance Services

6.9.1) Support services shall include unlimited technical support incidents.

6.9.2) Support services shall include telephone, electronic, and remote support availability.

6.9.3) Standard case support services should be available 8AM to 5PM Eastern Time. Emergency case support should be available 24 hours a day, 7 days a week, 365 days a year.

6.9.4) Maintenance downtime shall be proactively scheduled with the LVAHCS system administrator.

7. System Performance Requirements

The system at minimum should provide the following:

7.1) The system should be designed, installed, and implemented to deliver a system that must operate in a high availability configuration with only infrequent and minimal downtime to routine functionality. Downtime for maintenance should be scheduled at least 2 weeks in advance for routine maintenance or as soon as feasible for emergent downtime with VA OIT and LVAHCS BME, and system administrator(s).

7.2) Provide a solution for the LVAHCS that allows configuration and customization for the nurse call escalations, staff terminal messaging/alerting with the VoIP system in-use at the LVAHCS, the Vocera Communication Platform.

7.3) Improve staff efficiency and patient safety through providing STAT order alerts or routing nurse calls to end users without the need to return to a computer or desk.

9) Security Requirements

9.1) For information systems that are hosted, operated, maintained, or used on behalf of the VA; contractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks.

9.1.1) System cybersecurity vulnerabilities are to be addressed in coordination with the site; any information security incidents should be reported within 1 hour of discovery

9.2) The deployment of Responder Enterprise software will adhere to the approved configuration in the latest VA approved ERA.

9.2.1) If the latest version of Responder Enterprise software is not approved at the initiation of this contract, then Responder Enterprise software will adhere to the configuration outlined for the software to be installed and utilized at the LVACHS resulting from the subsequently required approval process(es).

9.3) Any contracted staff requiring access to the VA network will complete the VA required security, privacy, account, and PIV credentialling requirements prior to being permitted access.

9.4) The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

9.5) ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

9.6) TRAINING. This entire section applies to all acquisitions which include section 3.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

9.7) VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

9.8) INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerablity scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent, to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COTR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor’s systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government-owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

d. The contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA’s POA&M management process. The contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested and re-authorized per VA Handbook 6500.3. This may require reviewing and updating all of the documentation (PIA, System Security Plan, Contingency Plan). The Certification Program Office can provide guidance on whether a new C&A would be necessary.

e. The contractor/subcontractor must conduct an annual self assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COTR. The government reserves the right to conduct such an assessment using government personnel or another contractor/subcontractor. The contractor/subcontractor must take appropriate and timely action (this can be specified in the contract) to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

f. VA prohibits the installation and use of personally-owned or contractor/subcontractor owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

g. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

h. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

(1) Vendor must accept the system without the drive;

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

(a) The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact; and

(b) Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be pre approved and described in the purchase order or contract.

(c) A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The ISO needs to maintain the documentation.

9.9) SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident.