36C25019Q1240-001.docx

36C25019Q1240

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

506-20-1-1022-0003 36C25019Q1240 07-31-2019

BAILEY, LISA

317-988-1530 08-14-2019

15:00 ET

Department of Veterans Affairs Network Contracting Office 10 8888 Keystone Crossing Suite 1100 Indianapolis IN 46240 X 532490 $32.5 Million N/A X Department of Veteran Affairs VA Ann Arbor Healthcare System 2215 Fuller Road Ann Arbor MI 48105 Department of Veterans Affairs Network Contracting Office 10 8888 Keystone Crossing Blvd Suite 1100 Indianapolis IN 46240

Please submit invoices in accordance with 852.232-72.

See CONTINUATION Page Contractor shall provide a CO2 laser or Ultra-pulse, a long with a Technologist certified to operate the laser in support of Urology, General Surgery, Condyloma, ENT surgical cases for the VA Ann Arbor Healthcare System (VAAAHS) for the period of one-year effective 10/1/19 through 9/30/20, with four (4) option years, exercisable at the Government's discretion.

See CONTINUATION Page 506-3600160-1022-820200-2341 0100202V1 X X Lisa Bailey Contracting Officer Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. CONTRACT ADMINISTRATION: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: _____________________________

DUNS# _____________________

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with: 52.23233, Payment by Electronic Funds Transfer – System for Award Management

3. INVOICES: Invoices shall be submitted in arrears: Monthly

4. GOVERNMENT INVOICE ADDRESS: All invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72, Electronic Submission of Payment Requests. Invoicing shall be in accordance with the requirements of the Department of Veterans Affairs (VA) Financial Services Center (VAFSC). The latest information shall be used for invoicing and payments and may change during the period of performance of this acquisition. Current Invoicing information is located at: http://www.fsc.va.gov/einvoice.asp.

All invoices shall include the following:

· Invoice Number

· Invoice Date

· Purchase Order Number (will always begin with 506)

5. CHANGES/MODIFICATIONS TO THE CONTRACT: The Contracting Officer will be the only person authorized to approve changes or modify any of the requirements under this resultant contract. The Contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer will be authorized to make commitments or issue changes that affect price, quantity, delivery or quality of performance of this resultant contract. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered unauthorized by the local VAMC and no adjustment will be made in the contract price to cover any increase in cost incurred as a result thereof.

6. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

7. SECURE FAX: In accordance with VA Handbook 6500, the following statement is required on all fax cover sheets; if it is determined the ordering process will include a fax: “This fax is intended only for the use of the person or office to which it is addressed and may contain information that is privileged, confidential or protected by law. All others are hereby notified that the receipt of this fax does not waive any applicable privilege or exemption for disclosure and that any dissemination, distribution or copying of this communication is prohibited. If you have received this fax in error, please notify this office immediately at the telephone number listed above.”

8. System for Award Management: Federal Acquisition Regulation requires contractor registration in the System for Award Management (SAM) database prior to the award of a contract. Offerors and Contractors may obtain information on registration and annual confirmation requirements via the internet at https://www.sam.gov/portal/public/SAM/.

B.2 SCHEDULE OF SUPPLIES/SERVICES AND PRICES

Contractor shall provide a CO2 laser or Ultra-pulse laser, along with a Technologist certified to operate the laser in support of Urology, General Surgery, Condyloma, and ENT surgical cases for the Department of Veterans Affairs (VA), Ann Arbor Healthcare System (VAAAHS), 2215 Fuller Road, Ann Arbor, MI 48105 for the period of one-year, effective October 1, 2019 through September 30, 2020, with four (4) option years, exercisable at the Government’s discretion.

The guaranteed minimum only applies to the Federal Government Fiscal Year in which the contract is awarded. The total minimum amount, or guaranteed minimum, for the initial fiscal year in which this contract is awarded is $5,000.00. The maximum total value of the contract, inclusive of the base year and all options exercised, shall not exceed $200,000.00. Individual task orders shall be funded annually. The Contracting Officer is the only authorized individual that can place annual task orders against this contract for the estimated amount of services for the specific timeframe, and the task orders shall be issued to the contractor.

BASE YEAR: 10/1/2019 to 9/30/2020

Estimated Cost

EA

ACCESSORIES & DISPOSABLES TOTAL

EA

4 hours)

TOTAL FOR BASE YEAR

OPTION YEAR 1: 10/1/2020 to 9/30/2021

Estimated Cost

EA

ACCESSORIES & DISPOSABLES TOTAL

EA

4 hours)

TOTAL FOR OPTION YEAR 1

OPTION YEAR 2: 10/1/2021 to 9/30/2022

Estimated Cost

EA

ACCESSORIES & DISPOSABLES TOTAL

EA

4 hours)

TOTAL FOR OPTION YEAR 2

OPTION YEAR 3: 10/1/2022 to 9/30/2023

Estimated Cost

EA

ACCESSORIES & DISPOSABLES TOTAL

EA

4 hours)

TOTAL FOR OPTION YEAR 3

OPTION YEAR 4: 10/1/2023 to 9/30/2024

Estimated Cost

EA

ACCESSORIES & DISPOSABLES TOTAL

EA

4 hours)

TOTAL FOR OPTION YEAR 4

B.3 PERFORMANCE WORK STATEMENT

1. SERVICES

Contractor shall provide a CO2 laser or Ultra-pulse laser, along with a Technologist certified to operate the laser in support of Urology, General Surgery, Condyloma, and ENT surgical cases upon the request of the surgery service. Services shall be provided to the VA Ann Arbor Healthcare System located at 2215 Fuller Road, Ann Arbor, MI 48105 for the period of one-year, effective October 1, 2019 through September 30, 2020, with four (4) option years, exercisable at the Government’s discretion.

The contractor shall provide a laser with the capability to treat large areas quickly and with even fluence, allowing exact elimination of tissue, layer by layer, and with little to no thermal harm during the procedure.

The COR shall be notified after the order is made with the type of laser being ordered, the case and date it will be used on, and an invoice for such services being rendered.

The Contractor shall certify that each Technologist provided by the Contractor to operate the equipment is trained and competent in the use of that equipment in his or her surgical specialty. Client maintains a facility adequate and suitable for the operation of the equipment. Client shall perform or cause to be performed all medical services, supervision, diagnosis and patient care in accordance with all applicable professional standards. Client and each designated Surgeon shall protect the equipment from injury (including attempted modification) and shall be liable to Contractor for damages occasioned by improper use or handling, carelessness or neglect.

On each scheduled day (or alternative day arranged in accordance with procedures below) Contractor shall deliver the equipment to Client’s site not less than 30 minutes prior to the first procedure, for usage by Client up to the conclusion of the day or part day as agreed to. Client shall afford Contractor not less than 24 hours telephone notice of the time of the first scheduled procedure. Contractor may remove the equipment at the conclusion of the last scheduled surgical procedure. Each of Client and Contractor may, in the event of an emergency, cancel a scheduled day by 24 hours advance telephone notice to the other. As an alternative the party giving notice may request that Client and Contractor adopt an alternative time or site. Due to the Contractor’s itinerary and due to the Client’s patient commitments, the rights to cancel and to request change shall be exercised sparingly.

2. EQUIPMENT REQUIRED

3. WORK HOURS

The Contractor will not be required, except in cases of emergency or urgency, to furnish services on a national holiday or during off-duty hours. Surgical cases requiring a CO2 laser or Ultra-pulse laser are typically scheduled between the hours of 6:00am to 8:30pm, local time, Monday through Friday, excluding Federal holidays. It is anticipated that some operative cases will extend later than 8:30 pm, and that service by the Contractor shall be provided until the patient has been transferred from the OR to the PACU.

The contractor shall not be required to provide services on the ten (10) holidays observed by the federal government, including: New Year’s Day, Martin Luther King’s Birthday, Presidents’ Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans’ Day, Thanksgiving, and Christmas, and any other day specifically declared by the President of the United States to be a federal holiday.

4. PERFORMANCE

In the performance of contract services, all contract staff shall adhere to the VAAAHS universal precautions and infection control policies in order to provide clinical care.

The services to be performed by the contractor will be under the direction of the OR Manager of the VAAAHS, or his/her delegate. Problems will be reported by the OR Manager to the Contracting Officer’s Representative (COR).

The VAAAHS will provide suitable workspace and equipment for contractor personnel performing services within the scope of this contract, in a timely fashion.

During the first ninety (90) days of performance, the contractor shall make no substitutions of key personnel unless illness, death, termination of employment, or specific request by the COR necessitates the substitution. The contractor shall notify the Contracting Officer, in writing, within fifteen (15) calendar days after the occurrence of any of these events.

The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the Contracting Officer. Proposed substitutes shall have comparable qualifications to those of the persons being replaced.

For temporary substitutions where the key person will not be reporting to work for three (3) consecutive work days or more, the Contractor shall provide a qualified replacement for the key person. This substitute shall have comparable qualifications to the key person.

Contractor performance shall be monitored and documented through the Quality Assurance Surveillance Plan (see Section D of Contract).

5. COMPLIANCE WITH LAWS AND REGULATIONS

The contractor shall maintain full compliance with applicable Federal and State regulations and shall comply with applicable VA policies and procedures.

6. PERSONNEL POLICY

This is not a contract for personal services. The contractor shall be responsible for furnishing personnel services under this contract in accordance with the Wage Determination (see Section D of Contract) which shall include: worker’s compensation, professional liability insurance, health examinations (includes annual TB testing), income tax withholding, and social security payments.

The contractor, its employees, agents, and subcontractors shall not be considered VA employees for any purpose.

7. JOINT COMMISSION COMPLIANCE STANDARDS

The contractor shall continuously meet or exceed all applicable Joint Commission Hospital standards.

Values and Mission: Care delivered will reflect the VA Medical Center’s mission, vision and values.

Mission. Honor America’s veterans by providing exceptional health care that improves their health and well-being.

Vision. VHA will continue to be the benchmark of excellence and value in health care and benefits by providing exemplary services that are both patient centered and evidenced based. This care will be delivered by engaged, collaborative teams in an integrated environment that supports learning, discovery and continuous improvement. It will emphasize prevention and population health and contribute to the nation’s well-being through education, research and service in National emergencies.

Patient Population Treated: The patient population treated at the VA Ann Arbor Healthcare System, Ann Arbor, Michigan, consists of veterans with varying physical, psychiatric, and psychological needs. Their conditions are, in many cases, directly related to the individual’s service to this country. The contractor’s employees shall provide compassionate care with respect for the special needs of the veteran population served and show professional courtesy toward the VA support staff as an integrated part of this medical center’s mission, vision and values.

Patient Rights: The contractor’s employees shall respect and integrate the patient’s beliefs, values and cultural influence. Protection of all patient rights is of highest priority. The contractor shall ensure patient privacy and confidentiality are maintained at all times. When applicable, the contractor shall involve the patient in care decisions by keeping him/her fully informed about the diagnosis, plan of care and treatment goals, risks and benefits of proposed treatment, and prognosis; shared-decision making shall be pursued. The contractor’s employees are required to review the Patient Rights Handbook and follow the standard of care. No patients shall be subject to any research activity by the contractor without the patient’s fully informed consent, subject to study approval by the VA Investigational Research Board (IRB). The contractor shall abide by the VAMC Code of Ethics, which addresses marketing, admission/transfer/referral/discharge processes, and billing issues.

Patient Safety: Patient safety shall be a primary focus of the contractor. Every effort shall be made by the contractor to prevent patient injury caused by acts of commission or omission in the delivery of care. For every applicable Patient Safety Alert or Sentinel Event, the contractor shall take the necessary steps to redesign processes to prevent occurrence and provide written feedback to the COR describing prevention actions taken. All events related to patient injury and other breeches of patient safety shall be reported immediately to the COR utilizing the VAMC Incident Report.

Sentinel Events: The VAAAHS shall inform the contractor of all applicable Sentinel Event or other Patient Safety Alerts received by the VAAAHS.

· The VAAAHS shall provide the contractor with VAAAHS Sentinel Event definitions in the start-up phase.

· The VAAAHS shall determine when a Root Cause Analysis (RCA) is required of the contractor.

· The contractor shall conduct all RCAs according to VAAAHS policy, and within established timeframes (45 days).

· Completed RCAs shall be provided to the VAAAHS COTR.

Patient Assessment: All care shall be based on assessed patient needs. Findings from assessment and reassessment shall be clearly documented in the electronic medical record, which is used by all members of the interdisciplinary care team in care planning and treatment. Contractor findings related to the above areas shall be recorded in the electronic medical record and addressed or referred as indicated. All required documentation shall be fully completed within VAMC-required timeframes.

Care of Patients: All care shall be provided by licensed, qualified, competent, and appropriately privileged individuals. Clinical work shall consist of treatment of patients with varying medical needs. The plan of care and all findings from patient assessment shall be documented in the electronic medical record and utilized in the overall plan of care in all care settings across the continuum. Nursing and support services, as well as clinic space and equipment will be supplied by the VAMC. Verbal, written, or electronic communication between any VAMC/VISN staff and the contractor’s staff shall not be restricted by the contractor.

Patient Education: The contractor’s employees shall develop and coordinate the interdisciplinary education plan for the patient/caregiver, when required. Education provided by the contractor shall be interactive with the patient and shall be aimed at disease management and prevention and quality of life. All education given shall be documented in accordance with VAMC policies and procedures. Discharge instructions shall be provided to and coordinated with the patient, caregiver, and home or community care provider. Patient education materials shall, at a minimum, include all educational materials provided in the VAMC setting and will be provided by the VAAAHS Surgery Service.

Continuum of Care: Relative to the services they provide, the Contractor shall be responsible for coordinating evaluation, consultation and management with the patient’s primary care provider and other relevant healthcare providers.

All related documentation, such as completed competency checklists or educational training records, shall be maintained by the contractor and available for VAAAHS review upon request.

Performance Improvement: The Contractor shall fully participate in the VAMC Performance Improvement (PI) program, if directed to do so by the Chief of Surgery. This will include monitoring of clinic processes and patient outcomes and satisfaction, data analysis and collaborative design of improvement opportunities. PI activities may be directed by the VAMC, Veterans Health Administration or Veterans Integrated Service Network who will identify data collection methodologies, report generation and oversight bodies related to identified measures. It is noted that PI activities are dynamic and subject to change, as driven outcomes, while implementing safeguards to prevent risk. Monitoring for continuous compliance with Joint Commission standards will be driven by VA Committees, PI teams and taskforces, or through established data collection mechanisms such as the Medical Record Review and Surgical Case Review process (as examples). Measures related to contract compliance will be determined by the Contracting Officer’s Representative (COR) and consistent with the Section titled “Services”. In all cases, the contractor shall continually assess for, and act upon, clinical and administrative improvement opportunities. High prevention shall be given by the contractor to the prevention of risk for the patient and shall implement process-related internal controls to prevent risk to the patient. Monitoring for continuous compliance with Joint Commission standards shall be directed by VAMC staff, and communicated to the contractor through the COR. Aggregate and/or practitioner-specific data collected by the VAMC will be provided to the contractor in accordance with established reporting schedules. Measures related to contract compliance will be identified by the COR.

All significant problems identified shall be reported verbally to the COR within 24 hours.

A written corrective plan of action shall be submitted to the COR within 5 working days.

VA - Timeframes and priorities for completion of action plan items will be mutually agreed upon by the contractor and the VAAAHS Safety Officer.

Leadership: The contractor shall effectively manage daily operations, information and support systems for contractor personnel performing work on this contract while also meeting the mission of the VAMC. The contractor shall take steps to improve contracted services that do not meet the requirements of the contract. VAAAHS leadership retains the right to decline assignment of any contract employee whose credentials, demonstrated practice or conduct has been deemed unsatisfactory.

Environment of Care: The Contractor shall maintain a safe environment at all times and follow all safety and emergency preparedness policies. Compliance with all safety management plans shall be continually demonstrated by the contractor.

Human Resources: The contractor’s performance will be continually monitored by the Chief, Surgery Service and/or the Contracting Officer’s Representative. Outcomes from monitoring data, peer review and the patient compliment and complaint process will be kept on file in the Chief, Surgery Service office. The contractor’s employees shall be aware and in compliance with the following policies/procedures: Mission/Vision/Values, all applicable VAMC policies and procedures, Patient Rights, suspected Patient Abuse reporting, Patient Compliment and Complaint process, Safety, Infection Control, Equipment Safety, Fire Safety, Confidentiality, Emergency Preparedness, Incident and Emergency reporting, electronic medical record training, Surgical Case Review process, peer review process, tort claims, and clinic procedures and processes. The contractor’s employees shall participate in learning-based Morbidity/Mortality and Tumor Board conferences as requested. All Continuing Education requirements shall be met by the contractor’s employees to maintain professional privileged status.

Information Management: The VAMC Information Management Plan shall be followed by the contractor. Documentation and record keeping shall be in accordance with VAMC policies and procedures. All timeframes for documentation and authentication in the medical record shall be adhered to. Computer access will be granted on a need-to-know basis, and security of computerized information shall be maintained by the contractor at all times. The contractor’s documentation and record keeping shall be in accordance with VAMC policies and procedures. All timeframes required by VAMC policies and procedures for documentation and authentication in the electronic medical record shall be adhered to by the contractor. Strict adherence to all documentation requirements related to the performance of invasive procedures shall be maintained by the contractor.

Infection Control: The contractor’s patient care activities shall be integrated into the VAMC Infection Control program, and the contractor shall adhere to VAMC Infection Control policies and procedures. This Infection Control Plan shall identify for the contractor how risks will be identified, methods to be used to reduced risk, identification and reporting of community-acquired and nosocomial infections, and data collection and reporting requirements. Routine and recurrent preventive maintenance inspections shall be the responsibility of Contractor who shall provide records of such maintenance upon request.

Information Management: All medical record documentation reviewed or created by the contractor’s employees is confidential and protected under the Privacy Act of 1974, the Healthcare Insurance Portability and Accountability Act of 1996 (HIPPA), as well as all applicable VA laws and regulations. Any individual making unauthorized disclosure may be criminally liable for violations under the Act. All records shall be and remain the exclusive property of the VA and shall not be removed or transferred from VA except in accordance with U.S.C. 551a (Privacy Act), 38 U.S.C. 5701 (Confidentiality of claimants records), 5 U.S.0 552 (FOIA), 38 U.S.C. 5705 (Confidentiality of Medical Quality Assurance Records), 38 U.S.0 7332 (Confidentiality of certain sensitive medical records), and federal laws, rules, and regulations. It is not anticipated that any of these authorities will permit, or that the contractor’s employees shall otherwise be authorized to obtain a property interest in, or to remove or transfer any such records.

8. PERSONAL SECURITY VERIFICATION

Personal Security Verification (PIV) Card and/or Security Badge Requirements for Contractor Employees:

a) Definitions. As used in this clause — Access means routine, unescorted physical entry into, and to the extent authorized, mobility within a Government facility. Also, it means the ability to obtain, view, read, modify, delete, and/or otherwise make use of information technology.

Contractor employee means an employee of the prime contractor or of any subcontractor, affiliate, partner, joint venture, or team Members with which the contractor is associated. It also includes consultants engaged by any of those entities.

Facility and Government facility mean buildings, including areas within buildings, owned, leased, shared, occupied, or otherwise controlled by the federal government.

Information technology means any equipment or interconnected system or subsystem of equipment, including telecommunications equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major systems/applications and general support systems as defined by OMB Circular A-130, owned by VA or owned and operated on VA's behalf by another party.

b) Access to VA Facilities or Systems.

1) General. The performance of this contract requires contractor employees to have routine, unescorted access to VA facilities. All such employees who do not already possess a current Security Badge or PIV Card acceptable to VA shall be required to provide personal information, undergo an FBI National Criminal History Fingerprint Check, and obtain a Security Badge or PIV Card prior to being permitted access to any such facility in performance of this contract. No contractor employee will be permitted routine, unescorted access to a VA facility without a proper Security Badge or PIV Card.

2) Citizenship-related requirements. Each affected contractor employee as described in paragraph (a) shall be a United States (U.S.) citizen. Otherwise, each affected contractor employee as described in paragraph (a) shall be:

A United States (U.S.) citizen; or A national of the United States (see 8 U.S.C. 1408); or An alien lawfully admitted into the United States for permanent residence as evidenced by an Alien Registration Receipt Card Form 1-151.

3) Background information. Each contractor employee that has access to VA facilities or systems shall complete the Special Agreement Check (SAC) worksheet and deliver to the VA office responsible for fingerprinting and processing contractor employees. The Contracting Officer’s Representative will provide instructions to the contractor regarding the local procedures for fingerprinting and obtaining Security Badges or PIV cards.

After completion of the fingerprint check, the Contracting Officer will notify the contractor in writing if any contractor employee is determined to be unsuitable to be given access to a government facility or VA system. If so notified, the contractor shall not allow such employees to perform work on this contract.

4) Security Badge or PIV Cards. VA will issue a Security Badge or PIV Card to each Contractor employee who is to be given routine, unescorted access to VA facilities or access to VA systems and does not already possess a Security Badge or PIV Card. VA will not issue the Security Badge or PIV Card until the Contractor employee has successfully cleared the FBI National Criminal History Fingerprint Check.

Security Badge or PIV Cards shall identify individuals as contractor employees. Contractor employees shall display their Security Badge or PIV Cards on their persons at all times while working in a VA facility and shall present their cards for inspection upon request by VA officials or VA security personnel. The Contractor shall be responsible for all Security Badge or PIV Cards issued to the contractor's employees and shall immediately notify the Contracting Officer if any Security Badge or PIV Card(s) cannot be accounted for. The contractor shall notify the Contracting Officer immediately whenever any Contractor employee no longer has a need for his/her VA- issued Security Badge or PIV Card (e.g., employee terminates employment with the contractor, employee's duties no longer require access to VA facilities). In such cases, the Contracting Officer will instruct the contractor on how to return the Security Badge or PIV Card. Upon expiration of this contract, the Contracting Officer will instruct the Contractor on how to return all VA-issued Security Badge or PIV Cards not previously returned. The contractor shall not return Security Badge or PIV Cards to any person other than the individual(s) named by the Contracting Officer.

5) Control of Access. VA shall have and exercise full and complete control over granting, denying, withholding, and terminating access of Contractor employees to VA facilities and systems. The Contracting Officer will notify the contractor immediately when VA has determined that an employee is unsuitable or unfit to be permitted access to a VA facility or system. The Contractor shall immediately notify such an employee that he/she no longer has access to any VA facility or system, shall retrieve the employee's Security Badge or PIV Card from the employee, and shall provide a suitable replacement employee in accordance with the requirements of this clause. The Government may not be able to give the contractor the reason for requiring the removal of the unsuitable Contractor employee. The Government shall not be responsible for any costs incurred by the contractor as a result of removing such employee from the subject contract.

6) Termination. Failure on the part of the Contractor to comply with the terms of this clause may result in termination of this contract for default.

9. QUALIFICATIONS

All individuals proposed to work under the shall be a citizen or resident alien of the U.S., its Territories or Commonwealths, shall possess English language proficiency and shall be able to physically perform the tasks outlined in this agreement.

(End of Performance Work Statement)

B.4 INFORMATION SECURITY IN ACCORDANCE WITH VA HANDBOOK 6500.6 Appendix C – Paragraphs:

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

· General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

4. INTENTIONALLY LEFT BLANK

5. INTENTIONALLY LEFT BLANK

6. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement.