36C25022Q0173_1.docx

Combined Synopsis for Solicitation

GENERAL INFORMATION

CONTRACTING OFFICE ADDRESS

Department of Veterans Affairs Network Contracting Office (NCO) 10 3140 Governor’s Place Blvd. Suite 210 Kettering OH 45409-1337

POINT OF CONTACT*

Contract Specialist Josh Kovar Joshua.Kovar@VA.gov

All Questions shall be emailed to POC above

PLACE OF PERFORMANCE

4100 West Third Street

Dayton OH

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

Description This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for Evaluation and Solicitation for Commercial Items,” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested, and a written solicitation document will not be issued.

This solicitation is issued as an RFQ. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular: 2021-07

This solicitation is set-aside for Service-Disabled Veteran Owned Companies (SDVOSB).

The associated North American Industrial Classification System (NAICS) code for this procurement is 334290 - Other Communications Equipment Manufacturing, with a small business size standard of 750 Employees. The FSC/PSC is 5830 - Intercommunication and Public Address Systems, Except Airborne.

Wage Determinations Montgomery County, Ohio Wage Determination No: 2015-4731 Revision No: 14 Date of Last Revision: 10/20/2021

Contracting Office Address

Department of Veterans Affairs Network Contracting Office 10 3140 Governor’s Place Blvd. Suite 210 Kettering, Ohio 45428

Combined Synopsis/Solicitation Notice Combined Synopsis/Solicitation Notice Is seeking to purchase Vocera Communications Hardware, Configuration, Installation, and Support services, all interested companies shall provide quotations for the following:

Combined Synopsis/Solicitation Notice

ITEM INFORMATION

0.00

Vocera Subscription/Support Services

PRINCIPAL NAICS CODE: 334290 - Other Communications Equipment Manufacturing PRODUCT/SERVICE CODE: 5830 - Intercommunication and Public Address Systems, Except Airborne

0001AA

Vocera Messaging, 600 users

MANUFACTURER PART NUMBER (MPN): 900-02064

0001AB

Vocera Premier Support, Messaging, 600 users

MANUFACTURER PART NUMBER (MPN): 920-02054

0001AC

Vocera Analytics License

MANUFACTURER PART NUMBER (MPN): 900-01862

0001AD

Vocera Platform, Premier Support, Instance

MANUFACTURER PART NUMBER (MPN): 920-01965

0001AE

Vocera Platform, Premier Support, Virtual Appliance

MANUFACTURER PART NUMBER (MPN): 920-04137

0001AF

Software License, Vocera Platform

MANUFACTURER PART NUMBER (MPN): 900-04165

0.00

Vocera Hardware

0002AA

V5000, Smartbadge, inc. 1 yr warranty

MANUFACTURER PART NUMBER (MPN): 220-02100

0002AB

V5000,FIPS 140-2 Device License Ver 1.0

MANUFACTURER PART NUMBER (MPN): 261-01950

0002AC

V5000 Battery

MANUFACTURER PART NUMBER (MPN): 230-02150

0002AD

V5000, Charger, 8-Bay, Universal

MANUFACTURER PART NUMBER (MPN): 230-02158

0002AE

V5000, Adaptor, 10W Charger, Universal

MANUFACTURER PART NUMBER (MPN): 230-01930

0002AF

V5000, Lanyard, Holster, 25 Pack

MANUFACTURER PART NUMBER (MPN): 230-02152

0002AG

V5000, Clip, Grip, 25 Pack

MANUFACTURER PART NUMBER (MPN): 230-02155

0002AH

V5000, Training Kit, 100 Users

MANUFACTURER PART NUMBER (MPN): 230-02200

0.00

Vocera Device Extended Warranty

0003AA

Warranty, V5000, 2-Year extension

MANUFACTURER PART NUMBER (MPN): 920-05002

0003AB

Warranty, V5000, 8-Bay Charger, 2-Year extension

MANUFACTURER PART NUMBER (MPN): 920-05082

0.00

Vocera Consultancy Services PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: Q702 - Technical Medical Support - Medical logistics, biomedical equipment, occupational/public health, medical supply, medical readiness.

0004AA

Clinical Solutions Consultant Please provide total number of hours and $/HR

ESTIMATED QUANTITY, Not to exceed, Bill for Actual Use PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: Q702 - Technical Medical Support - Medical logistics, biomedical equipment, occupational/public health, medical supply, medical readiness.

LOCAL STOCK NUMBER: CLIN SOL

Miscellaneous Fees/Expenses for Installation and Implementation of services.

Indicate Number of days, hotel/travel, meals per GSA pricing and per-diem requirements. All information shall be broken down into individual categories.

PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: Q702 - Technical Medical Support - Medical logistics, biomedical equipment, occupational/public health, medical supply, medical readiness.

MANUFACTURER PART NUMBER (MPN): 240-01239

0005AA

Misc Expenses - Travel (Airfare and Vehicle Rental) Provide rate and number of days

Estimated Quantity, Not to Exceed, Bill for Actuals Per GSA pricing and per-diem requirements. All information shall be broken down into individual categories.

PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: Q702 - Technical Medical Support - Medical logistics, biomedical equipment, occupational/public health, medical supply, medical readiness.

0005AB

Misc Expenses - Hotel / Lodging Provide Rate/Day and No of days

Estimated Quantity, Not to Exceed, Bill for Actuals Per GSA pricing and per-diem requirements. All information shall be broken down into individual categories.

PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: Q702 - Technical Medical Support - Medical logistics, biomedical equipment, occupational/public health, medical supply, medical readiness.

0005AC

Misc Expenses - Meals Provide Rate/Day and Number of Days.

Estimated Quantity, Not to Exceed, Bill for Actuals Per GSA pricing and per-diem requirements. All information shall be broken down into individual categories.

PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: Q702 - Technical Medical Support - Medical logistics, biomedical equipment, occupational/public health, medical supply, medical readiness.

TOTAL SUBSCRIPTION

TOTAL LABOR

TOTAL HARDWARE/WARRANTY

TOTAL MISC. EXPENSES

GRAND TOTAL

A.1 Performance Work Statement

A. GENERAL INFORMATION

1. TITLE OF PROJECT: Vocera Badges Dayton VAMC

2. SCOPE OF WORK:

The contractor shall provide all resources necessary to accomplish the deliverables described in this statement of work (SOW), except as may otherwise be specified. The purpose of this agreement is to provide full-software support for the VOCERA. This service agreement will include all Vocera software upgrades and maintenance. Support/software services and labor will also be included in the service agreement. This service agreement is being obtained for the purpose of maintaining the operation of the Vocera paging system.

3. BACKGROUND: The Vocera solution will be deployed on the Vocera Enterprise Platform for the following in a single phased approach:

· Vocera Voice Migration to version 6.x

· Vocera Analytics Upgrade

· Vocera Messaging on Smartbadges for 2,000 existing Vocera Voice users in a maximum of 25 existing departments

4. PERFORMANCE PERIOD

The contractor shall complete the work required under this SOW for the Period of Performance indicated below unless otherwise directed by the Contracting Officer (CO).

· Anticipated Start of Performance: 2/3/22

Work at the Government site shall not take place on Federal holidays or weekends unless directed by the CO.

· FEDERAL HOLIDAYS

· New Year's Day

· Birthday of Martin Luther King, Jr.

· Washington's Birthday

· Memorial Day

· Juneteenth

· Independence Day

· Labor Day

· Columbus Day

· Veterans Day

· Thanksgiving Day

· Christmas Day

5. TYPE OF CONTRACT: Firm-Fixed-Price

6. PLACES OF PERFORMANCE: The requirement is for the following stations.

· Dayton VAMC - 4100 W 3rd St, Dayton, OH 45428

B. SPECIFIC MANDATORY TASKS AND MANDATORY DELIVERABLES

Project Management and Deployment Planning Services Comment by Kovar, Joshua:

A Vocera Project Manager will be assigned to this project at order acceptance. Project scheduling requests for project kick-off and other engagement activities, including but not limited to, Vocera workshop; Vocera call flow design; installation and implementation; end user training and go-live services; as well as the required Vocera resources for these project activities, can only be committed by the assigned Vocera Project Manager.

The Vocera Project Manager will schedule a project kick-off call with the Customer to officially initiate the project, review the scope of services to be provided, introduce team members, set expectations and develop a communications plan.

Vocera Performance Assessment Services Vocera Professional Services will not conduct a Vocera Performance Assessment. Customer will be responsible for ensuring the network infrastructure can support the Vocera Communications System, and that the server hardware and software configuration meets our requirements as indicated in the Vocera Infrastructure Planning Guide.

Vocera Kick-Off and Messaging Design Services Deliverable: Vocera Communication Design

1.1 Vocera will facilitate a remote Design Kickoff with the key stakeholders, including project manager and key clinical staff. Vocera will review the design process for development of the call flow structure.

1.2 Vocera will conduct a series of remote messaging design sessions and develop the design specifications for a maximum of 2,000 users. These users must have user profiles existing in the Voice database and will have messaging design completed. Vocera will produce a Clinical Design specification describing the distribution lists and alert templates.

1.2.1 During the installation and configuration of the product the designated administrators of the system will be educated on how to add/modify any additional distribution lists that may be required in the future.

1.3 Customer is responsible for the development of call flow, messaging and/or staff assignment design specifications for any remaining individual nursing units / ancillary departments. If Customer requests additional areas for design, the request will be handled through a Change Order for required rework as a result of those changes.

System Migration to Platform 6.x, Configuration and Testing Services Deliverable: Implementation Report

1.4 Upon Customer review and approval of the Clinical Design specification and completion of the User List template, the Vocera Implementation Engineer will develop and document the initial database, maximum users and maximum contact entries per the above details.

1.5 If Customer requests call flow, messaging or database design changes after initial review and approval of the Vocera Communication Design or submission of the User List, the request will be handled through a Change Order for required rework as a result of those changes.

1.6 Remotely install and configure the most current GA release of Vocera Platform 6.x software with Voice, Messaging, and Telephony services on the Vocera platform server in a high availability configuration.

1.6.1 Work with internal groups as identified by Customer to ensure external access while maintaining internal security practices.

1.6.2 Vocera will synchronize the Messaging service with the Vocera Voice service and Customer’s Active Directory.

1.7 Assist your System Administrator with the initial Vocera database installation and configuration.

1.8 Any variation from the best practice System Installation, Configuration and Testing Services deployment model may result in additional work effort and require a Change Order for required work as a result of those changes.

1.9 Vocera will provide an Implementation Report documenting the initial configuration of the system at the completion of the installation.

Vocera Analytics Installation, Configuration and Testing Services Deliverable: Implementation Report The Vocera Implementation Engineer will complete the following tasks:

1.10 Install and configure the most current GA release of Vocera software on the Vocera Analytics server.

1.11 Install and configure Vocera Analytics “monitoring agents” on the Vocera Analytics server for data collection:

1.12 Verify connectivity and data collection for all configured data sources.

1.13 Conduct end-to-end testing of the Vocera Analytics solution, including:

1.13.1 Review of Vocera Analytics data and User Interface presentation.

1.13.2 Dashboard review of facilities, units, and users.

1.13.3 Review of report data for specific integrations and clinical workflows, escalations, events, and accepts and declines.

1.14 Vocera will provide a Implementation Report documenting the initial configuration of the system at the completion of the installation.

Vocera Enterprise Platform 6 Intermediate Knowledge Transfer Services Deliverable: Certificate of Completion

1.15 This training will teach Vocera Platform 6 system administrators and their backup administrators how to administer and maintain the Vocera Platform on a daily basis. Topics include managing users and groups in the Web Console, understanding policies and permissions, and troubleshooting using the audit log.

1.15.1 This training focuses on day-to-day administration of the voice, messaging, and intelligent workflows components the Vocera Platform 6 and will cover:

1.15.1.1 Overview of Adaptors

1.15.1.2 Managing Users and Groups

1.15.1.3 Managing the Facility

1.15.1.4 Security

1.15.1.5 Troubleshooting

1.15.1.6 Understanding Core Components of Vocera Engage

1.15.1.7 Additional Training Opportunities

1.16 Vocera Platform 6 Intermediate Training sessions will be delivered by a Vocera Implementation Engineer, over two (2) consecutive calendar days for up to three (3) participants. The training will leverage your system to reinforce the training material provided to and covered with participants.

Vocera Training and Go-Live Support Services Deliverable: Training and Go-Live Support Report

Vocera’s Clinical Informaticist will develop and deliver tailored training using the Train-the-Trainer model. This methodology provides your organization with the ability to independently provide and sustain Vocera training as your user base expands and as staff members change.

1.17 Train-the-Trainer class size not to exceed eight (8) seats and will be scheduled for up to two (2) hours.

1.18 Instructor Led Training (ILT) class size not to exceed twelve (12) seats and will be scheduled for up to 60 minutes.

1.19 Web Console class size not to exceed ten (10) seats and should be schedule for up to 30 minutes.

1.20 Maximum number of classes per day not to exceed five (5).

1.21 A minimum of 15 minutes will be scheduled between each class for prep time

1.22 It is recommended that class attendees come to class after reviewing any applicable Computer Based Training (CBT) modules via Health Stream or the Customer’s Learning Management System

1.22.1 Customer is responsible for CBT management of completion rate.

1.23 Provide consultation on training strategies and best practices to meet the needs of Customer as well as on-unit support during training days to support staff to effectively utilize Vocera.

1.24 Customer Trainer(s) will train all remaining staff.

1.25 Vocera will work with the customer to establish the training schedule.

1.26 Customer is responsible for ensuring full attendance to all training sessions scheduled.

Vocera Go-Live Support Services Deliverable: Training and Go-Live Support Report

1.27 The Vocera Implementation Team will work with Customer Project Manager to coordinate the delivery of go-live support. Go-Live Support services include:

1.27.1 Incident reporting

1.27.2 Incident tracking

1.27.3 Incident diagnosing and resolution

1.27.4 System Administration

1.27.5 Tiered System Administration Support (if applicable)

1.27.6 End User Clinical Support

1.27.7 End User Hands-on Training and Support (rounding in departments using Vocera)

1.27.8 Database issue tracking and modifications

Post-Deployment Assessment Services Deliverable: Post Deployment Assessment Report

Vocera Professional Services will provide an onsite post-deployment assessment. The post-deployment assessment includes remote evaluation of reports, on-site clinical walk-throughs and clinical interviews. The assessment is performed by senior Vocera staff and examines end user satisfaction and congruency with workflow to identify areas of optimizing critical processes and user/system performance and includes:

· Support for the System Administrator to:

· Provide system reports to departmental managers

· Ensure the System Administrator is proficient to run, schedule and interpret system reports

· Review of current workflow and alert/alarm configuration

· Provide Support for the End Users

· Independently build database based on clinical process

· End user support through:

· Collaboration with clinical staff

· Incorporating changes to or new clinical process – independent database builds by System Administrator

· Identifying support:

· Super Users

· Trainers

· Support for struggling staff:

· Refresher classes for trainers

· Refresher classes for basic end users

· Provide rounding support:

· Talk with staff, super users, charge nurses and managers as available

· Identify user issues (frustrations) and what is working well

· Refresher training on broadcast feature

· Analysis, recommendations and communications to the deployment team

· Debrief (review of findings)

· Written report

· Message flow accuracy

· Alert template accuracy Vocera will provide a Post-Deployment Assessment report documenting Vocera’s findings and recommendations.

Vocera University Vocera provides several training courses designed to promote Client self-sufficiency in administering, supporting, and providing training on the Vocera solution. “Customers interested in participating in a Vocera University course may find additional information regarding course content and costs at www.vocerauniversity.com .

C. OTHER MANDATORY TASKS AND ASSOCIATED DELIVERABLES

A) Provide Telephone Support

a. Phone support coverage:

i. 24 Hours/Day – 7 Days/Week

b. Phone Engineer Live Coverage:

i. Monday – Friday: 24 Hrs.

ii. Saturday, Sunday, Holidays: 6AM-6PM CST

c. On-Call Support

i. Saturday, Sunday, Holidays: 6PM-6AM CST

d. Telephone Response Time: (Maximum)

i. 30 Minutes: Monday – Friday 6AM-6PM CST

ii. 2 Hours: Monday-Friday 6PM-6AM CST & Saturday-Sunday & Holidays B) Provide Remote Software & Interface Diagnostics

a. Proactive Remote Available via Secure Server C) Provide Repair/Replacement Parts D) Provide Software Updates & Upgrades E) Uptime Commitment – 96%

D. CHANGES TO STATEMENT OF WORK

Any changes to this SOW shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor.

E. GOVERNMENT RESPONSIBILITIES

To facilitate a productive engagement, Customer is responsible for the following:

Provide a single point of contact to manage the Vocera implementation, obtain resources, schedule client personnel, and review and approve engagement deliverables.

Acquire and configure all related server and network hardware and resources as identified by Vocera in the Deployment Sizing Matrix (and/or specifications provided by Vocera at time of project initiation). Ensure hardware required for Vocera System is ready at the time services are provided. This includes rack mounting servers, procuring IP address for servers, and configuring servers to network.

Schedule all client personnel as necessary for implementation activities, and review and approve engagement deliverables.

Ensure that all necessary client IT and clinical personnel as identified by Vocera are available at mutually agreed times and dates to support key meetings, including but not limited to call flow design meeting, installation, assessment, and training.

Ensure that all necessary client IT and clinical personnel as identified by Vocera review and completion of deliverables. Any changes to deliverables will be handled through a change order process. Change Order request can be initiated by either the Client or by Vocera.

Assign technical resources that have access and adequate permissions on the Vocera servers and configuration computers.

Customer must ensure VMWare ESX is available for virtual environment configuration.

For Customers wanting to send Vocera Messaging Alerts to the Vocera Badges, ensure the access points, network infrastructure, hardware and systems software support the requirements for the Vocera Communications System. These requirements are documented in the Deployment Sizing Matrix and Vocera Infrastructure Planning Guide.

Smartphones must be assigned to the same Wi-Fi network as the Vocera server and Vocera B3000N badges in order to support the “Call” feature of Vocera Vina.

Schedule all remote Vocera Standard services in local time between the hours of 9am and 5pm Monday thru Friday. There is a 20% upcharge for Premium services which are delivered outside of these hours. Vocera services are performed in 8-hour days.

Identify all staff to be trained by Vocera.

Vocera Web Console Training should be scheduled as a classroom training session, if applicable. Each participant should be provided with a workstation that has intranet/internet access to connect to the Web Console.

Ensure the Vocera Systems Administrator is always available to support the Vocera trainer during the training classes and make changes as necessary to the database to support modifications and changes uncovered during training.

Identify help desk staff who can support any issues uncovered during training.

Designate training rooms of adequate size with wireless coverage and a speaker phone for demonstration purposes.

Assumptions Vocera is not responsible for the following:

Troubleshooting or maintaining hardware infrastructure, including servers, network, SQL Server Database and the PBX Third party system interfaces (licensing, configuration and interoperability) Configuration of telephony switch / PBX Wireless remediation, including but not limited to configuration and/or adjustment to network controllers / settings Deployment of MDM solution.

Allocation of names and locations of access points Any services not included in this Statement of Work are considered out of scope Required Resource Allocations This section provides information on the minimum required resource allocation for the Vocera Platform Node virtual machine (VM) based on the scoped solution.

This guidance represents the resources required to provide adequate performance for customer environments of up to 200 concurrent users. These specifications should be considered a starting point and could be updated as new requirements are discovered.

The following are the minimum required resources to be allocated to each of the Vocera Platform Node virtual machines (VM).

Resource Type, 500 or less Concurrent Users

Note: The CPU Single Thread Rating reflects the benchmark reported for various processor models by PassMark Software published on https://www.cpubenchmark.net/. Vocera’s test methodology includes various reference hardware configurations deployed with Intel Xeon class CPU s meeting the listed Single Thread Rating. The above requirements are for the currently shipping version of the Vocera Platform as of the latest revision date of this SOW. As new Platform versions are released, these requirements may change. Current requirements can be found in the Vocera Products Server Sizing Guide.

Oversubscription The Vocera Platform features many latency sensitive use-cases, such as the clinical system notification delivery, real-time communication, and speech recognition. Oversubscription of the host resources needs to be avoided to ensure adequate performance is maintained for these mission critical use-cases.

The amount of provisioned logical CPUs for all VMs on the host should be no more than the amount of the physical processor cores installed on the host.

CPU affinity is not required or recommended.

Hyper-threading should be enabled but additional logical CPUs made available via the hyper-threading feature do not count toward the provisioning totals.

VMware Environment Requirements The resource allocation requirements include the Virtual Machine (VM) set up with network and VM components. Access the VM through the FTP site and login credentials that Vocera provides to get to the appliance. The virtual machine is provided as an .ovf file containing the entire VM and application.

Network Requirements All network segments from the monitor to the fixed or mobile communication device should have a network latency for an 8000-byte packet of no more than 70 milliseconds, or an end-to-end latency of no more than 500 milliseconds.

VM Requirements The Vocera Platform VM requires the following resources:

VMware Feature Recommendations Vocera recommends that you do not use VMware vMotion, DRS, Storage vMotion, or Storage DRS features on the Vocera Platform.

These features have the potential to disrupt real-time communication. VM Override rules or Affinity/Anti-Affinity rules should be used if possible, or selectively disabling some of these features, to prevent these actions.

Performing vMotion on a running the Vocera Platform server is likely to cause some or all of the following:

· Cluster failover (all active calls will be dropped)

· Badges displaying the Searching For Server error and not able to make calls

· Interruption in communication (alarm delivery, badge-to-server communication, such as speech recognition and call setup)

Configuration Validation All of the requirements discussed above will be verified by the Vocera Implementation Engineer prior to completion of technical testing. This validation will require assistance from the customer in sharing configuration details of the VMs either by screen shots or by screen sharing. If it is determined that a server does not meet these requirements, technical testing will not be completed, and the Vocera project team will not proceed with the project until properly resolved. This could result in previously scheduled activities being rescheduled for a later date depending on resource availability. If this results in an extended project duration, a change order could be required to complete the project.

Vendor Credentialing Vocera has a corporate agreement with the following Vendor Credentialing Agency. Customer may require Vocera personnel assigned to this project to be credentialed by the following credentialing agency:

Symplr

F. CONTRACTOR EXPERIENCE REQUIREMENTS

The government will determine on a SR basis what positions are considered key personnel. The contractor shall identify, by name, the key management and technical personnel who will work under this task order at the time the work is being negotiated.

If a key person becomes unavailable to complete the SR, the proposed Substitutions of key personnel shall be made only as approved directed by the Contracting Officer and the COR. The government will not dictate specific experience and education requirements of the employees initially proposed to perform the work stated herein. The contractor shall submit a resume of qualifications for the COR and all other direct employees proposed for the project. All Contractor employees will be approved by the COR prior to bringing on duty. If, at any time from date of award to the end of the contract, non-key personnel Contractor personnel are no longer available, HES/HIS reserves the right to review the qualifications of the proposed replacement personnel and to reject individuals who do not meet the qualifications set forth in the TLO. Team personnel proposed by the contractor should possess some of the following knowledge and/or skills:

The contractor must notify VHA in advance and we will approve or reject proposed contractor key personnel for the performance of this contract. The contractor shall submit a resume of qualifications to the COR for key personnel and all other direct employees proposed for the project. All Contractor employees will be approved by the COR prior to bringing on duty. If, at any time from date of award to the end of the contract, Contractor personnel are no longer available, the VHA will approve the qualifications of proposed replacement personnel and will reject individuals who do not meet qualifications set forth herein. The contractor must inform the VHA COR, and Project Manager/Task Manager when personnel are removed from the contract for any reason. The Contractor shall remove any employee from the performance of this contract within five (5) workdays of receiving notice from the Contracting Officer that the employee's performance is unsatisfactory. All Contractor employees are subject to immediate removal from performance of this contract when they are involved in a violation of the law, VA security, confidentiality requirements and/or other disciplinary reasons.

· The contractor must inform the VHA COR, and Project Manager/Task Manager when personnel are removed from the contract for any reason.

· If a key person becomes unavailable to complete the SR, proposed Substitutions of key personnel shall be made only if approved by the COR and Project Manager.

· The contractor shall submit a resume of qualifications to the COR for all direct employees proposed for the project. All Contractor employees will be approved by the COR prior to bringing on duty.

G. CONFIDENTIALITY AND NONDISCLOSURE

It is agreed that:

1. The preliminary and final deliverables, and all associated working papers, application source code, and other material deemed relevant by VA which have been generated by the contractor in the performance of this task order, are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the task order.

2. The CO will be the sole authorized official to release, verbally or in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order, presented to the contractor, shall be submitted to the CO for response.

3. Press releases, marketing material, or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.

H. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS[footnoteRef:0] [0: This language is still in draft form. The OI Service Center is reviewing alternative sources for background investigations. ]

All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to subcontractor personnel requiring the same access.

1. Position Sensitivity – The position sensitivity has been designated as Moderate Risk (Insert High Risk, Moderate Risk or Low Risk.)

2. Background Investigation – The level of background investigation commensurate with the required level of access is Minimum Background Investigation (Insert Background Investigation, Minimum Background Investigation or National Agency Check with Written Inquiries).

3. Contractor Responsibilities

a. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship, and are able to read, write, speak and understand the English language.

b. The contractor shall submit or have their employees submit the required forms (SF 86 or SF 85P, SF 85P-S, FD 258, Contractor Fingerprint Chart, VA Form 0710, Authority for Release of Information Form, and Optional Forms 306 and 612) to the VA Office of Security and Law Enforcement within 30 days of receipt.

c. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the affected employee from working under the contract.

d. Failure to comply with contractor personnel security requirements may result in termination of the contract for default.

4. Government Responsibilities

a. The VA Office of Security and Law Enforcement will provide the necessary forms to the contractor, or to the contractor’s employees, after receiving a list of names and addresses.

b. Upon receipt, the VA Office of Security and Law Enforcement will review completed forms for accuracy and forward the forms to the office of Personnel Management (OPM) to conduct background investigations.

c. The VA Office of Security and Law Enforcement will notify the CO, and contractor, of adjudication results received from OMB.

d. Upon being notified about a favorable determination, the CO may issue a notice to proceed to the contractor.

Security Requirements:

Service & Maintenance will follow the security requirements as per VA’s Medical Device Protection Program (MDPP) which protects VA’s medical devices through a comprehensive security initiative that encompasses pre-procurement assessments, medical device isolation architecture (MDIA), communication, validation, scanning, access control list remediation, patching, and secure remote connectivity.

General Security Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

Access to VA Information and VA Information Systems

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

c. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. A BI is not required per VA Information and Information System Security/Privacy Requirements for IT Contracts dated August 2008 if the following exception applies:

Contract Personnel with limited and intermittent access to equipment connected to facility networks on which limited VA sensitive information may reside, including medical equipment contractors who install, maintain, and repair networked medical equipment such as CT scanners, EKG systems, ICU monitoring, etc. In this case, Veterans Health Administration facilities must have a duly executed VA Business Associate Agreement (BAA) in place with the vendor in accordance with VHA Handbook 1600.1, Business Associates, to assure compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in addition to the contract. Contract personnel, if on site, should be escorted by VA IT Staff.

Training

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

Information Systems Hosting, Operations, Maintenance, or Use

a. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

(1) Vendor must accept the system without the drive;

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

(5) The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact; and

(6) Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

(7) A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The ISO needs to maintain the documentation.

SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification.

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports.

(3) Data breach analysis.

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

SYSTEM INTERCONNECTION

a. VA External Computer System interconnections between VA Systems on the VA Network and VA Business Partner Systems residing outside the VA Network require a signed Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA) collectively known as MOU ISA between the VA and the VA Business Partner. There is a current a VA-Vocera National MOU ISA published 21 Jul 2020.

L. QUALITY ASSURANCE. The COR will periodically evaluate the Contractor’s performance to ensure that contracted services are received. The COR will evaluate the Contractor’s performance through intermittent on-site inspections of the Contractor's quality control program and receipt of complaints from VAMC personnel. The Government may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints. Likewise, the Government may decrease the number of quality control inspections if performance dictates. The Government will also receive and investigate complaints from various customers located at VAMC. The Contractor shall be responsible for initially validating customer complaints. However, the COR shall make final determination of the validity of customer complaint(s) in cases of disagreement with customer(s). A QASP shall be provided to awardee and shall be bilaterally updated during contract period of performance.

The full text of FAR provisions or clauses may be accessed electronically at http://acquisition.gov/comp/far/index.html.

The following solicitation provisions apply to this acquisition:

· FAR 52.212-1, “Instructions to Offerors–Commercial Items” (JUN 2020)

· FAR 52.204-7, “System for Award Management” (OCT 2018)

· FAR 52.204-16, “Commercial and Government Entity Code Reporting” (AUG 2020)

· FAR 52.209-7, “Information Regarding Responsibility Matters (OCT 2018)

· FAR 52.212-2, “Evaluation-Commercial Items” (OCT 2014)

· FAR 52.233-2 “Service of Protest” (SEPT 2006)

· VAAR 852.215-72 “Notice of Intent to Re-solicit” (OCT 2019) FAR 52.212-3, “Offerors Representations and Certifications–Commercial Items” Offerors must complete annual representations and certifications electronically via the System for Award Management (SAM) website located at https://www.sam.gov/portal in accordance with FAR 52.212-3, “Offerors Representations and Certifications–Commercial Items.” If paragraph (j) of the provision is applicable, a written submission is required.

The following contract clauses apply to this acquisition:

· FAR 52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights (JUN 2020)

· FAR 52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper (MAY 2011)

· FAR 52.204-13, “System for Award Management Maintenance” (OCT 2018)

· FAR 52.204-18, “Commercial and Government Entity Code Maintenance” (JUL 2016)

· FAR 52.222-19 Child Labor – Cooperation with Authorities and Remedies (JUL 2020) (DEVIATION)

· FAR 52.212-4, “Contract Terms and Conditions–Commercial Items” (OCT 2018)

· FAR 52.228-5 Insurance-Work on a Government Installation (JAN 1997)

· FAR 52.232-40, “Providing Accelerated Payments to Small Business Subcontractors” (DEC 2013)

· FAR 52.237-1, “Site Visit” (APR 1984)

· FAR 52.237-2, “Protection of Government Buildings, Equipment, and Vegetation” (APR 1984)

· VAAR 852.212-70,” Provisions and Clauses Applicable to VA Acquisition of Commercial Items)” (APR 2020)

· VAAR 852.203-70, “Commercial Advertising”

· VAAR 852.219-10, VA Notice of Total Service-Disabled Veteran-Owned Small Business Set-Aside. (NOV 2020)

· VAAR 852.232-72, “Electronic Submission of Payment Requests”

· VAAR 852.233-70, Protest Content/Alternative Dispute Resolution

· VAAR 852.233-71, Alternate Protest Procedure

· VAAR 852.246-71, Rejected Goods

· VAAR 852.219-74 Limitations on Subcontracting – Monitoring and Compliance (JUL 2018)

· VAAR 852.212-72 Gray Market and Counterfeit Items (MAR 2020) (DEVIATION)

· VAAR 852.273-70, Late Offers

· VAAR 852.219-77 VA Notice of Limitations on Subcontracting – Certificate of Compliance for Services and Construction (SEP 2021) (DEVIATION) VENDORS SHALL FILL OUT CLAUSE

· VAAR 852.237-75, “Key Personnel (OCT 2019)

· VAAR 852.242-71, “Administrative Contracting Officer” (OCT 2020)

· FAR 52.212-5, “Contract Terms and Conditions Required to Implement Statutes or Executive Orders” (Jan 2021) The following subparagraphs of FAR 52.212-5 are applicable:

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E. Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kapersky Lab and Other Covered Entities (JUL 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020) Section 889(a)(1)(A) of Pub.