36C25025Q0052.docx

36C25025Q0052

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

553-25-2-2115-0002 12/01/2025 36C25025Q0052 -2025 Debby Williams 937-268-6511 11-07-2024 12:00

EST

deborah.williams1@va.gov Network Contracting Office (NCO) 10 Department of Veterans Affairs 3140 Governor’s Place Blvd. Suite 210 Kettering OH 45409-1337 X X 561110 $12.5 Million N/A X 36C250 Department of Veterans Affairs John D. Dingell VA Medical Center 4646 John R. St.

Detroit MI 48201 36C250 Network Contracting Office (NCO) 10 Department of Veterans Affairs 3140 Governor's Place Blvd. Suite 210 Kettering OH 45409-1337

Department of Veterans Affairs Financial Services Center Invoices To Be Submitted Electronically https://www.ob10.com/us/en/veterans-affairs// Invoice Setup Info Phone 877 353 9791 512 460 5429 See CONTINUATION Page Cancer Registry Base plus 3 option years.

Privacy/HIPAA Training - all contractors need to complete InfoSec Training - contractors that access to the network/ computer system Evaluation for this procurement is Price Only Vendors need to complete VAAR 852.219-75 and FAR 52.204-24 and FAR 52.204-29 when submitting quote.

See CONTINUATION Page X Lisa D. Bailey Contracting Officer Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C250 Debby Williams deborah.williams1@va.gov Network Contracting Office (NCO) 10 Department of Veterans Affairs 3140 Governor’s Place Blvd. Suite 210 Kettering OH 45409-1337

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

3,000.00

EA

Case Findings Contract Period: Base POP Begin: 01-01-2025 POP End: 12-31-2025 PRINCIPAL NAICS CODE: 561110 - Office Administrative Services PRODUCT/SERVICE CODE: R408 - Support - Professional: Program Management/Support

350.00

Case Abstracts

POP Begin: 01-01-2025 POP End: 12-31-2025

2,600.00

FOLLOW UPS

POP Begin: 01-01-2025 POP End: 12-31-2025

40.00

CONSULT HOURS

POP Begin: 01-01-2025 POP End: 12-31-2025

RQRS

POP Begin: 01-01-2025 POP End: 12-31-2025

500.00

EDITS AND CORRECIONS E.G. NCDB AND ALL OTHER CORRECTIONS TO ABSTRACTS

POP Begin: 01-01-2025 POP End: 12-31-2025

Case Findings Contract Period: Option 1 POP Begin: 01-01-2026 POP End: 12-31-2026

Case Abstracts

POP Begin: 01-01-2026 POP End: 12-31-2026

FOLLOW UPS

POP Begin: 01-01-2026 POP End: 12-31-2026

CONSULT HOURS

POP Begin: 01-01-2026 POP End: 12-31-2026

RQRS

POP Begin: 01-01-2026 POP End: 12-31-2026

EDITS AND CORRECIONS E.G. NCDB AND ALL OTHER CORRECTIONS TO ABSTRACTS

POP Begin: 01-01-2026 POP End: 12-31-2026

Case Findings Contract Period: Option 2 POP Begin: 01-01-2027 POP End: 12-31-2027

Case Abstracts

POP Begin: 01-01-2027 POP End: 12-31-2027

FOLLOW UPS

POP Begin: 01-01-2027 POP End: 12-31-2027

CONSULT HOURS

POP Begin: 01-01-2027 POP End: 12-31-2027

RQRS

POP Begin: 01-01-2027 POP End: 12-31-2027

EDITS AND CORRECIONS E.G. NCDB AND ALL OTHER CORRECTIONS TO ABSTRACTS

POP Begin: 01-01-2027 POP End: 12-31-2027

Case Findings Contract Period: Option 3 POP Begin: 01-01-2028 POP End: 12-31-2028

Case Abstracts

POP Begin: 01-01-2028 POP End: 12-31-2028

FOLLOW UPS

POP Begin: 01-01-2028 POP End: 12-31-2028

CONSULT HOURS

POP Begin: 01-01-2028 POP End: 12-31-2028

RQRS

POP Begin: 01-01-2028 POP End: 12-31-2028

EDITS AND CORRECIONS E.G. NCDB AND ALL OTHER CORRECTIONS TO ABSTRACTS

POP Begin: 01-01-2028 POP End: 12-31-2028

GRAND TOTAL

B.3 STATEMENT OF WORK

The Contractor shall provide all necessary staffing and resources needed to properly maintain the John D. Dingell V.A. Medical Center’s Cancer Registry database in accordance with 100% of the current American College of Surgeons Commission on Cancer, Cancer Registry standards and Veterans Health Administration (VHA) Cancer Registry requirements. The Contractor shall have current experience managing an accredited Cancer Registry program within the last twelve months and have recent experience as a consultant with the American College of Surgeons (ACOS) Commission on Cancer (CoC). The duties and responsibilities of the Contractor shall include:

A. Case finding/ Case Ascertainment – The Contractor is responsible for monthly review of disease indices, pathology reports, radiology reports, discharges, outpatient encounters, referrals to the community, and all other data sources to identify reportable cancer cases for the previous 30-day period. Responsible for curation with a high level of specificity for required minimum data set from all available patient records. This must also include correct case status options and proper use of Accession Only for non-reportable patients. This is required for all new and/or recurrent patients using the approved Veterans Administration (VA) cancer registry database software. The Contractor is required to identify and report all patients within 30 days of first contact with reporting hospital using all available data sources. Case ascertainment must be conducted using VA and industry standards of the North American Association of Central Cancer Registries (NAACCR), National Cancer Institute Surveillance, Epidemiology and End Results Program (SEER), World Health Organization International Classification of Diseases for Oncology (ICD-O), American Joint Commission on Cancer (AJCC) Staging Manual, VA Central Cancer Registry (VACCR) Reportable List, American College of Surgeons / Commission on Cancer (ACOS / CoC), and the John D. Dingell VAMC Cancer Registry. The contractor will be a VA experienced and nationally credentialed personnel by NCRA; must provide proof of current credential status for all personnel on the contract.

B. Rejects – The Contractor must delete patients from the suspense reports and purge the queue each month once all data sources have been reviewed and reportable vs non-reportable diagnoses does not meet the requirements for a reportable case have been distinguished. No case finding lists (Excel, Word documents, etc.) will be retained after the patient has been accessioned.

C. Case Abstraction and Data Completion – Data abstraction is defined as the weekly process of reviewing all patient information (demographics, primary payer, etc.), diagnostics, stage at presentation, full course of treatment, recurrence/progression, and any subsequent therapies into the VA cancer registry database software, e.g. the Rapid Cancer Reporting System (RCRS/NCDB). The Contractor shall utilize national standard setter manuals and guidelines. The Contractor shall abstract oncology cases with 100% accuracy and shall ensure that all Commission on Cancer requirements/standards are met. The Contractor shall ensure the full data set is completed to VA/national standards on a weekly basis and passes data quality edits within 6 months from first contact. Responsible for curating all required data fields from the source documents in the patient records regarding diagnostic and treatment provided to all newly reportable patients regardless of location of those tests and/or treatment each week. All patient data must be in compliance with the industry standards to include but not limited to the North American Association of Central Cancer Registries (NAACCR), National Cancer Institute Surveillance, Epidemiology and End Results Program (SEER), World Health Organization International Classification of Diseases for Oncology (ICDC), American Joint Commission on Cancer (AJCC) Staging Manual Criteria, VA Central Cancer Registry (VACCR) Reportable List, American College of Surgeons / Commission on Cancer (CoC), and the Michigan Cancer Registry (MCR). All contracted personnel must be experienced on VA systems, nationally board certified by the NCRA, and provide the CO/COR designate evidence of current credential status. All patients must be completed on a weekly basis to ensure the full data set is reported within 4-6 months of the date of first contact with the reporting hospital.

D. Follow-up – The Contractor must complete all required Commission on Cancer to monitor disease status, vital, and substantiating text remarks to validate all fields after the first course of treatment is completed; including but not limited to recurrence, subsequent treatment(s), corresponding dates and required vital status fields. Contractor is responsible for reviewing all data sources for diagnostics and care received in the years following their cancer diagnosis at the John D. Dingell VA Medical Center, military hospitals, and at other VA and non-VA health care institutions. Only nationally board credentialed personnel through the NCRA may provide these services. Contractor shall provide the Cancer Registry support services for follow-up as described in the Commission on Cancer (CoC) standards manuals pertinent to diagnosis year. Follow up reports must be provided to the CO/COR/designate on a quarterly basis, at time tri annual CoC accreditation survey, and at end of year. Reports must reflect follow up rates for disease surveillance to reference date and for prior 5 years. Outcome data shall be included when applicable. Follow-up shall be maintained at a minimum of 90% on all patients to the VA reference date; this is required to use registry data for survival (outcome) analysis, which is industry standard. Patients are considered delinquent (lost) if the follow-up interval exceeds 15 months. Contractor shall provide a list of patients completed follow-up along with monthly invoice.

E. Consult Hours: The Contractor shall provide documentation of consultation hours that shall include time spent working with CO/COR, the Cancer Committee, and in support of the tri annual CoC accreditation survey. Consult hours shall also include ensuring that all current ACOS and related Cancer Registry standards pertaining to the John D. Dingell Veterans Administration Medical Center Cancer Registry are met, that all data entered the Cancer Registry is 100% accurate and that all pre-established timeframes related to the Cancer Registry are met. Consult hours include but not limited to producing reports, ensuring that the Cancer Registry Policy and Procedure Manual meets the Commission on Cancer Programs Standards. Consult hours shall also include preparation of data for transmission to the VACRS or CoC. The contractor will provide consultative services telephonically or virtually via teleconferencing platform as requested.

F. National Cancer Database (NCDB): The Contractor shall conform to all CoC requirements relating to the National Cancer Database (NCDB) requires, including but not limited to, timely accurate submissions, timely accurate resubmissions, correcting edits, and monitoring CoC flash newsletters to ensure compliance with all Cancer Registry and related deadlines, etc. Cancer Registry data submitted by the Contractor to the NCDB shall meet the established quality criteria 100% of the time, as outlined in the NCDB Call for Data. Patient data submitted by the Contractor to the NCDB must be for the specified years, meet the established quality criteria and submission deadlines as specified by the CoC and/or VACRS.

G. Staging Alerts – At the time of case finding the Contractor shall send an email to the attending physicians confirming clinical and pathologic staging has been documented in the EMR as required by the American Joint Commission on Cancer (AJCC). The Contractor shall carbon copy the Service Chief CO/COR/designate, on all email messages only using approved VHA email system; personal email platforms is forbidden. Emails with patient PHI/PII must have proper level of encryption to ensure compliance with privacy and disclosure laws.

H. Rapid Cancer Reporting System (RCRS) - The contractor shall submit all newly diagnosed and updated patients since the previous 30 days to obtain real time patient diagnostic, treatment, and recurrence information. Contractor will monitor the facility’s compliance with RCRS via the CoC performance indicators, transcripts/delivery receipt, and reporting alerts. Contractor will keep the CO/COR/designate, Cancer Liaison Physician, the Cancer Committee Chair, and the Cancer Program Administrator advised of compliance as requested by the above-mentioned staff and on a recurring monthly basis to meet CoC standards. (RCRS is a real-time data collection program to assess hospital-level performance using National Quality Forum (NQF) endorsed quality of cancer measures).

I. Quality Assurance Surveillance Plan (QASP) – The Contractor will provide quality work, complete patient data, and with level of accuracy in accordance with CoC, NCDB, Michigan State Cancer Registry, and the VA Cancer Registry System Quality Audit Policy and Process. Contractor shall perform a 100% quality assurance review on all completed patients for compliance, noting any deficiencies and resolution/correction of errors. A list shall be forwarded to the COTR via e-mail monthly noting any deficiencies or non-deficiencies at least once monthly preferably with monthly invoices. All corrections must be made and verified by submitting a patient abstract summary along with the notice.

The Contractor’s Cancer Registry Quality Assurance Surveillance Plan/Program (QASP) must follow the VACRS Quality Audit Policy and Process to evaluate the quality of 100% of data and 100% contract personnel activities contracted on behalf of the John D. Dingell Veterans Administration Medical Center. The Contractors’ quality assurance plan does the following:

1. The review criteria and standards

2. The quality control timetable

3. The specified quality control methods, sources, and auditor/employee reviewed.

· Required audits must review sample for reporting/case finding audit to ensure all data sources are reviewed with >90% accuracy.

· Random sampling of annual analytic caseload is reviewed for date quality using the VACRS Quality Audit Policy and Process Identifies the activities to be evaluated:

QASP required reviews must follow the VACRS Quality Audit Policy and Process (link) National Oncology Program Quality Audit Policy and Procedure 11062023.pdf

i. Case finding

ii. Abstracting timeliness

iii. Accuracy of abstracted data

· Accession/Sequence Number

· Morphology (Histology/Behavior)

· Dx Date/Date 1st Contact

· Class of Case

· Primary Site

· SEER Summary Stage/EOD

· AJCC Stage

· First Course of Treatment

· Follow-up information, including Date of First Recurrence, Type of First Recurrence, and Cancer Status

iv. The percentage of information coded as unknown (usually coded as 9 or a string of 9s)

v. NCDB data submission, correction of data errors, and resubmission of corrected data.

vi. Required accuracy – 100%

vii. Cancer Registry data submitted to the NCDB meets the established quality criteria

viii. All other standards as outlined in the most current edition of the CoC manual/VACRS are met or exceeded.

The Contractor must be conducted audits monthly and send their Quality Assurance Surveillance Plan (QASP) report findings to the CO/COR/designate and Cancer Program Administrator or as requested. The QASP must include established process for conducting monthly random case finding audits that complies with VACRS and CoC standards.

The QASP will reflect error corrections were completed and provide patient abstract summary to validate using appropriate encryption. All errors identified the Contractor, the VACRS or by the facility’s credentialed oncology data personnel will be corrected by the Contractor within one business day at no additional cost to the VA. The Contractor monitors each area of Cancer Registry activity, ensures that all duties performed e.g. case finding, accessioning, follow up, edit corrections, data submissions, abstracting, etc. (i.e. all Cancer Registry tasks required by the COC/VACRS) are performed by a Certified Tumor Registrar. The Contractor provides written reports upon request and monthly/quarterly to the CO/COR/designate and Cancer Program Administrator; takes corrective action on any area(s) that falls below the measures specified in the VACRS Quality Audit Policy and Process (the QASP must be submitted with the Contractors’ proposal for approval prior to award of contract). The Contractor’s Cancer Registry Quality Assurance Surveillance Plan ensures that:

· 100% of cases are abstracted within 4 - 6 months of the patient’s first contact with the facility.

· 80% follow-up rate is maintained on all patients from the VA Cancer Registry reference date.

· 90% follow-up rate is maintained on all patients diagnosed within the last 5 years.

· Complete error free data is properly submitted annually (or as required by the NCDB) for the National Cancer Database (NCDB) Annual Call for Data.

· Submits RCRS every month or as required by the CoC

· Submits data to the MCR as directed, Cancer Committee and to the VA Central Cancer Registry upon request prior to or within deadlines.

· Data re-submitted due to errors, e.g. to the NCDB and to all other requestors, e.g. VA Central Cancer Registry for patients diagnosed on or after the Cancer Registry System reference date, must meet the quality criteria and resubmission deadline specified in the VA Central Cancer Registry or NCDB Annual Call for Data.

· Conducts monthly reviews of the quality of Cancer Registry data completed through of 100% of the annual analytic caseload. The plan identifies the activities to be evaluated and ensures compliance with benchmarks for required accuracy to meet all VACRS and CoC cancer program standards. Review of all available patient data sources for healthcare documentation as outlined above is included in the plan.

· Contractor will remove personnel from the contract if found to have chronic productivity or data quality issues because of audits.

J. Education/ Certification: The Contractor will show proof that those providing contract support services are currently nationally credentialed through the National Cancer Registrars Association. Contractor shall verify its personnel’s’ current certification status with the National Cancer Registrars Association and shall provide evidence of certification along with their proposal submission. Participation in ongoing nationally recognized education which enhances knowledge and skills, ensures high data quality and complete cancer incidence reporting. All Contractor personnel who perform must:

•• Hold a current certification and evidence of cycle validation of NCRA Oncology Data Specialist (certified).

The ODS credential is granted through the National Cancer Registrars Association, who provides details on eligibility, testing, and recredentialing. High-quality Cancer Registry data are essential to accurately assess incidence, treatment outcomes and patient survival. Successful operation of the Cancer Registry requires credentialed staff that is trained and knowledgeable in all aspects of oncology data collection and case abstracting. Abstracting is defined as curating and reporting patient information and disease specific information into the Cancer Registry data base. Oncology Data Specialists apply knowledge obtained from formal education and work experience to correctly report cancer diagnosis, stage, treatment, and outcomes information for each patient that is seen at the John D. Dingell VA Medical Center enrollment area meets CoC reporting requirements.

Upon Contract award and upon request, the Contractor provides the following:

•• Confirmation of a valid ODS credential for all personnel staff working on this contract.

•• Verification of the date of hire to perform Cancer Registry support services as in the terms

To facilitate accurate data collection and to gain or maintain their credentials, all Contracted personnel participate in ongoing NCRA approved cancer-related education at the local, state, regional, or national level. Full-time and part-time registry staff for whom annual education is required are:

•• ODS staff •• Contract ODS staff who are contracted to work for 3 or more consecutive months during the calendar year, regardless of the number of hours worked

Additionally, the Contractor shall be responsible for completing and providing all Background Investigation, Information Security, Rules of Behavior, and Privacy Training documentation, and completing all other requirements needed for the Contractor’s employees to access the John D. Dingell VA Medical Center network.

The 10 holidays observed by the federal Government are: New Year’s Day, Martin Luther King’s Birthday, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, and Christmas and any other specifically declared by the President of the United States to be a Federal holiday.

K. Policy and Procedure manual - The contractor is responsible for maintaining current Cancer Registry policies and procedures in compliance with CoC, NCDB, VACRS standards, and submitting them to the COTR at the John D. Dingell VA Medical Center annually (or upon request) for review. The Contractors’ Cancer Registry policy and procedure manual must be specific to the John D. Dingell Veterans Administration Medical Center and specify that current CoC data definitions and coding instructions are used to describe all reportable cases. The Contractor uses the data standards defined by the CoC appropriate for the year of diagnosis for any specific case. The Contractors’ Cancer registrars may be required to comply with additional mandates pertaining to case and data reporting established by the Veterans Administration, federal or state government or by the John D. Dingell VA Medical Centers’ cancer committee. The Cancer Registry policy and procedure manual may include, but is not limited to, the following:

•• Abstracting •• American Joint Committee on Cancer (AJCC) and SEER staging policies •• Cancer Registry reference date •• Case eligibility •• Case finding data sources, methods, and frequency •• Real time reporting of newly diagnosed or recurrent diagnoses •• Confidentiality and release of information •• Computer operations •• Dates of implementation or changes in policies for registry operations •• Disaster recovery policy

•• Documentation of first course of treatment •• Annual follow-up for disease surveillance after completion of first course treatment •• History of the registry for the program or health system (which may include facility mergers, network formation, facility name changes, vendor information, and identification of previous staff) •• Job descriptions •• Maintaining and using the suspense system •• NCDB reporting requirements and mechanisms •• Operational requirements for facility-based cancer registries •• Policy for CoC survey documentation •• Quality control of registry data •• Registry purpose •• Data request log •• Required national standard manuals •• Retention of documents •• State registry reporting requirements and mechanisms

For the Cancer Registry Policy and Procedure, the Contractor provides a table of contents in accordance with Commission on Cancer standards.

L. Outcome Studies / Special Studies: Responsible for providing Cancer Registry data for outcome studies special studies and assisting with preparation of the reports as requested. The contractor will provide outcome studies / special studies for the medical staff, Cancer Committee, Cancer Conference / Tumor Board, Veterans Administration Central Cancer Registry (VACCR), and quality management upon request with no additional cost. The data is compared to national data for comparison to determine effectiveness of treatment, programs and survival. The contractor will also provide patient care evaluation studies for the annual cancer program report at no additional cost.

K. Corrections: Contractor will correct any errors in submitted patient data made by them within one business day at no cost to the VA. This includes any data corrections because of audits, edit error reports received from the NCDB, MCR or VACRS or records rejected because they lack supporting English substantiating text per the NCRA Informational Abstracts and/or have missing data elements. Contractor shall correct all inconsistencies found through any quality assurance review within one business day (or sooner if it impacts adversely on accreditation of the cancer program) of submission of inconsistencies, errors, warnings, or any other data quality problems at no additional cost to the VA.

L. Other - The Contractor shall ensure that all American College of Surgeons Commission on Cancer Registry standards, requirements, and initiatives are implemented and met; this includes but is not limited to ensuring that all Rapid Case Reporting System (RCRS) requirements are met and includes developing a Cancer Registry policy and procedure manual which meets the current Commission on Cancer Standards. If abstract are inadvertently re-opened after being in the completed status (e.g. due to software updates for example), Contractor will maintain thorough documentation as to the reason the case reopened on 100% of the cases entered into by the Contractor, will resolve the issue within one working day and will clear data quality edits, set patient to complete status, and send the documentation to the CO/COR or designee (monthly with the monthly invoice (this documentation may be reviewed by the CoC Surveyor during the accreditation process). The Contractor may be asked to speak directly to a CoC Cancer Program Surveyor; if requested, the Contractor will speak with the ACOS Surveyor at no additional costs to the government. Responsible for preparing Cancer Registry reports to the Cancer Committee which meets 4- 6 times a year, or as requested. Reports on TNM staging, timeliness of abstracting, follow-up, and quality improvement of the Cancer Registry services. The contractor will bear all the costs of reports prepared for Cancer Committee meetings to meet data quality standards and credential status of personnel.

M. Commission on Cancer Accreditation: Responsible for coordinating the Cancer Registry requirements for the Commission on Cancer surveys in collaboration with the facility CO/COR or designate, facility Oncology Data Specialist, Cancer Program Administrator and/or Physician Cancer Liaison. Responsible for assisting with preparation for the survey; updating the CoC survey application in collaboration with the assigned John D. Dingell VA Medical Center representative. The contractor will also provide telephonic consultation about Cancer Registry issues to the John D. Dingell VA Medical Center upon request during normal working hours, Mondays through Fridays, 8:00am -4:30pm. Eastern Standard Time.

N. Reporting or Sharing Patient Data / Transmission of Data: Responsible for required data submissions / resubmissions to the NCDB and the Michigan Cancer Registry (MCR) within prescribed timeframes. Submits complete and accurate reports and makes corrections as required/requested. Demonstrates knowledge of the VHA Directive 1412, VACRS policy, NDCB, and MCR reporting requirements. Completes required privacy reports and submits them to the privacy officer in collaboration with the John D. Dingell VA Medical Center Cancer Registry contact.

O. Data User Agreement with Veterans Administration and the State of Michigan: Ensures that all disclosures required by VHA Directive 1412 are also compliant for the Michigan State Cancer Registry prior to submitting or transmitting requested data.

P. Continuing Education / Competency: The contractor should show proof of attendance at recent continuing education activities including state Cancer Registry trainings and Cancer Registry association education meetings. The contractor will maintain competency / training folders and make them available as requested. The contractor and contractor staff must have a working understanding of VA systems and policies. If the CO/COR or designate has a concern about competency, the contractor staff may be requested to take the NCRA Cancer Registrar Employment Screening at the contractor’s cost to evaluate competency, or request a VA ODS review a specified number of patients to evaluate competency and ensure required elements are being completed. If the VA Cancer Registry System Oncology Data Manager documents continued data quality or reporting issues, uncorrected errors by the Contract personnel, this will be considered adequate documentation to terminate the contract due to quality concerns.

Q. VA-Specific / Privacy Training - The contractor will complete the VHA Privacy Policy Training and Cyber Security training, and any other mandated training, at their own cost before access is given, at no cost to the government.

R. VA Electronic Medical Records Systems. VA will provide Contract personnel with electronic access to all available electronic medical records systems. Contract employees are responsible to access the system a minimum of once every ninety (90) days. Failure to access VA system at least once every ninety (90) days will result in the contractor’s employees being locked out of the VA system. If necessary, VA will provide Contractor with remote access to all VA systems necessary to perform the work. It is expected that electronic access will be done monthly. Contractor’s abstracting personnel may perform the abstracting functions from remote locations by computer modem and shall comply with the VA standard of case completion of four to six (6) months after date of diagnosis. A list of patients completed shall be provided to the Contracting Officer’s Technical Representative (COTR) along with monthly invoices. Abstracting shall encompass the full and complete data set (required, optional and supplemental fields) to present a complete patient summary in the approved VA cancer registry database software. Text fields must be utilized to document and substantiate findings of Physical Exam, Scans, Scopes, Labs, Diagnostics, OP Reports, Pathology, Treatment and other pertinent fields. Text content must follow the NCRA Informational Abstracts format for content and quality: Link: Text Best Practices Staging shall be performed on all cases meeting the criteria as established by SEER and the American Joint commission on Cancer in conjunction with accepted principles for establishing clinical and pathology stage. All required fields must be completed with 100% accuracy.

INFORMATION MANAGEMENT

Documentation and record keeping shall be in accordance with VA policies and procedures. The Contractor shall adhere to all timeframes required by John D. Dingell V.A. Medical Center policies and procedures for documentation and authentication in electronic medical records.

DESTRUCTION OF TEMPORARY PAPER RECORDS

The contractor will ensure that all temporary paper records generated are destroyed in accordance with VA Directive 6371. The contractor will have a written procedure that outlines how paper records, if generated, will be destroyed in compliance with VA Directive 637

B.4 IT CONTRACT SECURITY

APPENDIX B

VA ACQUISITION REGULATION SOLICITATION PROVISION AND CONTRACT CLAUSE

NOTE: This clause will undergo official rule making by the Office of Acquisitions and Logistics.

The below language will be submitted for public review through the Federal Register. The final wording of the clause may be changed from what is outlined below based on public review and comment. Once approved, the final language in the clause can be obtained from the Office of Acquisitions and Logistics Programs and Policy.

1. SUBPART 839.2 – INFORMATION AND INFORMATION TECHNOLOGY SECURITY

REQUIREMENTS

839.201 Contract clause for Information and Information Technology Security:

a. Due to the threat of data breach, compromise or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with Federal laws and regulations, VA has developed an Information and Information Technology Security clause to be used when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

b. In solicitations and contracts where VA Sensitive Information or Information Technology will be accessed or utilized, the CO shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources.

2. 852.273-75 - SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION

TECHNOLOGY RESOURCES (INTERIM- OCTOBER 2008)

As prescribed in 839.201, insert the following clause:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

(END OF CLAUSE)

APPENDIX C

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

Not Applicable

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

Not Applicable

6. SECURITY INCIDENT INVESTIGATION

a. The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/ subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/ subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. 5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis.