36C25025Q0739_1.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

539-25-4-554-0014

36C25025Q0739 07-14-2025

Josh Kovar 937-268-6511 x 7141 08-05-2025

13:30 EDT

36250

Department of Veterans Affairs Network Contracting Office (NCO 10) 3140 Governor’s Place Blvd. Suite 210 Kettering OH 45409-1337

X

513210

$47 Million

N/A

X

36C539

Department of Veterans Affairs VHA VISN 10 Pharmacy Operations Multiple VA Medical Centers Please see PWS for location information

36C250

Department of Veterans Affairs Network Contracting Office (NCO) 10 3140 Governors Place Blvd. Suite 210

Financial Services Center Invoices To Be Submitted Electronically https://www.ob10.com/us/en/veterans-affairs// Invoice Setup Info Phone

877 353 9791 512 460 5429

See CONTINUATION Page

This is a solicitation for a Pharmacy Compounding System for VHA VISN 10 Locations as identified in the Performance Work Statement.

Vendor shall provide all items indicated in Quote Preparation Instructions (Section E.9.)

This requirement shall be evaluated in accordance with FAR 13 Procedures, Comparative Evaluation.

Questions are due by 7/24/2025 no later than 1:30 PM EST via email to Joshua.Kovar@Va.gov. Phone Queries will not be entertained.

Vendor responses are due no later than 1:30 PM EST on 8/5/2025 via email to Joshua.Kovar@VA.gov

See CONTINUATION Page x X

X 1

Josh Kovar

36C25025Q0739

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PERFORMANCE WORK STATEMENT

B.3 PRICE/COST SCHEDULE

ITEM INFORMATION

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 VAAR 852.252-70 SOLICITATION PROVISIONS OR CLAUSES INCORPORATED BY

REFERENCE (JAN 2008)

C.3 52.216-18 ORDERING (AUG 2020)

C.4 52.216-19 ORDER LIMITATIONS (OCT 1995)

C.5 52.216-22 INDEFINITE QUANTITY (OCT 1995)

C.6 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.7 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

C.8 52.228-5 INSURANCE—WORK ON A GOVERNMENT INSTALLATION (JAN 1997)

C.9 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.10 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

C.11 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES

OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (JAN 2025)

(DEVIATION FEB 2025)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

D.1 WAGE DETERMINATIONS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 52.204-29 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS—

REPRESENTATION AND DISCLOSURES (DEC 2023)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.5 52.216-1 TYPE OF CONTRACT (APR 1984)

E.6 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.7 VAAR 852.233-71 ALTERNATE PROTEST PROCEDURE (OCT 2018)

E.8 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV

2021)

E.9 QUOTE PREPARATION INSTRUCTIONS

E.10 ADDENDUM TO FAR 52.212-2 EVALUATION--COMMERCIAL ITEMS EVALUATION OF

OFFERS

E.11 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES (MAY 2024) (DEVIATION FEB 2025)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C250 Josh Kovar

Network Contracting Office (NCO 10) 3140 Governor’s Place Blvd. Suite 210

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award

Management, or [] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Monthly in Arrears

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

https://www.tungsten-network.com/customer-campaigns/veteransaffairs/

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PERFORMANCE WORK STATEMENT

VHA VISN 10 Pharmacy Documentation Compounding System Updated 7/11/2025 Introduction Veterans Integrated Service Network (VISN) 10 is comprised of 10 medical centers, the independent Columbus, OH Ambulatory Care Clinic, and a network of greater than 60 outpatient clinics. VISN 10 provides personalized, proactive, patient centered care to more than 685,000 Veterans throughout the lower peninsula of Michigan, Ohio/Northern Kentucky, and Indiana.

VISN 10 facilities must comply with regulatory standards related to compounded sterile preparations (CSP). United States Pharmacopeia (USP) has developed chapters that provide industry-accepted guidance on this topic which are enforceable by The Joint Commission (TJC), Federal Drug Administration (FDA), and VA Office of Inspector General (OIG). Furthermore, VHA Handbook 1108.12 includes requirements above and beyond those outlined in USP chapters relative to the CSP area regarding cleanliness, quality, competency, and documentation. Compounding sterile preparations inherently carries a risk of human error and advanced training mitigates the risk to minimize errors for better patient safety and positive outcomes.

VISN 10 Pharmacy Services have identified a need for a comprehensive system that supports documentation, training, and reporting requirements set forth by these regulatory bodies on compounding. This electronic platform shall not contain any PHI, shall be web-based, and not require the installation of any hardware/software on the VA system. The information stored shall be items such as staff activities (i.e., cleanroom tasks, competencies, sampling results), environmental controls (i.e., viable sampling, temperatures, humidity, and pressure differentials), and compounding records (i.e., master formulations, anticipatory compounding). The system shall generate triggers or alerts when trends are identified so pharmacy management can take the appropriate steps to mitigate risk. The service shall maintain a single or multiple system superusers that will grant each employee their own unique access to the site where employees can log-in and see their to-do list of items required for their shift such as remove garbage, decontaminate IV hoods, etc.

***NOTE: The Government reserves the right to add or remove any additional Medical Centers, CBOC’s or other facilities to the contract as they become available. Furthermore, the Government reserves the right to add, increase, or decrease modules, services, or quantities to allow for fluctuations of client demand that are otherwise unknown at time of solicitation.

The total contract value may increase up to 20% of the base awarded contract value.

Period of Performance: The estimated term of the contract will be for 12 Months with 4 possible option years, exercisable at the Government’s option.

• Base: 9/29/2025 – 9/28/2026

• OY1: 9/29/2026 – 9/28/2027

• OY2: 9/29/2027 – 9/28/2028

• OY3: 9/29/2028 – 9/28/2029

• OY4: 9/29/2029 – 9/28/2030

Federal Holidays: Federal personnel and facilities will not be available to the locations on the following Federal holidays:

• New Year’s Day, January 1 (see note)

• Birthday of Martin Luther King, Jr. – the third Monday in January

• Washington’s Birthday – the third Monday in February

• Memorial Day – the last Monday in May

• Juneteenth, June 19th

• Independence Day, July 4 (see note)

• Labor Day – the first Monday in September

• Columbus Day – the second Monday in October

• Veterans Day, November 11 (see note)

• Thanksgiving Day – the fourth Thursday in November

• Christmas Day, December 25 (see note)

Note: Indicates that if the established date falls on a Sunday, then the succeeding Monday is observed; if the date falls on a Saturday, the preceding Friday is observed.

RATES: Contractor will provide firm-fixed price rates for each designated period. No pass-through costs are to be applied for any reason including disposal, fuel, host site increases, travel, hosting, etc. will be passed on to the Government.

INVOICES: Payment shall be made monthly in arrears upon receipt of a properly prepared detailed invoice and validated by the COR. Invoices must be sent electronically through VA Tungsten Network Portal. https://www.tungsten-network.com/customer-campaigns/veteransaffairs/ https://www.tungsten-network.com/customer-campaigns/veteransaffairs/ https://www.tungsten-network.com/customer-campaigns/veteransaffairs/

A PROPERLY PREPARED INVOICE SHALL CONTAIN:

• Invoice Number and Date services were provided

• Contract Number

• Contractor’s Name and Address

• Accurate Purchase Order Number

• CLIN & Date of service/period of supply

• Description of Supply or Service provided Broken Down CLIN/SLIN if applicable

• Total amount due

Location of VISN 10 facilities: The system will be accessible to all locations within VISN 10 (this includes both the main VA facility and any associated clinics). When the facility deems it is appropriate, they should have the ability to set up separate accounts or sites in the system.

VISN 10 Facility Address of Main Facility Point of Contact Authorized Bed Count*

Ann Arbor VA Healthcare System

2215 Fuller Rd Ann Arbor, MI 48105

POC information will be provided upon contract award 102

VA Battle Creek Healthcare System

5500 Armstrong Rd Battle Creek, MI 49037

POC information will be provided upon contract award 45

VA Chillicothe Healthcare System

17273 State Route 104 Chillicothe, OH 45601

POC information will be provided upon contract award 55

VA Cincinnati Healthcare System

3200 Vine Street Cincinnati, OH 45220

POC information will be provided upon contract award 116

VA Northeast Ohio Healthcare System

10701 East Boulevard Cleveland, OH 45601

POC information will be provided upon contract award 298

VA Central Ohio Healthcare System

420 North James Rd Columbus, OH 43219

POC information will be provided upon contract award 0

VA Dayton Healthcare System

4100 West Third Street Dayton, OH 45428

POC information will be provided upon contract award 91

VA Detroit Healthcare System

4646 John R St Detroit, MI 48201

POC information will be provided upon contract award 105

VA Indiana Healthcare System

1481 West 10th St Indianapolis, IN 46202

POC information will be provided upon contract award 159

VA Northern Indiana Healthcare System

Marion 1700 East 38th St

Marion, IN 46953

Fort Wayne 2121 Lake Ave

Fort Wayne, IN 46805

POC information will be provided upon contract award

Total: 91 Marion: 65

Fort Wayne: 26

VA Saginaw Healthcare System

1500 Weiss St Saginaw, MI 48602

POC information will be provided upon contract award 0

VISN 10

VISN 10 Pharmacy Admin officials will access the system as “super users” only

Contracting Officer’s Representative

(COR)

POC information will be provided upon contract award

N/A

*Updated January 2025, Authorized bed count does not include community living center (CLC)/nursing home and domiciliary beds.

Modules or Features Required for Documentation Compounding System:

• Simplifi 797 + Sole Source Academy (or Equivalent):

o Simplifi 797 (or Equivalent) is a turnkey web- based quality management system that simplifies and automates ongoing compliance with essential USP Chapter 797 requirements for safety and risk mitigation o Training - Collection are concise and consumable CE courses for USP Chapters 797, 795, and 800 including 2023 updates. Modern, didactic content in each course is accompanied by short instructional ‘how-to’ videos. Each course teaches specific core skills or chapter requirements with interactive elements to support skills-based learning.

• Compounding Module - The Compounding module in Simplifi 797 (or Equivalent) allows for digital storage of master formulation records for sterile and non- sterile preparations. It also provides an integrated workflow for both compounding and pharmacy checks and approvals, along with a robust activity tracker. In addition, labels can be easily printed from any network printer.

• USP 795 - USP 795 is an add module to Simplifi 797 that supports nonsterile drug compounding. USP 795 simplifies and automates ongoing compliance with USP Chapter 795 requirements— including comprehensive policies, procedures, staff training, and competency evaluations necessary for an efficient compounding environment.

• USP 800 - USP 800 is an add module to Simplifi 797 that support Hazard Drug compounding. USP 800 simplifies and automates ongoing compliance with USP Chapter 800 requirements for safety and risk mitigation, including comprehensive policies, procedures, staff training, competency evaluations, risk management, quality assurance practices necessary for a safe and efficient sterile compounding environment

• Med Storage – MedStorage (or Equivalent) is a checklist management system that helps ensure that staff are following standardized protocols essential to meeting quality objectives and improving care. For example, checklists can help make sure that medications are properly stored in areas outside of the cleanroom.

• Med Trays – MedTrays (or equivalent) is a restock management system that helps maintain the accuracy and compliance of medication trays on emergency carts, helping to ensure medication safety and minimize risk to patients. By removing manual processes and automating the tracking and inventory of emergency tray drugs, Simplifi+MedTrays reduces human error and streamlines the medication tray restock and management process.

Facility Inpatient

Beds Training Module

Compounding Module

<USP

795>

<USP

800>

Med Storage

Med Trays

Ann Arbor 102 x x x x O O Battle Creek 45 x x x x O O Chillicothe 55 x x x x O O Cincinnati 116 x x x x O O Columbus 0-50 x x O x O O Cleveland 298 x x x x X O Dayton 91 x x x x O X Detroit 105 x x x x O O

Northern Indiana - Marion 65 x x x x O O

Northern Indiana - FT. Wayne 26 x x x x O O Indianapolis 159 x x x x X X Saginaw 0-25 x x x x O O

Estimated Total 1062 X = Currently in place in Facility

O = Possible Future Need

Scope of Services:

The vendor shall have a system that meets the following requirements:

• Provides a comprehensive management system that assists with documentation of training, procedural tasks, and quality assurance activities essential to compliance, safety, and risk mitigation related to compounding. The system logs activities and stores all documentation electronically for a period no less than 3 years.

• Provides a system that is web-based and accessible from any internet connected device (no requirement to install software/hardware on a secured Department of Veterans Affairs network).

• Supports the VA’s requirement to log into systems storing VA data via multi-factor authentication.

• Supports up to 250 individual users per facility. Permission levels can be configured by the site administrator. The system must provide specified users access to information, data, and reports at either an enterprise/VISN, facility, clinic, and/or area level focusing on trends and identifying problem areas.

• Assigns a unique username to each user. Completion of tasks and other activities associates the user’s name with that task and applies a digital signature with timestamp. Once completed, the signature or time record cannot be modified by the user. Specified users with higher level access may edit activities completed in error. All edits and modifications must be documented and be retrievable.

• Allows staff to be assigned and sorted by roles and/or shifts for competency assignment and monitoring by supervisor.

• Offers ongoing didactic education with accredited continuing education (CE) for pharmacists, pharmacy technicians, and designated person(s) to allow staff to meet the USP requirements. Training shall include lessons on aseptic compounding, hazardous drug handling, primary engineering controls in aseptic processing, environmental monitoring, USP Chapters <795>, <797> and <800>, closed system transfer devices (i.e., Equashield) and compounding-specific equipment/supplies (i.e., repeater pump, elastomeric pumps, etc.). In addition to lessons on individual topics, annual refresher training courses should be available. Prebuilt testing or calculations examinations shall be available to ensure that individuals understand the material and learning has been achieved.

• Allows option for scheduling staff for competencies and training. Courses and annual training shall have the ability to be assigned automatically based on specified roles and/or shifts. Additional courses can be added or courses removed from identified individuals as needed. Training records should be available as part of the overall analytical dashboard for real-time reporting, tracking, and trending purposes.

• Tracks when staff are due/overdue on training requirements. Provides the ability to send customizable alerts and/or reminders to specific users/user groups before training is overdue (i.e., customizable rules engine).

• Schedules tasks by administrator to staff on a one-time or recurring basis. Provides the ability to send customizable alerts and/or reminders to specific users/user groups before tasks are overdue (i.e., customizable rules engine).

• Provides the ability to interface with continuous monitoring systems (e.g., temperature, humidity, pressure) auto-documenting these values in the system.

• Provides customizable policies and procedures based on current USP guidelines populated with recommendations by field experts. Documents are automatically updated when policy changes are enacted or new best practices are identified.

• Allows for importing of policies and procedures already developed by the facility. Documents can be uploaded to the system from common formats such as Microsoft Word and Adobe PDF.

• Includes the ability to customize the document management layout of system to meet the user’s needs (i.e., add subfolders under main folders for facility document organization, etc.).

• Allows for uploading of external reports, including but not limited to semi-annual certification reports, certificates of analysis, and viable sampling results. Includes the ability for certification reports and viable sampling results to be automatically uploaded to the system through a vendor interface.

• Provides competency and task templates populated with best practice recommendations from subject matter experts from industry subject matter experts.

• Provides integrated templates for CAPA/excursion response documentation electronically within the system that can be initiated from the correlated excursion, competency failure, or other failed activity.

• Stores master formulation records (recipes) and compounding records for both sterile and non-sterile preparations.

• Creates customized labels for compounded medications that can be sent to any network printer. Labels include at minimum drug, strength, volume, unique ID number, barcode, preparation date, beyond use date, user initials, comments, and pharmacy identifier (i.e., name and address).

• Provides a comprehensive audit-oriented analytics/reporting dashboard with the ability to trend selectable parameters and filter down to specific values by user, task or another specific category. Reports for USP 797 and USP 795 related activities are generally separated by default. Summary reports are available at an enterprise/VISN level.

Results shall be exportable to any printer and/or Excel for additional manipulation.

• Offers multiples ways (i.e., email, telephone, chat, etc.) to contact the vendor for assistance and/or support.

Responses are provided within 24 hours. The response shall be actual assistance and not that the inquiry is being reviewed and will be addressed.

• Customizes workflow based on current practices.

• Alerts system users when updates are made.

• Develops a quality assurance (QA) plan that is based on workflow and data that offers recommendations for improvement providing microbiological decision support.

• Offers a separate module to integrate documentation of non-compounding pharmacy tasks such as ward inspections, maintaining separate records from compounding compliance documentation for interested facilities participating in this contract.

• Allows the ability for main VA facilities covered under this contract to not enroll or subscribe to all modules available if that area is not pertinent to the facility.

• If a system other than the one currently used is selected, the vendor shall ensure a seamless transition, providing a way to export and store previous documentation records electronically within the system. Exports of logs and activity will be in common file formats such as CSV or Excel.

QUALITY CONTROL AND QUALITY ASSURANCE FOR CONTRACT SERVICE:

The contractor shall be responsible for effective implementation of their Quality Control Program, and shall be responsive to the requirements of the Government’s Quality Assurance Plan conducted by the COR.

Quality Control. The contractor shall have a Quality Control program to assure that the requirements of the contract are provided as specified. One copy of the Contractor’s basic Quality Control Program shall be submitted for approval by the COR. Subsequent changes to the approved Quality Control Program must also be reviewed and approved by the COR with final approval by the Contracting officer. The program shall include but not be limited to the following.

An inspection system covering the performance indicators given in the Quality Assurance/Performance Requirements table below.

A method for identifying deficiencies in the quality of services performed before the level of performance becomes unacceptable.

A file of all quality control inspections inspection results, and any corrective action required shall be maintained by the Contractor throughout the duration of this contract. This file shall be the property of the Government and shall be available to the COR during normal working hours. The file shall be turned over to the Government within 14 days of completion of termination of the contract.

QASP: A (Quality Assurance Surveillance Plan (QASP) has been developed for in-house operations or to implement a service contract. It is designed to aid the Government in providing effective and systematic surveillance of all aspects of document and media destruction. This plan provides for monitoring all contract requirements through a combination of methods. These are:

• Check in at all locations using hospital tracking system were applicable.

• Furnishing reports including pick up data.

• Random observation

• Client/Customer Complaints

• Surveillance Activity Checklist

The contractor is required to conduct a check-in process upon arrival at all designated locations. This procedure shall be executed using the hospital tracking system, where applicable. QR Codes, accessible at entry points and front desks or can be provided by point of contact (POC). This must be utilized by the contractor to gain access to the app. The App will capture and record details such as time, date, and location upon check-in. Additionally, the contractor is obligated to input details regarding the services provided into the available slots within the app.

The contractor shall be responsible for furnishing comprehensive details regarding performance and any identified deficiencies. This information will be delivered via email to identified Government officials in the role of COR, and or identified leadership, Alternate COR or the contracting officer if COR is not available.

The QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the contractor. Updates shall ensure that the QASP remains a valid, useful, and enforceable document. Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.

The objective of this surveillance plan is to evaluate how the Government or contractor is performing in key areas.

We are primarily interested in the final product or service being provided and not the details of the accomplishment.

mailto:VHACINEMSAdministrator@va.gov

QUALITY ASSURANCE / PERFORMANCE REQUIREMENTS STANDARDS

Performance Objective Standard Performance Threshold Method of

Surveillance Incentive / Disincentive

PRS #1

Compliance with USP Standards

Ensure the system meets all USP 795, 797, and 800 requirements.

No more than 1 instance of non-compliance per year.

No more than 1 instance of non-compliance per year.

Regular compliance audits and random inspections.

incentive: favorable performance review and use option years;

disincentive: A Contract Discrepancy Report (CDR) will be issued on the first instance of failure to provide the acceptable level of service and lead to possible termination of contract

PRS #2

User Support and Satisfaction

Provide timely and effective user support.

Response within 24 hours for 90% of support requests.

Review of support ticket resolution times and user satisfaction surveys.

incentive: favorable performance review and use option years;

disincentive: A Contract Discrepancy Report (CDR) will be issued on the first instance of failure to provide the acceptable level of service and lead to possible termination of contract

PRS #3

Training Completion Rates

Ensure all required training is completed

95% training completion rates

Review Training Records and Reports incentive: favorable performance review and use option years;

disincentive: A Contract Discrepancy Report (CDR) will be issued on the first instance of failure to provide the acceptable level of service and lead to possible termination of contract

PRS #4

Environmental Data Accuracy

Accurately document environmental controls

99% data accuracy

Regular data audits and cross-checks with manual logs by end users and VISN program leadership incentive: favorable performance review and use option years;

disincentive: A Contract Discrepancy Report (CDR) will be issued on the first instance of failure to provide the acceptable level of service and lead to possible termination of contract

PRS #5

DOL Wage Determination Compliance

Department of Labor - Wage Determination Compliance

Shall submit confirmation of compliance with the current Department of Labor Wage Determination (WD) hourly rate if requested by the CO in writing within four (4) hours of request which may include an itemized list of the hourly rate being paid for employees performing services under this contract

The Contracting Officer (CO) will conduct random compliance checks with the contractor as necessary.

incentive: favorable performance review and use option years;

disincentive: A Contract Discrepancy Report (CDR) will be issued on the first instance of failure to provide the acceptable level of service and lead to possible termination of contract

PERFORMANCE MONITORING:

The government will periodically evaluate the contractor's performance by appointing representative(s) from serviced facilities to monitor performance to ensure services are received.

The government representative will evaluate the contractor's performance through intermittent observation and on-site inspections of the contractor's quality control program and receipt of complaints from facility personnel.

Routine collections and container movements will be observed by a government representative at random intervals no less than once per month.

The government representative will perform on-site inspections of the contractor's facility(s) if applicable, no less than once annually. The government may increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints. The government will also receive and investigate complaints from various customers located on the installation.

The contractor shall be responsible for initially validating customer complaints. However, the government representative shall make final determination of the validity of customer complaint(s) in cases of disagreement with customer(s).

ACCEPTABLE PERFORMANCE

The Government shall document positive performance. Any report may become a part of the supporting documentation for any contractual action.

UNACCEPTABLE PERFORMANCE

When unacceptable performance occurs, the COR shall inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the COR shall document the discussion and place it in the COR file.

a. When the COR determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR) and present it to the contractor's program manager.

b. The contractor shall acknowledge receipt of the CDR in writing. The CDR will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CDR will also state how long after receipt the contractor has to present this corrective action plan to the COR. The Government shall review the contractor's corrective action plan to determine acceptability.

c. Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the

CO.

The Contractor shall appoint a point of contact that will have the responsibility to respond to customer needs in accordance with this contract. He/she will ensure emergent needs are appropriately addressed within 24 hours and non-emergent needs addressed within the normal delivery period specified by the contract. Facility POC’s are listed above.

SPECIAL CONTRACT REQUIREMENTS:

PER REVIEW OF VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX A- INFORMATION SECURITY AND PRIVACY

CHECKLIST:

• “The C&A requirements apply, and a Security Accreditation Package is required.”

• Acquisition of this service does not involve the storage, generating, transmitting, or exchanging of PHI/PII of patients or other sensitive information to the vendor. A formal BAA is not required; however, any vendor that is named the apparent awardee will need to complete and sign an Authority to Operate prior to any performance taking place.

• There may exist exposure to VA sensitive information, to sensitive personal information (SPI) while implementing contractual services

MINIMUM STATUTORY REQUIREMENTS:

1. GENERAL.

This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

5. SECURITY INCIDENT INVESTIGATION.

This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY:

711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA.

Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract; the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages— Reimbursement for Data Breach Costs.

6. INFORMATION SYSTEM DESIGN AND DEVELOPMENT.

This entire section applies to information systems, systems, major applications, minor applications, enclaves, and platform information technologies (to include the subcomponents of each) designed or developed for or on behalf of VA by any non-VA entity.

a. Information systems designed or developed on behalf of VA at non-VA facilities shall comply with all applicable Federal law, regulations, and VA policies. This includes standards for the protection of electronic Protected Health Information (PHI), outlined in 45 C.F.R. Part 164, Subpart C and information and system security categorization level designations in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems and FIPS 200, Minimum Security Requirements for Federal Information Systems. Baseline security controls shall be implemented commensurate with the FIPS 199 system security categorization (reference VA Handbook 6500 and VA Trusted Internet Connections (TIC) Architecture).

b. Contracted new developments require creation, testing, evaluation, and authorization in compliance with VA Assessment and Authorization (A&A) processes in VA Handbook 6500 and VA Information Security Knowledge Service to obtain an Authority to Operate (ATO). VA Directive 6517, Risk Management Framework for Cloud Computing Services, provides the security and privacy requirements for cloud environments.

c. VA IT contractors, subcontractors and third-party service providers shall address and/or integrate applicable VA Handbook 6500, VA Handbook 6517, Risk Management Framework for Cloud Computing Services and Information Security Knowledge Service specifications in delivered IT systems/solutions, products and/or services. If systems/solutions, products and/or services do not directly match VA security requirements, the contractor shall work though the COR/CO to identify the VA organization responsible for governance or resolution. Contractors shall comply with FAR 39.1, specifically the prohibitions referenced.

d. The contractor (including producers and resellers) shall comply with Office of Management and Budget (OMB) M- 22-18 and M-23-16 when using third-party software on VA information systems or otherwise affecting the VA information. This includes new software purchases and software renewals for software developed or modified by major version change after the issuance date of M-22-18 (September 14, 2022). The term “software” includes firmware, operating systems, applications and application services (e.g., cloud-based software), as well as products containing software. The contractor shall provide a self attestation that secure software development practices are utilized as outlined by Executive Order (EO)14028 and NIST Guidance. A third-party assessment provided by either a certified Federal Risk and Authorization Management Program (FedRAMP) Third Party Assessor Organization (3PAO) or one approved by the agency will be acceptable in lieu of a software producer's self-attestation.

e. The contractor shall ensure all delivered applications, systems and information systems are compliant with Homeland Security Presidential Directive (HSPD) 12 and VA Identity and Access management (IAM) enterprise identity management requirements as set forth in OMB M-19-17, M-05-24, FIPS 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors (or its successor), M-21-31 and supporting NIST guidance. This applies to Commercial Off-The-Shelf (COTS) product(s) that the contractor did not develop, all software configurations and all customizations.

f. The contractor shall ensure all contractor delivered applications and systems provide user authentication services compliant with VA Handbook 6500, VA Information Security Knowledge Service, IAM enterprise requirements and NIST 800-63, Digital Identity Guidelines, for direct, assertion-based authentication and/or trust-based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV and/or Common Access Card (CAC), as determined by the business need and compliance with VA Information Security Knowledge Service specifications.

g. The contractor shall use VA authorized technical security baseline configurations and certify to the COR that applications are fully functional and operate correctly as intended on systems in compliance with VA baselines prior to acceptance or connection into an authorized VA computing environment. If the Defense Information Systems Agency (DISA) has created a Security Technical Implementation Guide (STIG) for the technology, the contractor may configure to comply with that STIG. If VA determines a new or updated VA configuration baseline needs to be created, the contractor shall provide required technical support to develop the configuration settings. FAR 39.1 requires the population of operating systems and applications includes all listed on the NIST National Checklist Program Checklist Repository. h. The standard installation, operation, maintenance, updating and patching of software shall not alter the configuration settings from VA approved baseline configuration. Software developed for VA must be compatible with VA enterprise installer services and install to the default “program files” directory with silently install and uninstall. The contractor shall perform testing of all updates and patching prior to implementation on VA systems.

i. Applications designed for normal end users will run in the standard user context without elevated system administration privileges.

j. The contractor-delivered solutions shall reside on VA approved operating systems. Exceptions to this will only be granted with the written approval of the COR/CO.

k. The contractor shall design, develop, and implement security and privacy controls in accordance with the provisions of VA security system development life cycle outlined in NIST 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, VA Directive and Handbook 6500, and VA Handbook 6517.

l. The Contractor shall comply with the Privacy Act of1974 (the Act), FAR 52.224-2 Privacy Act, and VA rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish a VA function.

m. The contractor shall ensure the security of all procured or developed information systems, systems, major applications, minor applications, enclaves and platform information technologies, including their subcomponents (hereinafter referred to as “Information Systems”) throughout the life of this contract and any extension, warranty, or maintenance periods. This includes security configurations, workarounds, patches, hotfixes, upgrades, replacements and any physical components which may be necessary to remediate all security vulnerabilities published or known to the contractor anywhere in the information systems (including systems, operating systems, products, hardware, software, applications and firmware). The contractor shall ensure security fixes do not negatively impact the Information Systems.

n. When the contractor is responsible for operations or maintenance of the systems, the contractor shall apply the security fixes within the timeframe specified by the associated controls on the VA Information Security Knowledge Service. When security fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the contractor shall provide written notice to the VA COR/CO that the patch has been validated as to not affecting the Systems within 10 business days.

7. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE OR USE.

This entire section applies to information systems, systems, major applications, minor applications, enclaves, and platform information technologies (cloud and noncloud) hosted, operated, maintained, or used on behalf of VA at non-VA facilities.

a. The contractor shall comply with all Federal laws, regulations, and VA policies for Information systems (cloud and non-cloud) that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities. Security controls for collecting, processing, transmitting, and storing of VA sensitive information, must be in place. The controls will be tested by VA or a VA sanctioned 3PAO and approved by VA prior to hosting, operation, maintenance or use of the information system or systems by or on behalf of VA. This includes conducting compliance risk assessments, security architecture analysis, routine vulnerability scanning, system patching, change management procedures and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures shall be the same as procedures used to secure VA-operated information systems.

b. Outsourcing (contractor facility, equipment, or staff) of systems or network operations, telecommunications services or other managed services require Assessment and Authorization (A&A) of the contractor’s systems in accordance with VA Handbook 6500 as specified in VA Information Security Knowledge Service. Major changes to the A&A package may require reviewing and updating all the documentation associated with the change. The contractor’s cloud computing systems shall comply with FedRAMP and VA Directive 6517 requirements.

c. The contractor shall return all electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) on non-VA leased or non-VA owned IT equipment used to store, process or access VA information to VA in accordance with A&A package requirements. This applies when the contract is terminated or completed and prior to disposal of media. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Information Security Knowledge Service requirements and NIST 800-88. The contractor shall send a self-certification that the data destruction requirements above have been met to the COR/CO within 30 business days of termination of the contract.

d. All external internet connections to VA network involving VA information must be in accordance with VA Trusted Internet Connection (TIC) Reference Architecture and VA Directive and Handbook 6513, Secure External Connections and reviewed and approved by VA prior to implementation. Government-owned contractor-operated systems, third party or business partner networks require a Memorandum of Understanding (MOU) and Interconnection Security Agreements (ISA).

e. Contractor procedures shall be subject to periodic, announced, or unannounced assessments by VA officials, the OIG or a 3PAO. The physical security aspects associated with contractor activities are also subject to such assessments. The contractor shall report, in writing, any deficiencies noted during the above assessment to the VA COR/CO. The contractor shall use VA’s defined processes to document planned remedial actions that address identified deficiencies in information security policies, procedures, and practices. The contractor shall correct security deficiencies within the timeframes specified in the VA Information Security Knowledge Service.

f. All major information system changes which occur in the production environment shall be reviewed by the VA to determine the impact on privacy and security of the system. Based on the review results, updates to the Authority to Operate (ATO) documentation and parameters may be required to remain in compliance with VA Handbook 6500 and VA Information Security Knowledge Service requirements.

g. The contractor shall conduct an annual privacy and security self-assessment on all information systems and outsourced services as required. Copies of the assessment shall be provided to the COR/CO. The VA/Government reserves the right to conduct assessment using government personnel or a third-party if deemed necessary. The contractor shall correct or mitigate any weaknesses discovered during the assessment.

h. VA prohibits the installation and use of personally owned or contractor-owned equipment or software on VA information systems. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW, PWS, PD or contract. All security controls required for government furnished equipment must be utilized in VA approved Other Equipment (OE). Configuration changes to the contractor OE, must be funded by the owner of the equipment. All remote systems must use a VA-approved antivirus software and a personal (host-based or enclave based) firewall with a VA-approved configuration.