36C25226Q0271.docx

SUBJECT*

Pyxis Automated Dispensing Cabinets

GENERAL INFORMATION

SET-ASIDE

36C252 115 South 84th Street, Suite 101 Milwaukee WI 53214-1476

POINT OF CONTACT*

Contract Specialist Jennifer Mead Jennifer.Mead@va.gov

DESCRIPTION

Sources Sought Notice Sources Sought Notice Sources of Sought – 36C25226Q0271 – Automated Dispensing Cabinets

THIS IS A SOURCES SOUGHT NOTICE ONLY. THIS IS NOT A REQUEST FOR QUOTE.

The NCO 12, Great Lakes Acquisition Center, 115 S. 84th Street, Suite 101, Milwaukee, WI 53214, is performing market research to determine if there is a sufficient number of qualified: (1) Service Disabled Veteran Owned Small Business (SDVOSB); (2) Veteran Owned Small Business (VOSB); or (3) Small or emerging small business firms, or (4) Other Than Small business firms, to provide brand name Pyxis (Automated Dispensing Cabinets) for the VA Illiana Healthcare System, Danville, IL.

Submit responses to the Contracting Officer, Jennifer Mead, at Jennifer.Mead@va.gov no later than 10:00 a.m. (Central Standard Time), 27 February 2026. RFQ - 36C25226Q0271 shall be referenced on all correspondence regarding this announcement.

TELEPHONIC INQUIRIES WILL NOT BE ACCEPTED.

The NAICS Code 532490 Other Commercial and Industrial Machinery and Equipment Rental and Leasing is applicable to this acquisition; the size standard is $40 Million. Interested firms are reminded that in accordance with FAR 4.12, prospective contractors shall complete electronic annual representations and certifications in conjunction with FAR 4.11 required registration in the Systems for Award Management (SAM) database prior to award of a contract. The Government will use responses to this notice to make an appropriate acquisition decision. This is the only notice; no other copies of this notice will be provided.

Statement of Work (SOW)

A. Background:

Pharmacy services are responsible for providing medication dispensing functions to all areas of care to include acute care, ambulatory care, psychiatric care, and long-term care. The current standard of care is to provide medication access and on-site dispensing and stocking of medications in a secure and accountable environment using an automated dispensing cabinet system.

VA Illiana Healthcare Systems (VAIHCS) is seeking a base plus four option year contract for automated dispensing cabinets, maintenance and support.

B. Purpose:

The contractor shall provide all equipment, labor, material, hardware, software, licensing, warranty, installation, user training, and all supplies necessary to install the Automated Dispensing Cabinet System and all necessary components.

C. Scope:

The contractor shall provide up to the current technological standard leased automated dispensing cabinet equipment as well as 24/hour 7 day per week technical, maintenance, and software support for their proprietary equipment at VAIHCS. Technically trained staff must be available to repair and diagnose issues related to the performance of the dispensing cabinets within a 24-hour window. Software and support for software must be provided to ensure accurate dispensing of patient orders from the dispensing cabinets as well as legally binding tracking and auditing capability of the dispensing cabinets. The contractor, as part of the need to diagnose/review and repair equipment, will have access to VA sensitive information as well as physical access to VA patient areas. All contracted staff employed in support of their equipment are subject to VA security agreements as well as VA technical security standards to ensure patient sensitive information is protected by OIT guidelines and VA privacy standards.

D. Physical Characteristics:

Automated Dispensing Cabinets (ADCs), hardware and software must have physical characteristics to enable the government to perform the following capabilities:

1. Patient-centric interface

2. System management roles can be defined, implemented, and adjusted as needed.

3. Integrates with HIT system to provide needed data.

4. Streamlined user management.

5. Barcode scanner

6. Thermal printer

7. Sealed keyboard

8. Secure half-height and full height cubie pockets

9. Secure mini drawer (single and triple wide)

10. Biometric access system

11. Matrix drawer

12. Accessible deep bin drawer

1. Ability to store and dispense controlled and non-controlled medications and products in various packaging forms, sizes and types, including but not limited to: ampules, bags (e.g. intravenous (IV) bags, TPN bags, IV piggyback, ready-to-use IV bags, premixed IV bags, bottled medications (e.g., oral liquids, spray, canister, droppers), box (e.g., dose packs, inhalers, cream, ointment), refrigerated medications, syringes up to 60ml (e.g. oral syringes, intravenous (IV) syringe), unit dose packaged medications (e.g., blister packs, liquid cups), vials (e.g. single-dose, multi-dose), patient specific medications. The system shall have multiple, configurable lidded pocket sizes.

2. Pockets shall be reconfigurable by the customer without requiring Vendor Support

3. The system shall restrict access to only one medication at a time during the removal and refill process.

4. Refrigerators shall have the ability to enable secure, single line-item access for high-risk, high-value, and patient-specific refrigerated medications.

5. Refrigerators shall have clear, secure locking bins.

6. Refrigerators shall have secure, locking bins that light up and unlock when accessed via the ADE.

7. The ability to be configurable to support different equipment in clinical settings, including but not limited to clinics, inpatient wards, pharmacies, sterile environments (e.g., operating rooms) or other ambulatory care settings.

8. Shall have the flexibility to reconfigure secure storage spaces to accommodate changing medication requirements within minutes and at zero additional cost.

9. Shall have simple, reliable, flexible drawers that efficiently dispense drugs in smaller increment doses for greater control and safety.

10. The contractor shall prevent the inadvertent loading of unsafe medications within the selected ADC.

11. Shall allow a nurse to queue meds or document medication waste from patient room- or any computer- via a fully web-accessible system.

12. Shall allow remote dose request via web-accessible system for patient-specific doses not residing in ADC.

13. Shall print patient dose-specific label for med removed from ADE, as configured by Pharmacy.

14. Shall locate medications not available at current station to support rapid medication access and timely administration of therapy.

15. Shall support dispensing of items consisting of multiple medications or components.

16. Shall allow removal of a partial dose from a multi-dose container, minimizing waste and associated costs.

17. Shall allow reallocation of medications between stations to support availability and reduce waste.

18. Main unit of the station shall contain locked & covered drawers which have a capacity of at least 60 different types of medications.

19. Ability to configure to support local site capacity needs (i.e. minimum storage capacity per equipment in a clinical setting of 120 medications and configurable up to 300+ medications).

20. Ability to be configured by local sites to allow separate equipment in clinical settings to share common stocks (e.g., floor stock from Ward 3c and be dispensed by users from Ward 6a).

21. Ability to display and utilize a clinic setting-specific patient list and a global patient list for medication administration.

22. Shall alert the clinical setting user whenever a product is not available (e.g., temporarily out of stock) and direct the user to nearby equipment in clinical settings with available stock.

23. Shall allow physical access to the medications, via manual lock and key, during power failure and outages.

24. Equipment in clinical settings shall be configurable to operate in a stand-alone or interconnected environment (e.g., main unit only or main unit attached to auxiliary cabinets).

25. Shall allow for the electronic issuance and receipt of controlled medications between different equipment located in separate equipment in clinical settings (e.g. equipment located on Ward 3c can issue and receive controlled substances to and from any equipment located at the local site)

26. Shall have multiple drawer configurations. Configuration capacities include:

a. Refrigerated product dispensing

b. Controlled substance dispensing, wastage, and return

c. Single-use dispensing, tamper-free drawer return

27. Shall be capable of transaction continuity by allowing users to start transactions on equipment in one clinical setting and allow completion of that transaction on equipment in a different clinical setting (e.g., start transaction on equipment in Ward 3c and complete the transaction on the equipment located in Ward 6a).

28. Shall be configurable by local sites to log users out of the system automatically (e.g. the session times out after three minutes of inactivity).

29. Shall be configurable by local sites to provide temporary access (e.g. username/password) for on-call or float users.

30. Shall be configurable by local sites to prompt users, per medication, to verify the inventory during transactions (e.g., loading, refiling, dispensing).

31. Shall be configurable by local sites to suspend user credentials due to system access inactivity (e.g., user has not logged in within 30 days).

32. Provide 24/7 technical and customer support.

33. Shall allow authorized users to perform system activity functions remotely and locally (e.g., reset drawer on equipment, restart a server).

34. Shall support the importing of external configuration data (e.g. drug files, user database, formulary data, equipment in clinical settings) from an external source file (e.g. database, spreadsheet, text file).

35. Shall be configurable by local sites, per medication, to require verification via second authorized user during transactions.

36. Shall be configurable by local site, per user role access, to require a second authorized user during transactions.

37. Shall be configurable by local sites, to require a review of all medication orders by a pharmacist prior to dispensing (e.g., medication profiling from pharmacy information system).

38. Shall utilize industry 1D and 2D barcode standards for transactions.

39. Cabinet shall be able to return without an External Return Bin

40. Shall be configurable by local sites for safe medication usage by limiting the dispensing of medications due to predetermined conditions (e.g., expired medication, incorrectly stocked user access level).

41. Shall allow authorized users to monitor and perform administrative functionalities including but not limited to managing of medications within clinical settings (e.g., assign medication, modify par level, modify inventory). Resetting/restarting of equipment in clinical settings, managing database (e.g., users, formulary, drug files).

42. Shall be capable of accurately incrementing and decrementing the equipment inventory during user transactions (e.g., dispensing, returning, wasting, refilling).

43. Shall provide unique qualifiers within drug properties configurable by local sites to include but not limited to high alert, locally controlled, sound-a-like/look-a-like, Tallman lettering, override medications.

44. Shall be configurable by local sites to print patient specific medication labels (e.g., IV’s, cream/ointment, eye drops, syringes, unit dose).

45. Shall be capable of automatic documentation of transactions, including but not limited to date, time, drug, patient, dose, quantity, username, witness information (when applicable), user IDs.

46. Shall aggregate and display the operational status of locally deployed network connected equipment in clinical settings equipment for local site administrators via dashboard.

47. Shall be capable of presenting a list of medication due for administration for a selected patient.

48. Shall be configurable by the local site to withhold medications that are not due for administration based on site-defined time frame.

49. Shall serially dispense medication when multiple medication is selected for removal (e.g., allow users to withdraw one medication at a time).

50. Cross-referencing when performing medication searches within the system (i.e. user search using brand name, while displaying the generic name for reference).

51. Shall be configurable by local sites to allow the return of unused and sealed controlled medication(s) to a secure integrated bin.

52. Shall offer Windows Server 2019 Server software.

53. Shall have servers that run in a virtual environment.

54. System management shall be available via a web-based application.

55. Concurrent users shall have access to the system at the same time.

56. Shall integrate with multiple Pharmacy Information Systems

57. Shall allow automated formulary updates from the pharmacy information system.

58. Shall be able to view system changes across facilities.

59. Shall support SQL Server 2019

60. Shall support IPsec network encryption.

61. Shall allow users to suspend inventory transactions or cancel all other in-progress transactions.

62. Shall be configurable by local sites to define and assign user roles and access to the equipment in clinical settings.

63. Shall be capable of using and displaying multiple unique patient identifiers (e.g., patient name, ID, date of birth).

64. Shall be able to secure medical refrigerators.

65. When equipped, shall be capable of monitoring and documenting the temperature of medical refrigerators, and providing alerts upon reaching the outer bound of the local site’s configurable ranges.

66. When equipped, shall provide local site configurable, audible, and visual alerts when the temperatures are out of range.

67. Shall provide and maintain integrated Uninterrupted Power Supply (UPS) for deployed Anesthesia clinical equipment up to 30 minutes.

68. Shall provide and maintain UPS for all non-Anesthesia deployed clinical equipment supporting proper system shut down (e.g., workstations, equipment).

69. Shall have a minimum underlying Operating System (OS) of Microsoft Windows 10 and Windows Server 2019. Operating systems shall remain current with OEM (e.g. Microsoft, etc.)

70. Printing reports (e.g., user report, inventory, system reports).

71. Shall maintain logs, including but not limited to activity logs, issue logs, technical logs.

72. Shall be configurable by local sites to generate scheduled pre-determined and ADHOC reports. The pre-determined reports shall include but not limited to: user activity reports, (e.g., load, refill, unload, remove, return, waste, override, log-in attempts), Inventory reports (e.g., load list, refill list, expired list, inventory list), system reports (e.g., user database, formulary, data dictionary, data schema, maintenance report, failed drawer/pocket system status).

73. Shall be configurable by local sites to export reports into multiple file formats (e.g., spreadsheet, database, text file).

74. Shall be capable of providing descriptive statistical analysis reports including, but not limited to average usage, frequency distribution, and standard deviations.

75. Shall be capable of creating visual representation of descriptive statistical analysis reports including, but not limited to histograms, bar charts, and frequency tables.

76. Shall be capable of generating reports in real-time without affecting system performance.

77. Shall be capable of unarchiving and integrating archived date for reporting purposes.

78. Shall maintain transaction data upon loss of network connectivity.

79. Shall automatically reconcile transaction data upon reestablishment of network connectivity.

80. Shall back-up and restore transaction data per site based on Government defined timeframe (e.g., 30 days, 45 days, or 60 days).

81. Shall be capable of rebuilding damage/lost files during data recovery process using database back-up data.

82. Shall be configurable by local sites to set up the parameters for incremental database back-up data.

83. Shall store, archive, and readily retrieve historical data for a minimum of five years.

84. Shall include reports and user interface features to manage and analyze inventory, diversion activity and usage data, for enhanced dispensing and compliance operations.

85. Shall store up to 7 days of transactional data at the station; the enterprise server stores up to 90 days of report data.

86. Shall be able to export and store data in a variety of ways for long-term storage.

87. Shall allow the user to run ad hoc query reports, schedule custom reports, create distribution list, receive email notifications, and share queries between facilities for more consistent results.

E. Software Interface:

1. Network connectivity between medication systems and the VA Network

2. Shall already be approved on the TRM.

3. Shall already work with VA software systems (e.g., VISTA, CPRS etc.), with the ability to interface with Cerner in the future

4. Shall already work with IV Prep

5. Shall work with VA PADE interface

F. Warranty/Service:

1. All equipment and materials shall come with a standard one-year warranty. Warranty shall begin after acceptance of equipment and the completion of the tests.

2. All hardware will be installed and operational in accordance with manufacturer’s specifications.

3. Support shall be available and provided via telephone and on-site.

G. Contractor Responsibilities:

1. Assign a project manager upon award of contract, project manager shall develop a project schedule and implementation plan.

2. The contractor shall provide qualified VA credentialed personnel to perform the installation of the items as noted in this SOW. The contractor can leverage already existing vetted workforce if they meet the requirements of the project.

3. The contractor shall be responsible for all systems and software testing prior to government acceptance.

4. The contractor is responsible for onsite super user training at the time of installation. Training times shall be coordinated with the COR, Pharmacy Chief, Procurement Supervisor, or designee.

5. The contractor is responsible for being on-site to ensure all equipment is installed to meet VA standards and is properly functioning prior to leaving the facility.

6. The contractor is responsible for securing all material, equipment, and tools while on government property or in government facilities. The government is not liable for any lost or stolen items that are not properly secured by the contractor.

H. Deliverables/Training:

Deliverables:

The contractor will install the Automated Dispensing Cabinets providing all necessary labor, management, skills, materials, etc. required to install, train, and maintain the system. Installation activities to include coordination with Biomedical Engineering and OI&T to ensure network connectivity as needed.

The contractor is required to check in and out with Police Service in Bldg. 102 everyday as well as wear a badge while on-station at VA Illiana Healthcare System. After check-in with Police Service, the contractor is free to check in with the COR, Procurement Supervisor, Associate Chief, Pharmacy Operations, or Chief of Pharmacy.

Any necessary files created during maintenance will not be saved by the vendor. Retention of data will be on an internal VA server only. All backup data will be completed, performed, and maintained by Pharmacy service.

The contractor provides technical support, software support (including updates), and preventative maintenance at the frequency designated by the manufacturer (this needs to be scheduled at the start of the contract).

The contractor is authorized to utilize VPN with required approvals from the VA Office of Information Technology to provide telecommunications and/or internet connectivity between vendor and the VA; it is required that the contractor’s equipment is compatible with VA software and hardware, including critical patches and antivirus updates. When an issue arises, the contractor is responsible for providing the COR time to address concerns with Biomed, OIT, or other VAIHCS staff involved. The equipment is required to be fully functional at all times. The contractor shall have an active National Business Associate Agreement (BAA).

Training:

The contractor is responsible for onsite super user training at the time of installation. Training times shall be coordinated with the COR, Pharmacy Chief, Procurement Supervisor, or designee.

I. Performance Monitoring:

The Government is required to monitor contractor performance and certify the work that is being done at our facility, which is done in accordance with the contract agreement. This monitoring is completed by the COR with compliance from the contract. The COR, Automation Technician, or Procurement supervisor will do random inspections of the equipment to ensure the equipment is functioning properly. The contract will require the contractor to set up a date for annual maintenance (preferably at the start of the contract). It is critical to ensure the equipment is operational at all times and it’s important for communication to be upheld between the contractor, COR, Contracting Officer (CO), staff, and anyone involved, which will establish how well the contractor is performing and identify areas to improve. This will implement any support needed to ensure quality performance for the contract is met. The contractor will report to the COR or Procurement Supervisor or designee, when services are done physically before and after to ensure services are performed to standards and to their agreement.

The company will supply 24/7 telephone support 365 days per year provided by trained client support engineers, remote diagnostics including patches, software downloads and unlimited support requests. The contractor will supply onsite support by trained client support engineers when telephone support cannot solve the issue and/or in the instance an emergency issue occurs, and patient care is compromised. Contractor’s employees and/or subcontractors should possess skills and administrative privileges for installation, setup and maintenance services.

J. Security Requirements:

1. Training. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete privacy training before commencing work on this contract, and annually thereafter. The contractor is to self-enroll into TMS via the link: http://www.tms.va.gov. Certificates must be available from the contractor upon request for audit purposes.

a. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the contractor Rules of Behavior, Appendix E relating to access to VA information and information systems.

b. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training.

c. Successfully complete the appropriate VA privacy training and annually complete required privacy training, and

d. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access.

e. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the contractor Rules of Behavior for each applicable employee within one week of the initiation of the contract and annually thereafter, as required.

f. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

2. Access to VA Information and VA Information Systems

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party services and associates working with the VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. 3) The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employment. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. Contractor Personnel Security Requirements. Failure to comply with the contractor personnel security requirements may result in termination of the contract for cause.

a. Contractor employees must wear ID badges at all times while on premises at VAIHCS and/or the Peoria CBOC. Taking photographs on the premises is prohibited.

b. All contractor employees who require access to the Department of Veterans Affairs' Contractors computer systems or who have access to sensitive information shall be the subject of a background investigation. The contractor is encouraged to have its employees immediately download the background investigation packet from http://www.va.gov/vabackground_investigations upon notification of contract award. A contractor’s employee shall not commence working at VA under contract until the Contracting Officer receives notification from the VA Office of Security and Law Enforcement that the contract employee’s application was received complete. A favorable adjudication from the VA Office of Security and Law Enforcement must be received for a contractor employee to continue contract performance. This requirement is applicable to all subcontractor personnel.

c. Position Sensitivity - The position sensitivity has been designated as Low Risk.

d. Background Investigation - The level of background investigation commensurate with the required level of access is Special Agreement Check.

e. Contractor Responsibilities:

i. The contractor shall bear the expense of obtaining background investigations. If the Office of Personnel Management (OPM) conducts the investigation, the contractor shall reimburse VA within 30 days. If timely payment is not made within 30 days from date of bill for collection, then VA shall deduct the cost incurred from the contractor’s 1st month’s invoice(s) for services rendered.

ii. It is imperative for the contractor to provide, at the request of VA, a listing of contractor personnel performing services under the contract for the background investigation process to commence. This list will include name (first, middle, last) social security number; date of birth; city, state, and country of birth.

iii. The contractor or their employees shall submit a complete background investigation packet. Additional guidance and information in completing the required forms, and examples of the forms, can be found at http://www1.va.gov/VABackground_Investigations/page.cfm?pg=2 . The following required forms must be submitted to the VA Office of Security and Law Enforcement before contract performance begins:

1. Standard Form 85, Questionnaire for Non-Sensitive Positions

2. Optional Form 306, Declaration for Federal Employment

3. Standard Form 86A (EG), Continuation Sheet for Questionnaire

4. Electronic Fingerprint Form. Fingerprinting is required with the background investigation. Fingerprinting can be done at the local VA Facility. The Electronic Fingerprint Verification Form must be submitted with the above required forms.

5. The contractor shall inform the contract employee that when filling out Standard Form 85, that there should be no gaps in employment history. Any gaps in employment history on Standard Form 85 may result in OPM rejecting the documentation for investigation and delay contract performance.

6. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract, and at the request of the VA, submit another employee for consideration.

7. The contractor may utilize a private investigating agency if such agency possesses an OPM and Defense Security Service certification. A Cage Code number must be provided to the VA Office of Security and Law Enforcement. VA Office of Security and Law Enforcement will verify the information and advise the contracting officer whether the contractor’s access to the computer systems can be authorized.

8. All contractor employees and subcontractors are required to complete VA’s Privacy training annually. All Contractor employees and subcontractors requiring access to VA computer network are required to complete Cyber Security training courses annually either on-line or hard copy. Documented proof must be provided to the Contracting Officer.

9. The contractor will notify the COR immediately when their employee(s) no longer require access to VA computer systems.

f. Government Responsibilities:

i. The contracting officer will request the contractor employee’s background investigation by the Office of Security and Law Enforcement.

ii. The Office of Security and Law Enforcement will notify the contractor with instructions for the contractor's employees, coordinate the background investigations, and notify the contracting officer and contractor of the results of the investigations.

iii. c) The VA facility will pay for requested investigations in advance. A bill for collection will be sent to the contractor to reimburse the VA facility. The contractor will reimburse the VA facility within 30 days. If timely payment is not made within 30 days from the date of bill for collection, then VA shall deduct the cost incurred from the contractor’s 1st month’s invoice(s) for services rendered.

iv. d) The most recent fees associated with background investigations are $122.00 each for low level investigation, $855.00 each for medium level investigation, and $3,045.00 each for high level investigation.

4. Special Security Requirements. Due to the increased emphasis on privacy and information security, the following special contract requirements are established and hereby made part of the contract entered into with the Department of Veterans Affairs.

a. Privacy Training: Contractor and their sub-contractors assigned work under the contract are required to receive annual training on patient privacy as established by HIPAA statues. Training must meet VHA’s and the Department of Health and Human Services Standards for Privacy of Individually identifiable health information. The contractor shall provide documented proof to the contracting officer that all employees assigned work and/or having access to Protected Health Information have received annual training. Proof of training is to be forwarded to the COR. Training can be obtained through http://www.insidelms.va.gov/index.shtm . An account must be set up in order to access the training site by visiting the http://www.insidelms.va.gov/insideLMSpages/localAdmin.shtm page and contacting the local LMS Administrator, contacting the VA LMS Help Desk by phone at 1-866-496-0463, or e-mail.

b. For contractors and sub-contractors who do not have access to VHA computer systems, this requirement is met by receiving VHA National Privacy Training, other VHA approved privacy training or contractor furnished training that meets the requirements of the HHS standards.

c. 3) Rules of Behavior for Automated Information Systems: Contractor personnel having access to VA Information Systems are required to read and sign a Rules of Behavior statement which outline rules of behavior related to VA Automated Information Systems. The COR will provide, through the facility ISO, the Rules of Behavior to the contractor for the respective facility.

d. 4) VA Cyber Security Awareness Training: Each contractor assigned work under the contract is required to receive and document completion of VA training on Cyber Security. Training can be obtained through http://www.insidelms.va.gov/index.shtm . An account must be set up in order to access the training site by visiting the http://www.insidelms.va.gov/insideLMSpages/localAdmin.shtm page and contacting the local LMS Administrator, contacting the VA TMS Help Desk by phone at 1-866-496-0463, or e-mail. The contractor shall provide documented proof to the COR that all contractor employees servicing a VA contract have received annual training.

5. Confidentiality of Patient Records.

a. The contractor, as a VA provider, will assist in the provision of health care to patients seeking such care from or through VA. As such, the contractor is considered as being part of the Department health care activity. Contractor is considered to be a VA provider for purposes of the Privacy Act, Title 5 U.S.C. 552a. Further, for the purpose of VA records access and patient confidentiality, Contractor is considered to be a VA contractor for the following provisions: Title 38 U.S.C. 5701, 5705, and 7362. Therefore, Contractor may have access, as would other appropriate components of VA, to patient medical records including patient treatment records pertaining to drug and alcohol abuse, HIV, and sickle cell anemia, to the extent necessary to perform its contractual responsibilities. However, like other components of the Department, and not withstanding any other provisions of the contract, the contractor is restricted from making disclosures of VA records, or information contained in such records, to which it may have access, except to the extent that explicit disclosure authority from VA has been received. The contractor is subject to the same penalties and liabilities for unauthorized disclosures of such records as VA.

b. The records referred to above shall be and remain the property of VA and shall not be removed or transferred from VA except in accordance with U.S.C.551a (Privacy Act), 38 U.S.C. 5701 (Confidentiality of claimants records), 5 U.S.C. 552 (FOIA), 38 U.S.C. 5705 (Confidentiality of Medical Quality Assurance Records) 38 U.S.C. 7332 (Confidentiality of certain medical records) and federal laws, rules and regulations. Subject to applicable federal confidentiality or privacy laws, the contractor, or their designated representatives, and designated representatives of federal regulatory agencies having jurisdiction over Contractor, may have access to VA‘s records, at VA’s place of business on request during normal business hours, to inspect and review and make copies of such records.

6. Health Insurance Portability and Accountability Act (HIPAA) Compliance. The contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). As required by HIPAA, the Department of Health and Human Services (HHS) has promulgated rules governing the security and use and disclosure of protected health information by covered entities, including the Department of Veterans Affairs (VA). In accordance with HIPAA, the contractor may be required to enter into a Business Associate Agreement (BAA) with VA. ScriptPro equipment maintenance does not require a BAA.

7. Security Incident Investigation.

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

8. Liquidated Damages for Data Breach.

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. The contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

i. Nature of the event (loss, theft, unauthorized access).

ii. Description of the event, including:

1. Date of occurrence.

2. Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

iii. Number of individuals affected or potentially affected.

iv. Names of individuals or groups affected or potentially affected.

v. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text.

vi. The amount of time the data has been out of VA control.

vii. The likelihood that sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons).

viii. Known misuses of data containing sensitive personal information, if any.

ix. Assessment of the potential harm to the affected individuals.

x. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

xi. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $ 300.00 per affected individual to cover the cost of providing credit protection services to affected individuals.

9. Property Damage. The contractor shall take all necessary precautions to prevent damage to any government property. The contractor shall report any damages immediately and shall be assessed current replacement costs for property damaged by the contractor, unless corrective action is taken. Any damaged material (i.e., shelving, pharmacy equipment, etc.) will be replaced in a timely manner or corrected by the contractor with like materials, at no extra cost to the government, upon approval of the Contracting Officer.

10. Record Retention.

a. Upon completion or termination of the applicable contract(s) or agreement(s), return and/or destroy VA information gathered, created, received, or processed during the performance of the contract(s) or agreement(s). No data will be retained by Business Associate, or contractor, subcontractor, or other agent of Business Associate, unless retention is required by law and specifically permitted by Covered Entity. As deemed appropriate by and under the direction of Covered Entity, Business Associate shall provide written assurance that all VA information has been returned to Covered Entity or destroyed by Business Associate. If immediate return or destruction of all data is not possible, Business Associate shall notify Covered Entity and assure that all VA information retained will be safeguarded to prevent unauthorized Uses or Disclosures.

b. Prior to termination or completion of this contract, the contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

c. Termination of contract Note: If the vendor maintains any records whether hardcopy or electronic, they must be returned to the VA per contract and VA regulations by vendor. All files (hardcopy or electronic) shall not be shared with a 3rd party (unauthorized) unless authorized in writing by the COR or contracting Officer. If any disclosures of VA records to any 3rd party, an accounting of the disclosure must be kept by the vendor.

K. Records Management Requirements

1. Contractor shall comply with all applicable records management laws and regulations of VA Illiana, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. VA Illiana and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of VA Illiana or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to VA Illiana. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government's behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to VA Illiana control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand-carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and VA Illiana guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with VA policy.

8. The Contractor shall not create or maintain any records containing any non-public VA Illiana information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. VA Illiana owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which VA Illiana shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with or otherwise handle records are required to take VA Illiana-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

12. [Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

13. D. Flow down of requirements to subcontractors

14. The Contractor shall incorporate the substance of this clause, its terms, and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

15. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.