36C25519Q0371-002.docx

36C25519Q0371

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

36C25519Q0371 05-01-2019 Kidder, Bruce | bruce.kidder@va.gov 913-946-1957 05-28-2019 12:01 pm 36C255 Department of Veterans Affairs Network Contracting Office (NCO) 15 3450 S 4th Street Trafficway Leavenworth

KS

66048 X X 517312 1500 Employees X N/A X St. Louis VAHCS, St. Louis, MO John J. Pershing VAMC, Poplar Bluf, MO Marion VAMC, Marion, IL

36C255 Department of Veterans Affairs Network Contracting Office (NCO) 15 3450 S 4th Street Trafficway Leavenworth

KS

66048

36C255 Department of Veterans Affairs Financial Services Center http://www.fsc.va.gov/einvoice.asp Austin

TX

877-353-9791 512-460-5429 This is a request for quote to provide guest wi-fi services for the St. Louis VA Health Care System, the John J.

Pershing VAMC, Poplar Bluff, MO and the Marion, IL VAMC and their outlying Community Based Out-Patient Clinics (CBOCs) and annexes in accordance with the B.3 Performance Work Statement (PWS).

This is a 100% Service Disabled Veteran Owned Samll Business (SDVOSB) set-aside.

This will be a firm fixed price contract. The contract is a base year and up to 4-Option Years to be awarded at the discretion of the Government.

See pages 57 through 59 for E.2 ADDENDUM to FAR 52.212-1: Instructions to Offerors This ADDENDUM contains key information on how to properly respond to this RFQ.

X X Roy D. Harrison Contracting Officer Attention Please go to Page 57 of this RFQ and review E.2 ADDENDUM to FAR 52.212-1:

Instructions to Offerors.

This ADDENDUM contains key information 36C25519Q0371 on how to properly respond to this RFQ.

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

(continuation from Standard Form 1449, block 18A.)

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

Leavenworth, Kansas 66048

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Austin, TX ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 SCHEDULE OF PRICE AND DELIVERY

Base Year: TBD St. Louis VA Health Care System, St. Louis, MO

TOTAL

John J. Pershing VA Medical Center, Poplar Bluff, MO

TOTAL

Marion VA Medical Center, Marion, IL

TOTAL

Base Year Total: $ ___________________________

Option Year 1: TBD St. Louis VA Health Care System, St. Louis, MO

TOTAL

John J. Pershing VA Medical Center, Poplar Bluff, MO

TOTAL

Marion VA Medical Center, Marion, IL

TOTAL

Option Year 1 Total: $ ___________________________

Option Year 2: TBD St. Louis VA Health Care System, St. Louis, MO

TOTAL

John J. Pershing VA Medical Center, Poplar Bluff, MO

TOTAL

Marion VA Medical Center, Marion, IL

TOTAL

Option Year 2 Total: $ ___________________________

Option Year 3: TBD St. Louis VA Health Care System, St. Louis, MO

TOTAL

John J. Pershing VA Medical Center, Poplar Bluff, MO

TOTAL

Marion VA Medical Center, Marion, IL

TOTAL

Option Year 3 Total: $ ___________________________

Option Year 4: TBD St. Louis VA Health Care System, St. Louis, MO

TOTAL

John J. Pershing VA Medical Center, Poplar Bluff, MO

TOTAL

Marion VA Medical Center, Marion, IL

TOTAL

Option Year 4 Total: $ ___________________________

6-Month Extension Under FAR Clause 52.217-8 at Option Year 4 Pricing St. Louis VA Health Care System, St. Louis, MO

TOTAL

John J. Pershing VA Medical Center, Poplar Bluff, MO

TOTAL

Marion VA Medical Center, Marion, IL

TOTAL

6-Month Extension Total: $ ___________________________ Total of Base Year, 4-Option Years, and 6-Month Extension: $ _______________________

B.3 PERFORMANCE WORK STATEMENT (PWS)

1. General The St. Louis Heath Care System, the Marion, IL VA Medical Center and the Poplar Bluff VA Medical Center are seeking a vendor to continue and maintain their existing Veterans Guest Internet Access (VGIA) wireless internet access service.

2. Required Services

a. The vendor shall use current equipment owned by the VA, that is already in-place, installed and operational in providing guest wi-fi service.

b. The vendor shall provide at a minimum 2.4GHz 802.11 b/g/n bandwidth for users of the public wireless internet via Wireless Access Points (WAPS) in specific areas identified on facility drawings provided by the Veteran Affairs Medical Center (VAMC).

c. If wireless access cannot be established in an identified location, the vendor shall provide a cable alternative.

d. The vendor shall provide public wireless security.

e. The vendor shall provide wireless isolation via Layer 1 air gap in accordance with the following documents:

1. Attachment 7: MOU - Air Gapped Networks

2. Attachment 8: Additional Security Info for Air-Gapped MOU

3. Attachment 9: VA Air Gapped Public Guest Internet Advisory Banner

f. The vendor shall provide for the physical security of vendor installed equipment, as needed. Due to limitations of IT closet access and space, switches, WAPS, and POE extenders, installation might require an IT closet on the floor above or below. Electrical power for switches will be the responsibility of VAMC and all respective outlying campuses.

g. For all installation activity, the vendor shall adhere to all standards governed by the most recent editions of the National Fire Protection Association (NFPA-101 Life Safety Code), NEC, and VA specifications.

h. The vendor shall be responsible for the design, configuration and installation of all cabling, access points, switches, and routers needed for the Veterans Guest Internet Access (VGIA).

i. The vendor shall supply the VAMC with a final wiring and equipment location map for each location upon completion of the project. See block diagram example provided.

j. The vendor shall provide an introduction page with usage agreements for acknowledgement at the time of login with information on the program, rules, restrictions, and usage agreements. If user does not agree and acknowledgement, user access is denied. Furthermore, users must acknowledge awareness of the risk of using public wi-fi.

k. The vendor shall provide 24/7/365 VGIA technical support via a call center for all users of the public wi-fi.

l. The vendor shall provide, at the medical center request, telephone support within two hours and onsite support within 24 hours (if required).

m. The vendor shall provide service availability with an expected uptime of ≥ 99%.

n. The minimum acceptable service speed shall be a high-speed circuit with an average 1Mbps upload and an average 10Mbps download delivered over an appropriately sized WAN.

o. The vendor shall monitor the typical usage of access points and Internet gateway(s) to define high usage areas; the vendor shall notify the VAMC of these locations. The vendor will help the VAMC re-evaluate and upgrade the bandwidth should the VAMC determine there is need. The number of projected users is ≥ 2000 patient visits per day on a 250-day annual basis.

p. The vendor shall test, validate, repair, replace as needed, and maintain installed VGIA equipment in accordance with this contract. The vendor shall relinquish ownership of any installed cabling and related equipment/devices used to provide full wi-fi service to the VAMC upon expiration of the contract.

q. The vendor will state having no relation to, and having no past or current affiliation with, any Veteran Affairs employee.

r. The vendor shall collaborate with VA COR and internal VA staff to prevent potential interference with medical center’s current, and future, wireless access. The frequency range for medical telemetry equipment is 609.00MHz – 614.000MHz and should be avoided.

s. The Vendor shall provide for Payment Card Industry (PCI) Security Standards Compliance.

t. The Vendor will customize the VA provided guest splash page to incorporate the look and feel that the VA desires which will include a VA non-liability disclaimer.

u. The Vendor’s solution shall provide bandwidth throttling, aggregation, and bonding.

v. The Vendor’s solution shall provide ability for content filtering for internet access. Department of VA filtering parameters shall be provided, centered on security, virus, malware and other harmful internet sites that would bring discredit to the VA or government.

w. To seamlessly accommodate new service for additional locations requiring guest wi-fi that are not already equipped, the vendor shall provide technical guidance, to include wireless access point (WAP) placement and equipment selection, to ensure that the installation of the necessary equipment/devices to provide guest wi-fi are installed properly, and fully compatible and functional with the current system, to any contractor that the government selects to install the necessary devices, equipment, wiring, etc., to provide full guest wi-fi service.

x. During the life of the contract, guest wi-fi service will be added or changed due to renovations, growth, etc. The vendor shall be prepared for this. When this occurs, service shall be priced commensurately and comparably to similar and like, already priced locations, that are listed on the B.2 SCHEDULE OF PRICE AND DELIVERY.

y. Within 120-days of the effective date of the contract and when necessary thereafter, the vendor shall provide to the COR, CAD floor plan drawings (provided by COR) showing equipment/device location and coverage areas of all guest wi-fi service located within each medical center and offsite location (e.g. CBOC, Annex, etc.). In addition, the vendor shall provide an Excel spreadsheet listing all equipment and devices which provide guest wi-fi access, by the following headers: Medical Center Name, Campus/CBOC/Annex Name, Location (within each building), Equipment/Device Model Number, Description of Equipment/Device, and Equipment/Device Serial Number. These documents shall be updated each time services are added/deleted or a change is made.

z. See following attachments for guest wi-fi coverage areas and equipment/device lists:

1. Attachment 1: Coverage Areas - St. Louis VAHCS

2. Attachment 2: Coverage Areas - Poplar Bluff VAMC

3. Attachment 3: Coverage Areas - Marion VAMC

4. Attachment 4: VGIA Device Inventory - St. Louis VAHCS

5. Attachment 5: VGIA Device Inventory - Poplar Bluff VAMC

6. Attachment 6: VGIA Device Inventory - Marion VAMC

3. Places of Performance See Enclosure 2: Locations Providing VGIA, to this PWS for a complete list of VA locations that provide guest wi-fi service.

4. Period of Performance See B.2 SCHEDULE OF PRICE AND DELIVERY

5. Contracting Officer’s Representative (COR) The Government Contracting Officer’s Representative (COR) for this contract will be listed in Block 20, SF 1449, upon award. The contractor's representative will schedule all work with the COR prior to performance of services. The contractor shall report all issues to the COR. The contractor shall ONLY respond to service calls placed by the COR, or his representative

6. Contract Administration Data All contract administration functions will be retained by the Department of Veterans Affairs. The Contracting Officer will be the only person authorized to approve changes or modify any of the requirements under this contract. The Contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer will be authorized to make commitments or issue changes that affect price, quantity, or quality of performance of this contract. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered unauthorized and no adjustment will be made in the contract price to cover any increase in costs incurred because of the change.

7. Acronyms and Definitions CDR: Contract Discrepancy Report. Report issued by the Government to the contractor to document a supply or service found to be unacceptable during contract performance.

CLIN: Contract Line Item Number. Unit of work (or service) to be performed (or delivered) by the contractor as a pay item.

COR: Contracting Officer’s Representative. An individual, including a Contracting Officer’s Representative (COR), designated and authorized in writing by the contracting officer to perform specific technical or administrative functions.

8. Personnel

a. Non-Personal Services. This is a non-personal services contract. Personnel rendering services under this contract are not subject either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees. The Government shall not exercise any supervision or control over the contract service providers performing services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

b. Contractor Compliance with the Immigration and Nationality Act of 1952. The Contractor shall comply with all legal provisions contained in the Immigration and Nationality Act of 1952, As Amended; its related laws and regulations that are enforced by Homeland Security, Immigration and Customs Enforcement and the U.S Department of Labor as these may relate to non-immigrant foreign nationals working under contract or subcontract for the Contractor while providing services to Department of Veterans Affairs patient referrals.

9. Hours of Operations

a. Business hours: Monday through Friday, 8:00 a.m. - 4:30 p.m.

b. Off-duty hours: Friday through Monday, 4:30 pm—8:00am; Monday through Thursday, 4:30 pm—8:00am.

c. National Holidays: The 10 holidays observed by the Federal Government are:

· New Year’s Day;

· Martin Luther King’s Birthday;

· Presidents Day;

· Memorial Day;

· Independence Day;

· Labor Day;

· Columbus Day;

· Veterans Day;

· Thanksgiving;

· Christmas; and

· any other day specifically declared by the President of the United States to be a national holiday.

10. Quality Control

a. Contract Performance Monitoring: The COR may perform surveillance of services by any of the methods listed below:

1. Observing actual performance;

2. Inspecting the services to determine whether the performance meets the performance standards; and

3. Review of any other appropriate records.

b. When unacceptable performance occurs, the COR shall inform the Contractor and the Contracting Officer. This will normally be in writing unless circumstances necessitate verbal communication. In any case the COR shall document the discussion and place it in the COR file. When the COR determines that formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR) and present it to the contractor program manager. The Contractor shall acknowledge receipt of the CDR in writing. The CDR will specify if the Contractor is required to prepare a corrective action plan to document how the Contractor shall correct the unacceptable performance and avoid a recurrence. The CDR will also state how long after receipt the Contractor must present this corrective action plan to the COR. The Government shall review the Contractor corrective action plan to determine acceptability. Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the Contracting Officer.

c. Pursuant to VAAR Provision 852.270-1, Representatives of Contracting Officer representative(s); The Government shall periodically evaluate the Contractor performance by appointing a Contracting Officers Representative (COR) to monitor performance to ensure services are received. The Government representative(s) shall evaluate the Contractor performance through inspections of observations, inspection of services or any other form of documentation and all complaints from VA personnel. The Government may inspect as each task is completed or increase the number of quality assurance inspections if deemed appropriate because of repeated failures or because of repeated customer complaints. Likewise, the Government may decrease the number of quality assurance inspections if performance dictates. The Government Contracting Officer shall make final determination of the validity of customer complaint(s).

d. If any of the services do not conform to contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount. When the defects in services cannot be corrected by re-performance, the Government may require the Contractor to take necessary action to ensure that future performance conforms to contract requirements at no additional cost to the Government.

e. Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements at no additional cost to the Government.

f. See Attachment 10: Quality Assurance Surveillance Plan (QASP) Guest Wi-Fi

11. Contract Security

a. No information shall be provided to any person/persons, agency/agencies, in or out of the Federal Government which might identify an employee or a member of his/her family without a voluntarily signed release of information by the employee or his/her family member (or legal guardian if a minor) specifying to whom, and for what reason, the information is to be released. The Contractor shall establish a confidential record-keeping system which is in compliance with Federal standards, and with requirements relating to the confidential nature of patients’ records in accordance with Section 333, Public Law 91-616 (as amended by Public Law 92-282), Section 406 of Public Law 92-255, and Federal regulations of the Special Action Office for Drug Abuse Prevention (21 CFR 1401).

b. See Enclosure 1: VA Information and Information System Security/Privacy Language for Inclusion into Contracts, to this Statement of Work.

Enclosure 1: VA Information and Information System Security/Privacy Language for Inclusion into Contracts

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS to VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. N/A

c. N/A

d. N/A

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL Language

1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

1. N/A

1. N/A

1. N/A

1. N/A

1. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

INFORMATION SYSTEM DESIGN AND DEVELOPMENT

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

1. N/A

SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

1. Nature of the event (loss, theft, unauthorized access);

2. Description of the event, including:

a. date of occurrence;

b. data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

3. Number of individuals affected or potentially affected;

4. Names of individuals or groups affected or potentially affected;

5. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

6. Amount of time the data has been out of VA control;

7. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

8. Known misuses of data containing sensitive personal information, if any;

9. Assessment of the potential harm to the affected individuals;

10. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

11. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $__37.50__ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1. Notification;

2. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3. Data breach analysis;

4. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

SECURITY CONTROLS COMPLIANCE TESTING

N/A

TRAINING

a. All contractor employees and subcontractor employees requiring access to va information and VA information systems shall complete the following before being granted access to va information and its systems:

1. N/A

2. N/A

3. Successfully complete the appropriate VA privacy training and annually complete required privacy training (see below training); and

4. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

VA Handbook 6500.6, Appendix C MRN_PrivacyOnly.doc

VA Privacy Training for Personnel without Access to VA Computer Systems or Direct Access or Use to VA Sensitive Information

The Department of Veterans Affairs, VA must comply with all applicable privacy and confidentiality statutes and regulations. One of the requirements in VA is to have all personnel trained annually on privacy requirements. “Privacy” represents what must be protected by VA in the collection, use, and disclosure of personal information whether the medium is electronic, paper or verbal.

This document satisfies the “basic” privacy training requirement for a contractor, volunteer, or other personnel only if the individual does not use or have access to any VA computer system such as Time and Attendance, PAID, CPRS, VISTA Web, VA sensitive information or protected health information (PHI), whether paper or electronic. You will find this training outlines your roles and responsibility for protecting VA sensitive information (medical, financial, or educational) that you may incidentally or accidentally see or overhear.

If you have direct access to protected health information or access to a VA computer system where there is protected health information such as CPRS, VISTA Web, you must take “Privacy and HIPAA Focused Training” (TMS 10203). “VA Privacy and Information Security Awareness and Rules of Behavior” (TMS 10176) is always required in order to use or gain access to a VA computer systems or VA sensitive information, whether or not protected health information is included. Both trainings are located within the VA Talent Management System (TMS): https://www.tms.va.gov What is VA Sensitive Information/Data?

All Department information and/or data on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes not only information that identifies an individual but also other information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, and records about individuals requiring protection under applicable confidentiality provisions.

What is Protected Health Information?

The HIPAA Privacy Rule defines protected health information as Individually Identifiable Health Information transmitted or maintained in any form or medium by a covered entity, such as VHA.

What is an “Incidental” Disclosure?

An incidental disclosure is one where an individual’s information may be disclosed incidentally even though appropriate safeguards are in place. Due to the nature of VA communications and practices, as well as the various environments in which Veterans receive healthcare or other services from VA, the potential exists for a Veteran’s protected health information or VA sensitive information to be disclosed incidentally. For example:

· You overhear a healthcare provider’s conversation with another provider or patient even when the conversation is taken place appropriately.

· You may see limited Veteran information on sign-in sheets or white boards within a treating area of the facility.

· Hearing a Veteran’s name being called out for an appointment or when the Veteran is being transported/escorted to and from an appointment.

Safeguards You Must Follow to Secure VA Sensitive Information:

· Secure any VA sensitive information found in unsecured public areas (parking lot, trash can, or vacated area) until information can be given to your supervisor or Privacy Officer. You must report such incidents to your Privacy Officer timely.

· Don’t take VA sensitive information off facilities grounds without VA permission unless the VA information is general public information, i.e., brochures/pamphlets.

· Don’t take pictures using a personal camera without the permission from the Medical Center Director.

· Any protected health information overheard or seen in VA should not be discussed or shared with anyone who does not have a need to know the information in the performance of their official job duties, this includes spouses, employers or colleagues.

· Do not share VA access cards, keys, or codes to enter the facility.

· Immediately report lost or stolen Personal Identity Verification (PIV) or Veteran Health Identification Cards (VHIC), any VA keys or keypad lock codes to your supervisor or VA police.

· Do not use a VA computer using another VA employee’s access and password.

· Do not ask another VA employee to access your own protected health information. You must request this information in writing from the Release of Information section at your facility.

What are the Six Privacy Laws and Statutes Governing VA?

1. Freedom of Information Act (FOIA) compels disclosure of reasonably described VA records or a reasonably segregated portion of the records to any person upon written request unless one or more of the nine exemptions apply.

1. Privacy Act of 1974 provides for the confidentiality of personal information about a living individual who is a United States citizen or an alien lawfully admitted to U.S. and whose information is retrieved by the individual’s name or other unique identifier, e.g. Social Security Number.

1. Health Insurance Portability and Accountability Act (HIPAA) provides for the improvement of the efficiency and effectiveness of health care systems by encouraging the development of health information systems through the establishment of standards and requirements for the electronic transmission, privacy, and security of certain health information.

1. 38 U.S.C. 5701 provides for the confidentiality of all VA patient and claimant information, with special protection for their names and home addresses.

1. 38 U.S.C. 7332 provides for the confidentiality of drug abuse, alcoholism and alcohol abuse, infection with the human immunodeficiency virus (HIV) and sickle cell anemia medical records and health information.

1. 38 U.S.C. 5705 provides for the confidentiality of designated medical-quality assurance documents.

What are the Privacy Rules Concerning Use and Disclosure?

You are not authorized to use or disclose protected health information. In general, VHA personnel may only use information for purposes of treatment, payment or healthcare operations when they have a need-to-know in the course of their official job duties. VHA may only disclose protected health information upon written request by the individual who is the subject of the information or as authorized by law.

How is Privacy Enforced?

There are both civil and criminal penalties, including monetary penalties that may be imposed if a privacy violation has taken place. Any willful negligent or intentional violation of an individual’s privacy by VA personnel, contract staff, volunteers, or others may result in such corrective action as deemed appropriate by VA including the potential loss of employment, contract, or volunteer status.

Know your VA/VHA Privacy Officer and Information Security Officer. These are the individuals to whom you can report any potential violation of protected health information or VA sensitive information, or any other concerns regarding privacy of VA sensitive information.

YOU ARE RESPONSIBLE FOR PROTECTING THE CONFIDENTIAL INFORMATION OF OUR VETERANS

Employee Signature Print Name of Contract Agency, if contractor Print Name of VHA Department/Supervisor/Local COR

PROVIDE A COPY OF THIS FORM TO YOUR SUPERVISOR/LOCAL COR

FOR DATA ENTRY INTO TALENT MANAGEMENT SYSTEM

Enclosure 2: Locations Providing VGIA

St. Louis, MO:

Jefferson Barracks (JB) Division 1 Jefferson Barracks Drive St. Louis, MO 63125 John Cochran (JC) Division 915 North Grand Boulevard St. Louis, MO 63016

Hope Recovery Center 2600 Washington Street St. Louis, MO 63106 St. Louis Women’s / Dermatology 3615 Olive Street St. Louis, MO 63108

St. Louis Mental Health Recovery Center 2600 Washington Street St. Louis, MO 63106

St. Louis MHICM Clinic 2600 Washington Street St. Louis, MO 63106

St. Louis Primary Care Team Annex 1 4974 Manchester Avenue St. Louis, MO 63110 St. Louis Primary Care Team Annex 2 2727 Washington Avenue St. Louis, MO 63103

St. Charles CBOC 844 Waterbury Falls Drive O’Fallon, MO 63368 St. Louis CBOC (North County) 6854 Parker Road Florissant, MO 63033

Washington CBOC 1627 A. Roy Drive, Washington, MO 63090

Poplar Bluff, MO:

John J Pershing VA Medical Center 1500 North Westwood Boulevard Poplar Bluff, MO 63901

Cape Girardeau Community-Based Outpatient Clinic (CBOC) 3051 William Street Cape Girardeau, MO. 63701

Farmington Community-Based Outpatient Clinic (CBOC) 1580 W. Columbia Drive Farmington, MO. 63640

Paragould Community-Based Outpatient Clinic (CBOC) 2420 Linwood Drive, Suite 3 Paragould, AR 72450

Sikeston Community-Based Outpatient Clinic (CBOC) 903 South Kings Highway Sikeston, MO 63801

West Plains Community-Based Outpatient Clinic (CBOC) 1801 E. State Route K West Plains, MO 65775

Pocahontas Community-Based Outpatient Clinic (CBOC) 300 Camp Road Pocahontas, AR 72455-9131

Marion, IL:

Marion VA Medical Center 2401 West Main Marion, IL 62959

Behavioral Medicine Annex 1301 Enterprise Way Suite 68 Marion, IL 62959

Ca…