36C25525Q0161 0001.docx

5. PROJECT NUMBER (if applicable)

CODE

7.

ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF

PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED

STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF

CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF

SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer) 02-21-2025 36C255 Department of Veterans Affairs Network Contracting Office (NCO) 15 3450 S 4th Street Trafficway Leavenworth KS 66048 36C255 Department of Veterans Affairs Network Contracting Office (NCO) 15 3450 S 4th Street Trafficway Leavenworth KS 66048 To all Offerors/Bidders

36C25525Q0161

X X X X WASP Maintenance and Repair Service - VASTLHCS Add the following to the Performance Work Statement

1. VA Information and Information System Security/Privacy language. (item no.16)

2. National Archives and Records Administration (NARA) Records Management language. (item no.17)

3. See updated Performance Work Statement (p.2)

Maria Riza Owen Contracting Officer

B.4 PERFORMANCE WORK STATEMENT

WASP Maintenance and Repair Services

1. General Information

(a) Service Agreement: The St. Louis VA Medical Center is requesting to establish a service contract for maintenance and repair on Copan Diagnostics WASP at John Cochran (JC) The facility is located at:

VA St. Louis Healthcare System John Cochran Division 915 N. Grand Blvd.

St. Louis, MO 63106

(b) Scope of Work: The Contractor shall supply all labor, travel, materials, equipment, tools, supervision, and all incidentals required to complete on-site full-service preventative maintenance and corrective maintenance (repair) of the equipment identified in Section II, in accordance with Manufacturer’s recommendations, Joint Commission standards, design specifications, and the specifications, terms, and conditions of this contract.

(c) Background: The WASP system is used to process patient biological data at a rapid pace and aid in diagnosis and treatment. The equipment is critical for the Path & Lab service and patient safety at the VA Medical Center. This procurement is to establish a service contract required to cover preventative and corrective maintenance services. This contract is issued to ensure the continuous reliability of the equipment identified in the statement of work. The reliable and accurate operation of the equipment at all times, is considered critical to the health of patients.

(d) Performance Period: The Contractor shall begin the work required under this SOW commencing with the effective date of award, unless otherwise directed by the CO, and shall provide continuous service until the date of contract expiration. The contract would be for 1 year starting May 1, 2025 through April 30, 2026 with up to 4 additional option periods.

(e) Type of Contract: Firm-fixed-price

2. Equipment to be Serviced Each of the following items is to be serviced in accordance with the specifications, terms and conditions of this contract.

3. Services to be Provided The contractor shall provide preventative and corrective maintenance, including emergencies, on the equipment outlined above in Section II.

(a) Summary of Services

a. Semi-annual PM on system (2 per year)

b. Monday – Friday on-site service available during working hours

c. 24/7/365 phone technical support

d. All replacement parts and PM kits as needed

e. All travel and labor expenses included

f. On-site turnaround time within 48-72 hours pending availability of parts

(b) Preventative Maintenance

a. The Contractor shall perform preventive maintenance (PM) service to ensure that equipment listed in Section II performs in accordance with Section B.4 (g) Conformance Standards. The Contractor shall provide checklists and utilize procedures with worksheet originals indicating work performed and actual performance values obtained (as applicable). The contractor shall provide written description of Preventive Maintenance Inspections (PMI). This description shall include an itemized list of the procedures performed, including electrical safety. This documentation shall be provided to the COR at the completion of the PM.

b. PM services shall be provided on a semi-annual basis (one PM each year). Any exceptions to the PM schedule shall be arranged and approved in advance with the COR and provided in writing to the Contracting Officer. Any charges for parts, services, manuals, tools, or software required to successfully complete scheduled PM shall be included within this contract’s agreed upon price, unless otherwise specifically excluded. Any fuel surcharges will not be authorized.

c. The Contractor shall notify the COR and Biomed Supervisor at least 48 hours in advance of the date of contemplated preventative maintenance inspection. A designated staff member will accompany the Contractor as an observer during the inspection. The inspection shall be thorough and shall conform to manufacturer and Industry Standards for the equipment. Sufficient time shall be allowed to permit a thorough inspection and test of each device comprising the overall system. Maintenance work and inspections may be combined at the approval of the COR or alternate COR if down time is not considered significant.

d. The Contractor shall immediately, but no later than 24 (twenty-four) consecutive hours after discovery, notify the CO and COR (in writing) of the existence or the development of any defects in or repairs required to the scheduled equipment which the Contractor considers he/she is not responsible for under the terms of the contract. If the contractor identifies issues outside of the scope of the contract, the contractor shall provide a quote to resolve the issue as part of a separate agreement and allow the work to continue under the current contract scope.

(c) Corrective Maintenance

a. The Contractor, COR, and Biomedical Engineering staff shall maintain the equipment in accordance with Section B.4 (g) Conformance Standards. Contractor shall provide unlimited telephone technical support and all required parts.

b. Only the CO, COR, or designated alternate has the authority to approve/request a corrective maintenance service call to the Contractor. CO or COR authorization for any work must be received prior to performance of work or payment will not be authorized.

c. Corrective maintenance service calls are unlimited and incur no charge for other than normal working hours.

d. Technicians responding for emergency corrective maintenance service must report to the COR, Biomed Supervisor, or designee (after hours). Upon completion of service/repair, the technician shall again report to that person.

(d) Parts The Contractor shall have ready access to all parts, including unique and/or high mortality replacement parts. All parts supplied shall be compatible with existing equipment and adhere to the Buy American Act. The contract shall include all parts except -if applicable - those parts specifically listed as being EXCLUDED. The Contractor shall use only new Original Equipment Manufacturer (OEM) or OEM-approved parts. All parts shall be of current manufacture and have complete versatility with the presently installed equipment. All parts shall perform identically to the original equipment specifications. Parts removed from another system, rebuilt and/or used, shall not be installed without specific approval by the COR. All defective parts replaced become the property of the Contractor, unless otherwise specified by the COR or Alt COR.

Consumables are excluded.

(e) Service Manuals/Tools/Equipment

a. The VA shall not provide tools, test equipment, service manuals, or service diagnostic software to the contractor. Contractor shall obtain, have on file, and make available to its Field Service Engineer (FSE) all operational and technical documentation (such as operational and service manuals, schematics, and parts list) which are necessary to meet the performance requirements of this contract. The location and listing of the service manuals, by name and/or the manuals themselves shall be provided to the COR upon request.

b. The Contractor shall provide the COR and the Biomedical Engineering Shop Supervisor copies of all documentation that pertains to any hardware, software, or firmware upgrade or repair.

c. Copies of the latest version(s) of all documentation and licensing agreements, which shall include operation, service, and diagnostic software. The COR shall have access to the same operation, service, diagnostic software, and documentation as the OEM's FSE. Contractor shall provide to the COR OEM Service Bulletins for the equipment covered under this contract. All documentation and service bulletins, etc. shall be provided within 30 days of award in either hard copy or electronic format. Any future service bulletins generated during the contract period shall be provided to the COR within 30 days of receipt in either hard copy or electronic format.

(f) Services Not Covered by Contract CO is the only individual with the authorization to approve any work outside the scope of this contract. The Contractor shall provide a quote for any work that is outside the scope of the contract and the CO will evaluate the price and if applicable, the CO will negotiate with the Contractor. If the CO and the Contractor agree on pricing and it is approved to add the new scope to the contract there will be a subsequent modification awarded to add the new scope.

(g) Removal of Equipment Approval from the COR must be obtained before removing any equipment from the VA Medical Facility. No transportation charges will be allowed for either the repair person or equipment to or from the Contractors facility. The Contractor will be responsible for all damage or loss of equipment. A loaner of the same type and functionality of the equipment removed, if required, shall be furnished, installed, and made fully operational by the contractor without additional cost.

4. Competency of Contractor Personnel

a. All work shall be performed by "Fully Qualified" competent FSEs. The Contractor shall have an established business, with an office and established/hired full-time staff. The Contractor shall provide written assurance of the competency of their personnel and a list of credentials of approved FSEs.

b. “Fully Qualified" is based upon training and experience in the field. For training, the FSE(s) must have successfully completed a formal OEM Certified (or equivalent) training program for all equipment to be maintained and all equipment to be utilized in the performance of the contract. The preferred experience of the FSE(s) is a minimum of two years in the installation, calibration, maintenance, and repair of the specific equipment identified in Section II.

c. If subcontractor(s) are used, they must meet the same competency standards as Contractor personnel and be preapproved by the CO. The Contractor shall submit any proposed change in subcontractor(s) to the CO for approval or disapproval.

d. The CO and/or the COR or Alt COR specifically reserve the right to reject any of the Contractor's personnel and refuse them permission to work on equipment.

5. Condition of Equipment All equipment is currently fully operational per required standards as set forth by the manufacturer. A list of standards may be provided upon request during solicitation.

6. Conformance Standards Contractor shall ensure that the equipment functions in conformance with the standards established by the manufacturer and Accrediting Organizations such as FDA, TJC, and VHA. These standards may be provided on request during solicitation.

7. Hours of Coverage

a. The Contractor will provide all non-emergent services within normal VA STL business hours (7:00 AM to 4:00 PM (CST) M-F).

b. All services shall be performed during these normal hours of coverage unless one of the following conditions exists:

i. The Contractor wishes to furnish services at a time that is outside of the normal hours of coverage, at no additional cost to the Government, the Contractor submits a request to the COR prior to the proposed start of the work, and the request is approved in writing by the COR before work has begun. Work performed outside the normal hours of coverage at the request of FSE/contractor shall be considered service performed during normal hours of coverage.

ii. Work performed outside the normal hours of coverage must be pre-approved by the CO, COR, or Alt COR. The Contractor will provide a written estimate of the charges prior to approval of the work.

c. The Contractor shall provide coverage 24 hours/day, 7 days/week and all holidays.

d. There will be no additional charge for time spent waiting at the site during or after the normal hours of coverage for delivery of parts.

e. Hardware/software update/upgrade installations shall be scheduled and performed during normal hours of coverage at no additional charge to the government.

8. Federal Holidays Observed by the VA Medical Center

President’s Day (Washington’s birthday), Memorial Day , Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, Christmas Day, and any other day specifically designated by the President of the United States.

9. Documentation/Reports No later than seven (7) business days after the conclusion of any maintenance or repair the Contractor will provide to the COR or Alt COR a signed detailed service/inspection report listing all devices, all repairs for each device, parts used to maintain or repair the devices, and operating efficiency of the devices. The service/inspection report shall contain, at a minimum, the following information:

(a) Date and time of the technician’s arrival on station.

(b) Type, model, and serial number(s) of all equipment on which maintenance was performed.

(c) Total time spent performing maintenance (exclusive of any travel time).

(d) Detailed narrative description of work performed.

(e) Complete list of parts replaced.

(f) Comments as to the cause of the malfunction when applicable

(g) Date and time the repair/preventive maintenance was completed.

10. Security Requirements Upon arrival at the VA Medical Center, all Contractor personnel shall be required to report to the VA Medical Center Police for a temporary ID and then to the COR for check-in. This check-in process is mandatory. When the service is completed, the personnel shall be required to check out with the COR or Biomedical Engineering Shop Supervisor.

11. Exposure to Blood Borne or Infectious Material There is a potential for exposure to blood borne or other infectious material with equipment throughout the medical centers. All maintenance persons must use the “Universal Precautions” (e.g., decontamination of medical equipment, wearing protective gloves, aprons, and goggles) during cleaning and maintenance/repair procedures.

12. Test Equipment The Contractor shall provide the COR or Alt COR with a copy of the current calibration certification of all test equipment which is to be used by the Contractor in the performance of this contract. Test equipment calibration shall be traceable to a national standard.

13. Identification, Parking, Smoking, and VA Regulations

a. Contractor’s personnel shall wear visible identification at all times while on the premises of the VA. Identification shall include, as a minimum, the employee’s name, position, and the contractor’s trade name.

b. It is the responsibility of the contractor to park in the appropriate designated parking areas. Information on parking is available from VA Police Service. VA will not invalidate or make reimbursement for parking violations of the contractor under any conditions.

c. Possession of weapons is prohibited. Enclosed containers, including tool kits, shall be subject to search. Violations of VA regulations may result in citation answerable in the United States (Federal) District Court, not local district, state, or municipal court.

d. Smoking is prohibited inside all VA buildings.

14. Definitions/Acronyms

a. CO – Contracting Officer

b. COR – Contracting Officer’s Representative

c. ESR - Engineering Service Report - Documentation provided by the vendor of the services rendered for each incidence of work performance under the terms and conditions of the contract.

d. FSE - Field Service Engineer - A person who is authorized by the contractor to perform maintenance (corrective and/or preventive) services on the AVAHCS premises.

e. NFPA - National Fire Protection Association.

f. OEM – Original Equipment Manufacturer.

g. OSHA – Occupational Safety and Health Administration.

h. PM - Preventive Maintenance Inspection. Services which are periodic in nature and are required to maintain the equipment in such condition that it may be operated in accordance with its intended design and functional capacity with minimal incidence of malfunction or inoperative conditions.

i. Unscheduled repairs – emergency services required to restore equipment to working condition outside normal hours of coverage.

j. UL – Underwriter’s Laboratories

15. IT Security Requirements VA information technology certification and accreditation requirements apply.

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

16. VA Information and Information System Security/Privacy

1. General Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. Access to VA Information and VA Information Systems

a. A contractor/subcontrator shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR

4. Information System Hosting, Operation, Maintenance, or Use

a. VA prohibits the installation and use of personally owned or contractor/subcontractor-owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, SOW or contract. All of the security controls required for government furnished equipment (GFE) must be utilized in approved other equipment (OE) and must be funded by the owner of the equipment. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA-approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

b. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1 requirements. This must be completed within 30 days of termination of the contract.

c. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

1. Vendor must accept the system without the drive;

2. VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

3. VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

4. Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

c. A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed. The ISO needs to maintain the documentation.

5. Security Investigation

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

Page 1 of

6. Liquidated Damages for Data Breach

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

1. Nature of the event (loss, theft, unauthorized access);

2. Description of the event, including:

i. date of occurrence;

ii. data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

11. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

17. Records Management Obligations

(1) includes VASTLHCS records.

(2) does not include personal materials.

(3) applies to records created, received, or maintained by Contractors pursuant to their VA contract.

(4) may include deliverables and documentation associated with deliverables.

Page 1 of