36C25620Q0078-002.pdf

36C256-19-Q-1243 Attachment 1

PERFORMANCE WORK STATEMENT

PRESCRIPTON FILLING SERVICES

Veterans Healthcare System of The Ozarks (VHSO)

1100 North College Ave.

Fayetteville, AR 72703

(7/5/19)

A. GENERAL INFORMATION

1. Title of Project: Pharmacy Prescription Services for Urgent/Emergent Needs.

2. Scope of Work:

a. Contractor to provide Pharmacy Prescription Services. These services shall intail the Contractor providing a network of pharmacies to insure urgent/emergent prescriptions (up to a 14-day supply), screening and counseling services for VA eligible MISSION beneficiaries which include, presenting VA authorized prescriptions through the contractor managed pharmacy Network in the area of Fort Smith, AR; Harrison, AR;

Ozark, AR; Jay, OK; Branson, MO; Mt Vernon, MO; Springfield, MO; Fayetteville, AR and Joplin, MO. These prescriptions will all require contractor override by the COR as the provider writing the prescription will not be a VA provider. The COR will ensure the beneficiary is eligible for the prescription services prior to approval to the contractor for filling the prescription.

b. Fayetteville Veterans Affairs Medical Center (VAMC), Fayetteville, Arkansas, has a requirement for pharmacy services, specifically filling an estimated 10,000 (3,000 – Fort Smith, Arkansas, 1,500 – Branson, Missouri, 750- Jay, Oklahoma, 750 – Ozark, 750- Joplin,MO, 1500-Springfield,MO, and 1,500- Harrison, Arkansas) prescriptions per year, to be located in several locations within a 10 mile radius of the Department of Veterans Affairs Community Based Outpatient Clinic (CBOC) for Ft. Smith, which is located at 1500 Dodson Avenue Fort Smith, AR 72901, Veterans Healthcare System of the Ozarks located at 1100 N. College Ave. Fayetteville, AR 72703; Community Based Outpatient Clinic (CBOC) for Harrison, which is located at 707 North Main St Harrison, AR 72601, Community Based Outpatient Clinic (CBOC) for Jay, which is located at 1569 N. Main, Jay, OK 74346; Community Based Outpatient Clinic (CBOC) for Branson, which is located at 5571 North Gretna Rd Suite B, Branson, MO 65616, Community Based Outpatient Clinic (CBOC) for Ozark, which is located at 2713 West Commercial, Ozark, AR 72949; for Gene Taylor Outpatient Clinic (CBOC) which is located at 1850 W. Republic St, Springfield, MO 65807; Community Based Outpatient Clinic (CBOC) located at 3015 Connecticut Ave, Joplin, MO 64804. Future Community Outpatient Clinic may be opened in Bella Vista, AR would be added to this contract in the event either opens during the time of this contract.

c. The contractor shall provide prescription filling services to include traditional prescription screening, dispensing and counseling services (by a registered and licensed pharmacist) to eligible veterans presenting authorized prescriptions from providers at the VA Medical Center Community Based Outpatient Clinics or prescriptions approved by

COR for a MISSION prescription. MISSION prescriptions will be written by a Non-VA provider and require COR approval to be filled. The contractor will not be reimbursed for any delivery charge in the event the pharmacy provides a delivery service.

(1) Printed drug information will be provided to each patient to supplement verbal instructions. These services will require a medication history and check for allergies, interactions, and duplications.

(2) Contractor’s staff and facility must meet all applicable federal and state requirements for performing services under this contract. Contractor must provide a copy of each pharmacist’s license (Arkansas Board of Pharmacy, Oklahoma Board of Pharmacy, or Missouri Board of Pharmacy, as applicable) and the license for the facility to dispense pharmaceuticals to the Contracting Officer prior to commencing work under a contract resulting from this solicitation. The Contractor will also provide copies of renewed licenses or licenses when new pharmacists are hired.

d. The contractor shall fill and dispense non-controlled and controlled substance prescription medications via two routes:

(1) The contractor shall fill and dispense controlled substance prescription medications written on approved VA form, and signed by a VA-approved provider working out of the VA Medical Center, Fayetteville, Arkansas Community Based Outpatient Clinic located in Fort Smith, AR, Jay, OK, Ozark, AR, Branson, MO, Springfield, MO, Joplin, MO, Fayetteville, AR and Harrison, AR. The VA will provide the contractor with a list of VA-approved providers and their signatures. Non-controlled prescriptions may either be faxed to the local pharmacy indicating approval to fill or a prescription directly from the provider. These faxed prescriptions are signed and dated by approving provider/pharmacist to fill and are legal prescriptions.

(2) The contractor shall fill and dispense controlled substance prescriptions written on legal prescriptions as defined by their respective state laws for MISSION prescriptions once approval is obtained by COR. MISSION prescriptions should be requested to filled at contracted pharmacies in the following locations: VA Medical Center, Fayetteville, Arkansas Community Based Outpatient Clinic located in Fort Smith, AR, Jay, OK, Ozark, AR, Branson, MO, Springfield, MO, Joplin, MO, Fayetteville, AR and Harrison, AR.. All MISSION (non-VA provider) prescriptions must have authorization from COR prior to being authorized to fill as override by contractor. Any prescription filled without authorization voids payment to the contractor.

di. The purpose of this contract is to provide prescription-filling services (first fill) for acute conditions deemed to be urgent by the CBOC provider or COR for MISSION prescriptions. Acute conditions included but not limited to cough, infection, colds, pain, and other severe medical conditions that drug therapy treatment must be started within 15 days of a patient’s visit to the CBOC or MISSION providers. The Contractor will screen these CBOC prescriptions and validate (if necessary) the urgent nature of the first fill.

MISSION prescriptions must be authorized by COR for review prior to override approval to contractor to fill.

f. Prescriptions will be filled and dispensed only for medications listed in the current VA National Formulary. An updated national formulary will be provided, at minimum, semi-annually to the contractor. Only those medications that are on the National Formulary or Approved Non-Formulary medications will be dispensed under this contract.

g. At a minimum, the contractor will have a facility located within close proximity of the following; VA Medical Center, Fayetteville, Arkansas Community Based Outpatient Clinic located in Fort Smith, AR, Jay, OK, Ozark, AR, Branson, MO, Springfield, MO, Joplin, MO, Fayetteville, AR and Harrison, AR.. Each facility shall be handicapped accessible, have handicapped accessible ramps, have handicapped parking spaces available and have seating for patients waiting for prescriptions.

h. All prescriptions shall be filled for the quantities as written, not to exceed a 14-day supply with the exception of those products that the manufacturer’s package size prohibits dispensing in a smaller quantity (e.g., inhalers, insulin vials).

i. No refills of prescriptions will be allowed. The contractor may only accept new prescriptions.

j. Contractor will not mail filled prescriptions to the patient.

k. Medical supplies, injectables and prosthetic items are not included in this contract except for emergency supply of insulin vials and syringes.

l. Prescriptions filled under this contract shall be, to the extent permitted by law, the least expensive drug product the pharmacy has in stock. Generic drugs shall be dispensed whenever possible. Generic drugs shall be dispensed if, in the professional judgment of the pharmacist, the substitute product is available, safe, effective, and to the greatest extent possible, contains the same chemical ingredients of the same strength, quantity, and dosage of the brand name. All generic products used must be in compliance with Federal and State requirements. The generic name must be indicated on drug label for all medications.

m. Requests to use generics not listed in the NDDF will be sent to the Contracting Officer through the COR. Under no circumstances are private company generics to be dispensed until the Contractor receives written approval from the Contracting Officer.

n. Those products that must be dispensed by brand name only are Lanoxin and Dilantin.

o. Pharmacies authorized to fill prescriptions under the contractor’s plan must agree to the following conditions:

(1) The contractor and its contract pharmacies shall keep all information concerning VA beneficiaries confidential and shall not release or disclose information to any person, except as authorized in writing and according to all applicable laws. The Privacy Act of 1974, public Law 93-579 applies to this contract.

(2) Representatives of the VA are authorized to visit the premises of any pharmacy filling VA prescriptions under the contractor’s plan during business hours for the purpose of auditing and evaluation, which may include the inspection of clinical records.

(3) All adverse drug events reported to the contractor’s pharmacies by beneficiaries of the VA will be reported to Pharmacy Services, Fayetteville, Arkansas. Adverse drug events include dispensing errors, drug allergies, and adverse drug reactions.

(4) Pharmaceutical care provided to beneficiaries under this contract shall meet all standards applicable to Medicaid recipients in the State where the services are provided and standards set forth in the current Joint Commission accreditation manual for Ambulatory Care/Pharmaceutical Services

p. Contract pharmacies shall maintain a log of VA prescriptions filled and have the patient sign next to each prescription number for each prescription received. The log is preferably electronic but can be written. A copy of the log shall be maintained at the contract pharmacy and be readily accessible for random VA audit.

q. Contractor must have a minimum of two licensed pharmacies accepting its plan in each of the following areas: Fort Smith, Arkansas, Branson, MO, Jay, OK, Harrison, AR, Joplin, MO, Springfield, MO, and VA Medical Center, Fayetteville, Arkansas primary service area. A minimum of one or two may be allowed for future CBOC’s. However, it is the intent of the Government, that the contractor has more than two in all areas to provide patients with more choices and additional access to pharmacies.

r. As services are needed for new CBOC’s in the VA Medical Center, Fayetteville, AR primary service area, and additional pharmacies will be added to this contract. When a new CBOC is to be opened, the contracting officer will notify the contractor. At that time, the contractor shall submit a listing of proposed pharmacies for that area to the contracting officer. The contracting officer shall approve additional pharmacies for that area. The contracting officer shall approve additional pharmacies via a supplemental agreement to the contract.

s. For non-CHOICE prescriptions (VA provider written): The contractor shall be advised of all existing and/or new VA physician’s state license number and his/her federal and state drug license number. The contractor shall immediately notify its contract pharmacies in that CBOC’s area of the new physician information so as to avoid any delay in patient services. Notification of physician information may occur on either the day the VA physician fills in at the CBOC or prior to CBOC duty as time allows.

t. For MISSION prescriptions (non-VA provider written): Contractor is to note these will not be VA providers and therefore will have to call COR at Fayetteville, AR VA to obtain approval to override the prescription.

u. The Government reserves the right to fill any prescription covered under this contract through the use of its own resources and/or staff.

3. Invoicing and Payment

a. The contractor shall submit monthly invoices in arrears within thirty (30) calendar days from the last day of the previous month. The monthly invoice shall contain at a minimum the following information:

(1) Name and Social Security Number of Patient

(2) Name, strength, quantity, and NDC of medication dispensed

(3) Date dispensed

(4) Cost of medication

(5) Dispensing fee

(6) Prescription number from VA Form 10-2772d or non-VA prescription number

(7) Name of VA provider or non-VA provider writing the prescription (VA provider and non-VA provider prescriptions should be separate on the report for auditing purposes)

(8) Contract Number

b. Payments made by the Department of Veterans Affairs (VA) under this contract shall constitute the total cost of services provided by the Contractor. Contractor hereby agrees, that in no event shall Contractor bill, charge, collect a deposit from, seek compensation, remuneration, or reimbursement from, or have any recourse against the beneficiary, the beneficiary’s family, private insurer, Medicare or any other entity acting on the beneficiary’s behalf, for services provided pursuant to this contract. Billings rendered by the contractor to the VA for services furnished a VA beneficiary under the terms of this contract shall be billings in full.

c. Reimbursements shall be determined by the Average Wholesale Price (AWP) discounted by the applicable percentage plus the applicable dispensing fee. The total price charge to the VA shall not exceed that charged to the general public and shall not exceed the price charged by the contractor’s lowest third-party reimbursement plant.

4. Services

a. The services specified may be changed by written modification to this contract.

b. The services to be performed by the contractor will be performed in accordance with VA policies and procedures and the regulations of the medical staff by laws of the VA facility.

c. The services to be performed by the contractor will be under the direction of the Chief of Staff and the Chief, Pharmacy Service.

d. Under the authority of Public Law 104-262 and 38 USC 8153, the contractor agrees to provide Health Care Resources in accordance with the terms and conditions stated herein, to furnish the services and prices specified in this contract.

5. Qualifications

Personnel assigned by the Contractor to perform the services covered by this contract shall have an active, unrestricted license in a State, Territory, or Commonwealth of the United States or the District of Columbia. The qualifications of such personnel shall also be subject to review by the VA Chief of Staff and approval by the VA Facility Director.

Each person assigned to work under this contract shall be licensed in accordance with the requirements of the State in which the services are being provided.

6. Place of Performance

The work shall be performed in service areas listed in areas listed in Scope of Work (2.

Above).

7. Personnel Policy

The Contractor shall be responsible for protecting the personnel (employees, agents, or subcontractors) furnishing services under this contract. To carry out this responsibility, the contractor shall provide the following for these personnel – worker’s compensation, professional liability insurance, health examinations, income tax withholding, and social security payments. The parties agree that such personnel shall not be considered a VA employee for any purpose and shall be considered employees of the contractor.

8. Contract Monitoring Procedures

a. The Contracting Officer Representative (COR) is the Chief, Pharmacy Service and is the VA official responsible for verifying and monitoring contract compliance.

b. Any incident of contractor non-compliance as evidenced by the monitoring procedures, shall be reported immediately by the COR to the Contracting Officer. Failure of contractor to follow procedure may result in nonpayment or delay of payment.

c. Record-Keeping Monitoring System: Contractor and VA will establish record keeping systems to verify contract performance. Data will be recorded and retrieved as necessary.

Contract will be monitored and validated against monthly billings.

d. The COR will furnish a statement in writing to the Contracting Officer as the close out of the contract to include summary of contractor actions and a statement that all requirements of the contract were fulfilled as agreed.

e. A summary evaluation of contractor performance, based upon the compliance or noncompliance of contract requirements as evidenced under the monitoring procedures shall be forwarded by the monitoring official to the Contracting Officer prior to exercising any option.

9. Hours of Work

a. The services covered by this contract shall be furnished by the Contractor as defined herein.

b. The following terms have the following meaning:

(1) Work Hours Monday through Friday, 8:00a.m. – 6:00p.m.

(2) National Holidays:

c. The 10 holidays observed by the Federal Government are: New Year’s Day, Washington’s Birthday, Martin Luther King’s Birthday, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, and Christmas; or any other day specifically declared by the President of the United States to be a national holiday. When a holiday falls on a non-work day, Saturday or Sunday, the holiday usually is observed on Monday (if the holiday falls on Sunday) or Friday (if the holiday falls on Saturday).

d. Except in case of an emergency as determined by the Chief of Staff or his designee, work will not be required on a national holiday observed by the Federal Government or on Saturday or Sunday.

10. Annual Report

a. The contractor shall provide the contracting officer with an annual report showing the total number of prescriptions filled and total dollar amount per CBOC location at the end of each contract year on or before July 15th. The Government reserves the right to negotiate lower fees and/or higher discounts should the combined total warrant lower fees and/or higher discounts. Should lower fees and/or higher discounts be negotiated, a supplemental agreement to the contract will be issued.

b. Contractor will maintain an ongoing performance measurement assessment and improvement process to assess the services provided under this contract. (e.g., customer’s satisfaction survey).

B. KEY PERSONNEL AND TEMPORARY EMERGENCY SUBSTITUTIONS

1. The Contractor shall assign a Program Manager/Contractor Representative to this contract.

2. During the first ninety (90) days of performance, the Contractor shall make NO substitutions of key personnel unless illness, death, or termination of employment necessitates the substitution. The Contractor shall notify the Contracting Officer, in writing, within 15 calendar days after the occurrence of any of these events and provide the information required by paragraph (c) below. After the initial 90-day period of the contract, the Contractor shall submit the information required by paragraph (c) to the Contracting Officer at least 15 days prior to making any permanent substitutions.

3. The Contractor shall provide a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the Contracting Officer. Proposed substitutes shall have comparable qualifications to those of the persons being replaced. The Contracting Officer will notify the Contractor within 15 calendar days after receipt of all required information of the decision on the proposed substitutes. The contract will be modified to reflect any approved changes of key personnel.

4. For temporary substitutions where the key person will not be reporting to work for three

(3) consecutive work days or more, the Contractor will provide a qualified replacement for the key person. This substitute shall have comparable qualifications to the key person.

Any period exceeding two weeks will require the procedure as stated above.

C. CONTRACT SECURITY

1. General Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA personnel regarding information and information system security.

2. VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook

6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self- certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes. The options are:

(1) Vendor must accept the system without the drive;

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase.

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

m. The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact;

n. Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

o. A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed.

p. The ISO needs to maintain the documentation.

3. Security Incident Investigation

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover.

4. Liquidated Damages For Data Breach

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(i) Date of occurrence;

(ii) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); VA information, obtain monetary or other

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

5. Confidentiality And Nondisclosure

It is agreed that:

a. The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which have been generated by the contractor in the performance of this task order are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the contract.

b. The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order presented to the contractor shall be submitted to the CO for response.

c. Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.