36C25621Q1765.docx

36C25621Q1765

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

36C25621Q1765 08-23-2021 James Rasco 318-466-4633 09-21-2021 15:00

CDT

00502

ALEXANDRIA VA HEALTH CARE SYSTEM

NETWORK CONTRACTING OFFICE 16

ALEXANDRIA VA HEALTH CARE SYSTEM

PO BOX 69004

ALEXANDRIA

LA

71306-9004 X 561621 $22 Million N/A X 00502

DEPARTMENT OF VETERANS AFFAIRS

Southeast Louisiana Veterans HCS 2400 Canal Ave New Orleans

LA

70119 00502

DEPARTMENT OF VETERANS AFFAIRS

NETWORK CONTRACTING OFFICE 16

ALEXANDRIA VA HEALTH CARE SYSTEM

2495 SHREVEPORT HIGHWAY

PINEVILLE

LA

71360-4004

FSC e-Invoice Payment http://www.fsc.va.gov/fsc/einvoice.asp Invoice Setup Information 1-877-489-6135 invoice must be submitted electronically

1-877-489-6135 See CONTINUATION Page This solicitation is a Request for Quotations (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2021-06 Dated 07/12/2021.

This solicitation is set aside 100% for Service-Disabled Veterans Owned Small Businesses (100% SDVOSB set aside).

The Southeast Louisiana VA HCS is seeking Intrusion Alarm Monitoring for its CBOC locations. (See PWS for detail).

See CONTINUATION Page X Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C256

ALEXANDRIA VA HEALTH CARE SYSTEM

NETWORK CONTRACTING OFFICE 16

ALEXANDRIA VA HEALTH CARE SYSTEM

PO BOX 69004

ALEXANDRIA LA 71306-9004

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

FSC e-Invoice Payment http://www.fsc.va.gov/fsc/einvoice.asp Invoice Setup Information 1-877-489-6135 invoice must be submitted electronically ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

Performance Work Statement Intrusion Alarm System (IDS) Monitoring, Maintenance, and Repair Service Southeast Louisiana Veterans Health Care System New Orleans, LA 7/19/2021

1. BACKGROUND

1.1 The Southeast Louisiana Veterans Health Care System (SLVHCS), and Community Based Outpatient clinics (CBOC’s) has a need for monitoring, maintenance and repair services for the currently installed Intrusion Alarm System.

2. SCOPE

2.1 The contractor shall provide all labor, parts, materials, equipment, supplies and tools necessary to monitor, maintain and repair the current Intrusion Alarm System, twenty-four hours, seven days a week from the first day of performance through completion of the contract in accordance with the Performance Based Work Statement (PWS) at the following SLVHCS Medical Center and CBOC’s locations:

2.1.1 SLVHCS Mental Health 3426 Canal St., New Orleans LA, 70112

2.1.2 SLVHCS Mental Health 3434 Canal St., New Orleans LA, 70112

2.1.3 SLVHCS Michoud Warehouse located at 4301 Poche Ct. West, New Orleans LA, 70127

2.1.4 SLVHCS St. John VA Outpatient Clinic, 4004 W. Airline Highway, Reserve, LA 70084

2.1.5 SLVHCS Hammond VA Outpatient Clinic and Wellness Center, 1131 South Morrison Blvd. Hammond, LA 70403

2.1.6 SLVHCS Slidell VA Outpatient Clinic, 60491 Doss Drive, Suite B, C and D Slidell, LA 70460

2.1.7 SLVHCS Baton Rouge South VA Outpatient Clinic, 7850 Anselmo Lane, Baton Rouge, LA 70810

2.1.8 SLVHCS Baton Rouge North VA Outpatient Clinic, 7968 Essen Park Ave. Baton Rouge, LA 70809

2.2 The Contractor shall supply system upgrades as part of the maintenance program, which shall include phone support and updates as released.

2.2.1 NOTE: This contract requirement is NOT an Equipment replacement contract or a means in which the Department of Veterans Affairs or the Contractor is to acquire or provide New or Updated Intrusion Alarm System (IDS) equipment. If a unit or piece of equipment cannot be repaired and it is the recommendation of the Contractor that it should be replaced, the Contractor is to provide a written recommendation and a good faith estimate for the item/equipment needing replacement; and the VA will acquire the item/equipment through appropriate means (not associated with the contract). Any new or updated IDS item/equipment added outside of the contract shall be covered under the contract terms and conditions and will be considered as part of this Intrusion Alarm System (IDS) Monitoring, Maintenance, and Repair Service agreement.

2.3 The Contractor shall insure that all alarm signals report to the contractors twenty-four hours, seven days a week monitoring services “Call Center” and the VA Police Headquarters located a 2400 Canal Streee New Orleans, LA 70119.

2.4 Provide 24/7 monitoring services of all alarm systems.

2.5 SERVICE CALLS

2.5.1 The Contractor shall provide a centralized call-in phone number and e-mail address for reporting of malfuctions or repair service issues. It is not necessary that the centralized call-in number be manned 24/7, only that the Contractor telephonically respond within one (1) hour from the placement of the repair service call to begin troubleshooting of the issue.

2.5.2 When telephone trouble-shooting is unable to resolve the problem, the Contractor will dispatch a service technician to the site within one (1) day of the service call to begin repair of the system. The service technician must arrive on-site within the next business day to begin servicing/repairing of the IDS system.

2.5.3 Upon arrival at the site/location the Contractor is required to report in with the Contracting Officer’s Representative (COR). Only the services specified by this agreement are authorized, the Contractor is cautioned that ONLY the Contracting Officer (CO) may authorize additional services and that any authorized services provided by the Contractor without proper authorization from the Contracting Officer is done at Contractor’s risk and may not be reimbursed.

2.5.4 The COR must be briefed on any work that needs to be accomplished and provided with a written work orders documenting all work performed or services provided.

2.5.5 All service calls shall be responded to without undue delay. If the Contractor is unable to respond to a service call or restore the service to its normal operational state, the Contractor shall compensate the Government for the downtime by prorating the monthly bill for the time (day) reflective of the period of non-service, equivalent to the downtime of the service.

2.5.6 The Contractor will be responsible for ensuring that their personnel are instructed on performing service on Government property and are properly badged and easily identifiable.

2.5 IDS EQUIPMENT The Contractor shall provide the following:

2.6.1 All replacement parts shall be of new current model. All newly installed replacement parts shall become the property of the Government. Replacement parts are to be disposed of by the Contractor, after receiving written approval from the COR.

2.6.2 The Contractor will be responsible for ensuring that its personnel are qualified for the repair and replacement of all IDS security products and have current SLVHCS Contractor’s badges. No works should be delayed because of out of date passes.

2.6.3 To minimize malfunctions and maximize the service life of the equipment, the Contractor shall perform monthly Preventative Maintenance Inspection (PMI) once per month. The PMI can be accomplished in conjunction with an on-call repair and shall consist of the following:

2.7 IDS SYSTEM

2.7.1 Inspect, test, and service all Motion Sensors (Passive Infrared), Door Contact Sensors, Window Contact Sensors, Hardline Panic / Duress Alarms, and all Intrusion alarm control panels.

2.7.2 Inspect all Alarm Panels to ensure of fully functionality,

2.7.3 Inspect and test all wiring and cabling and replace defective components as necessary.

2.7.4 Perform an end-to-end power test of each location’s Motion Sensors (Passive Infrared), Door Contact Sensors, Window Contact Sensors and Hardline Panic / Duress Alarms.

2.7.5 Inspect all power cables, fuses, circuit breakers, and lightning protection devices at each IDS location.

2.7.6 Inspect the sensor mounts at each location, repair or replace as needed.

2.7.8 Inspect the lighting protection and grounding, repair as necessary.

2.7.9 Perform a complete system check-out upon completion of the PMI.

2.7.10 Visually inspect for cracks and corrosion, clean and repair all Alarm and housing assemblies.

2.8 EQUIPMET LISTING

(4) Door Contact Sensor

(1) Alarm control panel

(3) Door Contact Sensor

(3) Window Contact Sensor

(1) Alarm control panel

Poche C.t West, New Orleans Louisiana 70127

(8) Motion Passive Infrared

(6) Door Contact Sensor

(1) Alarm control panel

(9) Door Contact Sensor

(4) Panic /Duress Alarms

(6) Alarm control panel

(8) Door Contact Sensor

(22) Window Contact Sensor

(3) Panic /Duress Alarms

(4) Alarm control panel

(6) Door Contact Sensor

(19) Window Contact Sensor

(4) Panic /Duress Alarms

(3) Alarm control panel

(2) Door Contact Sensor

(2) Alarm control panel

(19) Door Contact Sensor

(2) Window Contact Sensor

(2) Alarm control panel

3. REQUIREMENTS

3.1 All equipment connected to AC power shall be protected from surges. Equipment protection shall withstand surge test waveforms described in IEEE C62.41.1 and IEEE C62.41.2.

3.2 Fuses shall not be used for surge protection.

3.3 Control units associated with IDS protecting all facility sites shall be mounted within secure office space within the height range specified by the Americans with Disabilities Act. With the exception of transmission lines and tamper-proof, local signaling devices, all component parts of sub-assemblies of intrusion detection systems protecting office spaces shall be inaccessible from the exterior of the facility.

3.4 All door contacts shall have no exposed wiring.

3.5 All window contacts shall have no exposed wiring.

3.6 All motion sensors shall have no exposed wiring.requirements for this solicitation/contract.

3.7 Shunt switches (access/secure switches) associated with intrusion detection systems protecting facilities shall be installed within the protected zone(s) and be equipped with a time delay of sufficient duration to permit opening of secured and protected zone(s) by authorized persons.

3.8 All monitoring systems/devices shall be one hundred (100) percent compatible with all existing systems, equipment and software in the facility.

3.9 The Contractor shall coordinate with the VA Police, Physical Security Officer (COR) to determine all IDS programming requirements.

3.10 The Contractor shall be responsible for the maintenance of each installed system thereafter.

3.11 The Contractor shall replace inoperable alarms within twenty-four (24) hours from when the test is completed. If the Contractor needs to deviate from the twenty-four (24) hour requirement, the request for deviation shall be in writing to the COR for approval and shall be of no cost to the Government.

3.12 Any property furnished by the Government to fulfill contract requirements which is lost or damaged resulting from improper use or negligence by the contractor’s employee, shall be repaired or replaced by the Government and the cost of such repairs or replacement shall be deducted from the contractor’s invoice or the contract price. The contractor shall take all reasonable precautions to safeguard and protect Government property.

3.13 Government property shall be used for official Government business only in the performance of this contract. The contractor or contractor’s employees will not use government property for personal advantage, business gain or other personal endeavor.

3.14 Rules and Regulations governing Security and Law Enforcement and Standard of Conduct on Veterans Affairs Property (38 CFR 1.218-1.220) are posted in all buildings under the charge and control of the Veterans Affairs and are applicable to all persons entering in or on such property.

3.15 The Contractor shall provide the COR with the monthly statistics for all properties protected by the contract on a monthly basis for comparison with the property protected under this contract.

3.16 The Contractor shall conduct regularly maintenance of all intrusion detection devices.

3.17 HOLIDAYS: The contractor may be required to work during U.S. federal Holidays. In accordance with 5 U.S.C. 6103, Executive Order 11582 and Public Law 94-97 the following national holidays are observed and for the purpose of this contract are defined as "Legal Federal, official holidays”.

Or any other specifically declared by the President of the United States to be a National Holiday.

3.18 Reporting Requirements: The Contractor shall report to the VA Police of any information or circumstances which may pose a threat to the security and/or safety of SLVHS personnel, Contractor personnel, resources, and or visitors.

3.19 Incident Reporting: The Contractor shall immediately call VA Police Headquarters and report all alarm activations and upon request notifed other local Police Departments as well.

4 SITE CONDITIONS

4.1 There shall be no smoking, eating, or drinking inside the facility at any time.

4.2 SITE LOCATIONS: Site locations consist of the following:

4.2.1 SLVHCS Mental Health 3426 Canal St., New Orleans LA. 70112

4.2.2 SLVHCS Mental Health 3434 Canal St., New Orleans LA. 70112

4.2.3 SLVHCS Michoud Warehouse, 4301 Poche C.t West, New Orleans Louisiana 70127

4.2.4 SLVHCS St. John VA Outpatient Clinic, 4004 W. Airline Highway, Reserve, LA 70084

4.2.5 SLVHCS Hammond VA Outpatient Clinic, 1131 South Morrison Blvd. Hammond, LA 70403

4.2.6 SLVHCS Slidell VA Outpatient Clinic, 60491 Doss Drive, Suite B, Slidell, LA 70460

4.2.7 SLVHCS Baton Rouge North VA Outpatient Clinic, 7968 Essen Park Ave. Baton Rouge, LA 70809

4.2.8 SLVHCS Baton Rouge South VA Outpatient Clinic, 7850 Anselmo Lane, Baton Rouge, LA 70810

5. PERIOD OF PERFORMANCE

5.1 Base Period October 1, 2021 through September 30, 2022

5.2 Option Year one October 1, 2022 through September 30, 2023

5.3 Option Year two October 1, 2023 through September 30, 2024

5.4 Option Year three October 1, 2024 through September 30, 2025

5.5 Option Year four October 1, 2025 through September 30, 2026

6. PROTECTION OF PROPERTY

7. SAFETY REQUIREMENTS

7.1 The Department of Veterans Affairs has identified the minimum worker safety standards and related training that are required by State law. All contractors providing service at VA facilities shall be in compliance with Louisiana Code of Regulations. These regulations require the employer to develop, implement and document written programs, as well as requiring initial and recurrent employee training and record keeping.

7.2 Hepatitis B Vaccination: Louisiana Code of Regulations state employers shall make available the Hepatitis B Vaccine and vaccination series to all employees who have occupation exposure, and post-exposure evaluation and follow-up to all employees who have had an exposure incident. Under the terms of this contract, the contractor will either provide, at no expense to the Government, the required vaccination defined herein, or have a letter of declination on file with the contractor. A copy of this letter shall also be filed with the COTR and placed in the official contract file. Copies of treatment and follow-up records shall be provided to the COTR.

7.3 Exposure to Hazardous Working Conditions: Contractor personnel may be required to perform work under potentially hazardous conditions. Contractor shall inform personnel of this, and shall provide the requisite training in the techniques to recognize and deal with such situations so as to minimize personal risk, and they must adhere to standard techniques for personal protection.

7.4 Fire and Safety: In performance of this contract, the contractor shall take all safety precautions as necessary to protect the lives and health of occupants of the building(s). The contractor shall immediately report any fire & safety deficiencies caused by its personnel. The contractor will comply with applicable Federal, State and local safety and fire regulations and codes which are in effect at the beginning of the contract period. The contractor will keep abreast of and comply with changes in these regulations and codes applicable to this contract. The contractor's personnel will follow applicable facility policies concerning fire & safety.

7.5 Radiation Safety: The Government will provide all contractor employees, the radiation safety training required by the U.S. Nuclear Regulatory Commission (NRC), prior to beginning work and annually thereafter.

8. SECURITY REQUIREMENTS

8.1 A&A requirements do not apply--Security Accreditation Package is not required".

8.2 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

8.2.1 A contractor/sub-contractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

8.2.2 All contractors, subcontractors, and third-party servicers and associates working with VA information is subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

8.2.3 Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security and Preparedness.

8.2.4 Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

8.2.5 The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leavesthe contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

8.3 VA INFORMATION CUSTODIAL LANGUAGE

8.3.1 Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

8.3.2 VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

8.3.3 Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

8.3.4 The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

8.3.5 The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

8.3.6 If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

8.3.7 If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

8.3.8 The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

8.3.9 The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

8.3.10 Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

8.3.11 Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

8.3.12 Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes.

The options are:

(1) Vendor must accept the system without the drive;

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase occur that may

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

(5) The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact;

(6) Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

(7) A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed.

The ISO needs to maintain the documentation.

8.4 SECURITY INCIDENT INVESTIGATION

8.4.1 The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

8.4.2 To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

8.4.3 With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

8.4.4 In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover.

8.5 LIQUIDATED DAMAGES FOR DATA BREACH

8.5.1 Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

8.5.2 The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

8.5.3 Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(3) Date of occurrence;

(4) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(5) Number of individuals affected or potentially affected;

(6) Names of individuals or groups affected or potentially affected;

(7) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(8) Amount of time the data has been out of VA control;

(9) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); VA information, obtain monetary or other

(10) Known misuses of data containing sensitive personal information, if any;

(11) Assessment of the potential harm to the affected individuals;

(12) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(13) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(14) Notification;

(15) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(16) Data breach analysis;

(17) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(18) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(19) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

8.6 CONFIDENTIALITY AND NONDISCLOSURE

It is agreed that:

8.6.1 The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which have been generated by the contractor in the performance of this task order are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the task order.

8.6.2 The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order presented to the contractor shall be submitted to the CO for response.

8.6.3 Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.

8.6.4 If you should have any questions regarding results of this review, please contact the FISOs at (504) 539-7423, (504) 539-7422.

8.6.5 Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

9. SCHEDULE AND DELIVERY INSTRUCTIONS:

9.1 The specific deliverables and schedule for delivery shall be per the Schedule of Supplies/Services and the Performance Requirements Summary.

9.2 Unsatisfactory Work – Performance by the contractor to correct defects identified by the Government as a result of quality assurance surveillance and by the contractor as a result of quality control shall be at the contractor’s own expense without additional reimbursement by the Government.

9.3 The acceptance of deliverables and satisfactory work performance required herein shall be based on the standards as specified in the requirements per Section 7 of this document. The COR will review the contractor’s performance indicators in accordance with all the specifications stated in this document. Only the COR or authorized alternate has the authority to inspect, accept, or reject work performed under this contract.

10. QUALITY CONTROL:

10.1 The contractor shall develop, implement, and maintain a complete Quality Control Plan (QCP) that contains, as a minimum, the items listed in Section 7 to the Contracting Officer (CO) for acceptance not later than ten (10) business days after the contract award. The CO will notify the contractor of acceptance or required modifications to the plan within five (5) work days. The contractor shall make appropriate modifications and obtain final acceptance of the plan by the CO within five (5) work days of notification of required changes.

10.2The plan shall include the following minimum requirements:

10.2.1 A description of the inspection system to cover all services listed in the Performance/Deliverables Matrix. Description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title and organizational placement of the inspectors. Additionally, control procedures for any government provided keys or lock combination should be included.

10.2.2 A description of the methods to be used for identifying and preventing defects in the quality of service performed.

10.2.3 A description of the records to be kept to document inspections and corrective or preventive actions taken.

10.2.4 All records of inspections performed shall be retained and made available to the government upon request throughout the contract period of performance, and for the period after contract completion, until final settlement of any claims under this contract.

11. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP): A Quality Assurance Surveillance Plan is designed to provide an effective surveillance method of monitoring and evaluating the Contractor performance. Upon contract award, the COR, with the assistance of the CO will establish a complete Quality Assurance Surveillance Plan (QASP) to ensure that the requirements of this contract are being met by the Contractor.

11.1 The objective of the QASP is to reduce the risk to both the Government and the Contractor when problems arise, and provide a disciplined process for evaluating the Contractor’s performance in order to determine conformity with the requirements of the contract. The systems also help ensure that the required performance quality levels are achieved and that the total payment is related to the degree that services performed or outcomes achieved meet contract standards.

11.2 For those services listed in the Performance Requirements Summary, the Contracting Officer Representative (COR), or evaluators will follow the method of surveillance specified in this contract. Government personnel will record all surveillance observations. When an observation indicates defective performance, the COR or evaluators will require the contractor manager or representative at the site to initial the observation. The initialing of the observation acknowledges that he or she has been made aware of the defective performance and does not necessarily constitute concurrence with the observation.

11.3 Government surveillance of services not listed in the Performance Requirements Summary or by methods other than those listed in the Performance Requirements Summary (such as provided in the Inspection of Services clause) may occur during the performance period of this contract. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the CO as a result of surveillance will be according to the terms of this contract. Noncompliance discrepancies will be documented and the contractor will be notified in writing. The contractor will immediately take corrective action and will notify the Contracting Officer and the COR in writing describing the corrective action taken to solve the matter in question.

12. PERFORMANCE REQUIREMENTS SUMMARY MATRIX

Positive and/or Negative

Contractor Furnished items

PWS Sections 2.1

Required contractor furnished items are provided 100% of the time.

Periodic site and records inspections.

100%

Payment or tender on percentage correctly completed IAW PWS.

Performance Requirements

PWS Section 2.5.2 and 3.11

95%

Payment or tender on percentage correctly completed IAW PWS.

Reports and Records submission

PWS sections 3.19

Payment or tender on percentage correctly completed IAW PWS.

Safety Requirements

PWS section 7

90% of the time safety requirements are met to include federal state and local laws.

Random Inspections. File reviews.

90%

Immediate corrective action taken at no cost to the Government.

Payment or tender on percentage correctly completed IAW PWS.

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

SLVHCS Mental Health 3426 Canal St., New Orleans LA, 70112 Contract Period: Base POP Begin: 10-01-2021 POP End: 09-30-2022

SLVHCS Mental Health 3434 Canal St., New Orleans LA, 70112

SLVHCS Michoud Warehouse located at 4301 Poche Ct. West, New Orleans LA, 70127

SLVHCS St. John VA Outpatient Clinic, 4004 W. Airline Highway, Reserve, LA 70084

SLVHCS Hammond VA Outpatient Clinic and Wellness Center, 1131 South Morrison Blvd. Hammond, LA 70403

SLVHCS Slidell VA Outpatient Clinic, 60491 Doss Drive, Suite B, C and D Slidell, LA 70460

SLVHCS Baton Rouge South VA Outpatient Clinic, 7850 Anselmo Lane, Baton Rouge, LA 70810

SLVHCS Baton Rouge North VA Outpatient Clinic, 7968 Essen Park Ave. Baton Rouge, LA 70809

OPTION 1 - Intrusion alarm services for all Clinic locations listed in CLINS 1-8.

Contract Period: Option 1 POP Begin: 10-01-2022 POP End: 09-30-2023

OPTION 2 - Intrusion alarm services for all Clinic locations listed in CLINS 1-8.

Contract Period: Option 2 POP Begin: 10-01-2023 POP End: 09-30-2024

OPTION 3 - Intrusion alarm services for all Clinic locations listed in CLINS 1-8.

Contract Period: Option 3 POP Begin: 10-01-2024 POP End: 09-30-2025

OPTION 4 - Intrusion alarm services for all Clinic locations listed in CLINS 1-8.

Contract Period: Option 4 POP Begin: 10-01-2025 POP End: 09-30-2026

Page 1 of Page 1 of

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL ITEMS (OCT 2018)

(a) Inspection/Acceptance. The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services that have been tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or reperformance of nonconforming services at no increase in contract price. If repair/replacement or reperformance will not correct the defects or is not possible, the Government may seek an equitable price reduction or adequate consideration for acceptance of nonconforming supplies or services. The Government must exercise its post-acceptance rights—

(1) Within a reasonable time after the defect was discovered or should have been discovered; and

(2) Before any substantial change occurs in the condition of the item, unless the change is due to the defect in the item.

(b) Assignment. The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727). However, when a third party makes payment (e.g., use of the Governmentwide commercial purchase card), the Contractor may not assign its rights to receive payment under this contract.

(c) Changes. Changes in the terms and conditions of this contract may be made only by written agreement of the parties.

(d) Disputes. This contract is subject to 41 U.S.C. chapter 71, Contract Disputes. Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause at FAR 52.233-1, Disputes, which is incorporated herein by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

(e) Definitions. The clause at FAR 52.202-1, Definitions, is incorporated herein by reference.

(f) Excusable delays. The Contractor shall be liable for default unless nonperformance is caused by an occurrence beyond the reasonable control of the Contractor and without its fault or negligence such as, acts of God or the public enemy, acts…