36C25625Q0077 Sources Sought_PWS Update.docx

Sources Sought Notice Sources Sought Notice

DESCRIPTION

Sources Sought Notice

Page 1 of

1. Title: Patient Monitoring System (Telemetry)

2. Purpose: The Network Contracting Office (NCO) 16 located at 5075 Westheimer Road, Galleria Financial Center, Suite 750, Houston, Texas, hereby issues the following Sources Sought to Request Information (RFI) with the intent of determining the contractor interest, capabilities, qualifications of potential businesses, nonmanufacturer rule compliance, Buy American Act compliance, Trade Agreement compliance and estimated industry pricing information for market research and estimated budgetary purpose for the Patient Monitoring System (Telemetry) that must be compatible with current Philips XPER System in the Cath Lab.

Contractor shall provide all shipping, installation, equipment, personnel, labor and testing for the system. This Sources Sought is published for market research purposes. This Sources Sought will be used to determine if a set-aside for any small business program is appropriate. Government anticipates competitive, firm fixed price contract. Please review this announcement, respond to questions below and review all attachments in their entirety.

Government request that interested offerors complete all questions below, provide required documentation, descriptive literature and authorization letter as described below. The Government is in no way obligated to do business with or to enter into any form of contract with any person, firm or other entity that receives or responds to this announcement.

3. Objective: To find qualified and certified contractors with the capability to provide the following:

a. Overton Brooks Veteran Affairs Medical Center (OBVAMC) requires a total end-of-life patient monitoring system replacement effort providing a single over-arching system capable of continuum of care for all levels of acuity. The system should be interchangeable, flexible, adaptive, and shall provide continuous monitoring capability between all patient care units. Contractor must install all software and application on any PC’s, Virtual Servers and/or physical servers. The system must be compatible with the current Philips XPER System in our Cath Lab. (as prescribed in the included draft of the Statement of Work).

4. Place of Performance:

The Overton Brooks Veteran Affairs Medical Center Building 1 510 East Stoner Avenue Shreveport, LA 71101

5. Responses Requested: The OBVAMC requires all the following information and questions answered in this RFI/SS: Questions and information that is not provided shall be considered nonresponsive to the Request for Information and contractor shall not be considered as part of the market research.

a. Contractors shall provide their point(s) of contact name, address, telephone number, and email address; and the company's business size, and SAM Unique Entity Identification Number.

b. Is your company a small business, SDBs, HUBZone, or 8A concern? Please provide proof of qualifications.

c. Does your company meet all required four prong factors for the Nonmanufacturer Rule (NMR) per guidance of SBA and 13 C.F.R. § 121.406 Offer must answer all questions below.

1. Does your company exceed the 500 employee alternative size standard for nonmanufacturers?

2. Is your company primarily engaged in the retail or wholesale trade and normally sells the type of products being supplied?

3. Does your company must take ownership or possession of the item(s) with its personnel, equipment, or facilities in a manner consistent with industry practice?

4. Does your company supply the end products of a small business manufacturer or processor made in the United States?

d. Is your company considered small under the NAICS code 423450.

e. Do you (offer) manufacture the product yourself or a distributor of the items being researched above?

f. Are you an authorized distributor/reseller? Provide evidence from original equipment manufacturer (OEM).

g. Do you (offer) supply a product manufactured by another domestic small business, if it is a nonmanufacturer?

h. Do you (offer) supply the product of any sized manufacturer if SBA has granted a waiver to the nonmanufacturer rule?

i. Is your (offer) Buy American Certificate completed in SAM? Please provide evidence with response.

j. Is your (offer) Trade Agreement Certificate completed in SAM? Please provide evidence with response.

k. Information for the name brand or equal product being requested, is it manufactured outside the US-Domestic non-available?

l. Information for the name brand or equal product being requested, is it a foreign manufactured end product under the trade agreement?

m. What is your schedule of delivery after receipt of order for the name brand or equal product?

n. For the name brand or equal product required, Is your company available under any;

Government Wide Agency Contract (GWAC) General Services Administration Schedules (GSA) Indefinite Delivery Indefinite Quantity (IDIQ) Blanket Purchase Agreement (BPA)

If so, please list the contract number for name brand or equal product.

o. Provide descriptive literature demonstrating ability to meet all of the requirement/salient characteristics listed if other than brand name product is being offered. Please provide list of contracts for commercial, federal, state, and local governments. Listed contracts shall provide communication on the government requirement illustrating the capability for comparison. to the name brand or equal product meeting the specific requirements per the draft Statement of Work.

p. Contractors shall provide an estimated industry pricing for name brand or equal product for market research and budgetary purpose.

6. Opportunity: NCO 16, is seeking information from potential contractors on their ability to provide this requirement. THIS IS A SOURCES SOUGHT FOR REQUEST INFORMATION (RFI) ONLY. Small Business Concerns are encouraged to provide responses to this Sources Sought in order to assist the OBVAMC in determining potential levels of competition available in the industry. Contractor shall possess the capability to provide all requirements and objectives.

7. Instructions and Response Guidelines: Sources Sought responses are due by 11/06/2024 at 1430 (CST) via email to LeKisha.Douglas@va.gov, tammy.demille@va.gov, and t.miller@va.gov.

All Questions shall be submitted by 11/04/2024 at 1300 (CST) via email to LeKisha.Douglas@va.gov, tammy.demille@va.gov, and t.miller@va.gov.

Telephone requests or inquires will not be accepted.

Public Information will not be provided and shall be utilized to the full extent possible.

This a New Requirement.

The subject line shall read: 36C25625Q0077 -RFI-Sources Sought- Patient Monitoring System (Telemetry) – Shreveport LA. NO SOLICITATION EXISTS AT THIS TIME. There is no page limitation on subparagraphs 5(a) - 5(o).

Please provide the information you deem relevant in order to respond to the specific inquiries of the Sources Sought. Information provided will be used solely by OBVAMC as "market research" and will not be released outside of the OBVAMC Purchasing and Contract Team.

This Sources Sought notice does not constitute a Request for Proposal (RFP), Invitation for Bid (IFB), or Request for Quotation (RFQ), and it is not to be construed as a commitment by the Government to enter into a contract, nor will the Government pay for the information submitted in response to this request. All information contained in this Sources Sought is preliminary as well as subject to modification and is in no way binding on the Government.

In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the U.S. Government to form a binding contract. If a solicitation is released, it is will be synopsized on Contracting Opportunities (https://beta.sam.gov/) website or GSA. It is the responsibility of the interested parties to monitor these sites for additional information pertaining to this Sources Sought, or future RFP/RFQ.

8. Contact Information:

Contracting Officer, Le Kisha Douglas, MPA Email address: LeKisha.Douglas@va.gov

Contracting Specialist, Tammy Demille Email address: tammy.demille@va.gov

Contracting Specialist, T Miller Email address: t.miller@va.gov

Your responses to this notice are appreciated.

THIS NOTICE IS NOT A REQUEST FOR COMPETITIVE QUOTES/PROPOSALS; however, any firm that believes it can meet the requirements may provide answers, responses and give written notification prior to the response due date and time. Supporting evidence and responses

36C25625Q0077 - Sources Sought - Patient Monitoring System Telemetry, Shreveport, LA

Page 1 of

See Statement of Work Below:

STATEMENT OF WORK (SOW)

as of 10/21/24

1. Contracting Officer’s Representative (COR).

510 East Stoner Ave, Shreveport, La 71101

2. Contract Title. Patient Monitoring System (Telemetry)

3. Background.

a) The Overton Brooks VA Medical Center (OBVAMC) currently has a need for an upgrade to the Patient Monitoring System to support physiological, telemetry, and transport monitoring requirements. The current patient monitoring fleet is comprised of Nihon Kohden and Philips monitoring equipment and devices located in different departments based on how previous projects allowed for upgrades. This is not the ideal monitoring solution especially now that one vendor platform is at end of life. This full encompassing equipment replacement and upgrade shall provide a patient monitoring solution for transfer of patient information and transferable end user training.

4. Scope.

a) Overton Brooks requires a total end-of-life patient monitoring system replacement effort providing a single over-arching system capable of continuum of care for all levels of acuity. The system should be interchangeable, flexible, adaptive, and shall provide continuous monitoring capability between all patient care units. Contractor must install all software and application on any PC’s, Virtual Servers and/or physical servers. The system must be compatible with the current Philips XPER System in our Cath Lab.

5. Site Visit:

a) A site visit will be held at Overton Brooks VA Medical Center:

Shreveport, LA, 71101

6. General Requirements:

a) Full system replacement to encompass ER, 3N, 6N, Telemetry Monitoring room on 7th floor, and wireless telemetry for 6w, 7w, and 8w. System requirements are below.

1) All software must be Technical Reference Model (TRM) approved.

2) All cabling will be its own backbone.

3) Servers only will touch Hospital Network. Per the Biomed Supervisor No FITARRA needed for this acquisition as it is patient monitoring and not IT Equipment. No IT requirements as server will be virtualized on Biomed Network and Server.

4) All servers will use Acropolis Hyper Visor.

5) Vendor must be able to always provide local onsite support.

6) Vendor must have an approved Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA)for remote connectivity.

7) Vendor must be able to repair and upgrade remotely through MOU/ISA.

8) If system can’t be repaired remotely, vendor must have the ability to have Field Service Engineer onsite within 2 hours.

9) System must be fully compatible and integrable with our current Phillips Xper system.

10) Vendor will supply all security, software, and firmware upgrades for manufacturer’s life of the equipment.

11) Technology that provides instructions of use in PDF format at the patient monitor.

12) Each monitor must be a touch screen, 6 to 8 trace, high-resolution color display with modular design and have network connectivity to a central station.

13) Monitors shall be capable of simultaneously measuring and displaying ECG x 2, Respiration, Cardiac Output, three Invasive Pressures, NIBP, SaO2, temp, SvO2, and main or side stream CO2.

14) Monitor shall be able to configure automatically for new parameters as they are connected.

15) Monitors shall be able to display physiologic measurements in numeric forms simultaneously and continuously while allowing view of all real-time waveforms full scale. This includes non-real-time and intermittent or discontinuous data.

16) Monitor operations shall be designed such that frequently used functions (example: zeroing pressures, silence alarms, etc.) are accomplished in one keystroke.

17) All monitor input connectors must be color coded or uniquely configured to avoid attempts to incorrectly plug in wrong connectors.

18) Monitors must be shipped complete with all patient cables, power cords and/or non-disposable accessories necessary for full functionality.

19) Monitor shall have built in self-test and diagnostic checks without the use of external devices.

20) Monitor architecture must allow for additional module slots for additional capabilities. If additional mounting hardware is required, it shall be provided by the vendor.

21) Monitors shall provide real time and delayed recording capability at a bedside recorder or central station recorder as specified.

22) Monitors must have at least two-hour battery backup.

7. Infrastructure:

a) Uninstall all current Nihon Kohden infrastructure including but not limited to all cabling, switches, patch panels, ORG’s, wall mounts, servers and software, antennas, and any other Nihon Kohden infrastructure not listed here.

b) Install all new infrastructure to include cabling, switches, patch panels, wall mounts, servers and software, antennas and any other items required for the new patient monitoring system to completely and properly function.

c) All software for servers or devices must be loaded by Field Service Engineer (FSE).

d) All network cabling must be Cat 6e.

e) Vendor must repair any firewall penetrations they make with either firewall sleeve or fire putty.

f) Vendor must provide full turnkey solution.

· Emergency Department (1North):

a) Uninstall all current Nihon Kohden equipment including but not limited to 8 bedside monitors with 8 attached transport monitors, 13 telemetry transmitters and 1 central monitoring computer with 2 monitors. Also remove from the Fast Track area 3 bedside monitors on rolling stands.

b) Install 8 new bedside monitors with 8 new attached transport monitors, 2 new portable (rolling stands) bedside monitors with 2 new attached transport monitors. Install in Fast Track area 3 new bedside portable (rolling stands) bedside monitors with 3 new attached transport monitors, and all applicable accessories.

· ICU (3North):

a) Uninstall all Nihon Kohden equipment including but not limited to 10 bedside monitors with 10 attached transport monitors, 2 central monitoring computers with 2 monitors.

b) Install 10 new bedside monitors with 10 new attached transport monitors, 2 central monitoring computers with 2 monitors, and all applicable accessories.

· Stepdown (6North):

a) Uninstall all Nihon Kohden equipment including but not limited to 11 bedside monitors with 11 attached transport monitors, 2 central monitoring computers with 4 monitors.

b) Install 11 new bedside monitors with 11 new attached transport monitors, 2 central monitoring computers with 4 monitors, and all applicable accessories.

· Central Telemetry (7West49):

a) Uninstall all Nihon Kohden equipment including but not limited to 3 central monitoring computers with 6 monitors, 1 (slave) monitor that monitors 6 north, 58 telemetry transmitters, 2 remote monitors on 6 west, 2 remote monitors on 7 west, 2 remote monitors on 8 west, several (exact number unknown at this time) transport monitors on 6 west, 7 west, 8 west.

b) Install 3 new central monitoring computers with 2 monitors each (total of 6), 1 slave monitor to monitor 6 north, 1 slave monitor to monitor 3 north, 58 telemetry transmitters 2 remote monitors on 6 west, 2 remote monitors on 7 west, 2 remote monitors on 8 west, 2 transport monitors on 6 west, 2 transport monitors for 7 west, 2 transport monitors on 8 west, and all applicable accessories.

8. Specifications

a) Telemetry Transmitters: Should have dimensions less than H 5” X W 2 ¾” X D 1 ¼” with a weight of less than 9 oz. Be capable running for 6.5 hours or more on one set of batteries. Must have a color display with a viewing area of at less 1.7 X 2.3 viewing area and 240 X 320 resolution. Must operate in environmental 60-95 degrees F with a relative humidity of 95%. Must obtain ECG 3,5 or 6 lead wire patient cable. SpO2 capability measurement range 0-100%, resolution 1% Pleth wave sampling rate 125 sps, wave-length range 500-1,000nm, pulse rate measurement 30-300 bpm and emitted light energy of < 15mW.

b) Patient Monitors: Dimensions should be less than H 14.33” X W 18.82” X D 5.98” with a weight of less than 26.4 lbs. The minimum useful screen area of 16.8” X 10.07 with pixel size of .0096” X .0096”. Monitor should encompass measurements available of HR, SpO2, Resp, tcpO2, pulse, Perf, CO2, ABP, PAP, CVP, ICP, CPP, BIS CCO, AWP, Delt SpO2, inO2 with measurements samples taken at a resolution of four samples per second and waves at 3cm a minute. Minimum CPU Intel Core2 Duo or equivalent for performance. 160 GB hard drive with a minimum 4 GB RAM. Internal wireless adapter, Five USB 2.0 receptacles, DVI-I (digital and analog, single link, Internal SSR Interface, ODU out measurement link.

c) Monitor Module/Wireless Transport Monitor (MM/WTM): Should allow for seamless transfer from room monitor to a wireless network transport monitor with no loss of data and remote monitoring. The MM/WTM is required to have a rechargeable battery and while acting as a transport monitor give an indication of charge level remaining. The battery should be charged when installed on the monitor and have the option of a separate charging station. This device dimensions should not exceed W 8” X H 4” X D 3.5” with an approximate weight not to exceed 5 lbs. The usable display touch screen size should be at least 5.5” X 2.5” with a resolution of 1024 X 480 minimum. The operating environment requirements of the MM/WTM should be the same as the Patient Monitors. The MM/WTM will be required to display and transmit all patient data as the Patient Monitor

9. Display Capability Requirements:

a) Modular display must be capable of a minimum of 6 to 8 wave forms, user selectable.

b) The display shall be multicolored, with different color selections for each wave form. Parameter numeric shall automatically match the color selected for the wave-form.

c) The monitor shall have a minimum of 3 preset configurations, user selectable.

d) The monitor must not require manual reconfiguration of display or performance parameters when changing care area.

e) The monitor shall be capable of displaying individual invasive blood pressure scales for each pressure simultaneously.

f) Display shall provide configurable status messages and shall indicate at least three levels of visual and audible alarms.

g) The monitor display shall provide at least three seconds of waveform trace in all modes of operation including "windowed" and menu modes.

h) Monitor shall have touch screen for user-interface functions.

10. Alarm Capability Requirements:

a) Each monitor shall be equipped with audible and visual alarms capable of being triggered by each monitor function. There must be recorder connections and actuators to allow for bedside and remote waveform recording.

b) Alarms must be distinct audibly and visually and prioritized to indicate level of patient condition and higher priority alarms State nurse-call interconnections, scrolling marquee’s, blinking lights, or other methods.

11. Data Management Requirements:

a) Bedside monitor calculations package shall include vital signs in tabular trends and graphic trends, as well as providing hemodynamic, pulmonary, and drug dosage calculations.

b) Data from continuously monitored parameters must be automatically stored in the bedside database for 24 hours in at least one minute resolution.

c) Graphical trends shall display up to 3 parameters simultaneously over varying time frames with colors corresponding to the appropriate parameter.

d) User must have ability to zoom on any portion of a graphical trend to display parameter at any 1-minute resolution.

e) All data management calculations shall be trended for later review and print out. Calculations must incorporate hemodynamics (resistance, stroke work, etc.), ventilatory (compliance, minute volumes, etc.), and respiration (AVDO2, O2 extraction, etc.).

f) Drug calculations shall display the name of each medication selectable for calculation. System should include the capability to perform user defined physiologic calculations and drug dosage calculations. Drug calculation package should be able to calculate infusion rate or dosage for any patient.

12. EKG Module Requirements:

a) Each bedside monitor must be capable of performing simultaneous multi-lead arrhythmia analysis.

b) Monitor must provide capability to store, view, and edit arrhythmia histories at the bedside.

c) Monitor shall simultaneously display one, two, or multiple leads of EKG at user's option without the need to change different modules.

d) Any EKG lead shall be selectable without disturbing the other.

e) Modules shall be capable of using 5-lead and 10-lead cables.

f) Monitors used in the OR shall be capable of filtering electrocautery interference.

g) Pacemaker pulses shall be displayed on all monitors but will not be computed in determining heart rate. The arrhythmia detector shall distinguish both ventricular and atrioventricular pacemakers.

h) Monitor shall provide an R-wave sync marker for cardioversions.

i) Monitor must be capable of measuring ST segments in 2 leads and displaying trends in graphical format.

j) Monitors shall be capable of retaining alarm settings for patient transport.

k) Monitor should be capable of providing diagnostic 12-lead EKG.

13. Pulse Oximetry Module Requirements:

a) Module shall provide oxygen saturation percentage level.

b) Module shall provide both wave form and pulse rate in beats per minute.

c) Range shall be zero to 100 percent saturation.

d) Module shall provide visual and audible alarms for low saturation and high and low pulse rate, including variable pitch tone for saturation.

e) Module must allow use of both reusable and disposable transducer probes.

f) Module shall contain an alarm for non-pulsatile signal or non-perfusion.

g) Module must be capable of retaining alarm setting for patient transport.

h) Module is essential at all bedside locations.

i) Modules for NELLCOR pulse oximetry must be available for 100% of bedside locations.

j) Must allow the use of non-proprietary transducer probes.

14. Noninvasive Blood Pressures Requirements:

a) Noninvasive blood pressure shall be available in every bedside monitor.

b) Monitor shall trigger an inoperative condition alarm if a static overpressure is detected.

c) Monitor shall allow NIBP systolic, diastolic, and mean values to be simultaneously shown on monitor's display and central station and shall be trended for presentation in tabular and graphic formats at bedside.

d) Monitor must provide stat mode for rapid readings.

15. Temperature Requirements:

a) Temperature modules shall be provided at all bedside locations.

b) Module(s) shall provide monitoring of at least two temperatures using a variety of probes including general purpose, skin surface, rectal, and esophageal.

c) Monitor shall be capable of displaying values from each temperature channel.

d) Accuracy shall be read plus or minus 0.1 degrees centigrade over a range of -1 to +45 degrees centigrade.

16. CO2 Module Requirements:

a) End-tidal CO2 modules shall be provided for all bedside locations.

b) Monitor shall utilize a side stream technology for all locations.

c) Unit shall be modular and shall not be an external device.

d) Unit shall be capable of discontinuing monitoring, and calibration shall be verifiable without interrupting ventilation.

e) Sensor shall allow calibration of the CO2 waveform and digital values for ETCO2, airway respiration rate (AWRP), and Inspired Minimum CO2 (IMCO2).

f) Airway respiration shall have an apnea delay alarm along with a high respiration alarm.

g) Alarms shall be available for high and low ETCO2.

h) Compensation for O2 and N2O shall be provided.

i) CO2 transducers shall be provided for each module.

j) Values from CO2 module shall be trendable and data entered automatically into the PIMS.

k) Module should not require the use of proprietary gas sampling lines.

17. Third Party Monitor Option Requirements:

a) Monitor shall provide interface capability for up to four third party monitoring options such as cerebral oximeters, BIS, EEG, CCO, etc.

b) Each bedside monitor must have leads that are interchangeable.

c) Monitor must provide interface capability for display of anesthesia gas analysis dated provided by anesthesia machines.

d) If additional modules are required, please specify.

18. Central Station Specifications

a) Central station shall be available in (2) options: Overview and Surveillance Stations. Surveillance stations provide the capability of admitting and discharging patients, while Overview stations do not.

b) Central monitoring technology that can advise on Alarm Violations on specified measurements determined by our Alarm Committee.

c) Central station must allow third-party devices drivers to display at the clinical unit / central station.

d) Central station should provide waveform recall for 2 hours minimum.

e) System verifies EMR system has successfully received data packets and resends if not received.

f) Central monitoring technology that provides workflow configuration settings that ensure patient data is collected during discharge merger to readmittance / transfer data.

g) Monitoring technology that allows up to 30 characters in all PHI fields, removing the needs for abbreviations.

h) Central station should allow monitoring of hospital units to include other facilities.

i) The central station shall display information from a minimum of 16 patients simultaneously per screen.

j) Central station displays shall be high resolution and have 27" minimum screen size.

k) Central monitor sectors may be moved, added, or shared without additional license. IE. Pull 6 sectors from BIOMED and add 2 sectors to PACU and 4 sectors to ASOU.

l) Alarm notification shall be by both visible and audible means. Describe specific interfaces with nurse call or scrolling marquees, paging systems etc.

m) Central monitoring technology that provides automatic application whitelisting controls.

n) Central station should provide waveform recall for 24 hours minimum for alarm conditions.

19. Telemetry Monitor Specifications

a) Telemetry monitors shall include both EKG and pulse oximetry. Two EKG channels are desirable.

b) Provides QRS detection threshold, eliminating noise or false readings on telemetry units.

c) Vendors shall specify broadcast frequencies for telemetry monitors.

d) The telemetry monitors shall display patient information at the central station for each unit.

e) The telemetry unit bedsides must be networked to the central station such that a basic monitor can be used at the bedside and displayed at the central station, except that the ICU telemetry unit shall have a full function monitor at each bedside.

f) For any proprietary network components, specify maintenance and support provisions, and any exclusive bandwidth use provisions.

20. Bedside Workstation Specifications

a) Workstation technology that can Admit, Discharge, and Transfer via network system or bed management system.

b) View any central station bed or tele from OBVAMC OIT computers or remote capabilities.

21. Clinical Training

Contractor shall provide on-site training of the equipment to clinical staff and Biomed Personnel. Scheduling of operator training shall be coordinated with the OBVAMC COR after installation is complete. Training should give a general overview of the equipment and its setup and configuration.

The contractor shall provide a training program to the Biomedical Engineering technicians consisting of the following:

Training for 2 people on:

· Equipment in hardware section

· Any electronic management system needed to manage and configure devices.

22. Warranty and Support:

a) The contractor shall provide manufacturer(s) warranty on devices. Provide full warranty for a period of 5 years from installation to include any corrective maintenance that may be needed. During the warranty period, the Contractor shall repair or repair without charge, any parts which are deemed to be defective. The vendor shall provide and install manufacturer recommended software upgrades and changes at no additional charge during warranty period. Vendor must be able to remotely repair workstation and servers. Vendor must be able to be on site for and repair within 2 hours of critical failure if it can’t be done remotely. Vendor must be able to provide these services with no help from OBVAMC Biomed department.

23. Specific Tasks. There is no trade in consideration as the equipment are at end of life. The procured equipment will be installed by the vendor.

24. Performance Monitoring. Once the equipment is procured, delivered the contract will be completed except for exercising use of the manufacturer’s warranty.

25. Security Requirements. All VA sensitive information shall be protected at all times, in accordance with VA local site guidelines. The Contractor shall report any known or expected security/privacy incidents, or any unauthorized disclosure of sensitive information, to the COR.

The physiological equipment shall have Federal Information Processing Standards (FIPS) 140-2 compliant Encryption for connectivity to secure Wi-Fi. The physiological equipment shall have approved Enterprise Risk Assessment for connectivity to the Local Area network. The Software version shall be approved within the Office of Information and Technology (OIT) Technical Reference Model for installation on Office of Information and Technology (OIT) virtual server and Office of Information and Technology (OIT) workstations. The Health Level-7 (HL7) interface for sending infusion reports to the patient electronic health record. The devices shall have Integration and Interoperability.

The Contractor shall follow all Government rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations, and shall adhere to all VA Privacy & Security, the Privacy Act, and Health Insurance Portability and Accountability Act (HIPPA) requirements when obtaining and reviewing information.

26. General

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

27. Access To Va Information and Va Information Systems

a) A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

a) All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

b) Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

c) Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

d) The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

28. VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

29. Security Incident Investigation

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

30. Liquidated Damages for Data Breach

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $ 37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

31. Security Controls Compliance Testing

a) On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

32. Training

a) All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b) The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c) Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

33. SUBPART 839.2 – INFORMATION AND INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

839.201 Contract clause for Information and Information Technology Security:

a. Due to the threat of data breach, compromise or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with Federal laws and regulations, VA has developed an Information and Information Technology Security clause to be used when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

b. In solicitations and contracts where VA Sensitive Information or Information Technology will be accessed or utilized, the CO shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources.

34. 852.273-75 - Security Requirements for Unclassified Information Technology Resources (Interim- October 2008)

As prescribed in 839.201, insert the following clause:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

REFERENCE (S):

1. VA Affairs Handbook 6500, Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program, 10 Mar 2015.

2. Veterans Health Administration Procurement Manual (VHA PM) – 11/3/2014.

3. VA Handbook 1901.01, Health Information Management and Health Records – 19 Mar 15.

4. VHA Handbook 1605.5, Business Associate Agreements – 22 July 2014

5. Privacy Act of 1974 (5 U.S.C. 552a).

35. Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI). All GFE/GFI will be kept and disposed of by the government.

36. Inspection and Acceptance Criteria.

Once the equipment is received, it will need to be tagged by Supply Chain Management and inspected by Bio-Med. The Nursing Service CO need to be notified of receipt and delivery so acceptance can be completed.

37. Invoices. Offeror may submit invoices for any completed and government accepted items on the Price Schedule. See VAAR Clause 852.232-72, Electronic Submission of Payment Requests for invoicing procedures.