36C25719Q0302-004.docx

MARCH 12, 2010 VA HANDBOOK 6500.6

APPENDIX D

APPENDIX D

STATEMENT OF WORK

SOUTH TEXAS VETERANS HEALTH CARE SYSTEM

MEDICAL COURIER SERVICES

1. GENERAL

Scope of Work:

The STVHCS has a need for a medical courier services contract for the STVHCS P&LMS Laboratory. The Government shall not exercise any supervision or control over the service providers providing the services described herein. The contractor will provide all necessary labor, transportation, equipment, material and supplies for twenty-four (24) hours a day, 7 Days a week pickup and delivery of routine and emergency reagents, blood and/or blood products, lab products and specimens to locations outlined in the Schedule of Delivery for the South Texas Veterans Health Care System.

Period of Performance:

Base plus four (4) one-year options.

2. CONTRACTOR QUALIFICATIONS

2.1 PERSONNEL POLICY:

The Contractor shall be responsible for protecting the personnel furnishing services under this contract. To carry out that responsibility, the Contractor will provide the following:

Note that the Contractor, its employees, agents and subcontractors will not be considered VA employees for any purpose.

2.2 Contractor Responsibilities:

A. Must be licensed, bonded, and carry a minimum of $1 million in liability insurance.

B. Couriers must carry cell phones and pagers for communication purposes.

C. Services must be performed with a company vehicle and a uniformed driver to transport laboratory specimens.

D. The Contractor’s personnel shall present a neat appearance and be easily recognized as a contract employee.

E. The Contractor’s employees shall wear identification tags that include the company’s name/logo and employee name.

F. Contractor’s vehicle shall have the company name/logo prominently displayed.

G. After award and prior to the start date, the contractor must provide the COR a copy their employee training certificates, drivers licenses, vehicle insurance, and vehicle registration.

H. All couriers transporting laboratory test specimens must be trained in “Universal Precautions” in the handling of biohazard materials (specimens). Training must include using clinical procedures in case of biohazard spills and accidents I. All couriers must maintain a valid driver’s license for the type of vehicle operated as required by the States of Texas J. A record of each driver as to character and physical capabilities of performing the duties as a courier must be maintained and made available to the COR for inspection upon request.

K. The contract manager, drivers, and alternates, must be able to read, write, speak, and understand English. The name of this person, and an alternate, or alternates, who shall act for the contractor when the manager is absent, shall be designated in writing to the COR. An updated listing will be provided as changes in personnel occur.

3. TASK SPECIFICATIONS

WORK HOURS:

The contractor as defined herein shall furnish the services covered by this contract at the times specified in Section 4 of the Contract.

The following terms have the following meanings:

(I) Work Hours: Service is to be available twenty-four (24) hours per day, seven days per week.

· Normal Duty Hours are 8:00 AM to 4:30 PM CST

· After Duty Hours are 4:30 PM to 7:59 AM CST

(II) Contractor may be required to work on the National Holidays observed by the Federal Government, on an as needed basis.

The recognized federal holidays are: New Year’s Day (1st), Martin Luther King Jr’s Birthday (3rd Monday in January), Washington’s Birthday (3rd Monday in February), Memorial Day (last Monday in May), Independence Day (4th of July), Labor Day (1st Monday in September), Columbus Day (2nd Monday in October), Veterans Day (November11th), Thanksgiving Day (4th Thursday in November), Christmas Day (December 25th) and any other day specifically declared by the President of the United States to be a national holiday, When one of the designated holidays falls on a Sunday, the following Monday will be observed as a legal holiday. When a legal holiday falls on a Saturday, the preceding Friday is observed as a holiday by U.S. Government agencies.

3.1 Specific Tasks

Courier Services will consist of the following:

A. The Courier will pick up the laboratory test specimens in locked coolers.

B. The pickup/delivery must be performed within a 30-minute window of the initial request for pickup. Pickup/delivery times greater than 30 minutes require a telephone call to the COR stating the reasons why this requirement was not met.

C. Delivery must be made to the STVHCS according to the Delivery Schedule.

D. The condition of the laboratory test specimens will be checked at time of delivery.

E. A daily tracking log will be provided by the clinics and will be completed and submitted to the STVHCS Laboratory.

F. The items to be transported under this contract consist of biological specimens that will be transported to/from the locations listed in section 4.1. The specimens are a combination of room temperature, refrigerated, and/or frozen specimens.

G. Laboratory test specimens, i.e. body fluids (blood, urine and stool), will be properly packaged in inner containers and stored at the proper temperature by Government personnel.

H. Test specimens stored in the refrigerated cooler must remain upright during transportation. Test specimens that are stored at room temperature can be placed near the top of the refrigerated cooler during transport.

3.2 Quality Control

A. The Contractor shall develop and maintain a quality control program that ensures courier services are performed in accordance with these specifications.

B. The contractor shall develop and implement procedures to track, identify, prevent, remedy, and ensure non-recurrence of defective services.

C. The contractor shall provide a method to accept and resolve customer complaints and notify the customer of the resolution.

D. The contractor shall immediately notify the COR upon receipt of a customer complaint so joint validation may be accomplished.

E. The contractor is responsible for quality control and specification compliance.

F. Quality Assurance will be performed by the Government who will evaluate the contractor’s performance using customer complaint, and may at the Government’s discretion, inspect each task to incur conformance and acceptance prior to payment All specimens must be transported in accordance with all Department of Transportation and Occupational Safety and Health Administration (OSHA) Codes of Federal Regulations (CFR) 29 and 49. The Contractor shall ensure the confidentiality of all patient information being transported and will be held liable in the event of breach of confidentiality. The Contractor shall comply with the provisions of the Federal Privacy Act of 1974 (Public Law 93-579).

G. All items must be transported in accordance with all local, state and federal regulations. All efforts shall be made to assure that all items are delivered without spoilage/damage from temperature conditions, rough handling and/or negligence.

H. If the courier services cannot be performed due to inclement weather, the COR must be notified in advance.

I. The COR must be notified within two hours, by phone and confirmed through email, if the Contractor has knowledge of any conditions which may adversely affect the Contractor’s ability to perform under the terms and conditions as stated in the specifications of this requirement.

J. In the event of a lost or broken specimen, the contractor must submit a written report to the COR within twenty-four hours explaining the circumstances. Failure to provide the report within this timeframe will be cause further review by the Government to determine if the infraction warrants suspension/termination of the contract.

K. The Contractor shall direct all questions and problems regarding this contract to the Contracting Officer and COR. The Contracting officer is the only authorized person on behalf of the Government, to modify the terms and conditions of the contract. All modifications must be in writing from the Contracting Officer to the Contractor.

L. The contractor must provide quality customer service at all times and shall not receive more than five complaints or referrals to the COR per year.

4. DELIVERY SCHEDULE

The VA reserves the right to change the pickup time and location, if it is beneficial to the government.

4.1 ADDRESSES (Listed in Delivery Schedule, not all inclusive):

South Texas Veterans Healthcare System

Victoria, TX 77901-5457 San Antonio, TX 78229

Santa Rosa Santa Rosa Stone Oak 7902 Ewing Halsell 502 Madison Oak Dr. #500 San Antonio, TX 78229 San Antonio, TX78258

Physical Security:

1. The Contractor shall be responsible for safeguarding all government equipment, information and property provided to Contractor personnel while performing the services described herein.

2. The Contractor assumes all liability risks for work performed under this contract.

3. The Contractor must assume total liability for all contract employees.

4. The Contractor shall perform to the standards of the contract.

Service Contract Act:

The Service Contract Act applies to this contract. Current Service Contract Act Wage Determinations for the service areas will be attached to the contract. Employees performing under this contract must be paid at least the pay and fringe benefits described therein.

Contract Administration:

The Contracting Officer is the only person authorized to approve changes or modify any of the requirements under this contract. The Contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer is authorized to make commitments or issue changes that will affect price, quantity or quality of performance of this contract. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. All changes to the contract will be issued via an amendment and/or modification in writing from the Contracting Officer to the Contractor.

Invoices:

Invoices are to be submitted electronically; monthly, in arrears of the start of the services performed each month. Electronic invoices can be submitted at no additional cost through Tungsten. The COR is responsible for acceptance of services and/or the processing of receiving reports for the services provided to the government. Monthly reports will be sent to the COR showing detail on all listed Line Items.

Information System Officer and Information Protection:

The contractor will not have access to VA Desktop computers they will not have access to online resources belonging to the government.

Privacy Officer:

The Contractor will have access to protected Patient Health Information (PHI) and will have capability of accessing patient information during the services provided to the VA and if removal of equipment from the VA is required, any memory storage device will remain in VA control and will not be removed from VA custody. All research data available for Contractor analysis is de-identified.

Records Manager:

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. STVHCS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of STVHCS or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to STVHCS. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to STVHCS control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and STVHCS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with STVHCS policy.

8. The Contractor shall not create or maintain any records containing any non-public STVHCS information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The STVHCS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which STVHCS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VHA-provided records management training, Talent Management System (TMS) Item #10176, Privacy and Information Security, Rules of Behavior. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

1. STX-HCR671-04 General Information Security Requirements /Records

1.1. All information and records provided to Contractor by VA, in whatever medium, as well as all information and documents, including drafts, emails, back-up copies, hand-written notes and copies that contain such information and records gathered or created by Contractor (collectively referred to as “VA information”) in the performance of this contract, regardless of storage media, are the exclusive property of VA. Contractor does not retain any property interest in these materials, and will not use them for any purpose other than performance of this contract.

1.2. Upon completion or termination of the contract, Contractor will either provide all copies of all VA information to VA or certify that it has destroyed all copies of all VA information as required by VA in a method specified by VA, at VA’s option. Medical records of any kind including notes shall be returned to the VA. The Contractor will not retain any copies of VA information. Where immediate return or destruction of the information is not practicable, Contractor will return or destroy the information within 30 days of completion or termination of the contract. All provisions of this contract concerning the security and protection of VA information that is the subject of this contract will continue to apply to VA information for as long as the Contractor retains it, regardless of whether the contract has been completed or terminated.

1.3. Prior to termination or completion of this contract, Contractor will not destroy VA information received from VA or gathered or created by Contractor in the course of performing this contract without prior written approval by VA.

1.4. Contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in accordance with the terms of this contract and applicable federal and VA information confidentiality and security laws, regulations and policies.

1.5. The Contractor shall not make copies of VA information except as necessary to perform this agreement or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

1.6. Contractor shall provide access to VA information only to employees, subcontractors, and affiliates only: (1) to the extent necessary to perform the services specified in this Contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of this contract, and (3) only to individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same VA information. These restrictions include the same level of background investigations, where applicable.

1.7. Contractor will store, transport or transmit VA information only in an encrypted form, using an encryption application that meets the requirements of FIPS 140-2, and is approved for use by VA.

1.8. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two other situations: (i) in response to an order of a court of competent jurisdiction, or (ii) with VA’s prior written authorization. The contractor will refer all requests for, demands for production of, or inquiries about, VA information to VA for response.

1.9. If VA information subject to the contract includes information protected by 38 USC 7332, or 5705, include the following after the last sentence of the paragraph immediately above: Contractor shall not release information protected by either 38 USC 5705 or 7332 in response to a court order, and shall immediately refer such court orders to VA for response.

1.10. Prior to any disclosure pursuant to a court order, the Contractor shall promptly notify VA of the court order upon its receipt by the Contractor, provide VA with a copy by fax or email, whichever is faster, and notify by telephone the VA individual designated in advance to receive such notices. If the Contractor cannot notify VA before being compelled to produce the information under court order, the Contractor will notify VA of the disclosure as soon as practical and provide a copy of the court order, including a copy of the court order, a description of the records provided pursuant to the court order, and to whom the Contractor provided the records under the court order. The notice will include the following information to the extent that the Contractor knows it, if it does not show on the face of the court order: the records disclosed pursuant to the order, to whom, where, when, and for what purpose, and any other information that the Contractor reasonably believes is relevant to the disclosure. If VA determines that it is appropriate to seek retrieval of information released pursuant to a court order before Contractor notified VA of the court order, Contractor will assist VA in attempting to retrieve the VA information involved.

1.11. The Contractor will inform VA by the most expeditious method available to Contractor of any incident of suspected or actual access to, or disclosure, disposition, alteration or destruction of, VA information not authorized under this Contract (“incident”) within one hour of learning of the incident. An incident includes the transmission, storage or access of VA information by Contractor or subcontractor employees in violation of applicable VA confidentiality and security requirements. To the extent known by the Contractor, the Contractor’s notice to VA will identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information was placed at risk or compromised), and any other information that the contractor considers relevant.

1.12. Contractor will simultaneously report the incident to the appropriate law enforcement entity of jurisdiction. The Contractor, its employees, and its subcontractors and their employees will cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor also will cooperate with VA in any civil litigation to recover VA information, to obtain monetary or other compensation from a third party for damages arising from any incident, or to obtain injunctive relief against any third party arising from, or related to, the incident.

1.13. VA will provide the Contractor with the name, title, telephone number, fax number and email address of the VA official to whom the Contractor will provide all notices required by this Contract.

1.14. VA has the right during normal business hours to inspect the Contractor’s facility, information technology systems and storage and transmission equipment, and software utilized to perform the contract to ensure that the Contractor is providing for the security of VA data and computer systems in accordance with the terms of this Contract.

1.15. Contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with all applicable Federal Information Processing Standards (FIPS) and Special Publications (SPs) issued by the National Institute of Standards and Technology (NIST) concerning VA information that is the subject of this contract. If NIST issues or updates an applicable FIPS or SP after execution of this contract, the parties agree to negotiate in good faith to implement the FIPS or SP in this contract.

1.16. A determination by VA that the Contractor has violated any of the information confidentiality and security provisions of this contract, including a violation of any applicable FIPS or SP, shall be a basis for VA to terminate the contract for cause.

1.17. If anyone performing this contract, including employees of subcontractors, accesses VA computer systems or data in the performance of the contract, VA may monitor and record all such access activity. If VA monitoring reveals any information of suspected or potential criminal law violations, VA will refer the matter to the appropriate law enforcement authorities for investigation.

1.18. Contractor shall inform its employees and other individuals performing any part of this contract that VA may monitor their actions in accessing or attempting to access VA computer systems and the possible consequences to them for improper access, whether successful or not. The Contractor shall ensure that any subcontractors or others acting on behalf of, or for, the Contractor in performing any part of this contract inform their employees, associates or others acting on their behalf that VA may monitor their access activities. Execution of this contract and any subcontract or agreement constitutes consent to VA monitoring.

1.19. The Contractor will ensure that all individuals who will access VA data or systems in performing the contract are appropriately trained in the applicable VA confidentiality and security requirements. Contractor may do this by requiring and documenting that these individuals have completed the VA training for its employees.

1.20. To the extent practicable, Contractor shall mitigate any harmful effect on individuals whose VA information was accessed or disclosed in an incident.

1.21. Contractor shall require subcontractors, agents, affiliates or others to whom Contractor provides access to VA information for the performance of this contract to agree to the same VA information confidentiality and security restrictions and conditions that apply to the Contractor before providing access.

1.22. The contractor shall abide by FAR clauses 52.224-1 and 52.224.2.

1.23. The contractor shall abide by FAR clauses 52.239-1 and 52.224.1-2 for Privacy or Security Safeguards

1.24. In the performance of any part of the work on this contract, the contractor shall utilize only employees, subcontractors or agents who are physically located within a jurisdiction subject to the laws of the United States. Contractor will ensure that it does not use or disclose Patient Health Information (PHI) received from Covered Entity in any way that will remove the PHI from such jurisdiction. Contractor will ensure that its employees, subcontractors and agents do not use or disclose PHI received from Covered Entity in any way that will remove the PHI from such jurisdiction.

2. STX671-01 Low Risk-Contractor Personnel Security Requirements (May 2010)

2.1. All contractor employees who require access to the Department of Veterans Affairs’ computer systems or routine access to VA Facilities shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access.

2.1.1. Position Risk and Sensitivity Designations – Shall be determined by Contracting Officer’s Representative (COR) in accordance with VHA Directive 0710 Appendix A. The position sensitivity for this contract has been designated as LOW RISK

2.1.1.1. Position Risk and Sensitivity Designations are directly tied to background investigative requirements.

2.1.1.2. A position designated as Low Risk requires a National Agency Check with Inquires (NACI).

2.1.1.3. A position designated as Moderate Risk requires a Minimum Background Investigation (MBI).

2.1.1.4. A position designated as High Risk requires a Background Investigation (BI).

2.2. Contractor Responsibilities:

2.2.1. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the contractor shall reimburse VA within 30 days from receipt of a bill of collection.

2.2.2. Cost and Time Frames: Low Risk (NACI)-- The case is only open for 30 days except in rare occasions when something in the person’s background requires and extension. This investigation is done by mail and that is why we have to be so stringent with the paperwork. The average turn around on these cases is 45 days.

2.2.3. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak and understand the English language.

2.2.4. After award and prior to contract performance, contractor shall submit to the Contracting Officer’s Representative all required information to initiate background check by completing the latest version of Local Background Check Request Form for each employee providing services under this contract. This form shall be provided by the COR.

2.2.5. Contractor shall notify the COR prior to changing/adding new contract personnel by submitting a new Local Background Check Request Form.

2.2.6. The Contractor, when notified of an unfavorable determination by the Government shall withdraw the employee from consideration of working under this contract.

2.2.7. The contractor shall submit the following required forms to the VA Office of Security and Law Enforcement as outlined within automatic email notification identifying the web site link following the detailed instructions regarding completion of the application process. This includes:

2.2.7.1. Standard Form 85, Questionnaire for Non-Sensitive Positions

2.2.7.2. If needed, Continuation Sheet for Questionnaires Standard Form 86A

2.2.7.3. FD 258, U.S. Department of Justice Fingerprint Applicant Chart; OR schedule to have electronic fingerprints as coordinated by COR

2.2.7.4. VA Form 0710, Authority for Release of Information Form

2.2.7.5. copies Optional Form 306, Declaration for Federal Employment (one copy submitted to office conducting electronic fingerprinting)

2.2.8. The Contractor shall ensure that all personnel requiring computer access will complete the VA’s Cyber Security Training and Privacy training prior to obtaining computer access and annually thereafter.

2.2.9. Failure to comply with the contractor personnel security requirements may result in termination of the contract.

2.3. Government Responsibilities:

2.3.1. The VA Office of Security and Law Enforcement will provide the necessary forms to the contractor or to the contractor’s employees after receiving a background investigation request. The COR shall submit Local Background Check Request Form to Contracting to initiate request in the Contractor Request Database (CRD).

2.3.2. Upon receipt, the VA Office of Security and Law Enforcement will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation. The forms will be returned to the Contractor if incomplete or inaccurate.

2.3.3. The VA Office of Security and Law Enforcement will notify the Contracting Office and contractor after adjudicating the results of the background investigations received from OPM.

2.3.4. The Contracting Office will file and secure evidence that investigations have been completed or are in the process of being requested appropriately.

2.3.5. The COR shall ensure that all personnel requiring computer access have completed the VA’s Cyber Security Training and VA’s General Privacy Training and signed Rules of Behavior, prior to obtaining computer access and annually thereafter; hard copies provided to contract officer by contract number

3. STX671-02 Personal Security Verification (PIV) Card And/Or Security Badge Requirements For Contractor Employees (FEB 2010)

3.1. Definitions. As used in this clause –

3.1.1. Access means routine, unescorted physical entry into, and to the extent authorized, mobility within a Government facility. Also, it means the ability to obtain, view, read, modify, delete, and/or otherwise make use of information technology.

3.1.2. Contractor employee means an employee of the prime contractor or of any subcontractor, affiliate, partner, joint venture, or team members with which the contractor is associated. It also includes consultants engaged by any of those entities.

3.1.3. Facility and Government facility mean buildings, including areas within buildings, owned, leased, shared, occupied, or otherwise controlled by the federal government.

3.1.4. Information technology means any equipment or interconnected system or subsystem of equipment, including telecommunications equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major systems/applications and general support systems as defined by OMB Circular A-130, owned by VA or owned and operated on VA’s behalf by another party.

3.2. Access to VA Facilities or Systems.

3.2.1. General. The performance of this contract requires contractor employees to have routine, unescorted access to VA facilities. All such employees who do not already possess a current Security Badge or PIV Card acceptable to VA shall be required to provide personal information, undergo an FBI National Criminal History Fingerprint Check, and obtain a Security Badge or PIV Card prior to being permitted access to any such facility in performance of this contract. No contractor employee will be permitted routine, unescorted access to a VA facility without a proper Security Badge or PIV Card.

3.2.2. Citizenship-related requirements. If required by the contract, each affected contractor employee as described in paragraph 14.1.2 shall be:

3.2.2.1. A United States (U.S.) citizen; or

3.2.2.2. A national of the United States (see 8 U.S.C. 1408); or

3.2.2.3. An alien lawfully admitted into the United States for permanent residence as evidenced by an Alien Registration Receipt Card Form I–151.

3.3. Background information.

3.3.1. For each contractor employee that has access to VA facilities or systems, the contractor shall coordinate with assigned Contracting Officer’s Representative (COR) to schedule electronic finger printing and initiate a Special Agreement Check (SAC). The COR will provide instructions to the contractor regarding the local procedures for fingerprinting and obtaining Security Badges or PIV Cards.

3.3.2. After completion of the fingerprint check, the Contracting Officer will notify the contractor in writing if any contractor employee is determined to be unsuitable to be given access to a government facility or VA system. If so notified, the contractor shall not allow such employees to perform work on this contract.

3.4. Security Badge or PIV Cards.

3.4.1. VA will issue a Security Badge or PIV Card to each contractor employee who is to be given routine, unescorted access to VA facilities or access to VA systems and does not already possess a Security Badge or PIV Card. Contractor employees that require logical access and email address in VA systems, access to sensitive records, sensitive physical access or common physical access of greater than 6 months, or considered as a fulltime equivalent will require PIV Card, requiring background investigation (NACI) and SAC.

3.4.2. VA will issue Non-PIV Security Badges to contractor employees that require logical access with no email address in VA systems, access to sensitive records, sensitive physical access or common physical access of less than 6 months, or not considered as a fulltime equivalent will require non-PIV Card, requiring SAC. This card is issued with expiration date of 6 months or less.

3.4.3. Security Badge or PIV Cards shall identify individuals as contractor employees. Contractor employees shall display their Security Badge or PIV Cards on their persons at all times while working in a VA facility and shall present their cards for inspection upon request by VA officials or VA security personnel.

3.4.4. The contractor shall be responsible for all Security Badge or PIV Cards issued to the contractor’s employees and shall immediately notify the COR if any Security Badge or PIV Card(s) cannot be accounted for. The contractor shall notify the COR immediately whenever any contractor employee no longer has a need for his/her VA-issued Security Badge or PIV Card (e.g., employee terminates employment with the contractor, employee’s duties no longer require access to VA facilities). In such cases, the COR will instruct the contractor on how to return the Security Badge or PIV Card. Upon expiration of this contract, the COR will instruct the contractor on how to return all VA-issued Security Badge or PIV Cards not previously returned. The contractor shall not return Security Badge or PIV Cards to any person other than the COR.

3.5. Control of access. VA shall have and exercise full and complete control over granting, denying, withholding, and terminating access of contractor employees to VA facilities and systems. The Contracting Officer will notify the contractor immediately when VA has determined that an employee is unsuitable or unfit to be permitted access to a VA facility or system. The contractor shall immediately notify such an employee that he/she no longer has access to any VA facility or system, shall retrieve the employee’s Security Badge or PIV Card from the employee, and shall provide a suitable replacement employee in accordance with the requirements of this clause. The VA will not give the contractor the reason for requiring the removal of the unsuitable contractor employee but can provide the applicant the phone number to call the FBI to receive a copy of the SAC report used for this determination. The Government shall not be responsible for any costs incurred by the contractor as a result of removing such employee from the subject contract.

3.6. Termination. Failure on the part of the Contractor to comply with the terms of this clause may result in termination of this contract for default.

4. STX-HRC671-02 Health Insurance Portability and Accountability Act (HIPAA) Compliance (Feb 2010)

4.1. HIPAA COMPLIANCE: HIPAA compliance is required. Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). As required by HIPAA, the Department of Health and Human Services (HHS) has promulgated rules governing the security and use and disclosure of protected health information by covered entities, including the Department of Veterans Affairs (VA).

5. Tuberculin Skin Test:

5.1. A tuberculin skin test shall be required for all employees before reporting to STVHCS and then annually. Annual tests shall be required for all negative results, completed during the anniversary month of initial test. Positive results should not be tested annually. All results forwarded to the Contracting Officer Technical Representative (COR). This test verifies the presence of tuberculosis (TB) (Mycobacterium tuberculosis). The Mantoux skin test uses TB antigens called purified protein derivative (PPD). The test cannot tell if the infection is active or inactive (latent).

6. STX-HCR671-01 Annual Office of Inspector General (OIG) Statement (Feb 2010)

6.1. “Providers and contracting entities have an affirmative duty to check the program exclusion status of individuals and entities prior to entering into employment or contractual relationships, or run the risk of civil monetary penalties (CMP) liability if they fail to do so.”

6.2. The Contractor shall provide a signed annual report to the COR stating each individual or entity under this contract has been checked against the OIG List of Excluded Individuals/Entities http://www.oig.hhs.gov/fraud/exclusions.html and found no individual or entity had been excluded from participation in Medicare, Medicaid and other Federal healthcare programs. The report will be due each year on the renewal date of the contract.

6.3. Office of Inspector General of the Department of Health and Human Services (IG/HHS) has made a determination that prior to obligating VA contracts, purchase orders, task and delivery orders, and purchase cards orders paid with VA healthcare funds may not be entered with any individual, or with any entity or organization that has been listed on the HHS/OIG Exclusionary List. VA does not have the burden of defending the merits of the HHS/OIG decision established under §42 U.S.C. 1320a-7.

7. STX-HCR671-03 National Provider Identifier (NPI) Information Required (Feb 2010)

7.1. All Contractors and healthcare practitioners who provide billable healthcare services to the Department of Veterans Affairs, VHA, shall obtain a National Provider Identifier (NPI) as required by the Health Insurance Portability and Accountability Act (HIPPA) National Provider Identifier Final Rule, administered by the Centers for Medicare and Medicaid Services (CMS). This rule establishes assignment of a 10-digit numeric identifier for healthcare practitioners, intended to replace the many identifiers currently assigned by various health plans. Each practitioner needs only one NPI, valid for all employers and health plans. The NPI may be obtained via a secure website at: https://nppes.cms.hhs.gov/NPPES

7.2. Contractors must also designate their Specialties/Subspecialties by means of Taxonomy Codes on the NPI application.

8. Required Registration with Contractor Performance Assessment Reporting System (CPARS)

8.1. As prescribed in Federal Acquisition Regulation (FAR) Part 42.15, the Department of Veterans Affairs (VA) evaluates contractor past performance on all contracts that exceed $100,000, and shares those evaluations with other Federal Government contract specialists and procurement officials. The FAR requires that the contractor be provided an opportunity to comment on past performance evaluations prior to each report closing. To fulfill this requirement VA uses an online database, the Contractor Performance Assessment Reporting System (CPARS), which is maintained by the National Institutes of Health (NIH). The CPARS database information is shared with the Past Performance Information Retrieval System (PPIRS) database, which is available to all Federal agencies.

8.2. Each contractor whose contract award is estimated to exceed $100,000 is required to register with the NIH CPARS database at the following web address: https://cpscontractor.nih.gov. Help in registering can be obtained by contacting CPARS Support E-mail (CPARS-support-l@list.nih.gov) or by calling (301) 451-2771. Registration should occur no later than thirty days after contract award, and must be kept current should there be any change to the contractor’s registered representative.

8.3. For contracts with a period of one year or less, the contracting officer will perform a single evaluation when the contract is complete. For contracts exceeding one year, the contracting officer will evaluate the contractor’s performance annually. Interim reports will be filed each year until the last year of the contract, when the final report will be completed. The report shall be assigned in CPARS to the contractor’s designated representative for comment. The contractor representative will have thirty days to submit any comments and re-assign the report to the VA contracting officer.

8.4. Failure to have a current registration with the NIH CPARS database, or to re-assign the report to the VA contracting officer within those thirty days, will result in the Government’s evaluation being placed on file in the database with a statement that the contractor failed to respond.

9. VA Handbook 6500.6 Appendix C Paragraph 2 - ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

9.1. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

9.2. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

9.3. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

9.4. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

9.5. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

10. VA Handbook 6500.6 Appendix C Paragraph 6 -…