36C25720Q0517-005.pdf

REVISED STATEMENT OF WORK

OVERVIEW: The Department of Veterans Affairs, VA North Texas Health Care System (VANTHCS) VA Primary Care Clinics located in Tyler, Texas, intends to award a contract for the provision of courier services. The Contractor shall provide regularly scheduled pick-ups of laboratory specimens, laboratory supplies, supplies, inter-office mail, and small equipment from various locations noted below and deliver to the P&LMS and other locations within the VA North Texas Dallas facility. The contractor shall sign a Business Associate Agreement with the Department of Veterans Affairs Veterans Health Administration.

PERIOD OF PERFORMANCE:

Base Period: June 1, 2020 – May 31, 2021

Option Period One: June 1, 2021 – May 31, 2022

Option Period Two: June 1, 2022 – May 31, 2023

Option Period Three: June 1, 2023 – May 31, 2024

Option Period Four: June 1, 2024 – May 31, 2025

PLACE(S) OF PERFORMANCE:

VA North Texas Health Care System VA Tyler Primary Care Clinic 7916 S Broadway Tyler, TX 75703

VA North Texas Health Care System Dallas VA Medical Center 4500 S. Lancaster Rd.

Dallas, Texas 75216

DESCRIPTION OF RESPONSIBILITIES: The contractor shall furnish all labor, tools, materials, equipment, and supervision necessary to provide same day courier services for the VA North Texas Health Care System Community Based Outpatient Clinics (CBOC’s):

VA Tyler Primary Care Clinic Site 2, 7916 S Broadway Tyler, TX 75703 and deliver to the Pathology & Laboratory Medicine Service (P&LMS) laboratories and other locations at:

• Dallas VA Medical Center, 4500 S. Lancaster Rd., Dallas, Texas 75216

• Mail Room - Bldg. 2, VA Dallas

• Warehouse Dallas Bldg. 44, Dallas VA

• Administrative Officer of the Day (AOD) Clinical Addition (2J), Dallas VA

• Other sites may be added or deleted as need arise.

1 Trip is defined as pickup and delivery from Tyler to Dallas and delivery back to the Tyler OPC

Items to be transported will consist primarily of small prepackaged containers/coolers containing lab specimens from each of the clinics. Shipments may also include:

• Envelopes

• Small boxes containing mail

• Medical records

• X-ray films

• Supplies

• Equipment under 50lbs

• All shipments will be clearly labeled. The VAMC and the Tyler OPC’s will be responsible for proper packaging and labeling.

• The contractor assumes all liability risks for work performed under this contract. The contractor must assume total liability for all contract employees. All couriers transporting specimens under this contract shall possess a valid driver’s license, vehicle insurance, and registration, and have two-way radios, cell phones, or pagers for communication purposes.

The contractor shall provide proof that all drivers have had training in the transportation of hazardous materials.

• The contractor shall provide all vehicles and couriers needed to perform this effort. Each vehicle shall be adequately stocked with at least one up-to-date complete “Spill Kit” for biohazard cleanup in case of leakage or accidental discharge.

• The cargo may contain bio-hazard material and dangerous goods. The contractor shall certify that all individuals involved in shipping clinical specimens have been trained and tested as specified in the training requirements of 49 CFR Part 172, Subpart H.

• The contractor shall maintain proper temperature in vehicles to preserve medical supplies, specimens, and films. The contractor shall provide insulated transport containers for the pickup/delivery of specimens. The transport containers are approx. 15”x12”x10”H, weight variable due to ice packs. Currently one cooler is sufficient, however as volume increases, a 2nd container maybe needed. The contractor shall also furnish various types of puncture proof containers (coolers), which shall be labeled biohazard for test specimens. Vehicles shall not be left in extreme heat or cold while specimens and films are being transported.

Occasionally, the contractor shall be required to furnish dry ice for transportation prior to arrival at the pickup site. Dry ice is most often used to transport certain specimens and is not expected on a routine basis.

PICKUP/DELIVERY SCHEDULE:

• Pickup shall be made daily from each Tyler site (Monday-Friday) except on Federal Holidays (as observed) between 2-3pm. Pickup times and days shall be established for each by the COR in accordance with clinic personnel.

• The contractor shall give prior notification to each clinic at the phone numbers indicated below if the scheduled pick-up time cannot be met for any reason:

1. Dallas VAMC – P&LMS Client Services: (214) 857-0666 or (214) 857-0714

2. VA Tyler Primary Care Clinic– (903) 266-5900 Tyler Exec Leadership (214)734-2993

Deliveries shall be made to the following P&LMS and other locations within VA North Texas Health Care System no more the 3.5 hrs. after pickup from the last Tyler site:

• Dallas VAMC: Deliver all lab specimen containers/coolers to the Client Services Unit located in the main lab on the first floor of the Clinical Addition.

• Locations Identified in 1.a IV, V, VI, VII, and VIII (if needed).

• The contractor shall pick up all empty containers/coolers and other items from the delivery site and return them to the Tyler OPC prior to 11:30pm.

QUALIFICATIONS - All couriers transporting under this contract must:

a. Be licensed, bonded and insured.

b. Have the ability to maintain (at the contractors' expense) communications with the courier dispatching facility while in transit.

c. Shall present a neat appearance in the performance of their duties and be easily recognized as a contract employee/courier (with identification prominently displayed or readily available).

d. Contractor shall ensure the confidentiality of all patient information and records being transported and will be held liable in the event of a breach of confidentiality. The Contractor shall comply with the provisions of the Federal Privacy Act of 1974 (Public Law 93-579).

e. The cargo may contain bio-hazardous material and dangerous goods. The

Contractor shall certify that all individuals involved in shipping clinical specimens have been trained and tested as specified in the training requirements of 49 CFR Part 172, Subpart H.

f. The Contractor shall maintain proper temperature in vehicles to preserve specimens and blood products as specified herein. The Contractor shall provide insulated, puncture proof, transport containers for the pickup/delivery of specimens, which shall be labeled biohazard for test specimens. Vehicles shall not be left in extreme heat or cold while specimens are being transported.

Successfully complete the required government background investigation at contractor expense.

EQUIPMENT: The contractor shall provide the means (i.e., personnel; vehicles; equipment) to travel and transport documents/material between all locations outlined within the Statement of Work.

HOLIDAYS: The following is a list of U.S. Government holidays. If the holiday falls on a

Saturday, the proceeding Friday is observed as the holiday; if the holiday falls on a Sunday, the following Monday is observed as the holiday and any other day specifically declared by the President of the United States to be a national holiday.

HOLIDAY DATE

New Year’s Day Jan 1

Martin Luther King’s Birthday 3rd Monday in Jan

President’s Day 3rd Monday in Feb

Memorial Day Last Monday in May

Independence Day July 4

Labor Day 1st Monday in Sep

Columbus Day 2nd Monday in Oct

Veterans Day Nov 11

Thanksgiving Day 4th Thursday in November

Christmas Day December 25

Any other day specifically declared by the President of the United States to be a National Holiday

PATIENT PRIVACY/RELEASE OF MEDICAL INFORMATION: The Contractor is responsible, in the management of private health information of patients, to maintain the highest level of patient privacy and confidentiality and shall release medical information obtained during the course of this contract only to hospital staff involved in the care and treatment of that individual patient.

CONTINUITY OF SERVICES/REPLACEMENT STAFF:

• The Contractor point of contact shall ensure that qualified personnel are available to provide coverage during scheduled and unscheduled absences of primary contract providers or when they will be unable to provide services for one (1) or more consecutive days.

• To prevent unexpected and unanticipated call-ins by Contract couriers that are scheduled to work, the Contractor will counsel Contract Staff, verbally and in writing, if staff members frequently call-in (>2 in a month) or if a pattern occurs (call-in on days attached to a non-work day/holiday, or calling in on weekends exceeding 2 occurrences per year). If the problem persists following counseling, the assignment of the contract employee may be requested to end. The Contractor should be able to provide rationale for contract staff member(s) absence if requested.

HIPAA COMPLIANCE/ SECURITY REQUIREMENTS:

• Contractor must adhere to the provisions of Public Law 104-191, Health Insurance Portability and Accountability Act (HIPPA) of 1998 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI).

• The C&A requirements do not apply. A Security Accreditation Package is not required.

PHYSICAL SECURITY: The Contractor shall safeguard all government property, including controlled forms provided for contractor use. At the close of each work period, government equipment, facilities, and other valuable materials shall be secured.

TRAINING:

All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

b. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

c. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

d. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

e. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800- 16, Information Technology Security Training Requirements.]

f. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

g. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

CONDUCT OF PERSONNEL: Contractor personnel shall conduct themselves in a professional manner (i.e. timeliness, communication; spoken and written etc.). The

Contracting Officer may require the Contractor to remove from the job site any employee working under this contract for reasons of suspected misconduct, a suspected security breach, or suspected to be under the influence of alcohol, drugs, or any other incapacitating agent. Contractor employees shall be subject to dismissal from the premises upon determination by the Contracting Officer that such action is necessary in the interests of the Government. The hospital director or designated representative has the authority to bar individuals from the Government facility. The removal from the job site or dismissal from the premises shall not relieve the

Contractor of the requirement to provide sufficient personnel to perform the services as required by this performance work statement. The Government shall not reimburse the Contractor for travel and other expenses associated with the removal of personnel. Contractor personnel are not authorized to carry or possess personal weapons to include, but not limited to, firearms and knives with a blade length in excess of three inches, while assigned under this contract.

CONTRACTORS ATTIRE AND APPEARANCE: Contractor personnel shall present a professional appearance commensurate with standards delineated for Government civilian personnel acting in similar capacities. The Government reserves the right to review Contractor personnel qualifications. Upon request, resumes shall be provided to the Contracting Officer prior to clearance approval, for review and acceptance by the COR. The intent is verification purpose and not for the Government to become the hiring authority.

SECURITY: The material being delivered must be protected from loss and damage due to inclement weather, accidents or other unforeseen circumstances. Failure to deliver timely, and loss or damages to transported materials shall be reported to the Contracting Officer Representative (COR) point of contact as soon as possible.

SECURITY INCIDENT INVESTIGATION:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor

e. must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

TRAINING: All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

• Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

• Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

• Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

• Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

• The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

• Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

CONFIDENTIALITY OF RECORDS:

• Contractor shall ensure the confidentiality of all patient information and records being transported and will be held liable in the event of a breach of confidentiality. The Contractor shall comply with the provisions of the Federal Privacy Act of 1974 (Public Law 93-579) and Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996. This includes both the Privacy and Security Rules published by the Department of Health and Human Services (HHS).

• Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards and VA Directives and Handbooks as VA and VA personnel regarding information. Submitting required privacy training documentation is required to the COR annually.

REPORTABLE INCIDENTS: Contractor shall furnish a written report should any delivery incidents occur. This report shall be delivered to the CO within 24 hours of the incident.

Incidents/actions involving laboratory specimens must be reported immediately to the COR.

Incidents/actions involving breach of patient records or patient identifiable information must be reported immediately to either the VA Information Security Officer or the VA Privacy Officer.

REPORTING PROCEDURES: The contractor shall have the capability to provide status information on all courier deliveries by tracking number. This information may be provided telephonically or electronically to the North Texas Health Care System staff. The following information shall be available for each delivery: tracking number, time of pickup and delivery, location of pickup and delivery, and signature of acceptance, if required.

QUALITY CONTROL AND ASSURANCE:

f. The contractor or designee shall notify the COR or Points of Contact within 2 hours by phone if conditions exist which may affect their ability to perform contract requirements.

The contractor shall provide a contingency plan for problems which may be experienced in the transport time frame (i.e. break down or accident, inclement weather) which allows for same day pick-up and delivery to and from the designated sites.

g. The Government will periodically evaluate the contractor’s performance in accordance with the following Quality Assurance Plan.

h. Surveillance: Any complaints received from VA personnel will be received by the COR and will be forwarded immediately to the Contracting Officer who will notify the company for corrective action.

i. Standard: The standard overall is two or less customer complaints per month in each area. The COR shall notify the contracting officer for appropriate action in accordance with FAR 52.212.4, Contract Terms and Conditions-Commercial Items or the appropriate Inspection of Services clause, if any of the above service areas exceed two customer complaints per month.

INVOICES: The contractor shall electronically invoice the VA on a monthly basis in arrears for delivery services and shall itemize each trip/item by a reference or tracking number, date, time of delivery, and cost as required.

DAILY REQUIREMENTS: The contractor shall provide all supervision, labor, employee training, locking containers vehicles, gasoline, insurance and material to provide courier services to pick-up and deliver sensitive and HIPAA confidential information, material, and medical documentation.

RECORDS MANAGEMENT STATEMENT

All records (administrative and program specific) created during the period of the contract belong to VA North Texas Health Care System (VANTXHCS) and must be returned to

VANTXHCS at the end of the contract or destroyed in accordance to the VHA Record Control

Schedule (RCS)10-1.

A. Citations to pertinent laws, codes and regulations such as 44 U.S.C Chapter 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR

Part 1222 and Part 1228.

B. Contractor shall treat all deliverables under the contract as the property of the U.S.

Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

C. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government ‘IT’ equipment and/or Government records.

D. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

E. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract or identified in the

RCS 10-1.

F. The Government Agency owns the rights to all data/records produced as part of this contract.

G. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

H. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the

Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

I. No disposition of documents will be allowed without the prior written consent of the

Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

J. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any sub-contractor) is required to abide by

Government and Agency guidance for protecting sensitive and proprietary information.