36C25721Q0924.docx

Contract Opportunity Combined Synopsis/Solicitation Notice

PRODUCT SERVICE CODE

SUBJECT

CONTRACTING OFFICE'S

ZIP-CODE

SOLICITATION NUMBER

RESPONSE DATE/TIME/ZONE

ARCHIVE

DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS

SET-ASIDE

NAICS CODE

CONTRACTING OFFICE

ADDRESS

POINT OF CONTACT

(POC Information Automatically Filled from User Profile Unless Entered)

DESCRIPTION

See Attachment

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

GENERAL INFORMATION

PLACE OF PERFORMANCE

* = Required Field Contract Opportunity Combined Synopsis/Solicitation Notice

ELP VA DRAGER WORKSTATION

75216 36C25721Q0924 06-14-2021 08:00 am

CENTRAL TIME, CHICAGO, USA

N

SDVOSBC

339113 Department of Veterans Affairs NCO 17 North Texas Healthcare System NCO 17 Network Contracting Activity 4500 S. Lancaster Road Dallas TX 75216 Contract Specialist Jim Houston James.Houston@va.gov 972-708-0816

NA

NA

Department of Veterans Affairs El Paso VA Healthcare System 5001 N. Piedras El Paso

TX

79930

USA

https://va.gov Combined Synopsis James.Houston@va.gov Contract Specialist This is a Combined Synopsis/Solicitation for commercial items prepared in accordance with the format in FAR 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only Solicitation; quotes are being requested and a written solicitation will not be issued. Solicitation number 36C25720Q0924 is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular. SET-ASIDE: This requirement is a Service Disable Veteran Owned Small Business and Veteran Owned Small Business Set-Aside, the NAICS is 339113 and the small business size standard is 750 employees. In order to be eligible an offeror must be Small Business for the applicable NAICS code at the time of the quote submission and at the time of award. Only qualified offerors may submit bids.

Introduction: A Firm Fixed Price award will be made to the lowest priced quote which conforms to the requirements within this solicitation and represents the best price to the Government.

Instructions to Offerors– Evaluation FACTORS For Award

Evaluation Factors for Award

I. Basis of Award The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation meets or exceeds the requirement at the lowest price.

The quotes will be evaluated on the basis of the evaluation factors listed below. The technical area will be evaluated on an "acceptable" or "unacceptable" basis. Only those contractors determined to be technically acceptable will be evaluated on price.

Required Delivery

Evaluation of quotes will be conducted using Simplified Acquisition Procedures in accordance with FAR 13.106-2 Evaluation of Quotes.

Please read each section below carefully for the submittals and information required as part of the evaluation. Failure to provide the requested information below shall be considered non-compliant and your quote could be removed from the evaluation process.

Offeror quotes shall be evaluated under FAR 13.106-2(b)(3) Comparative Evaluation. Comparative evaluation is the side by side pairwise comparison of quotes based on factors resulting in a Contracting Officer decision for the quote most favorable to the Government. The Government reserves the right to consider a quotation other than the lowest price that provides additional benefit(s). Quotations may exceed minimum requirements of the solicitation. The Government reserves the right to select a quotation that provides benefit to the Government that exceeds the minimum requirements of the solicitation but is not required to do so. Each response must meet the minimum requirements of the solicitation.

The Government is not obligated to determine a competitive range, conduct discussions with all contractors, solicit final revised quotes, and use other techniques associated with FAR Part 15. The contracting techniques associated with FAR Part 15 are not mandatory.

The Government will issue a contract to the responsible offeror whose quotation conforming to the solicitation will be most advantageous to the Government, price and other factors considered.

The Government shall award a contract resulting from this solicitation. The following factors shall be used to evaluate offers:

1. Vendor is a certified Service Disabled Veteran Owned Small Business (SDVOSB)/ Veteran Owned Small Business (VOSB).

2. Vendor must be registered in SAM with applicable NAICS code by the close of solicitation.

3. Technical Acceptability - The technical acceptability will be evaluated on an "acceptable" or "unacceptable" basis.

If quoting other than brand name, the contractor shall provide a written statement addressing each line item and must provide enough detail to determine minimum qualifications.

4. Price - Contractor shall complete B.4 Price/Cost Schedule.

Vendors responding to this solicitation need to abide by the Nonmanufacturer Rule:

The nonmanufacturer rule applies to socioeconomic categories for contracts valued above the micropurchase threshold. It applies to both socioeconomic categories and small businesses above the simplified acquisition threshold.

Anesthesia Clinical WorkStations Statement of Work (SOW)

1. GENERAL

The El Paso VA Health Care System (EPVAHCS) is procuring 6 (Six) Medical Anesthesia Clinical Workstations, accessories (cabling, keyboards, mice, stands, etc), operating system software and installation/integration services. The products and services will be delivered at the EPVAHCS. This acquisition is required in order to meet essential anesthesia expansion requirements of the EPVAHCS. The equipment will be used by VA personnel (doctors, medical technologists, and nurses and shall be maintained by Biomedical Engineering, Office of Information Technology (OIT) support staff and the Contractor. Equipment connectivity will be inside the VA firewall via LAN and WAN network.

2. DESCRIPTION OF WORK

The scope of the Anesthesia workstations includes delivery of equipment, installation of the equipment, services and warranty defined herein.

The Contractor shall provide all labor, travel, tools, materials, project management, shipping and delivery, hardware, software, installation, integration, documentation, acceptance testing and warranties required for the anesthesia workstations functionality, each medical anesthesia workstation hardware (computer, monitor, mouse, keyboard, cabling).

Delivery of equipment shall be to the El Paso VA health care system. After delivery, the Contractor shall be responsible for unpacking, assembly, delivery to specific areas within the Medical Center Anesthesiology Service, installation, configuration and testing in accordance with the EPVAHCS policy and standard operating procedures. The Contractor must perform all anesthesia database configurations such as adding each workstation, completing entries, changes and licensing each new workstation to the anesthesia database.

The Contractor shall provide EPVAHCS a description and complete set of workstation and monitor specifications for the Contractor’s proposed anesthesia workstation solution.

3. WORK HOURS

The Contractor shall provide support 24 hours per day, 7 days per week. Normal hours of work are defined as Monday through Friday from 7:00 a.m. to 4:30 p.m., excluding Federal holidays or as otherwise arranged with the Contracting Officer’s Representative (COR).

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4. PLACE OF PERFORMANCE

Tasks under this contract shall be performed at The El Paso VA Health Care Service. Remote support may be performed remotely at Contractor facilities. Work may be performed at remote locations other than Contractor facilities with prior approval of the COR. On-site support shall be performed at the VA Medical Center located in the following location:

El Paso Health Care System: 5001 N. Piedras St. El Paso, TX 79930

5. TRAVEL

All Contractor transportation, lodging, and subsistence expenses incurred by the Contractor shall be incorporated into the Contractor’s fees and are the sole responsibility of the Contractor. Travel will be scheduled at the most cost-effective rate and fare, and by the most cost-effective mode of travel in accordance with the General Services Administration.

6. SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

6.1. KICKOFF MEETING

The Contractor shall attend a Project Kickoff Meeting where the project shall be discussed in detail. The meeting will be conducted by conference call and coordinated by the COR within seven (7) days after the contract award.

6.2 DELIVERY, INSTALLATION and INTEGRATION

Equipment shall be delivered to each HCS as listed in the Deliver Equipment Location.

Upon delivery of the equipment, the Contractor shall provide on-site project management, set-up and assembly, installation and integration of new equipment and software.

During the installation, the Contractor shall provide on-site as well as remote support, as needed, and must be available to respond to any questions asked by the Facility POCs. The Contractor shall provide same day resolution of any issues related to the new equipment. The Contractor is responsible for providing EPVAHCS staff with configuration instructions and guidance for all equipment and accessories procured under this contract.

At a minimum, the Contractor shall provide on-site and remote technical support staff on duty from 6 AM Mountain Standard Time to 6 PM Mountain Standard Time, Monday through Friday, excluding federal holidays. The Contractor shall provide a daily Status report via e-mail for any issue that requires action. The report will describe the time the issue was identified, problem summary, steps taken to resolve the problem, time to complete the task and system or component down-time.

6.3 ACCEPTANCE TESTING

The Contractor is responsible for coordinating and performing technical testing. Equipment will be put into clinical use during implementation. Implementation must be 100%, all equipment operational with 100% functionality before being considered as complete and accepted by the Government.

If deficiencies found at the time of Government acceptance are corrected within 30 calendar days after receipt of the deficiency letter from the Contracting Officer, final acceptance will be issued upon validation of deficiency correction by the Government, and the warranty start date shall be back-dated to the date the initial acceptance testing was completed.

Clinical testing will be performed by the Government.

6.4 INTERFACE SUPPORT

The Contractor shall ensure that all anesthesia side interfaces associated with the new workstations, including but not limited to, VistA, VistA Imaging/CPRS, Medical Devices, Reporting Tool, and data transfer links are configured, testing and maintained consistently. The Contractor shall coordinate with other Contractors when necessary to accomplish this task.

7. WARRANTY

Warranty shall start at acceptance. During the 12-month warranty period, the Contractor shall furnish warranty maintenance service support that includes, as a minimum, preventive and corrective maintenance services for the equipment. and all associated hardware, firmware and software, parts, labor, travel and expenses necessary to perform such services at no additional cost to the Government. Parts cost incurred during maintenance calls shall be included in the base warranty/maintenance price and shall not be billed as additional costs. In those emergency situations when a system component(s) is down and the Government places the call for corrective action to the Contractor, the Contractor shall respond within the prescribed response time The Government representative will make formal notification of the problem by phone to the Contractor POC as soon as the problem is identified by the Government.

Warranty Maintenance & Support Help Desk: The Contractor shall provide be provided with remote (connectivity to VA network) access for maintenance and support. The Contractor shall provide contact information to the Contractor’s Support Help Desk. The Government will call and/or email the Contractor to report problems and to coordinate technical support. Maintenance under the warranty periods shall include access to new versions, updates, patches, upgrades and to the equipment components as they are released as well as scheduled maintenance (preventive maintenance inspections, electrical safety testing, calibration, scheduled releases) and unscheduled corrective maintenance. The Contractor Help Desk shall permit EPVAHCS staff to report problems, ask questions, request services, query historical data and request reports. The Help Desk shall provide real time information to include current status, total equipment down time, who initiated the service ticket, the original complaint, response time, the service technician, work performed, replacement parts and completion date and time.

Warranty Maintenance & Support Hours of Coverage: Contractor support staff will work with the User’s schedule to ensure efficient operation. Contractor support staff are stationed at home offices. The Contractor shall provide a Help Desk telephone line with live-support which shall be available 27x7x365. The Contractor shall provide an Online Help Email address which received messages 24x7x365. The Contractor shall provide an Online Help Desk Website Access which shall be available 24x7x365.

Warranty Maintenance and Support Response Time: The Contractor shall respond to maintenance and support requests made by the EPVAHCS by telephone or email within one hour from the time the request was made. Response time shall commence at the time the Government POC places the maintenance and support call to the Contractor maintenance and support POC and shall end at the time the Contractor maintenance and support provider contacts the Government by email or telephone. The Contractor is required to provide a reliable maintenance and support POC for 24-hour service call notification. The Contractor maintenance and support POC shall provide a telephonic response of acknowledgment of receipt of an emergency call within one hour following notification. Failure of the maintenance and support POC to answer valid attempts made by the Government within the response time will result in the start of both downtime and response time.

Warranty Hardware Upgrades: If hardware upgrades become available after award of a delivery order but prior to delivery of the equipment, the Contractor is requested to offer them to the Contracting Officer for consideration. The Contractor's proposal for such upgrades shall include the following information: Pricing information, to include both the price of the equipment to be added and the equipment to be deleted. Specific awarded items that shall be changed if the proposal is awarded. Performance data, including both comparisons to the specification requirements and to the equipment on contract. A detailed description of the differences between the awarded items and those being proposed, and a specific analysis of the comparative advantages/disadvantages of the items involved. An evaluation of the effect proposed changes will have on the life cycle of the equipment and an associated cost impact as it relates to site preparation, installation, maintenance, and operational expense. An analysis of the timeframe required to institute the change.

Warranty Replacement Components and Parts: The Contractor shall make available to the Government all components and spare parts required to maintain the equipment herein. The Contractor shall furnish all parts at no additional cost. All parts supplied shall be the original equipment manufacturer or equivalent and fully compatible with existing equipment. The Contractor shall provide new parts. Replacement components and parts (hardware, firmware, software, and any work station discrete components) shall receive a full 12-month warranty from the time of replacement. The Contractor shall deliver components and parts by next business day from the date/time requested by the Government. The Contractor shall provide a guarantee that the Government will be able to obtain all required spare parts from the Contractor for a period of seven (7) years from the date of final system acceptance. During the equipment life cycle, if the Government elects not to upgrade existing systems to new versions (either hardware, software, and spare components and parts), the Contractor shall guarantee that they will continue to provide support all hardware, software, and spare components and parts for the equipment for a minimum of seven (7) years, after release of the upgrade.

Warranty Maintenance and Support Reports: The Contractor shall maintain historical warranty service records on each component of the system, which will be provided to the Government upon request and made available in electronic format. Warranty Service reports of all services performed shall be verified by the EPVAHCS point of contact, maintained and turned over to the EPVAHCS point of contact and filed with the equipment history file. The Contractor shall also provide service reports to the Contracting Officer and COR upon request. As a minimum, the report shall include: (a) date and time notified, (b) date and time of actions taken, (c) description of malfunction or service to be performed, (d) model number/serial number and location of the equipment, (e) time spent to resolve, (f) parts used/replaced, and (g) parts cost if applicable, (h) description of service performed, (i) name of government POC, (j) name of Contractor maintenance and support staff, (k) tele-maintenance methods used, if any, (l) designation of user error, if appropriate. Documentation such as Service Bulletins, Product Modifications, Removals, Recalls, and End of Support Notifications shall be sent to the CO, COR and HCS POCs.

8. DOCUMENTATION

Documentation and reports will be provided to EPVAHCS by the Contractor in accordance with facility policies and procedures. Documentation includes equipment, components and parts specification data sheets, user and technical manuals, schematics and diagrams, written preventive maintenance and calibration procedures, software license agreements, training documentation, service bulletins, product modification, removal, recall or end of support notifications and maintenance and support reports.

Non-compliance with the documentation requirements specified herein may result in actions as deemed appropriate by the Contracting Officer.

Specification Data Sheets, User and Technical Manuals, Schematics and Diagrams, Preventive Maintenance and Calibration Procedures, Software License Agreements, and Training Documentation (software and hardware).

The Contractor shall certify that manufacturer manuals provided with the equipment and the system’s software accurately reflect the configuration of the delivered equipment and system’s software or the operation and maintenance thereof. The Contractor shall furnish their commercial system administration’s manuals, operator’s manuals, and maintenance manuals for the supplied equipment.

Copies of document corrections and revisions shall be supplied by the Contractor for the life of the equipment and software. The Contractor shall furnish unlimited e-copies in PDF format to the EPVAHCS. All software and supporting literature is to be updated as required software upgrades are fielded.

9. MANDATORY CHECK IN/OUT AND REMOVABLE MEDIA SCANNING

For any services performed on-site the Contractor shall, upon arrival at the EPVAHCS, report to the Facility POC to check in before proceeding to the any department and before performing any services. Prior to leaving the medical center, the Contractor shall check out with the POC. This check in and check out is mandatory. Upon check in with the Facility POC and before performing any services, the Contractor shall ensure that any removable media is scanned by the Biomedical Engineering Section prior to connecting to any EPVAHCS network, device or system. The Contractor shall provide any removable media to Biomedical Engineering staff. Biomedical Engineering staff will perform a malware/virus scan of the Contractor’s removable media. If “nothing found” is displayed, the Contractor may proceed and use the removable media. If “nothing found” is not displayed and/or the number of detections is greater than zero (0), the removable media shall be presumed infected with malware and shall not be allowed to be used. The media shall be returned to the Contractor for virus removal. The Government will not perform any virus or malware removal on the Contractor’s removable media. Biomedical Engineering will report any detection to the Facility Information Security Officer (ISO). Failure by the Contractor to check in, check out, provide removable media for scanning, or use of any infected media is a breach of security and shall be acted upon in accordance with the terms and conditions of this contract.

10. PHYSICAL SECURITY & SAFETY REQUIREMENTS

The Contractor personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

10.1 The Contractor personnel shall wear visible identification at all times while they are on the premises.

10.2. VA does not provide parking space at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

10.3 Smoking is prohibited inside/outside any building other than the designated smoking areas.

10.4 Possession of weapons is prohibited.

10.5 The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

11. FACILITY/RESOURCE PROVISIONS

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

12. SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping and parts or supplies, the Contractor shall notify Site POCs, by phone and by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC.

Contractors shall coordinate deliveries with Site POCs before shipment of hardware or other material to ensure sites have adequate storage space.

All shipments, either single or multiple container deliveries, will bear the VA Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA PO number shall indicate total number of containers for the complete shipment (i.e. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

PO #: ____________

Total number of Containers: Package ___ of ___. (i.e., Package 1 of 3)

DELIVER EQUIPMENT TO LOCATION:

El Paso VA Health Care System (EVAHCS) 5001 N. Piedras El Paso, TX 79930 FOB Destination Purchase Order Number: ____________

13. VA FURNISHED PROPERTY AND VA FURNISHED INFORMATION

There will be no government furnished property.

16. SECURITY REQUIREMENTS

This Medical Anesthesia Workstations contract involves the Contractor’s access, use of VA secure networks and equipment and exposure to VA sensitive personal information while implementing contract services defined herein. This contract does not intentionally involve the use or disclosure of sensitive information as the object of this contract. Any access to sensitive information by the Contractor personnel in completion of their services is considered incidental. Access and exposure to VA sensitive personal information occurs as a bi-product of Contractor personnel duties and is not be reasonably prevented. As such, in accordance with Department of Veterans Affairs Memorandum, “VA Maintenance/Installation (Warranty) Contracts (VAIQ 7058822), dated March 24, 2011, such disclosures are incidental and permitted by the HIPAA Privacy Rule (see 45 CFR 164.502 (a)(1). Furthermore, this contract includes the following five requirements per 38 U.S.C.§§ 5723 and 5725:

Each documented initiative under this contract incorporates the VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix A, is included in this document as Attachment B.

a. Prohibition on unauthorized disclosure: “Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contracting in performance or administration of this contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. See Handbook 6500.6, Appendix C, paragraph 3.a.

b. Data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including the contained in system(s) to which the contractor/subcontractor has access, the contractor/subcontractor shall immediately and simultaneously notify the COR, the Designated ISO and Privacy Officer for the contract. The term “security incident” means an event that has or could have resulted in the unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

c. Requirement for pay liquidated damages in the event of a data breach: In the event of a data breach or privacy incident involving sensitive personal information the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals. See VA Handbook 6500.6, Appendix C, paragraph 7.a, 7.d.

d. Requirement for annual security/privacy awareness training: Before being granted access to VA information or information systems, all contractor employees and subcontractor employees requiring such access shall complete on an annual basis either: (i) the VA security/privacy awareness training (contains VA’s security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the contractor. If the contractor provides their own training that conforms to VA’s requirements, the Contractor shall provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9.

e. Requirement to sign VA’s Rules of Behavior: Before being granted access to VA information or information systems, all contractor employees and subcontractor employees requiring such access shall sign on an annual basis an acknowledgement that they have read, understand, and agree to abide by VA’s Contractor Rules of Behavior which is attached to this contract or by completing the VA Talent Management System (TMS) "VA Privacy and Information Security Awareness and Rules of Behavior” course. See VA Handbook 6500.6, Appendix C, paragraph 9, Appendix D. Note: If a medical device vendor anticipates that the service under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by the vendor’s designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing the VA’s information and information systems

16.1 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

The contractor/subcontractor shall request logical (technical) and/or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

The Contractor will notify the COR immediately when their employee(s) no longer require access to VA computer systems.

16.2 GENERAL:

The Contractor, contractor personnel, subcontractors, and subcontractor personnel shall follow, and shall be subject to, the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security, handling of privacy information and shall be subject to penalties associated with the release of such data.

Failure to comply with the Contractor personnel security requirements may result in termination of the contract for default.

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and this PWS, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall.

Any security violations or attempted violations shall be reported to the VA Program Manager, COR and VA Information Security Officer as soon as possible.

The Contractor shall not transmit, store or otherwise maintain sensitive data or products in the Contractor systems (or media) within, or outside, the VA firewall in accordance with VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times.

16.3 VA DIRECTIVE 6550 PRE-PROCUREMENT ASSESSMENT

The Contractor shall complete the VA Directive 6550 Pre-Procurement Assessment and Manufacturer’s Disclosure Statement worksheet as necessary for networked Anesthesia devices. These must be completed to assure that Anesthesia devices are integrated effectively and securely. A sample manufacture disclosure statement, pre-procurement assessment and pre-implementation items are included in Attachment X of this SOW.

16.5 BUSINESS ASSOCIATE AGREEMENT

The contractor shall have a Business Associate Agreement (BAA) and safeguard Personal Health Information (PHI) agreements.

Business Associate Agreements (BAA) are mandated by the Health Insurance Portability & Accountability Act (HIPAA) and defined at 45 CFR 160.103 and amended by the Health Information Technology for Economic and Clinical Health Act (HITECH).

16.6 VA INFORMATION CUSTODIAL LANGUAGE

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

VA information should not be co-mingled with any other data on the Contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements.

VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

The Contractor shall not store VA information off site. VA information is only stored at the VAMC’s located at the Temple, Texas.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated BAA and ISA/MOU must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

16.7 INFORMATION SYSTEM DESIGN AND DEVELOPMENT

The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer configured to operate on Windows and Vista (in Protected Mode on Vista) and future versions, as required.

The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration.

Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

The contractor/subcontractor agrees to comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency.

(1) “Operation of a System of Records” means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

(2) “Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

(3) “System of Records” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than five (5) days.

When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within three (3) days.

All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g. for the convenience of VA) shall only be granted with approval of the Contracting Officer and the VA Assistant Secretary for Office of Information and Technology.

16.8 INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

The contractor/subcontractor must document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the system may need to be reviewed, retested and re-authorized. This may require reviewing and updating all of the documentation (6550, Contingency Plan, Disaster Recovery Plan, etc.).

VA prohibits the installation and use of personally-owned or contractor/subcontractor owned equipment or software on VA’s network. If non-VA owned equipment must be used to fulfill the requirements of a contract, the equipment must be transferred to ownership of the VA during its use. All the security controls required for government furnished equipment (GFE) must be funded by the original owner before it is transferred to VA ownership and will be maintained as a component of the System. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA approved configuration. Software must be kept current, including all critical updates and patches. Original owners of equipment that is transferred to VA ownership are responsible for providing and maintaining the anti-viral software and the firewall of the transferred equipment..

All Medical Anesthesia systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of use, lease, for trade-in, or other purposes. Storage media shall be retained by the VA and shall not be returned to the Contractor.

16.9 SECURITY INCIDENT INVESTIGATION

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances…