36C25721Q1286.docx

SUBJECT*

VA Temple Workstation

GENERAL INFORMATION

1901 S. 1st Street

Temple TX

COUNTRY

CONTACT INFORMATION

CONTRACTING OFFICE ADDRESS

Department of Veterans Affairs VISN17 Network Contracting Activity 5441 Babcock Road Ste. 302 San Antonio TX 78240

POINT OF CONTACT*

Contract Specialist Dr. Vinicky Ann Ervin Ph.D.

vinicky.ervin@va.gov Please title email Subject Line with : 36C25721Q12

Q&A VIA EMAIL ONLY

3 Aug -5 Aug 7:00 AM CST

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

Presolicitation Notice Presolicitation Notice

DESCRIPTION

Presolicitation Notice

Statement of Work

VISN 17

Central Texas Veterans Health Care System Draeger Medical Innovian Anesthesia Clinical Workstation Upgrade

Table of Contents

GOVERNING LAW…………………………………………………………………………...3

BACKGROUND………………………………………………………………………………3

APPLICABLE DOCUMENTS………………………………………………………………..5

OVERVIEW……………………………………………………………………………………6

GENERAL REQUIREMENTS……………………………………………………………….6

PERFORMANCE PERIOD…………………………………………………………………..7

PLACE OF PERFORMANCE……………………………………………………………….8

TRAVEL………………………………………………………………………………………..8

SPECIFIC TASKS AND DELIVERABLES…………………………………………………8

KICKOFF MEETING………………………………………………………………………….8

DELIVERY, INSTALLATION and INTEGRATION…………………………………………8

ACCEPTANCE TESTING……………………………………………………………………9

INTERFACE SUPPORT……………………………………………………………………...9

WARRANTY……………………………………………………………………………………10

DOCUMENTATION……………………………………………………………………………12

MANDATORY CHECK IN/OUT AND REMOVABLE MEDIA SCANNING………………13

PHYSICAL SECURITY & SAFETY REQUIREMENTS……………………………………13

FACILITY/RESOURCE PROVISIONS……………………………………………………...14

SCHEDULE FOR DELIVERABLES………………………………………………………...14

SPECIAL SHIPPING INSTRUCTIONS……………………………………………………..14

POINTS OF CONTACT………………………………………………………………………15

VA FURNISHED PROPERTY AND VA FURNISHED INFORMATION……………...15

SECURITY REQUIREMENTS………………………………………………………………15

1.0 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (“FAR”), shall govern this Order. Commercial license agreements may be made a part of this Contract but only if both parties expressly make them an addendum. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Order; this includes, but is not limited to, any agreement embedded in the computer software or any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation, or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Order.; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Order. Federal law and regulation, including without limitation, the Contract Disputes Act (41 U.S.C. §601-613), the Anti-Deficiency Act (31 U.S.C. §1341 et seq.), the Competition in Contracting Act (41 U.S.C. §2304), the Prompt Payment Act (31 U.S.C. §3901, et seq.) and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control and render ineffective any inconsistent, conflicting or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. § 516. At the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Order must be made by order modification (Standard Form 30). Nothing in this Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

2.0 BACKGROUND

The Department of Veterans Affairs (VA) Veterans Health Administration (VHA) provides health care benefits and services to Veterans of the United States. VHA provides high quality, effective, and efficient Anesthesia Record Keeper Systems (ARK) to those responsible for providing care to the Veterans throughout all the points of surgical and anesthesia health care in a timely and compassionate manner. VHA depends on ARK to meet mission goals.

In 2009, VHA Heart of Texas Veteran Integrated Service Network 17 (VISN 17) embarked on implementation of a VISN-wide Draeger Medical Innovian Anesthesia Record Keeper System initiative. VISN-wide installation of Innovian servers and software was completed in 2012 and is currently operational at the Dallas, Temple, El Paso, Amarillo, Harlingen Care Center and San Antonio VA Medical Centers (VAMCs). In 2012 a follow-on contract for maintenance and support was awarded to Draeger Medical.

The software applications that make up Innovian Anesthesia provide data collection, access and reporting, building of specific environments, auto-triggers, database query, real-time access to information in the PreOp, IntraOp, Post Op and moderate sedation areas, remote and single sign-on access, inbound and outbound Health Level Seven (HL7) interfaces to VistA, inbound data from medical devices, record upload to VistA Imaging and data extracts. Innovian Anesthesia replaced paper records used in the VISN 17 Anesthesia care areas. Certified Nurse Anesthetists, Anesthesiologists and other clinical staff use the Innovian Anesthesia System to manage the surgical/anesthesia patient information. Innovian Anesthesia provides a real-time bi-directional interface with the Veterans Health Information Systems and Technology Architecture (VistA), and allows the creation and storage of a completed Portable Document Format (PDF) file that is accessible in VistA Imaging via the Computerized Patient Record System (CPRS).

Innovian Anesthesia is a distributed solution required by the VA North Texas Health Care System (VANTHCS), Temple and San Antonio VA Medical Centers (VAMCs) Anesthesiology, El Paso VAMC, Amarillo VAMC, Harlingen Care Center and Pain Management Service that provides comprehensive data management for the anesthesiologist. The Innovian Anesthesia information management system works to create a complete, continuous, and paperless record of patient’s anesthetic care. This system compliments existing capabilities at the VANTHCS.

3.0 APPLICABLE DOCUMENTS

The following documents are required in the performance of the tasks associated with this Performance Work Statement (PWS):

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201, “Personal Identity Verification of Federal Employees and Contractors,” March 2006

4. Software Engineering Institute, Software Acquisition Capability Maturity Modeling (SA CMM) Level 2 procedures and processes

5. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

6. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

7. Department of Veterans Affairs (VA) Directive 0710, “Personnel Suitability and Security Program,” May 18, 2007

8. VA Directive 6102, “Internet/Intranet Services,” July 15, 2008

9. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

10. OMB Circular A-130, “Management of Federal Information Resources,” November 28, 2000

11. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

12. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

13. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

14. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

15. Health Technology Management (HTM) Service Bulletin SB2012-004; Removable Media Scanning; November 2012

16. Health Information Technology and Health Data Standards http://www.nlm.nih.gov/healthit.html

17. Healthcare Information Technology Standards Panel http://www.hitsp.org/

18. VA Directive 6500, “Information Security Program,” August 4, 2006

19. VA Handbook 6500, “Information Security Program,” September 18, 2007

20. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”

21. VA Handbook 6500.6, “Contract Security,” March 12, 2010

22. National Institute Standards and Technology (NIST) Special Publications

23. VA Directive 6550, “Pre-Procurement Assessment for Medical Devices,”

24. VA Handbook 1907.01 Health Information Management Systems (HIMS)

25. Health Insurance Portability and Accountability Act (HIPAA) (Public Law 104-191)

26. Personally Identifiable Information (PII) (VHA Directive 1080)

27. VA Maintenance/Installation (Warranty) Contracts; VAIQ 7058822; March 24, 2011

28. VHA Handbook 1600.01, Business Associate Agreements

29. VA Directive 6300, Records and Information Management

30. VA Handbook 6300.1, Records Management Procedures

31. VA Handbook 6500.1, Electronic Media Sanitization

32. Contractor Access Policy Guidance Bulletin, January 30, 2012, VA OIT Field Security Service (FSS) No. 26

Statement of Work

1. OVERVIEW

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), VA Heart of Texas VA Integrated Services Network (VISN 17) Central Texas Veterans Health Care System (CTVHCS) is upgrading Draeger Medical Innovian Anesthesia Clinical Workstations as the current ones are at end of life, accessories (cabling, keyboards, mice, stands, etc), operating system software and installation/integration services. Biomed training is also required. The products and services will be delivered at the VA CTVHCS at Temple VA Medical Center. This acquisition is required in order to meet essential anesthesia record keeping expansion requirements of the existing Draeger Innovian Anesthesia Record Keeper (ARK) and characteristics defined herein. The equipment will be used by VA personnel (doctors, medical technologists, and nurses and shall be maintained by Biomedical Engineering, Office of Information Technology (OIT) support staff and the Contractor. Equipment connectivity will be inside the VA firewall via LAN and WAN network.

2. GENERAL REQUIREMENTS

The scope of the VISN 17 Temple VA Medical Center ARK Workstations includes delivery of equipment, services and warranty defined herein.

The Contractor shall provide all labor, travel, tools, materials, project management, shipping and delivery, hardware, software, installation, integration, documentation, acceptance, testing and warranties required for upgrading the ARK workstations functionality with the existing ARK including twenty-seven (27) each Draeger Medical clinical work station hardware (computer, monitor, mouse, keyboard, cabling) for the Gastrointestinal (GI) and the Post Anesthesia Care Unit (PACU).

Delivery of equipment shall be to the Temple VA Medical Center. After delivery, the Contractor shall be responsible for unpacking, assembly, delivery to specific areas within the Medical Center’s Anesthesiology Service, installation, configuration and testing in accordance with the VA CTVHCS policy and standard operating procedures. The Contractor must perform all Innovian Anesthesia database configurations such as adding each workstation to Innovian, completing entries, changes and licensing each new workstation to the Innovian Anesthesia database.

The solution must be fully compatible with the existing Innovian Anesthesia system used at San Antonio meaning that the workstation hardware and software configurations shall be the same manufacturer as the existing Innovian products.

a. Silent Characteristics:

b. Training Requirements:

i. DataBridge Training

ii. Innovian System Administrator Training

iii. Innovian Replacement Training

iv. Innovian Clinical Application End User Training for Anthologists, CRNA, technologists and Clinicians

v. Biomedical Training

c. Minimum Workstation Specifications:

i. OS: Microsoft Windows 10 Pro 64bit

ii. Processor: Intel Core i7 6600U

iii. Storage: 128Gb SSD

iv. Wireless Communication: 802.11 a/b/g/n + BT 4.0

v. Resistive Touch

vi. Trusted Platform Module) Smart Card Reader

vii. Display size: 19” / 21.5” VA panel

viii. Bottom USB: USB 3.0 x2, USB 2.0 x2

ix. Side USB: USB 3.0 x2

x. Video Out: HDMI

xi. Ethernet: 1kv isolated Gigabit LAN x2

xii. COM: 4kv isolated COM port x3

xiii. DC Power Supply & Connector: 24V 2.5 DC connector

xiv. Battery Pack: 5700 mAh x2, 10.8V, 3.5 Hours charge time, 2~3 hours run time

d. The Offer must utilize the virtual machines provided by the Texas Valley Costal Bend’s Biomedical Engineer for all server applications. All patient data must be transmitted via HL7 messaging through the existing DSS DataBridge system and archived in VistA.

The Contractor shall provide VISN 17 a description and complete set of work station and monitor specifications for the Contractor’s proposed ARK work station solution.

All equipment and components proposed by the Contractor shall provide VISN 17 with full functionality and compatibility with existing Draeger Medical Innovian Anesthesia software.

The Contractor shall have current 510k clearance to market its products and an adequate quality assurance system, such as ISO 9001.

3. PERFORMANCE PERIOD

The period of performance must be August 1, 2021 through July 31, 2022.

The Contractor shall provide support 24 hours per day, 7 days per week. Normal hours of work are defined as Monday through Friday from 7:00 a.m. to 5:30 p.m. Central Time, excluding Federal holidays or as otherwise arranged with the Contracting Officer’s Representative (COR).

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4. PLACE OF PERFORMANCE

Tasks under this contract shall be performed at VISN 17, Central Texas Veterans Health Care System, Temple VA Medical Center. Remote support may be performed remotely at Contractor facilities. Work may be performed at remote locations other than Contractor facilities with prior approval of the COR. On-site support shall be performed at the VA Medical Center located in the following location:

Central Texas Veterans Health Care System: 1901 S. 1st Street, Temple TX, 76504, Phone: (210)694-6232

5. TRAVEL

All Contractor transportation, lodging, and subsistence expenses incurred by the Contractor shall be incorporated into the Contractor’s fees and are the sole responsibility of the Contractor. Travel will be scheduled at the most cost effective rate and fare, and by the most cost effective mode of travel in accordance with the General Services Administration.

6. SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

6.1. KICKOFF MEETING

The Contractor shall attend a Project Kickoff Meeting where the project shall be discussed in detail. The meeting will be conducted by conference call and coordinated by the COR within seven (7) days after the contract award.

6.2 DELIVERY, INSTALLATION and INTEGRATION

Equipment shall be delivered to each HCS as listed in the Deliver Equipment to Location section 13.

Upon delivery of the equipment, the Contractor shall provide on-site project management, set-up and assembly, installation and integration of new equipment and software to the existing ARK based on Central Texas Veterans Health Care System policy and procedures.

During the installation, the Contractor shall provide on-site as well as remote support, as needed, and must be available to respond to any questions asked by the Facility POCs. The Contractor shall provide same day resolution of any issues related to the new equipment. The Contractor is responsible for providing VA CTVHCS staff with configuration instructions and guidance for all equipment and accessories procured under this contract.

At a minimum, the Contractor shall provide on-site and remote technical support staff on duty from 6 AM Central Standard Time to 6 PM Central Standard Time, Monday through Friday, excluding federal holidays. The Contractor shall provide a daily Status Report via e-mail for any issue that requires action. The report will describe the time the issue was identified, problem summary, steps taken to resolve the problem, time to complete the task and system or component down-time.

6.3 ACCEPTANCE TESTING

The Contractor is responsible for coordinating and performing technical testing. Equipment will be put into clinical use during implementation. Implementation must be 100% (all equipment operational with 100% functionality before being considered as complete and accepted by the Government.

If deficiencies found at the time of Government acceptance are corrected within 30 calendar days after receipt of the deficiency letter from the Contracting Officer, final acceptance will be issued upon validation of deficiency correction by the Government, and the warranty start date shall be back-dated to the date the initial acceptance testing was completed.

Clinical testing will be performed by the Government.

6.4 INTERFACE SUPPORT

The Contractor shall ensure that all Innovian Anesthesia side interfaces associated with the new workstations, including but not limited to, VistA, VistA Imaging/CPRS, Medical Devices, Innovian Reporting Tool, and data transfer links are configured, testing and maintained consistently. The Contractor shall coordinate with other Contractors when necessary to accomplish this task.

7. WARRANTY

Warranty shall start at acceptance. During the 12 month warranty period, the Contractor shall furnish warranty maintenance service support that includes, as a minimum, preventive and corrective maintenance services for the equipment. and all associated hardware, firmware and software, parts, labor, travel and expenses necessary to perform such services at no additional cost to the Government. Parts cost incurred during maintenance calls shall be included in the base warranty/maintenance price and shall not be billed as additional costs. In those emergency situations when a system component(s) is down and the Government places the call for corrective action to the Contractor, the Contractor shall respond within the prescribed response time The Government representative will make formal notification of the problem by phone to the Contractor POC as soon as the problem is identified by the Government.

Warranty Maintenance & Support Help Desk: The Contractor shall provide be provided with remote (connectivity to VA network) access for maintenance and support. The Contractor shall provide contact information to the Contractor’s Support Help Desk. The Government will call and/or email the Contractor to report problems and to coordinate technical support. Maintenance under the warranty periods shall include access to new versions, updates, patches, upgrades and to the equipment components as they are released as well as scheduled maintenance (preventive maintenance inspections, electrical safety testing, calibration, scheduled releases) and unscheduled corrective maintenance. The Contractor Help Desk shall permit CTVHCS staff to report problems, ask questions, request services, query historical data and request reports. The Help Desk shall provide real time information to include current status, total equipment down time, who initiated the service ticket, the original complaint, response time, the service technician, work performed, replacement parts and completion date and time.

Warranty Maintenance & Support Hours of Coverage: Contractor support staff will work with the User’s schedule to ensure efficient operation. Contractor support staff are stationed at home offices. The Contractor shall provide a Help Desk telephone line with live-support which shall be available 27X7X365. The Contractor shall provide an Online Help Email address which received messages 24X7X365. The Contractor shall provide an Online Help Desk Website Access which shall be available 24X7X365.

Warranty Maintenance and Support Response Time: The Contractor shall responds to maintenance and support requests made by the CTVHCS by telephone or email within 1 hour from the time the request was made. Response time shall commence at the time the Government POC places the maintenance and support call to the Contractor maintenance and support POC and shall end at the time the Contractor maintenance and support provider contacts the Government by email or telephone. The Contractor is required to provide a reliable maintenance and support POC for 24 hour service call notification. The Contractor maintenance and support POC shall provide a telephonic response of acknowledgment of receipt of an emergency call within 1 hour following notification. Failure of the maintenance and support POC to answer valid attempts made by the Government within the response time will result in the start of both downtime and response time.

Warranty Hardware Upgrades: If hardware upgrades become available after award of a delivery order but prior to delivery of the equipment, the Contractor is requested to offer them to the Contracting Officer for consideration. The Contractor's proposal for such upgrades shall include the following information: Pricing information, to include both the price of the equipment to be added and the equipment to be deleted. Specific awarded items that shall be changed if the proposal is awarded. Performance data, including both comparisons to the specification requirements and to the equipment on contract. A detailed description of the differences between the awarded items and those being proposed, and a specific analysis of the comparative advantages/disadvantages of the items involved. An evaluation of the effect proposed changes will have on the life cycle of the equipment and an associated cost impact as it relates to site preparation, installation, maintenance, and operational expense. An analysis of the timeframe required to institute the change.

Warranty Replacement Components and Parts: The Contractor shall make available to the Government all components and spare parts required to maintain the equipment herein. The Contractor shall furnish all parts at no additional cost. All parts supplied shall be the original equipment manufacturer or equivalent and fully compatible with existing equipment. The Contractor shall provide new parts. Replacement components and parts (hardware, firmware, software, and any work station discrete components) shall receive a full 12 month warranty from the time of replacement. The Contractor shall deliver components and parts by next business day from the date/time requested by the Government. The Contractor shall provide a guarantee that the Government will be able to obtain all required spare parts from the Contractor for a period of seven (7) years from the date of final system acceptance. During the equipment life cycle, if the Government elects not to upgrade existing systems to new versions (either hardware, software, and spare components and parts), the Contractor shall guarantee that they will continue to provide support all hardware, software, and spare components and parts for the equipment for a minimum of seven (7) years, after release of the upgrade.

Warranty Maintenance and Support Reports: The Contractor shall maintain historical warranty service records on each component of the system, which will be provided to the Government upon request and made available in electronic format. Warranty Service reports of all services performed shall be verified by the VA CTVHCS POC, maintained and turned over to the VA CTVHCS POC and filed with the equipment history file. The Contractor shall also provide service reports to the Contracting Officer and COR upon request. As a minimum, the report shall include: (a) date and time notified, (b) date and time of actions taken, (c) description of malfunction or service to be performed, (d) model number/serial number and location of the equipment, (e) time spent to resolve, (f) parts used/replaced, and (g) parts cost if applicable, (h) description of service performed, (i) name of government POC, (j) name of Contractor maintenance and support staff, (k) telemaintenance methods used, if any, (l) designation of user error, if appropriate. Documentation such as Service Bulletins, Product Modifications, Removals, Recalls, and End of Support Notifications shall be sent to the CO, COR and HCS POCs.

8. DOCUMENTATION

Documentation and reports will be provided to CTVHCS by the Contractor in accordance with facility policies and procedures. Documentation includes equipment, components and parts specification data sheets, user and technical manuals, schematics and diagrams, written preventive maintenance and calibration procedures, software license agreements, training documentation, service bulletins, product modification, removal, recall or end of support notifications and maintenance and support reports.

Non-compliance with the documentation requirements specified herein may result in actions as deemed appropriate by the Contracting Officer.

Specification Data Sheets, User and Technical Manuals, Schematics and Diagrams, Preventive Maintenance and Calibration Procedures, Software License Agreements, and Training Documentation (software and hardware).

The Contractor shall certify that manufacturer manuals provided with the equipment and the system’s software accurately reflect the configuration of the delivered equipment and system’s software or the operation and maintenance thereof. The Contractor shall furnish their commercial system administration’s manuals, operator’s manuals, and maintenance manuals for the supplied equipment.

Copies of document corrections and revisions shall be supplied by the Contractor for the life of the equipment and software. The Contractor shall furnish unlimited e-copies in PDF format to the VANTHCS. All software and supporting literature is to be updated as required software upgrades are fielded.

9. MANDATORY CHECK IN/OUT AND REMOVABLE MEDIA SCANNING

For any services performed on-site the Contractor shall, upon arrival at the VAMC, report to the Facility POC to check in before proceeding to the any department and before performing any services. Prior to leaving the medical center, the Contractor shall check out with the POC. This check in and check out is mandatory. Upon check in with the Facility POC and before performing any services, the Contractor shall ensure that any removable media is scanned by the Biomedical Engineering Section prior to connecting to any VAMC network, device or system. The Contractor shall provide any removable media to Biomedical Engineering staff. Biomedical Engineering staff will perform a malware/virus scan of the Contractor’s removable media. If “nothing found” is displayed, the Contractor may proceed and use the removable media. If “nothing found” is not displayed and/or the number of detections is greater than zero (0), the removable media shall be presumed infected with malware and shall not be allowed to be used. The media shall be returned to the Contractor for virus removal. The Government will not perform any virus or malware removal on the Contractor’s removable media. Biomedical Engineering will report any detection to the Facility Information Security Officer (ISO). Failure by the Contractor to check in, check out, provide removable media for scanning, or use of any infected media is a breach of security and shall be acted upon in accordance with the terms and conditions of this contract.

10. PHYSICAL SECURITY & SAFETY REQUIREMENTS

The Contractor personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

10.1 The Contractor personnel shall wear visible identification at all times while they are on the premises.

10.2. VA does not provide parking space at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

10.3 Smoking is prohibited inside/outside any building other than the designated smoking areas.

10.4 Possession of weapons is prohibited.

10.5 The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

11. FACILITY/RESOURCE PROVISIONS

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

12. SCHEDULE FOR DELIVERABLES

13. SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping and parts or supplies, the Contractor shall notify Site POCs, by phone and by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC.

Contractors shall coordinate deliveries with Site POCs before shipment of hardware or other material to ensure sites have adequate storage space.

All shipments, either single or multiple container deliveries, will bear the VA Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA PO number shall indicate total number of containers for the complete shipment (i.e. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

PO #: ____________

Total number of Containers: Package ___ of ___. (i.e., Package 1 of 3)

DELIVER EQUIPMENT TO LOCATION:

VA Central Texas Veterans Health Care System 1901 S. 1st Street Temple, TX 76504 Attention: Robert France Purchase Order Number: ____________

14. POINTS OF CONTACT

Contracting Officer’s Representative:

Name: Farid Attaran Address: 5441 Babcock Road, Suite 301, San Antonio, TX 78229

Contracting Officer:

Name:

Address:

Voice:

Email:

15.0 VA FURNISHED PROPERTY AND VA FURNISHED INFORMATION

There will be no government furnished property.

16.0 SECURITY REQUIREMENTS

This Draeger Medical Innovian Anesthesia Workstations contract involves the Contractor’s access, use of VA secure networks and equipment and exposure to VA sensitive personal information while implementing contract services defined herein. This contract does not intentionally involve the use or disclosure of sensitive information as the object of this contract. Any access to sensitive information by the Contractor personnel in completion of their services is considered incidental. Access and exposure to VA sensitive personal information occurs as a bi-product of Contractor personnel duties and is not be reasonably prevented. As such, in accordance with Department of Veterans Affairs Memorandum, “VA Maintenance/Installation (Warranty) Contracts (VAIQ 7058822), dated March 24, 2011, such disclosures are incidental and permitted by the HIPAA Privacy Rule (see 45 CFR 164.502 (a)(1). Furthermore, this contract includes the following five requirements per 38 U.S.C.§§ 5723 and 5725:

Each documented initiative under this contract incorporates the VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix A, is included in this document as Attachment B.

a. Prohibition on unauthorized disclosure: “Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contracting in performance or administration of this contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. See Handbook 6500.6, Appendix C, paragraph 3.a.

b. Data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including the contained in system(s) to which the contractor/subcontractor has access, the contractor/subcontractor shall immediately and simultaneously notify the COR, the Designated ISO and Privacy Officer for the contract. The term “security incident” means an event that has or could have resulted in the unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

c. Requirement for pay liquidated damages in the event of a data breach: In the event of a data breach or privacy incident involving sensitive personal information the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals. See VA Handbook 6500.6, Appendix C, paragraph 7.a, 7.d.

d. Requirement for annual security/privacy awareness training: Before being granted access to VA information or information systems, all contractor employees and subcontractor employees requiring such access shall complete on an annual basis either: (i) the VA security/privacy awareness training (contains VA’s security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the contractor. If the contractor provides their own training that conforms to VA’s requirements, the Contractor shall provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9.

e. Requirement to sign VA’s Rules of Behavior: Before being granted access to VA information or information systems, all contractor employees and subcontractor employees requiring such access shall sign on an annual basis an acknowledgement that they have read, understand, and agree to abide by VA’s Contractor Rules of Behavior which is attached to this contract or by completing the VA Talent Management System (TMS) "VA Privacy and Information Security Awareness and Rules of Behavior” course. See VA Handbook 6500.6, Appendix C, paragraph 9, Appendix D. Note: If a medical device vendor anticipates that the service under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by the vendor’s designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing the VA’s information and information systems

16.1 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

The contractor/subcontractor shall request logical (technical) and/or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

The Contractor will notify the COR immediately when their employee(s) no longer require access to VA computer systems.

Information Systems Officer, Information Protection:

The contractor will have access to VA Desktop computers. If removal of equipment from the VA is required, any memory storage devices, such as hard drives, solid state drives and non-volatile memory units will remain in VA control and will not be removed from VA custody. Privacy Officer: The contractor will/will not have access to protected Patient Health Information (PHI) nor will they have the capability of accessing patient information during the services provided to the VA and if removal of equipment from the VA is required, any memory storage devices, such as hard drives, solid state drives and non-volatile memory units will remain in VA control and will not be removed from VA custody.

All research data available for Contractor analyses is de-identified.

Records Manager: 1.

Records Manager:

a. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

b. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

c. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

d. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

e. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

f. The Government Agency owns the rights to all data/records produced as part of this contract.

g. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

16.2 GENERAL:

The Contractor, contractor personnel, subcontractors, and subcontractor personnel shall follow, and shall be subject to, the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security, handling of privacy information and shall be subject to penalties associated with the release of such data.

Failure to comply with the Contractor personnel security requirements may result in termination of the contract for default.

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and this PWS, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall.

Any security violations or attempted violations shall be reported to the VA Program Manager, COR and VA Information Security Officer as soon as possible.

The Contractor shall not transmit, store or otherwise maintain sensitive data or products in the Contractor systems (or media) within, or outside, the VA firewall in accordance with VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times.

16.3 NATIONAL CONTRACTOR ACCESS PROGRAM, INTERCONNECTION SECURITY AGREEMENT /MEMORANDUM OF UNDERSTANDING AND REMOTE ACCESS

The Draeger Medical Innovian Anesthesia Upgrades, Maintenance and Technical Support contract involves Contractorremote access to VA VISN 17 networks in accordance with the VA OIT National Contractor Access Program (NCAP). Inter-connection between the Contractor and VA shall be via an approved Site to Site Virtual Private Network (VPN) under an Interconnection Security Agreement/ Memorandum of Understanding/ (ISA/MOU) approved for the Site to Site VPN. VA will provide access to VISN 17 Draeger Medical Innovian Anesthesia systems as required for execution of the tasks via the remote access site to site VPN technology which will provide Contractor access to VAMC’s Innovian Anesthesia specific hardware and software enabling the Contractor to perform the required Upgrades, Maintenance and Technical Support.

The Draeger Medical Innovian Anesthesia/VA utilizes a Memorandum of Understanding (MOU) to document the terms and conditions for sharing data and information resources in a secure manner. The supporting information within the MOU will define the purpose of the interconnection, identify relative authorities, specify the responsibilities of both organizations, and define the terms of the agreement. Additionally, the MOU provides details pertaining to apportionment of cost and timeline for terminating or reauthorizing the interconnection.

Technical details on how the interconnection is established or maintained are included within the Interconnection Security Agreement (ISA). A system interconnection is a direct connection between two or more information technology (IT) systems for the purpose of sharing data and other information resources. The Draeger Medical Innovian Anesthesia/VA uses the ISA to formally document the reasons, methodology, and approvals for interconnecting IT systems; to identify the basic components of an interconnection; to identify methods and levels of interconnectivity; and to discuss potential security risks associated with the interconnections.

The ISA specifies the technical and security requirements of the interconnection and the MOU defines the responsibilities of the participating organizations.

The purpose of the ISA/MOU is to establish a management agreement between the Contractor and VISN 17 regarding the development, management, operation, and security of a connection between Draeger Medical Innovian Anesthesia and VA. The agreement governs the relationship between Draeger Medical and VA including designated managerial and technical staff, in the absence of a common management authority.

16.4 VA DIRECTIVE 6550 PRE-PROCUREMENT ASSESSMENT

The Contractor shall complete the VA Directive 6550 Pre-Procurement Assessment and Manufacturer’s Disclosure Statement worksheet as necessary for networked Innovian Anesthesia devices. These must be completed to assure that Innovian Anesthesia devices are integrated effectively and securely. A sample manufacture disclosure statement, pre-procurement assessment and pre-implementation items are included in Attachment X of this PWS.

16.5 BUSINESS ASSOCIATE AGREEMENT

The contractor shall have a Business Associate Agreement (BAA) and safeguard Personal Health Information (PHI) agreements.

Business Associate Agreements (BAA) are mandated by the Health Insurance Portability & Accountability Act (HIPAA) and defined at 45 CFR 160.103 and amended by the Health Information Technology for Economic and Clinical Health Act (HITECH).

16.6 VA INFORMATION CUSTODIAL LANGUAGE

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

VA information should not be co-mingled with any other data on the Contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements.

VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA.