P09 SOW Courier Services - Updated 5-15-2024.docx

1. GENERAL

Scope of Work:

The South Texas VA Health Care System (STVHCS) has a continued need for medical courier services. The Government must not exercise any supervision or control over the service providers providing the services described herein. The contractor will provide all necessary vehicles, labor, transportation, equipment, material, personnel, gasoline, insurance, directional materials and supplies for twenty-four (24) hours a day, seven (7) days a week pickup and delivery of routine and emergency reagents, blood and/or blood products, lab products and specimens, and office supplies to locations outlined in the Price/Cost Schedule for the STVHCS.

2. CONTRACTOR QUALIFICATIONS

2.1. PERSONNEL POLICY:

The Contractor must be responsible for protecting the personnel furnishing services under this contract. To carry out that responsibility, the Contractor will provide the following:

· Workers’ compensation

· Professional liability insurance

· Health examinations including: (a) Annual TB Skin Test and recent (within the last year) chest X~ Ray if there is a history of positive TB Skin Test, (b) Evidence of Hepatitis B immunity (hepatitis immune titer, if provider has had the series of shots; if no immunity, evidence that provider has started the Hepatitis B vaccination series), (c) Evidence of a Hepatitis C titer, (d) Varicella titer if provider has not had chicken pox and any other immunizations required.

· Income tax withholding, and

· Social Security Payment

Note: The Contractor, its employees, agents, and subcontractors will not be considered VA employees for any purpose.

2.2. Contractor Responsibilities: (Contractor must confirm they meet all the following requirements at solicitation)

A. Must be licensed and have professional and automobile liability insurance.

B. Couriers must carry cell phones or pagers for communication purposes.

C. Services must be performed with a company vehicle and a uniformed driver to transport laboratory specimens.

D. The Contractor’s personnel must present a neat appearance and be easily recognized as a contract employee.

E. The Contractor’s employees must wear identification tags that include the company’s name/logo and employee name.

F. Contractor’s vehicle must have the company name/logo prominently displayed. No personal vehicles will be acceptable.

G. After award and prior to the start date, the contractor must provide the Contracting Officer’s Representative (COR) a copy their employee training certificates, drivers’ licenses, vehicle insurance, and vehicle registration.

H. All couriers transporting laboratory test specimens must be trained and tested as specified in the training requirements of 49 CFR Part 172, Subpart H. Written statement documenting Universal Precautions training, Hazardous Materials training, and training that meets all laws and regulations of the US Department of Transportation and the Centers for Disease Control governing the transport of clinical specimens must be provided to the COR annually.

I. All couriers must maintain a valid driver’s license for the type of vehicle operated as required by the States of Texas.

J. A record of each driver as to character and physical capabilities of performing the duties as a courier must be maintained and made available to the COR for inspection upon request.

K. The contract manager, drivers, and alternates, must be able to read, write, speak, and understand English. The name of this person, and an alternate, or alternates, who must act for the contractor when the manager is absent, must be designated in writing to the COR. An updated listing will be provided as changes in personnel occur.

3. TASK SPECIFICATIONS

WORK HOURS:

The Contractor as defined herein must furnish the services covered by this contract at the times specified in Section 4 of the Contract.

The following terms have the following meanings:

I. Work Hours: Service is to be available twenty-four (24) hours per day, seven (7) days per week.

· Normal Duty Hours are 07:30 AM to 4:00 PM CST.

· After Duty Hours are 4:00 PM to 7:30 AM CST

II. Contractor may be required to work on the National Holidays observed by the Federal Government, on an as needed basis.

The recognized Federal holidays are: New Year’s Day (1st), Martin Luther King Jr’s Birthday (3rd Monday in January), Washington’s Birthday (3rd Monday in February), Memorial Day (last Monday in May), Juneteenth (19th of June), Independence Day (4th of July), Labor Day (1st Monday in September), Columbus Day (2nd Monday in October), Veterans Day (November11th), Thanksgiving Day (4th Thursday in November), Christmas Day (December 25th) and any other day specifically declared by the President of the United States to be a national holiday. When one of the designated holidays falls on a Sunday, the following Monday will be observed as a legal holiday. When a legal holiday falls on a Saturday, the preceding Friday is observed as a holiday by U.S. Government agencies.

3.1. Specific Tasks

Courier Services will consist of the following:

A. The Courier will pick up the laboratory test specimens in locked coolers. Locked coolers will be provided by Audie Murphy VA.

B. The pickup/delivery must be performed within a 30-minute window of the initial request for pickup. Pickup/delivery times greater than 30 minutes require a telephone call to the COR stating the reasons why this requirement was not met.

C. Delivery must be made to the STVHCS according to the Delivery Schedule (Attachment A).

D. The condition of the laboratory test specimens will be checked at time of delivery by Government personnel.

E. A daily tracking log will be provided by the clinics and will be completed and submitted to the STVHCS Laboratory.

F. The items to be transported under this contract consist of biological specimens that will be transported to/from the locations listed in section 4. The specimens are a combination of room temperature, refrigerated, and/or frozen specimens and other items defined under the Statement of Work.

G. Laboratory test specimens, i.e., body fluids (blood, urine, and stool), will be properly packaged in inner containers according to meets all laws and regulations of the US Department of Transportation and the Centers for Disease Control governing the transport of clinical specimens and stored at the proper temperature by Government personnel.

H. Test specimens stored in the refrigerated cooler must remain upright during transportation. Test specimens that are stored at room temperature can be placed near the top of the refrigerated cooler during transport.

I. Drivers:

· All drivers must be of legal age (the age of 18 years) and must maintain neat, clean, and professional appearance and be easily recognized as contractor employees by wearing appropriate identification which identifies them by name, title and job performed.

· Drivers must be able to speak, understand and write English.

· All couriers transporting specimens under this contract must possess a valid driver’s license, vehicle insurance, and registration and have two-way radios, cell phones, or pagers for communication purposes. Drivers must be licensed in accordance with the State of Texas, to include any special licensure required for the transporting required items.

· Under no circumstances must any person other than the driver assigned ride in a vehicle or handle items being transported. Driver must not make non-emergent stops, for any reason, during the transport of items under this contract.

· No pets and no smoking are allowed in vehicle when transporting items under this contract.

J. Inclement Weather and Emergency Provision:

· The contractor must contact the COR or designee if conditions exist which may affect their ability to perform contract requirements.

· The contractor must have an established contingency plan for problems which may be experienced in the transport time frame (i.e., breakdown, accident, inclement weather).

· If there is a delay within 30 minutes of the timeframe established, COR or designee must be notified immediately.

· The contractor must arrange alternative transportation for delivery of specimens, mail and supplies in the event the driver is unable to complete deliveries.

· The contractor must provide a list of driver’s names and names of alternate drivers for each route, in case of emergency. Included in the list must be contact phone numbers or pagers and names of each driver. Updated lists must be provided to the COR annually and when changes have occurred.

· Emergency is defined as a vehicle breakdown, traffic and/or accident.

K. Vehicle:

· All vehicles used in performance of this contract must be registered, licensed, and meet the minimum vehicle requirements as mandated by the Department of Transportation.

· The Government reserves the right to inspect the vehicles and investigate the responsibility of contractor to perform the work outlined in the contract. The Contractor must provide all vehicles needed to perform this effort.

· Each vehicle must have some type of identification representing the contractor and be prominently displayed. Each vehicle must be adequately stocked with at least one up-to date complete “SPILL KIT” for a bio-hazard cleanup in case of leakage or accidental discharge.

· The Contractor must maintain proper temperature in vehicles to preserve laboratory specimens and medical supplies.

· There must be climate control in the vehicles, so that the internal vehicle temperature can be maintained at a temperature between 65ºF and 85ºF.

· The vehicle must meet the requirement that all efforts must be made to assure that all items are delivered upright, without spoilage/damage from temperature conditions, rough handling and/or negligence.

· The courier who is to transport must place the secured, locked container in a secured, confined area in the vehicle, for instance, the trunk.

· Avoid situations/conditions where the container can be a projectile object in case of sudden breaking of the vehicle.

· The vehicles must not be abandoned between transports from facility to destination. All items must not be left in an unsecured vehicle at any time.

· Under no circumstances should any items transported under this contract be left in the vehicle overnight.

· It is recommended that vehicles are equipped with helpful carrying devices such as hand trucks or other suitable apparatus to assist with transporting items under this contract. These items will not be provided by the Government.

3.2. Quality Control

A. The Contractor must develop and maintain a quality control program that ensures courier services are performed in accordance with these specifications.

B. The contractor must develop and implement procedures to track, identify, prevent, remedy, and ensure non-recurrence of defective services.

C. The contractor must provide a method to accept and resolve customer complaints and notify the customer of the resolution.

D. The contractor must immediately notify the COR upon receipt of a customer complaint so joint validation may be accomplished.

E. The contractor is responsible for quality control and specification compliance.

F. Quality Assurance will be performed by the Government who will evaluate the contractor’s performance using customer complaint, and may at the Government’s discretion, inspect each task to incur conformance and acceptance prior to payment. All specimens must be transported in accordance with all Department of Transportation and Occupational Safety and Health Administration (OSHA) Codes of Federal Regulations (CFR) 29 and 49. The Contractor must ensure the confidentiality of all patient information being transported and will be held liable in the event of breach of confidentiality. The Contractor must comply with the provisions of the Federal Privacy Act of 1974 (Public Law 93-579).

G. All items must be transported in accordance with all local, state, and Federal regulations. All efforts must be made to assure that all items are delivered without spoilage/damage from temperature conditions, rough handling and/or negligence.

H. If the courier services cannot be performed due to inclement weather, the COR must be notified in advance.

I. The COR must be notified within two hours, by phone and confirmed through email, if the Contractor has knowledge of any conditions which may adversely affect the Contractor’s ability to perform under the terms and conditions as stated in the specifications of this requirement.

J. In the event of a lost or broken specimen, the contractor must submit a written report to the COR within twenty-four hours explaining the circumstances. Failure to provide the report within this timeframe will be cause further review by the Government to determine if the infraction warrants suspension/termination of the contract.

K. The contractor must always provide quality customer service and must not receive more than five complaints or referrals to the COR per year.

3.3. Quality Assurance and Surveillance Plan (QASP)

The Government will evaluate the contractor’s performance using customer complaints, periodic on-site inspection, and may, at the Government’s discretion, inspect each task to verify conformance and acceptance prior to payment.

The Government will periodically evaluate the contractor’s performance in accordance with the following Quality Assurance Plan.

Government may request replacement of Courier if repeated occurrences not to exceed 3 valid complaints per year.

Annual Training for Courier Privacy and HIPAA Training VA Privacy and Information Security Awareness and Rules of Behavior

Government may request replacement of Courier if repeated occurrences not to exceed 3 valid complaints per year.

· The standard overall is two or less customer complaints per month in each area. The COR must notify the Contracting Officer for appropriate action in accordance with FAR 52.212.4, Contract Terms and Conditions-Commercial Items or the appropriate Inspection of Services clause, if any of the above service areas exceed two customer complaints per month.

· Contractor must submit a copy of required Privacy, Information Security and HIPPA training on each employee to the COR within 60 days of award and annually thereafter. Training is currently located in the VA TMS Education Program. Access to the training will be given to the contractor by the COR within 10 days of award.

· Any VA employee that observes unacceptable performance should immediately contact the COR. The COR will complete appropriate documentation to record the complaint. The COR will determine if the customer complaint is valid. The COR will inform the customer of the approximate time the unacceptable performance will be corrected and ask the customer to contact him/her if not corrected.

· The Contractor will be given two hours after verbal notification to address the unacceptable performance. If the contractor disagrees with the complaint after investigation and challenges the validity of the complaint; the Contractor will notify the COR. The COR will retain documentation for his/her files. If after investigation the COR determines the complaint as valid, the COR will inform the Contracting Officer and the Contracting Officer will determine what action is to be taken based on the requirements of the contract.

· Contract Monitoring: This contract will be monitored monthly by the COR regarding timeliness of pick-ups, deliveries, invoicing, quality of care, and customer satisfaction.

4. DELIVERY SCHEDULE

The VA reserves the right to change the pickup time and location, if it is beneficial to the Government.

Silver Suite A-88 Women’s Clinic

Silver Suite A-88 Women’s Clinic

*Denotes: Prior approval required by Laboratory Management, if not approved initiator will be responsible for charges incurred. Urgent Pickups must be completed within two (2) hours of initial call for pickup.

4.1. Addresses (listed in Delivery Schedule, not all inclusive):

South Texas Veterans Healthcare System Audie L. Murphy VA Hospital 7400 Merton Minter Blvd.

San Antonio, TX 78229-4404 Kerrville VA Hospital 3600 Memorial Blvd.

Kerrville, TX 78028-5768 Villa Serena 4455 Horizon Hill Blvd.

San Antonio, TX 78229 North Central Federal Clinic 17440 Henderson Pass San Antonio, TX 79232-1662 Lackland Blood Donor Center 2430 Ladd St.

Lackland AFB, TX 78236-5310 South Bexar Outpatient Clinic 4610 E. Southcross Blvd.

San Antonio, TX 78222-4911 Randolph Airforce Base Dental Clinic 231 3rd St. West (2nd Floor Dental Clinic)

RAFB, TX 78150

Victoria Outpatient Clinic 1908 N. Laurent St., Ste. 150 Victoria, TX 77901-5457 Santa Rosa 423 Treeline Park Suite 202 San Antonio, TX 78209

Villa Serena 4455 Horizon Hill Blvd.

San Antonio, TX 78229

Lackland Blood Donor Center 2430 Ladd St.

Lackland AFB, TX 78236-5310

Randolph Airforce Base Dental Clinic 231 3rd St. West (2nd Floor Dental Clinic)

RAFB, TX 78150

Santa Rosa 423 Treeline Park Suite 202 San Antonio, TX 78209

Polytrauma Transition Rehabilitation Program (PTRP) 4949 Gus Eckert San Antonio, TX,78240

VA Eye/Dental Care Clinic 8410 Datapoint Dr.

San Antonio, TX, 78229

North Bexar Outpatient Clinic 16109 Nacogdoches ST 100 San Antonio, TX 78247

Shavano Park 4350 Lockhill Selma Rd.

Shavano Park, 78249

Balcones Heights (Wonderland of the Americas) 4522 Fredericksburg Rd.

Gold Suite A-1-, Silver Suite A-88, GYN Clinic San Antonio, TX 78201 Northwest Clinic 9939 State Hwy 151 San Antonio, TX 78251

5. OTHER CONTRACT REQUIREMENTS

Period of Performance:

Base + 4 Option Years

Physical Security:

1. The Contractor must be responsible for safeguarding all Government equipment, information and property provided to Contractor personnel while performing the services described herein.

2. The Contractor assumes all liability risks for work performed under this contract.

3. The Contractor must assume total liability for all contract employees.

4. The Contractor must perform to the standards of the contract.

Service Contract Act:

The Service Contract Act applies to this contract. Current Service Contract Act Wage Determinations for the service areas will be attached to the contract. Employees performing under this contract must be paid at least the pay and fringe benefits described therein.

Contracting Officer Representative (COR):

The COR will be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. A letter of designation issued to the COR, a copy of which will be provided to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

Contract Administration:

The Contracting Officer is the only person authorized to approve changes or modify any of the requirements under this contract. The Contractor must communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer is authorized to make commitments or issue changes that will affect price, quantity, or quality of performance of this contract. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change must be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. All changes to the contract will be issued via an amendment and/or modification in writing from the Contracting Officer to the Contractor.

Invoices:

Invoices are to be submitted electronically; monthly, in arrears of the start of the services performed each month. Electronic invoices can be submitted at no additional cost through Tungsten.

Acceptance:

The COR is responsible for acceptance of services and/or the processing of receiving reports for the services provided to the Government. Monthly reports will be sent to the COR.

Information System Officer and Information Protection:

The contractor will not have access to VA Desktop computers or access to online resources belonging to the Government.

Privacy Officer:

The Contractor will have access to protected Patient Health Information (PHI) and will have capability of accessing patient information during the services provided to the VA and if removal of equipment from the VA is required, any memory storage device will remain in VA control and will not be removed from VA custody. All research data available for Contractor analysis is de-identified.

Records Manager:

1. Contractor must comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor must maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. STVHCS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of STVHCS or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to STVHCS. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor must immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract. The Contractor must ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor must not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it must be returned to STVHCS control, or the Contractor must hold it until otherwise directed. Items returned to the Government must be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the contract. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and STVHCS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor must only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with STVHCS policy.

8. The Contractor must not create or maintain any records containing any non-public STVHCS information that are not specifically tied to or authorized by the contract.

9. The Contractor must not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The STVHCS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which STVHCS must have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VHA-provided records management training, Talent Management System (TMS) Item #10176, Privacy and Information Security, Rules of Behavior. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

6. SPECIAL CONTRACT REQUIREMENTS

6.1. STX-HCR671-04 General Information Security Requirements /Records

6.1.1. All information and records provided to Contractor by VA, in whatever medium, as well as all information and documents, including drafts, emails, back-up copies, hand-written notes and copies that contain such information and records gathered or created by Contractor (collectively referred to as “VA information”) in the performance of this contract, regardless of storage media, are the exclusive property of VA. Contractor does not retain any property interest in these materials and will not use them for any purpose other than performance of this contract.

6.1.2. Upon completion or termination of the contract, Contractor will either provide all copies of all VA information to VA or certify that it has destroyed all copies of all VA information as required by VA in a method specified by VA, at VA’s option. Medical records of any kind including notes must be returned to the VA. The Contractor will not retain any copies of VA information. Where immediate return or destruction of the information is not practicable, Contractor will return or destroy the information within 30 days of completion or termination of the contract. All provisions of this contract concerning the security and protection of VA information that is the subject of this contract will continue to apply to VA information for as long as the Contractor retains it, regardless of whether the contract has been completed or terminated.

6.1.3. Prior to termination or completion of this contract, Contractor will not destroy VA information received from VA or gathered or created by Contractor while performing this contract without prior written approval by VA.

6.1.4. Contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in accordance with the terms of this contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies.

6.1.5. The Contractor must not make copies of VA information except as necessary to perform this agreement or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

6.1.6. Contractor must provide access to VA information only to employees, subcontractors, and affiliates only: (1) to the extent necessary to perform the services specified in this Contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of this contract, and (3) only to individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same VA information. These restrictions include the same level of background investigations, where applicable.

6.1.7. Contractor will store, transport, or transmit VA information only in an encrypted form, using an encryption application that meets the requirements of FIPS 140-2, and is approved for use by VA.

6.1.8. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two other situations: (i) in response to an order of a court of competent jurisdiction, or (ii) with VA’s prior written authorization. The contractor will refer all requests for, demands for production of, or inquiries about, VA information to VA for response.

6.1.9. If VA information subject to the contract includes information protected by 38 USC 7332, or 5705, include the following after the last sentence of the paragraph immediately above: Contractor must not release information protected by either 38 USC 5705 or 7332 in response to a court order, and must immediately refer such court orders to VA for response.

6.1.10. Prior to any disclosure pursuant to a court order, the Contractor must promptly notify VA of the court order upon its receipt by the Contractor, provide VA with a copy by fax or email, whichever is faster, and notify by telephone the VA individual designated in advance to receive such notices. If the Contractor cannot notify VA before being compelled to produce the information under court order, the Contractor will notify VA of the disclosure as soon as practical and provide a copy of the court order, including a copy of the court order, a description of the records provided pursuant to the court order, and to whom the Contractor provided the records under the court order. The notice will include the following information to the extent that the Contractor knows it, if it does not show on the face of the court order: the records disclosed pursuant to the order, to whom, where, when, and for what purpose, and any other information that the Contractor reasonably believes is relevant to the disclosure. If VA determines that it is appropriate to seek retrieval of information released pursuant to a court order before Contractor notified VA of the court order, Contractor will assist VA in attempting to retrieve the VA information involved.

6.1.11. The Contractor will inform VA by the most expeditious method available to Contractor of any incident of suspected or actual access to, or disclosure, disposition, alteration, or destruction of, VA information not authorized under this Contract (“incident”) within one hour of learning of the incident. An incident includes the transmission, storage, or access of VA information by Contractor or subcontractor employees in violation of applicable VA confidentiality and security requirements. To the extent known by the Contractor, the Contractor’s notice to VA will identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information was placed at risk or compromised), and any other information that the contractor considers relevant.

6.1.12. Contractor will simultaneously report the incident to the appropriate law enforcement entity of jurisdiction. The Contractor, its employees, and its subcontractors and their employees will cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor also will cooperate with VA in any civil litigation to recover VA information, to obtain monetary or other compensation from a third party for damages arising from any incident, or to obtain injunctive relief against any third party arising from, or related to, the incident.

6.1.13. VA will provide the Contractor with the name, title, telephone number, fax number and email address of the VA official to whom the Contractor will provide all notices required by this Contract.

6.1.14. VA has the right during normal business hours to inspect the Contractor’s facility, information technology systems and storage and transmission equipment, and software utilized to perform the contract to ensure that the Contractor is providing for the security of VA data and computer systems in accordance with the terms of this Contract.

6.1.15. Contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with all applicable Federal Information Processing Standards (FIPS) and Special Publications (SPs) issued by the National Institute of Standards and Technology (NIST) concerning VA information that is the subject of this contract. If NIST issues or updates an applicable FIPS or SP after execution of this contract, the parties agree to negotiate in good faith to implement the FIPS or SP in this contract.

6.1.16. A determination by VA that the Contractor has violated any of the information confidentiality and security provisions of this contract, including a violation of any applicable FIPS or SP, must be a basis for VA to terminate the contract for cause.

6.1.17. If anyone performing this contract, including employees of subcontractors, accesses VA computer systems or data in the performance of the contract, VA may monitor and record all such access activity. If VA monitoring reveals any information of suspected or potential criminal law violations, VA will refer the matter to the appropriate law enforcement authorities for investigation.

6.1.18. Contractor must inform its employees and other individuals performing any part of this contract that VA may monitor their actions in accessing or attempting to access VA computer systems and the possible consequences to them for improper access, whether successful or not. The Contractor must ensure that any subcontractors or others acting on behalf of, or for, the Contractor in performing any part of this contract inform their employees, associates or others acting on their behalf that VA may monitor their access activities. Execution of this contract and any subcontract or agreement constitutes consent to VA monitoring.

6.1.19. The Contractor will ensure that all individuals who will access VA data or systems in performing the contract are appropriately trained in the applicable VA confidentiality and security requirements. Contractor may do this by requiring and documenting that these individuals have completed the VA training for its employees.

6.1.20. To the extent practicable, Contractor must mitigate any harmful effect on individuals whose VA information was accessed or disclosed in an incident.

6.1.21. Contractor must require subcontractors, agents, affiliates, or others to whom Contractor provides access to VA information for the performance of this contract to agree to the same VA information confidentiality and security restrictions and conditions that apply to the Contractor before providing access.

6.1.22. The contractor must abide by FAR clauses 52.224-1 and 52.224.2.

6.1.23. The contractor must abide by FAR clauses 52.239-1 and 52.224.1-2 for Privacy or Security Safeguards

6.1.24. In the performance of any part of the work on this contract, the contractor must utilize only employees, subcontractors or agents who are physically located within a jurisdiction subject to the laws of the United States. Contractor will ensure that it does not use or disclose Patient Health Information (PHI) received from Covered Entity in any way that will remove the PHI from such jurisdiction. Contractor will ensure that its employees, subcontractors, and agents do not use or disclose PHI received from Covered Entity in any way that will remove the PHI from such jurisdiction.

7. STX671-01 LOW RISK-CONTRACTOR PERSONNEL SECURITY REQUIREMENTS (May 2010)

7.1. All contractor employees who require access to the Department of Veterans Affairs’ computer systems or routine access to VA Facilities must be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access.

7.1.1. Position Risk and Sensitivity Designations – Must be determined by Contracting Officer’s Representative (COR) in accordance with VHA Directive 0710 Appendix A. The position sensitivity for this contract has been designated as LOW RISK.

7.1.1.1. Position Risk and Sensitivity Designations are directly tied to background investigative requirements.

7.1.1.2. A position designated as Low Risk requires a National Agency Check with Inquires (NACI).

7.1.1.3. A position designated as Moderate Risk requires a Minimum Background Investigation (MBI).

7.1.1.4. A position designated as High Risk requires a Background Investigation (BI).

7.2. Contractor Responsibilities:

7.2.1. The contractor must bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM), the contractor must reimburse VA within 30 days from receipt of a bill of collection.

7.2.2. Cost and Time Frames: Low Risk (NACI)-- The case is only open for 30 days except in rare occasions when something in the person’s background requires and extension. This investigation is done by mail and that is why we must be so stringent with the paperwork. The average turn around on these cases is 45 days.

7.2.3. The contractor must prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak, and understand the English language.

7.2.4. After award and prior to contract performance, contractor must submit to the Contracting Officer’s Representative all required information to initiate background check by completing the latest version of Local Background Check Request Form for each employee providing services under this contract. This form must be provided by the COR.

7.2.5. Contractor must notify the COR prior to changing/adding new contract personnel by submitting a new Local Background Check Request Form.

7.2.6. The Contractor, when notified of an unfavorable determination by the Government must withdraw the employee from consideration of working under this contract.

7.2.7. The contractor must submit the following required forms to the VA Office of Security and Law Enforcement as outlined within automatic email notification identifying the web site link following the detailed instructions regarding completion of the application process. This includes:

7.2.7.1. Standard Form 85, Questionnaire for Non-Sensitive Positions

7.2.7.2. If needed, Continuation Sheet for Questionnaires Standard Form 86A.

7.2.7.3. FD 258, U.S. Department of Justice Fingerprint Applicant Chart; OR schedule to have electronic fingerprints as coordinated by COR.

7.2.7.4. VA Form 0710, Authority for Release of Information Form

7.2.7.5. Copies Optional Form 306, Declaration for Federal Employment (one copy submitted to office conducting electronic fingerprinting)

7.2.8. The Contractor must ensure that all personnel requiring computer access will complete the VA’s Cyber Security Training and Privacy training prior to obtaining computer access and annually thereafter.

7.2.9. Failure to comply with the contractor personnel security requirements may result in termination of the contract.

7.3. Government Responsibilities:

7.3.1. The VA Office of Security and Law Enforcement will provide the necessary forms to the contractor or to the contractor’s employees after receiving a background investigation request. The COR must submit Local Background Check Request Form to Contracting to initiate request in the Contractor Request Database (CRD).

7.3.2. Upon receipt, the VA Office of Security and Law Enforcement will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation. The forms will be returned to the Contractor if incomplete or inaccurate.

7.3.3. The VA Office of Security and Law Enforcement will notify the Contracting Office and contractor after adjudicating the results of the background investigations received from OPM.

7.3.4. The Contracting Office will file and secure evidence that investigations have been completed or are in the process of being requested appropriately.

7.3.5. The COR must ensure that all personnel requiring computer access have completed the VA’s Cyber Security Training and VA’s General Privacy Training and signed Rules of Behavior, prior to obtaining computer access and annually thereafter; hard copies provided to contract officer by contract number.

8. STX671-02 Personal Security Verification (PIV) Card and/or Security Badge Requirements for Contractor Employees (FEB 2010)

8.1. Definitions. As used in this clause –

8.1.1. Access means routine, unescorted physical entry into, and to the extent authorized, mobility within a Government facility. Also, it means the ability to obtain, view, read, modify, delete, and/or otherwise make use of information technology.

8.1.2. Contractor employee means an employee of the prime contractor or of any subcontractor, affiliate, partner, joint venture, or team members with which the contractor is associated. It also includes consultants engaged by any of those entities.

8.1.3. Facility and Government facility mean buildings, including areas within buildings, owned, leased, shared, occupied, or otherwise controlled by the Federal Government.

8.1.4. Information technology means any equipment or interconnected system or subsystem of equipment, including telecommunications equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major systems/applications and general support systems as defined by OMB Circular A-130, owned by VA or owned and operated on VA’s behalf by another party.

8.2. Access to VA Facilities or Systems.

8.2.1. General. The performance of this contract requires contractor employees to have routine, unescorted access to VA facilities. All such employees who do not already possess a current Security Badge or PIV Card acceptable to VA must be required to provide personal information, undergo an FBI National Criminal History Fingerprint Check, and obtain a Security Badge or PIV Card prior to being permitted access to any such facility in performance of this contract.