36C25726Q0175_.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C25726Q0175 12/19/2025

Lesley Kitchen; Lesley.Kitchen@va.gov 682-415-0135 1-12-2026

12PM CST

36C257 Department of Veterans Affairs NCO 17 North Texas Healthcare System Regional Procurement Office West (RPO-W) 124 E. Hwy 67, Suite 100 Duncanville TX 75137

X 100

X

561990

$16.5 Million

N/A

36C257

Department of Veterans Affairs VISN 17 North Texas Healthcare System

124 E. Hwy 67, Suite 100 San Antonio TX 78229

36C257

NCO 17

Department of Veterans Affairs North Texas Veterans Health Care Center

This is accomplished through the Tungsten Network located at:

http://www.fsc.va.gov/einvoice.asp This is mandatory and the sole method for submitting invoices.

(877) 353-9791 (512) 460-5540

See CONTINUATION Page

Description: Film Shredding Services

The contractor shall provide a quotation for Film Shredding Services in accordance with the Statement of Work and the terms and conditions contained herein.

See CONTINUATION Page

X X

X 1

Donald Smith Contracting Officer

36C25726Q0175

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

B.3 DELIVERY SCHEDULE

B.4 STATEMENT OF WORK

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.240-91 SECURITY PROHIBITIONS AND EXCLUSIONS (NOV 2025)

(DEVIATION)

C.3 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—

CERTIFICATE OF COMPLIANCE FOR SERVICES AND CONSTRUCTION (JAN 2023)

(DEVIATION)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

D.1 WAGE DETERMINATION 2015-5293 REV 31

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (NOV 2021)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: Name: _____________________________

Address: _____________________________

City/State/Zip:_____________________________

POC Name:_____________________________

POC Phone: _____________________________

POC Email:_____________________________

UEI:_____________________________

b. GOVERNMENT: Contracting Officer 36C257 Donald Smith Donald.Smith10@va.gov

Department of Veterans Affairs NCO 17 North Texas Healthcare System Regional Procurement Office West (RPO-W) 124 E. Hwy 67, Suite 100 Duncanville TX 75137

Contract Specialist 36C257 Lesley Kitchen Lesley.kitchen@va.gov Department of Veterans Affairs NCO 17 North Texas Healthcare System Regional Procurement Office West (RPO-W)

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] monthly

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

https://dvagov-my.sharepoint.com/personal/lesley_kitchen_va_gov/Documents/2026%20contracts/36C257-26-AP-1026%20GEMs%20Program/Donald.Smith10@va.gov https://dvagov-my.sharepoint.com/personal/lesley_kitchen_va_gov/Documents/2026%20contracts/36C257-26-AP-1026%20GEMs%20Program/Lesley.kitchen@va.gov

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

1.00 JB __________________ __________________

Custom Amount Disposal of non-paper products (files, metal clips, etc)

On-Site Shredding Services Sorting of Radiology Files Services Packaging of X-Ray film and delivering to shipping department Special Services Sorting and Shredding of Kerrville Radiology files.

LOCAL STOCK NUMBER: Shredding Films

GRAND TOTAL __________________

B.3 DELIVERY SCHEDULE

ITEM

NUMBER SHIPPING INFORMATION QUANTITY

DELIVERY

DATE

See SOW for details ALL 90 days for completion

B.4 STATEMENT OF WORK

1. General. Contractor required to provide secure staging, shredding, recycling of paper, radiographic films, documented confidential and sensitive information from the South Texas Veteran Health Care Services (STVHCS) / Kerrville site. The Government shall not exercise any supervision or control over the contract service providers performing the services. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

2. Description of Services / Introduction: Due to the nature of disposal in-house destruction is not feasible. There is no in-house space allocated, nor resources available, such as locked collection bins for PHI, which maintains a chain of custody of documents up until the documents are destroyed. This is provided solely by the contractor. VA Handbook 6300.1, Chapter 6- Records Disposal Program, number 7b determines that records containing PHI or other Privacy Act (PA) material must be segregated and shredded or otherwise destroyed. HIPAA regulations require the Department of Veterans Affairs to take all necessary measures to protect PHI and patient privacy.

These steps include properly destroying or disposing of documentation. Contractor will have an approximate 3 months for completion of services.

3. Separation of Film and paper –Exams completed greater than 5 years in the past (10 for mammography), will be separated from exams that are less than 5 years. They must be separated from any paper in the film jacket and the film jacket itself. Paper reports and film jackets will be shredded. The film will be placed in secure shred bins for shredding.

4. Removal of Film and paper - Palletized film will be relocated to the facility warehouse (or designated area) and the Contracting Officer Representative (COR)/Program Manager will be notified. The film will be placed in Gaylord containers and secured. The COR/Program Manager will inspect pallets and arrange for the facility to ship the palletized radiographic film to:

Department of Veterans Affairs Service and Distribution Center, Operations Division Bldg. 37, Door 14 1st Avenue 1 block North of 22nd Street Hines, IL 60141

5. The contractor shall furnish all necessary equipment, labor, and material to meet collection, staging, shredding, disposal, palletizing, strapping, wrapping, and recycling services as outlined in this SOW.

6. Shredding Services:

a. Contractor shall shred an estimated quantity of 20 gaylord containers, each equivalent to a weight capacity ranging from 4,000 to 5,000 pounds and dispose of the shredded material.

b. Contractor qualifications- The contractor and its subcontractor(s) are responsible for meeting standards outlined in VA Directive 6371, dated April 8, 2014.

c. Health Insurance Portability and Accountability Act (HIPPA) Compliance: The contractor is subject to the provisions of HIPPA. It is the responsibility of the contractor to review the requirement of HIPPA, which can be accessed at the following address: www.ahima.org. The contractor shall understand and agree that property obtained under this contract may contain records previously maintained as a system of records subject to the Privacy Act. The contract is therefore subject to the provisions of the Privacy Act and is responsible for compliance with its provisions with respect to the handling and disposal of protected information.

http://www.ahima.org/

d. Collection site(s)- The contractor shall furnish all necessary equipment, labor and material to complete secure shredding and disposal recycling services for the Department of Veterans Affairs (VA), Kerrville VA Medical Center. All separate film jackets, radiologic reports, and PHI identifiable papers shall be shredded. Services will be provided at the following location:

• Kerrville VA Medical Center 3600 Memorial Blvd, Kerrville, Tx 78028

7. Shipment of X-Ray Film

7.1 X-ray film disposition

a. The contractor shall determine x-ray film ready to be dispositioned, according to Veterans Health

Administration Records Control Schedule 10-1 (VHA RCS 10-1):

i. Radiology Films: 5 years from date of last exposure

ii. Mammograms: 10 years from date of last exposure

b. When determining date of last exposure, the x-ray film is to be maintained as ‘active’ until the last period of “radiographic” activity for the patient, which includes film AND digital images.

EXAMPLE:

Patient Smith:

Chest x-ray 1998 (x-ray film)

IVP 2006 (x-ray film) Femur 2010 (digital x-ray)

c. All x-ray films for this patient are kept until the cutoff, which begins with the last known x-ray activity, which is 2010 in this case (film + digital x-rays).

8. Shelved X-ray Film Processing:

a. Pull patient information from the shelf

b. Pull film from the jacket/envelope

c. Place film in brown box or Gaylord box

d. Place jacket in secure shred container

e. Tape box with 2” clear packing tape & tamper evident tape

f. Weigh each box

g. Write weight on the side of the box

NOTE: Only film should be placed in boxes – No envelopes/paper/jackets are to be shipped.

9. Preparing Film for Shipment

9.1 Transportation costs:

a. The Government handles the funding for the shipment of x-ray films for the facility.

Contractor will coordinate with COR/Program Manager and shipping warehouse to prepare the documents for transportation of the x-ray films.

9.2 Gaylord containers

a. The number of Gaylord containers required is approximately 25 containers for shipping.

b. The Gaylord containers are the preferred methods of shipment; they are sturdy and can hold a large amount of film. Suitable Gaylord containers may be obtained through gsaadvantage.gov, that meet the requirements of 48” X 40” X 36” with a minimum of 275 lb. test. When ordering, be sure lids are included in your order.

c. The Gaylord containers will be shipped to the facility flat and must be assembled by unfolding and utilizing 2” clear packing tape to secure the bottom flaps. The lids are also shipped to the facility flat, and the edges must be created by folding and taping, to fit securely over the top of the box.

d. Place the Gaylord container on a 40 x 48 pallet prior to filling with film. The container will be heavy once filled and will need to be moved with a pallet jack. When full, place the lid on the container, shrink wrap tightly, place tamper evident tape across the top and down the sides of the pallet, and securely band to the pallet with shipping straps in all directions.

e. Delivery Confirmation: Provide delivery confirmation and status of the x-ray film shipment upon delivery to SDC in Hines, IL, contact the VA Service & Distribution Center POCs.

10. Shipment Security

a. For further security of shipments, the contractor shall arrange to have the shipment picked up early in the week, so it will be delivered within the same week. The contractor shall avoid LTL shipments held over a weekend or a federal holiday at a carrier’s terminal.

11. Use of Facility

a. Storage and staging area. The contractor is permitted to stage additional cabinets or bins in the

Kerrville Imaging Department located at VA Kerrville Division. The contractor shall coordinate with COR/Program Manager for exact location of authorized staging area.

b. Loading docks. Loading docks are present at VA Kerrville Contractor may be used as needed.

c. Ramps. Ramps are present at VA Kerrville. Contractor may be used as needed.

d. Parking areas. Parking, loading, and unloading areas are available for contractor use. These areas are NOT specifically marked or identified for contractor use. The contractor shall coordinate with the COR for exact parking, loading and unloading areas.

12. Invoicing: The contractor shall submit invoices in whole monthly increments in arrears. The invoicing period of performance shall start on the first day of the month and end on the last day of the month.

13. Training (VA MANDATORY): Contractor shall ensure employees and subcontractor employees meet mandatory training course requirements defined herein; all training must be completed by the contractor’s staff as required by the VA. List all training, associated time and frequency.

List all training required, frequency and associated time

26. List all training required, frequency and associated time

a. Non-Personal Healthcare Services: The parties agree that the Contractor and all contractor’s staff shall not be considered VA employees for any purpose.

b. Indemnification: The Contractor shall be liable for, and shall indemnify and hold harmless the

Government against, all actions or claims for loss of or damage to property or the injury or death of persons, arising out of or resulting from the fault, negligence, or act or omission of the Contractor, its agents, or employees.

c. No Employee status: The Contractor shall be responsible for protecting Contractor’s staff. To carry out this responsibility, the Contractor shall provide or certify that the following is provided for all their staff providing services under the resultant contract:

a. Workers’ compensation

20. Control Schedule 10-1 (VHA RCS 10-1)

a. The contractor shall perform interim destruction of all material on-site prior to leaving the area. Interim destruction serves as a reasonable physical safeguard, providing an additional layer of security for temporary paper records identified for destruction. This process occurs while the records are stored at a VA location awaiting final destruction or when they are removed from VA custody until final destruction is completed at an off-site location. Interim destruction is generally accomplished through macerating, chopping, pulverizing, or shredding, ensuring that the material becomes unreadable and cannot be reconstructed. All shredding shall be in accordance with VA Directive 6371 dated 8 April 2014.

b. A final destruction certificate or manifest from the destruction company shall be provided in an electronic report identifying date collected, date destructed and facility location to the COR.

c. White or colored paper and reams of paper can be placed into collection containers for shredding and recycling. The contractor shall be responsible for removing all paper products from the radiologic film. Paper products will be shredded onsite and radiologic films will be boxed and prepared for shipment according to SOW.

d. The contractor shall submit any limitations on items that can be included for shredding and recycling in this system, but it is expected that compact discs, paper clips, and staples can be placed in collection containers. Evaluation of the restrictions shall be considered in the award of the contract. Specification of what items shall be included in the collection/destruction shall be the decision of the COR/Program Manager.

21. Collection schedule. The Contractor assumes all responsibility for the routine collection, in-house transportation, and storage of materials.

14. Training 15. Frequency (once a year, etc)

16. Annual Hours

17. 10176 VA Privacy and

HIPPA

18. Once a year 19. 1 hour

20. Site orientation 21. One time 22. 1 hour

23. VISTA training 24. One time 25. 1 hour

Storage or staging locations will be permitted upon approval of the COR/Program Manager at the Kerrville campus. Contractor may store bins for the collection of documents from consoles prior to interim destruction being performed at COR/Program Manager approved locations. All bins are required to be locked and stored inside the approved storage location.

22. Containers. Contractor shall furnish all necessary containers and labor for individual generators’ collection of sensitive documents and recycling. The contractor shall provide lockable containers for the storage of paper product until it is shredded. All containers are to be in serviceable condition and compliant with HIPPA regulations and NFPA standards. Any containers deemed unserviceable by the COR/Program Manager shall be removed and replaced at no additional cost to the government.

a. All containers shall have posted on the exterior a listing of materials that can be deposited. The Contractor shall provide replacement containers and/or material listing (to be posted on the containers) when damaged or broken due to normal fair wear and tear or change in collection practice.

b. Keys shall only be provided to the facility COR and the contractor.

c. All containers shall have a slot to insert paper and be equipped with a locking mechanism that can be opened with an identical key. A total of 3 keys shall be provided to the COR so that containers can be accessed by the government when necessary.

d. Containers shall be cleaned inside and out quarterly and as needed if liquids or other inappropriate items are deposited within.

e. The contractor shall ensure security of contents from the point of collection to final destruction. Shredding is to be performed on-site; the Contractor shall leave exterior area where mobile shredder is used clean and free of any debris from their work/visit.

23. Hours of Operation. Due to nature of work, access to pipe space work area will be granted

24 hours a day / 7 days a week until radiologic films are sorted and palletized. For warehouse access, services are expected to be performed between the hours of 8:00 AM and 4:00 PM CST, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

24. Recognized Holidays. The Contractor shall ensure holidays are reflected in the schedules.

The Contractor is not required to provide routine services on the following approved holidays:

New Year’s Day - 1 January Martin Luther King Day - 3rd Monday in January Washington’s Birthday - 3rd Monday in February Memorial Day - last Monday in May Juneteenth – June 19th

Independence Day - 4 July Labor Day - 1st Monday in September Columbus Day - 2nd Monday in October Veteran’s Day - 11 November Thanksgiving Day - 4th Thursday in November Christmas Day - 25 December

If a holiday falls on a Saturday, the preceding Friday will be observed. If a holiday falls on Sunday, the following Monday will be observed. If a holiday falls on a scheduled service day, the Contractor will be responsible for rescheduling services for the first day after the holiday observance.

25. Additional Service Requirements

All VA sensitive information that is contained in paper records shall be handled by the most secure, economical, and effective means in accordance with legal requirements. Patient Identifiable Information (PII) is the most common form of sensitive information handled at VA;

therefore, it requires the use of extraordinary procedures for its protection. PII that is not properly disposed of can result in actual or potential identity theft and cause personal hardship to the subject individuals. It is imperative that the appropriate means of destruction be used for all VA temporary paper records. VA’s preference is for a method of destruction that permits paper records to be recycled, while still meeting the requirements for final destruction. Procedures for the destruction of these records are identified in this document and outlined in VA Directive 6371.

26. Key Personnel.

a. The Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the contracting officer.

b. The contract manager or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract.

c. The contract manager or alternate shall be available between 8:00 a.m. to 3:30p.m., Monday through Friday except for Federal holidays or when the Government facility is closed for administrative reasons. The Contractor Representative’s name and telephone number must be provided by the contractor with the proposal.

d. The contractor shall have identifiable company uniforms or company ID badges.

27. Post Award Conferences or Periodic Progress Meetings. The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the contracting officer will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

28. Quality Control. The contractor shall establish and maintain a complete Quality Control Plan to ensure the requirements of the contract are provided as specified.

a. The quality control plan shall comply with the requirements of FAR 52.246.4, Inspection of Services—Fixed Price. The plan shall include the following:

b. An inspection system covering all the services specified in this SOW; must specify the areas to be inspected on a scheduled or unscheduled basis, how often inspection will be accomplished, and the title of the individual (s) who will perform the inspections.

c. The methods for identifying and preventing defectives in the quality of service performed before performance become unacceptable.

d. On-site records of all inspections conducted by the contractor and necessary corrective action taken. This documentation shall be made available to the government during the term of the contract.

29. Security Requirements:

a. A prohibition on unauthorized disclosure: “Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without prior written agreement of the VA.”

b. A requirement for data breach notification: “Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor has access, the contractor shall immediately and simultaneously notify the COR/ Program Manager, the designated ISO, and Privacy Officer for the contract. The term ‘security incident’ means an event that has, or could have, resulted in unauthorized access to, loss, or damage to VA assets, or sensitive information, or an action that breaches VA security procedures.”

c. A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving any Sensitive Personal Information (SPI) the contractor processes or maintains under this contract, the contractor shall be liable to the VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.”

30. Information Security Requirements

a. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

b. Access to VA Information and VA Information Systems: A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

c. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

d. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

31. VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data General, FAR 52.227-14(d) (1).

b. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

c. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

d. Security Incident Investigation:

The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR/ Program Manager and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

e. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

f. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

g. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal violations associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

32. Information Security and Privacy Training

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems;

b. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, VA Handbook 6500.6, Appendix E relating to access to VA information and information systems;

c. Successfully complete the Privacy and Information Security Awareness and Rules of Behavior training and annually complete required security training;

d. Successfully complete the appropriate VA Privacy and HIPAA training and annually complete required privacy training; and Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document - e.g., any role-based information security training required in accordance with NIST Special Publication 800- 16, Information Technology Security Training Requirements.

e. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

f. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

g. Security Requirements for Unclassified Information Technology Resources:

h. The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

33. Compliance with Hospital Policies and Procedures:

a. Contractors shall adhere to all hospital policies and procedures related to non-smoking except in designated areas and the requirement for using I.D. badges. In addition, the contractor must also adhere to the Information Security, Records Management and Privacy local and national policies prescribed herein:

b. Information Systems Officer, Information Protection: The contractor shall have access to

VA desktop computers, shall have access to online resources belonging to the government while conducting services in the application of complex adaptive systems theory to health care organizations. The certification and accreditation requirements do not apply to this procurement nor is a security accreditation package required.

c. Privacy Officer: The contractor shall have access to Patient Health Information (PHI) and shall have the capability of accessing patient information during the services provided to the VA. All documents accessible to the Contractor shall be de-identified through the destruction of the sensitive information which is the purpose of this contract.

34. Records Manager:

a. The following standard Items relate to records generated in executing this contract and should be included:

Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a).

These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

b. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

c. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for

Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

d. STVHCS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of STVHCS or destroyed except in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to STVHCS. The agency must report promptly to NARA in accordance with 36 CFR 1230.

e. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle.

f. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected.

g. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to STVHCS control or the Contractor must hold it until otherwise directed.

Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED.

h. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and STVHCS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

i. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with STVHCS policy.

j. The Contractor shall not create or maintain any records containing any non-public STVHCS information that are not specifically tied to or authorized by the contract.

k. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

l. STVHCS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which STVHCS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

m. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VHA-provided records management training, Talent Management System (TMS) Item #10176, Privacy and Information Security, Rules of Behavior. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52#FAR_52_252_1 http://www.va.gov/oal/library/vaar/index.asp

(End of Clause)

FAR

Number

Title Date

52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS NOV 2023

52.204-9

52.204-13

52.209-6

52.212-4

PERSONAL IDENTITY VERIFICATION OF CONTRACTOR

PERSONNEL

SYSTEM FOR AWARD MANAGEMENT MAINTENANCE

PROTECTING THE GOVERNMENT’S INTEREST WHEN

SUBCONTRACTING WITH CONTRACTORS DEBARRED,

SUSPENDED, PROPOSED FOR DEBARMENT, OR

VOLUNTARILY EXLUDED

CONTRACT TERMS AND CONDITIONS-COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES

JAN 2011

OCT 2018

JAN 2025

NOV 2023

52.222-36 52.222-41 52.222-50 52.222-54 52.222-62 52.226-8

52.232-33

52.232-40

52.233-3

EQUAL OPPORTUNITY FOR VETERANS

SERVICE CONTRACT LABOR STANDARDS

COMBATING TRAFFICKING IN PERSONS

EMPLOYMENT ELIGIBILITY VERIFICATION

PAID SICK LEAVE UNDER EXECUTIVE ORDER 13706

ENCOURAGING CONTRACTOR POLICIES TO BAN TEXT

MESSAGING WHILE DRIVING

PAYMENT BY ELECTRONIC FUNDS TRANSFER-SYSTEM

FOR AWARD MANAGEMENT

PROVIDING ACCELERATED PAYMENTS TO SMALL

BUSINESS SUBCONTRACTORS

PROTEST AFTER AWARD

JUN 2020

AUG 2018

NOV 2021

JAN 2025

JAN 2022

MAY 2024

OCT 2018

MAR 2023

AUG 1996

852.203-70 852.219-73

852.232-72 852.242-71

COMMERCIAL ADVERTISING

VA NOTICE TO TOTAL SET-ASIDE FOR CERTIFIED

SERVICE-DISABLED VETERAN-OWNED SMALL

BUSINESSES

ELECTRONIC SUBMISSION OF PAYMENT REQUESTS

ADMINISTRATIVE CONTRACTING OFFICER

MAY 2018

JAN 2023

NOV 2018

OCT 2020

C.2 52.240-91 SECURITY PROHIBITIONS AND EXCLUSIONS (NOV 2025) (DEVIATION)

(a) Definitions. As used in this clause—

American Security Drone Act-covered foreign entity means an entity included on a list that the Federal Acquisition Security Council (FASC) develops and maintains and publishes in the System for Award Management (SAM) at https://www.sam.gov (section 1822 of Pub. L. 118-31, 41 U.S.C. 3901 note prec.).

Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Covered application means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

Covered article, as defined in 41 U.S.C. 4713(k), means:

(1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153);

(3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or

(4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

Covered foreign country means The People’s Republic of China.

Covered telecommunications equipment or services means—

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Critical technology means—

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

https://www.sam.gov

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled—

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

FASC-prohibited unmanned aircraft system means an unmanned aircraft system manufactured or assembled by an American Security Drone Act—covered foreign entity.

FASCSA order means any of the following orders issued under the Federal Acquisition Supply Chain Security Act (FASCSA) requiring removing covered articles from executive agency information systems or excluding one or more named sources or named covered articles from executive agency procurement actions, as described in 41 CFR 201-1.303(d) and (e):

(1) The Secretary of Homeland Security may issue FASCSA orders that apply to civilian agencies, to the extent not covered by paragraph (2) or (3) of this definition. This type of FASCSA order may be referred to as a Department of Homeland Security (DHS) FASCSA order.

(2) The Secretary of Defense may issue FASCSA orders that apply to the Department of Defense (DoD) and national security systems other than sensitive compartmented information systems. This type of FASCSA order may be referred to as a DoD FASCSA order.

(3) The Director of National Intelligence (DNI) may issue FASCSA orders that apply to the intelligence community and sensitive compartmented information systems, to the extent not covered by paragraph (2) of this definition. This type of FASCSA order may be referred to as a DNI FASCSA order.

Information technology, as defined in 40 U.S.C. 11101(6)—

(1) Means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use—

(i) Of that equipment; or

(ii) Of that equipment to a significant extent in the performance of a service or the furnishing of a product;

(2) Includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but

(3) Does not include any equipment acquired by a Federal contractor incidental to a Federal contract.

Intelligence community, as defined by 50 U.S.C. 3003(4), means the following—

(1) The Office of the Director of National Intelligence;

(2) The Central Intelligence Agency;

(3) The National Security Agency;

(4) The Defense Intelligence Agency;

(5) The National Geospatial-Intelligence Agency;

(6) The National Reconnaissance Office;

(7) Other offices within the Department of Defense for the collection of specialized national intelligence through reconnaissance programs;

(8) The intelligence elements of the Army, the Navy, the Air Force, the Marine Corps, the Coast Guard, the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Department of Energy;

(9) The Bureau of Intelligence and Research of the Department of State;

(10) The Office of Intelligence and Analysis of the Department of the Treasury;

(11) The Office of Intelligence and Analysis of the Department of Homeland Security; or

(12) Such other elements of any department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the intelligence community.

Interconnection arrangement means arrangements governing the physical connection of two or more networks to allow the use of another’s network to hand off traffic where it is ultimately delivered (e.g., connecting a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Kaspersky Lab-covered article means any hardware, software, or service that—

(1) Is developed or provided by a Kaspersky Lab-covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a Kaspersky Lab-covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a Kaspersky Lab-covered entity.

Kaspersky Lab-covered entity means—

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab, including any change in name, e.g., “Kaspersky”;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or