36C25726Q0505 06.05.26.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C25726Q0505 06-05-2026

Rafael Rodriguez (254) 560-0262 06-10-2026

11AM CDT

Network Contracting Office 17

5441 Babcock Road Ste. 302

San Antonio TX 782540

X

541519

$34 Million

N/A

X

Department of Veterans Affairs

North Texas Veterans HCS

450 N. Lancaster Rd.

Dallas, TX 75216

Department of Veterans Affairs

Central Texas Veterans HCS

1901 Veterans Memorial Dr. Building 171

Temple TX 76504

This is accomplished through the

Tungsten Network located at:

http://www.fsc.va.gov/einvoice.asp

This is mandatory and the sole method for submitting invoices.

(877) 353-9791 (512) 460-5540

See CONTINUATION Page

Title: BD Alaris SMS Service Contract

To provide software management services for the Alaris

Infusion System server and software components at the

VA North Texas.

This is a solicitation for a fixed-price contract.

Quotes MUST be valid for at least 60 days.

Quotes must be submitted via email to Oneka.Robertson@va.gov

By 11PM CST ON JUNE 10, 2026.

ALL QUESTIONS MUST BE RECEIVED BY 12PM CST ON JUNE 08, 2026.

See CONTINUATION Page

X X

X 1

Rafael Rodriguez

Contracting Officer mailto:Oneka.Robertson@va.gov

36C25726Q0505

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

B.3 DELIVERY SCHEDULE

B.4 SCOPE OF WORK

SECTION C - CONTRACT CLAUSES

C.1 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.2 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) ... 35

C.3 52.222-90 ADDRESSING DEI DISCRIMINATION BY FEDERAL CONTRACTORS

(APR 2026)

C.4 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.5 52.232-29 TERMS FOR FINANCING OF PURCHASES OF COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES (NOV 2021)

C.6 52.240-91 SECURITY PROHIBITIONS AND EXCLUSIONS (NOV 2025)

(DEVIATION)

C.7 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

C.8 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—

CERTIFICATE OF COMPLIANCE FOR SERVICES AND CONSTRUCTION (NOV 2022)

C.9 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.10 VAAR 852.237-75 KEY PERSONNEL (OCT 2019)

C.11 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (OCT 2025) (DEVIATION FEB 2025)

SECTION D - SOLICITATION PROVISIONS

D.1 52.216-1 TYPE OF CONTRACT (NOV 2025) (DEVIATION)

D.2 52.240-90 SECURITY PROHIBITIONS AND EXCLUSIONS REPRESENTATIONS

AND CERTIFICATIONS (NOV 2025) (DEVIATION)

D.3 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE

(FEB 1998)

D.4 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (NOV 2021)

D.5 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (OCT 2025) (DEVIATION

FEB 2025)

D.6 52.219-1 SMALL BUSINESS PROGRAM REPRESENTATIONS (NOV 2025)

(DEVIATION)

D.7 VAAR 852.252-70 SOLICITATION PROVISIONS OR CLAUSES INCORPORATED

BY REFERENCE (JAN 2008)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C257 : Oneka Robertson

Network Contracting Office 17

5441 Babcock Road Ste. 302

San Antonio TX 782540

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Monthly

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment

Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBE

R

DESCRIPTION OF

SUPPLIES/SERVIC

ES

QUANTIT

Y

UNI

T UNIT PRICE AMOUNT

1.00 YR ________________

Annual maintenance and support for BD Alaris SMS servers and software Contract Period: Base POP Begin: 06-13-2026 POP End: 06-12-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DE01 - IT and Telecom - End User: Help Desk; Tier1-2, Workspace, Print, Output, Productivity Tools (Labor)

Annual maintenance and support for BD Alaris SMS servers and software Contract Period: Option 1 POP Begin: 06-13-2027 POP End: 06-12-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DE01 - IT and Telecom - End

Annual maintenance and support for BD Alaris SMS servers and software Contract Period: Option 2 POP Begin: 06-13-2028 POP End: 06-12-2029 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DE01 - IT and Telecom - End

Annual maintenance and support for BD Alaris SMS servers and software Contract Period: Option 3 POP Begin: 06-13-2029 POP End: 06-12-2030 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DE01 - IT and Telecom - End

Annual maintenance and support for BD Alaris SMS servers and software Contract Period: Option 4 POP Begin: 06-13-2030 POP End: 06-12-2031 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DE01 - IT and Telecom - End

GRAND TOTAL ________________

B.3 DELIVERY SCHEDULE

ITEM

NUMBER SHIPPING INFORMATION QUANTITY

DELIVERY

DATE

0001 SHIP TO: Department of Veterans Affair Dallas VAHCS, Garland Hospital Sam Rayburn Memoria 500 S. Lancaster Rd., 3700 Mar Dallas, TX 75216 7167

USA

1.00 06/12/2027

MARK FOR: Tony Pham

(214) 857-1040 tony.pham1@va.gov

FOB: DESTINATION

1001 SHIP TO: Department of Veterans Affair Dallas VAHCS, Garland Hospital Sam Rayburn Memoria 500 S. Lancaster Rd., 3700 Mar

1.00 06/12/2028

2001 SHIP TO: Department of Veterans Affair

Hospital Sam Rayburn Memoria 500 S. Lancaster Rd., 3700 Mar

1.00 06/12/2029

3001 SHIP TO: Department of Veterans Affair

Hospital Sam Rayburn Memoria 500 S. Lancaster Rd., 3700 Mar

1.00 06/12/2030

4001 SHIP TO: Department of Veterans Affair

Hospital Sam Rayburn Memoria 500 S. Lancaster Rd., 3700 Mar

1.00 06/12/2031

B.4 SCOPE OF WORK

Rev 2.0 7

SOFTWARE MANAGEMENT SERVICES

PERFORMANCE WORK STATEMENT

The purpose of this procurement is to acquire infusion pump software management services

(SMS) for use in VA North Texas, VISN 17. The Contractor shall provide the Alaris Support

Program required to maintain and operate the Alaris Infusion System from BD (formerly

CareFusion) currently located at VA North Texas.

BACKGROUND

Software management services for the Alaris Support Program includes software enhancements to server-based Alaris Infusion System software components; services that include internet, webinar and on-site training and clinical education; support ranging from remote monitoring of the Alaris Systems Manager to technical support for the Alaris Infusion

System; and includes collection of data and providing analytics tools and services. The Software enhancements do not include software updates or version upgrades to infusion device hardware that is not part of the server-based Alaris Infusion System.

The following components comprise the Alaris Infusion System located at VA North Texas for this requirement.

Table 1. Alaris Infusion System Components

VA Medical Device Nomenclature System (VAMDNS) Category

Model

INFUSION PUMPS: MULTITHERAPY:

SYRINGE

ALARIS SYR MODULE 8110

INFUSION PUMPS: MULTITHERAPY ALARIS PUMP MODULE 8100

INFUSION CONTROLLERS ALARIS PC UNIT 8015

INFUSION PUMPS: ANALGESIC:

PATIENT-CONTROLLED

ALARIS PCA MODULE 8120

MONITORS: PHYSIO: EXHALED

CO2: BEDSIDE/INTRAOP

ALARIS ETCO2 MODULE 8300

NETWORKED SERVERS: MEDICAL Alaris Systems Manager; BD Care Coordination Engine

SOFTWARE: MEDICAL Guardrails Suite MX; Guardrails Editor;

Infusion Knowledge Portal; Alaris System Maintenance

Alaris Infusion System Description. Infusion system modules connect to an infusion controller

(PCU). The PCU connects wirelessly to the VA enterprise network to transmit and receive data to and from the Alaris Systems Manager server. The Alaris Systems Manager resides on a server (virtual) in a VA data center. Users will access the Alaris Systems Manager server to manage system configuration, retrieve pump connectivity data, capture data analytics, and upload infusion drug libraries. Users will also access software applications such as Guardrails

Editor and Infusion Knowledge Portal to manage drug library configuration and analyze reports collected from infusion data. The Alaris System Maintenance software is utilized during performance of Alaris Infusion System maintenance.

Rev 2.0 8

The Contractor shall provide the SMS required under this contract for the following Alaris

Infusion System equipment covered under this contract. All services performed shall support compatibility with the current infusion equipment.

Table 2. Supported Alaris Equipment and Software

Facility Name Server/Application Name

Operating System/Version

VA North Texas Alaris Systems Manager Windows Server

2022 LTSC

VA North Texas Guardrails Suite MX Version 12.x

VA North Texas Alaris System Maintenance

Version 12.x

SCOPE OF WORK

The Contractor shall provide software management services for the Alaris Infusion System server and software components identified in Table 2 above. The services shall be in accordance with the tasks and deliverables as described in this Performance Work Statement

(PWS). For those components of the system subject to software updates, the Contractor shall complete all system enhancements and patching with clear communication and preparation.

The Contractor shall communicate all enhancements and support activations required to keep the system running effectively to the primary point of contact (POC) or the contracting officer representative (COR). All maintenance and updates shall be scheduled at least three (3) days in advance with the COR.

Information Security Considerations

All VA sensitive information shall be protected at all times, in accordance with VA Local site guidelines. The Contractor shall report any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information to the COR.

Any wireless connectivity to the VA network must be compatible with 802.11b/g/n and FIPS

140-2 compliant.

Any remote service support requires a Memorandum of Understanding/Interconnection Security

Agreement (MOU/ISA) with the VA.

DELIVERABLES

The Contractor shall perform/provide the following services:

Training

The Contractor shall include on-site nursing clinical support training for practice reinforcement that can be used for compliance rounds and hospital best practices.

One time during the base year of the contract period and any subsequent option year, the

Contractor must provide one eight (8) hour day of on-site clinical consulting at each facility for

Rev 2.0 9 every 500 infusion devices installed at that facility. The training must include nursing staff interactions with the devices and recommending improved practices for medication safety. The

COR will provide the Contractor with requested training dates for each facility during the base year of the contract and any subsequent option year. The Contractor will work with the COR in good faith to reasonably accommodate the requested training dates.

The Contractor shall provide a written report to each facility for each practice reinforcement visit.

The Contractor shall include a workshop with clinical peers to support customer adoption of

Infusion Knowledge Portal software and enhance interpretation skills of IKP data.

Workshop shall be for a period of 2 days and hosted by the Contractor at VA North Texas once during the base year of the contract and each subsequent option year (annually). The COR will provide the Contractor with requested workshop dates for each facility during the base year of the contract and any subsequent option year. The Contractor will work with the COR in good faith to reasonably accommodate the requested workshop dates.

Workshop shall cover defining and creating a systematic approach to analyzing Guardrails

Reporter software alerts and refine drug libraries, dose limits, and clinical advisories to achieve maximum impact for the organization.

The Contractor shall provide access to online education. Video content must be made available, upon request, to VA education staff and allowed to be uploaded by the VA to internal learning management systems.

The Contractor shall include Suite training sessions with clinical peers to refresh skills on the use of Infusion Knowledge Portal and Editor training. The training sessions shall be available monthly and can be used as needed.

The Contractor shall provide tuition annually for up to two (2) VA representatives to attend the

System Data Workshop.

Support

The Contractor shall provide phone or email access to highly qualified Pharmacy Consultants and Insight Consultants to address customer data set questions and concerns and assist with the interpretation of CQI data. The Contractor shall, to their best efforts, provide a resolution turnaround time of 48 hours from the initial phone call or email communicating a customer issue.

The Contractor shall provide access to qualified Pharmacy Consultants who hold the RPh credential and have at least 3 years’ experience working with BD Continuous Quality

Improvement (CQI) information to make recommendations for improved safety limits on specific pharmaceutical products.

The Contractor shall provide access to Insight Consultants (formerly CQI Managers) who must have at least 3 years’ experience working with BD CQI information to make recommendations for improved safety limits on specific pharmaceutical products and other data set parameters.

Rev 2.0 10

The Contractor shall provide live technical telephone support with BD authorized support professionals who are based in the United States. The team must be ready to assist and provide support for equipment covered in this contract from 8:00am to 5:00pm CST, Monday through Friday.

The Contractor shall provide Insight Consultant data support via phone or email from 8:00am to

7:00pm CST, Monday through Friday, for questions related to the use of the software and interpretation, review, and consulting of data.

Data & Analytics

The Contractor shall provide real-time monitoring of the Alaris Systems Manager to ensure system uptime, functionality, optimization, and health in accordance with the national MOU/ISA between the Contractor and VA which is made part of this contract and is incorporated by reference herein.

The Contractor shall provide concise, actionable information on the hospital’s infusion management practices, without requiring analytical or reporting software installation or in-house technical resources. This includes unlimited access to a web-based portal defined by hospital with analytics reports and the ability to view all infusions. The Government can request a quarterly phone call or report with the data analyst to review the findings in this report.

The Contractor shall provide analytics reports and the ability to view all infusions (not just those outside of prescribed ranges). This information must be web-based and be accessible to an unlimited number of users per hospital. These services would require hosting on a vendor platform but must not contain any sensitive information, in accordance with the national

MOU/ISA.

Software Updates & Maintenance

If the Contractor releases updates to the applications or server identified in Table 2 to enhance the security or operation of the software, the Contractor shall deliver the enhancement to the

Government in machine-readable form with instructions to assist the Government with installing the enhancement. These enhancements will be provided to the Government within 60 days of their issuance or data of first commercial availability, with no additional charge to the

Government, for installed instances of the software. As applicable, the Contractor will install updates remotely through the Contractor’s remote access solution. The Contractor shall use commercially reasonable efforts to correct errors in the software that materially affect the functionality of the software.

All labor, time, materials, equipment, travel, service manuals, and supplies necessary to provide the services required under this contract shall be included in the contract price. One time during each annual period, the Contractor will perform one (1) on-site technical service visit for up to eight (8) hours for each 80 PC units to download CQI data and upload the Government’s drug library data set onto the licensed units. The Contractor shall provide telephone support to the

Government regarding the operation of and potential errors in the software.

Rev 2.0 11

The Contractor shall provide enhancements to the Guardrails Suite MX and Guardrails Editor software when commercially available. This includes providing any updates to the Alaris

Systems Manager that are required to install the newest version of Suite MX software.

The Contractor shall provide Alaris Systems Manager service patch management of the operating system, Systems Manager application, and other software components. The

Contractor shall provide rigorous testing before deployment of software patches and updates, including customized patch cycles and notifications options. All software patches and updates shall be provided at no additional cost to the Government. Remote management of the server shall be delivered in accordance with the most current version of the national MOU/ISA between

VA and the Contractor.

The Contractor shall provide CareFusion Coordination Engine (CCE) service patch management of the operating system, CCE application, and other software components. The

Contractor shall provide rigorous testing before deployment of software patches and updates, including customized patch cycles and notifications options. All software patches and updates shall be provided at no additional cost to the Government. Remote management of the server shall be delivered in accordance with the most current version of the national MOU/ISA between

VA and the Contractor.

The Contractor shall provide remote installation of server system patches, including the operating system, Alaris Systems Manager, and other system components which will be patched regularly.

Software update/enhancement installations shall normally be scheduled and performed outside normal business hours, 8:00am to 5:00pm CST Monday through Friday, of coverage at no additional charge to the Government. The COR may approve software installations outside of these hours to meet facility needs.

Unscheduled Maintenance (Emergency Repair Service)

The Contractor’s Field Service Engineer (FSE) shall respond via phone call to the COR or his/her designee immediately after receipt of telephoned emergency repair service notification twenty-four (24) hours per day. If the problem cannot be corrected by phone, the FSE will commence work (on-site or remote desktop response) within two (2) hours after receipt of the notification and will proceed progressively to completion without undue delay. This requirement for response time shall be the same for both service calls during the VA normal business hours and after-hour service calls. The COR will provide the Contractor with (a) an accurate description of the software error; (b) the steps necessary to reproduce the software error, if available; (c) if required, the data being processed at the time of the software error and associated log files; and (d) the severity of the software error, including the circumstances that lead to the software error. The COR and the Contractor will communicate and mutually agree on the severity level of the software error in writing.

Scheduled Maintenance

The Contractor shall perform patches and enhancements to the software components identified in Table 2 to ensure the Alaris Infusion System equipment and software perform in accordance with the latest OEM maintenance procedures and protocols. Patching shall be provided for all

Rev 2.0 12 environments: pre-production, production, and training environments. Scheduled software maintenance shall be scheduled at least three (3) days in advance with the COR. An outline of the scheduled software maintenance procedures shall be provided to the COR. The Contractor shall provide and utilize procedures and checklists with worksheet originals indicating work performed, as applicable. This documentation shall be provided to the COR at the completion of the scheduled software maintenance. The Contractor shall provide written description of scheduled software maintenance. This description shall include an itemized list of the procedures performed.

Scheduled software maintenance services shall include, but need not be limited to, the following:

Reviewing operating system software diagnostics to ensure that the system is operating in accordance with the manufacturer’s specifications

Performing remedial software maintenance of non-emergent nature

Returning the equipment to the operating condition, per OEM standards

Providing documentation of services performed

The Contractor shall perform scheduled maintenance services from 8:00am to 5:00pm CST, Monday through Friday. All exceptions to the scheduled software maintenance schedule shall be arranged and approved in advance with the COR.

Documentation & Reports

The Contractor shall provide written reports detailing the software management services provided under the contract. The documentation shall include detailed descriptions of the scheduled and unscheduled software maintenance (i.e., emergency software repairs (ESR)) procedures performed, including updates and services required to maintain the software. The

ESR shall consist of a separate report for the item(s) covered under this contract. Grouping reports of services performed under this contract with reports of services performed under other contracts on “one” ESR is prohibited. In addition, each ESR shall, at a minimum, document the following data legibly and in complete detail:

Contractor information:

Name of Contractor

Contract Number

Name of FSE who performed the services

Contractor service ESR number/log number

Date and time (starting and ending), software downtime, and hours on-site for service call

VA purchase order numbers covering the call

Description of problem reported by COR

Rev 2.0 13

Identification of software to be serviced:

Software license and version number

Inventory ID number

Manufacturer name

Device name, model number, and serial number

Any other manufacturer identification numbers

Itemized description of service performed:

Labor and travel

Software patches

Parts (with part numbers)

Location of problem/corrective action

Total cost to be billed, if applicable (i.e., service rendered after normal hours of coverage)*

Signatures:

FSE performing services described

Authorized VA employee who witnessed service described

*Any additional charges for work performed outside the scope of this contract shall be coordinated with the CO (Contracting Officer) and COR before service is initiated.

Payments

All invoices shall be submitted monthly in arrears. Invoices shall be properly prepared in accordance with FAR 52.212-4, shall contain sufficient detail, shall match with the service tickets for the work rendered, and shall match the contracting line-item numbers (CLINs).

Invoices shall be sent electronically to the VA Financial Services Center for payment processing via their electronic e-Invoice system. At a minimum, invoices shall include the following details:

Contract number

Purchase order number (Correct purchase order number which will be issued by the Contracting

Officer after the contract is awarded. Invoices without correct purchase order number shall be rejected and returned to the Contractor.)

Item(s) covered (to include serial numbers if applicable)

Description of the services rendered

Billing period in which the services were rendered

Invoice number and date

Rev 2.0 14

Competency and Certification of Personnel Servicing Equipment

The Contractor shall provide fully qualified FSEs to perform the software maintenance and repair services required under this contract. “Fully qualified” is defined as having successfully completed OEM training required for the software components identified in Table 2 along with any associated equipment.

The FSEs shall be authorized by the Contractor to perform the maintenance services. All work shall be performed by fully qualified competent FSEs. Upon request, the Contractor shall provide copies of all OEM training certificates for FSEs showing types of software and equipment and dates of training for all software and equipment identified to be covered. When deemed appropriate, the COR reserves the right to prohibit Contractor personnel from working on VAMC software and equipment.

PERFORMANCE STANDARDS

Table 3. Performance Standards

Deliverable Reference Paragraph

Deliverable Description

Standard Performance Threshold

Method of Surveillance

3.1 Web-based refresher training for infusion data

On demand 90% Monthly surveillance

3.1

One (1) on-site nursing clinical support for practice reinforcement for eight (8) hours for each 500 infusion units)

As needed 100% Periodic surveillance of access

3.2

Access to Pharmacy Consultants via phone/email

As needed No more than 1 instance of non-compliance

Periodic surveillance of access

3.2 Live technical telephone support

As needed during normal business hours

No more than 1 instance of non-compliance

Periodic surveillance of access

3.3

Access to Knowledge Portal by all registered staff

Web-based portal is always accessible

95% Periodic surveillance of access by CE

3.3 Infusion Analytics Services

Data Analysts are available quarterly

100% Quarterly surveillance

Rev 2.0 15

3.4

One (1) on-site technical service visit for up to eight (8) hours for each 80 PC units

As needed 100% Periodic surveillance of access

3.4 Guardrails Suite MX Software enhancements

Updates and maintenance are completed when commercially available and reported to the

COR

95% Inspection of service report by the COR

3.4 Server patches and updates

Patch management is completed regularly, documented, and reported to the

COR

95% Inspection of service report by the COR

3.4.1

Technical support for Emergency Repair Service

Immediate response with work commencement within two (2) hours of notification by

FSE

100% Inspection of service report by the COR

3.5 Documentation &

Reports

All SMS activities are documented and reported to the COR

100% Inspection of report by the

COR

PERFORMANCE PERIOD

The period of performance (POP) shall be for:

Base Year – June 13, 2026 to June 12, 2027

Option Year One – June 13, 2027 to June 12, 2028

Option Year Two – June 13, 2028 to June 12, 2029

Option Year Three – June 13, 2029 to June 12, 2030

Option Year Four – June 13, 2030 to June 12, 2031

Normal hours of work are defined as Monday through Friday from 8:00am to 5:00pm CST, excluding Federal holidays or as otherwise arranged with the COR.

Rev 2.0 16

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five (5) are set by date:

New Year’s Day January 1 Juneteenth National Independence Day June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Birthday of Martin Luther King, Jr. Third Monday in January Washington’s Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed remotely, when possible. The Contractor shall perform on-site work when required. Work may be performed at remote locations other than the

Contractor’s facilities. If a problem requiring service cannot be resolved over the phone or remotely, then an authorized Contractor’s representative shall commence work on-site within the designated time identified and will proceed progressively to rectify the problem without undue delay without any additional cost to the Government with prior approval by the COR.

Table 4. Locations of Performance

Facility Name Facility Address POC POC Email

VA North Texas 4500 S Lancaster Rd, Dallas, TX 75216 Tony Pham

Tony.Pham1@va.gov

REFERENCES

National MOU-ISA – CareFusion, LLC (A Becton Dickinson Subsidiary) (Pyxis, Alaris)

INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract. The contractor shall comply with all Federal laws

Rev 2.0 17 and regulations the VA has developed when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor. The information made available to the contractor by VA for the performance of this contract will be used only for the purposes of performance under this contract. The certification and accreditation requirements do not apply to this requirement and a security accreditation package is not required.

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language. a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract.

This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define

Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and

VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable

Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

Rev 2.0 18

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive

6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate

Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using

VA-approved encryption tools which are, at a minimum, Federal Information Processing

Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements.

The contractor shall transmit VA sensitive information using VA approved Transport Layer

Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and

Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by

Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38

U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and

Access Management (IAM) Security processes specified in the VA Information Security

Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with

National Archives and Records Administration (NARA) requirements as outlined in VA Directive

6300, Records and Information Management, VA Handbook 6300.1, Records Management

Procedures, and applicable VA Records Control Schedules.

Rev 2.0 19

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal

Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the

Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the

COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS. This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior

(ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and

Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security

Clearance shall be processed through the Special Security Officer located in HRA/OSP.

Rev 2.0 20

Contractors shall conform to all requirements stated in the National Industrial Security Program

Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-

71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity

Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens.

Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge

Rev 2.0 21

Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA

COR/CO.

4. TRAINING. This entire section applies to all acquisitions which include section 3.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent

Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to

VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

5. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately

(within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise

Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to

VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

Rev 2.0 22

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA

Information Systems VA Information Security Program, and VA Information Security Knowledge

Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving

Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or…