36C25918Q9575-001.docx

FedBizOpps Combined Synopsis/Solicitation Notice

CLASSIFICATION CODE

SUBJECT

CONTRACTING OFFICE'S

ZIP-CODE

SOLICITATION NUMBER

RESPONSE DATE (MM-DD-YYYY)

ARCHIVE

DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS

SET-ASIDE

NAICS CODE

CONTRACTING OFFICE

ADDRESS

POINT OF CONTACT

(POC Information Automatically Filled from User Profile Unless Entered)

DESCRIPTION

See Attachment

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

GENERAL INFORMATION

PLACE OF PERFORMANCE

* = Required Field FedBizOpps Combined Synopsis/Solicitation Notice Rev. March 2010 Immunofluorescence Antibody Assay on a Cost per Reportable Result Basis for Rocky Mountain Regional VA Medical Center in Aurora, CO.

80111 36C25918Q9575 07-13-2018 N 334516 Department of Veterans Affairs Network Contracting Office

NCO 19

6162 South Willow Drive, Suite 300 Greenwood Village CO 80111 Juanita Street Contract Specialist Network Contracting Office 19 Juanita.Street@va.gov Department of Veterans Affairs Rocky Mountain Regional VA Medical Center Attn: Pathology and Laboratory 1700 Wheeling Street Aurora, CO 80045

USA

IMMUNOFLUORESCENCE ANTIBODY ASSAY for Rocky Mountain Regional VA Medical Center, Aurora, CO

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will also be attached.

Solicitation Number: 36C25918Q9575_2

Classification Code: 6640 – Laboratory Equipment

NAICS Code: 334516 – Analytical Laboratory Instrument Manufacturing

Set-Aside: No Set-Aside

Contracting Office Address: Department of Veterans Affairs Network Contracting Office 19 (NCO 19)

Quote Response Date: Friday, July 13th, 12:00pm MT

DESCRIPTION:

(1) Contractor shall provide all equipment, reagents, standards, controls, supplies, consumable/disposable items, parts, accessories and any other item required for the proper operation of its' contractor owned Immunofluorescence Assay Analyzer (IFA) necessary for the generation of a patient Cost Per Reportable Result (CPRR).

(2) Cost Per Reportable Result (CPRR): The per reportable result price shall include costs covering (a) equipment use, (b) all reagents, standards, controls, supplies, consumable/disposable items, parts, software, middleware that enables efficient communication between LIS and instrument which provides a flexible rule engine to automate routine tasks, reruns, reflex testing, accessories and any other item required for the proper operation of the contractor’s equipment and necessary for the generation of a patient reportable result. This does not include those items approved for exclusion by the government such as printer paper, labels etc. This per patient reportable result price shall also encompass all costs associated with dilution, repeat, titration and confirmatory testing required to produce a single patient reportable result. It will also include the material to perform as well as all other costs associated with quality control, calibration and correlation study testing that is prescribed by the Clinical and Laboratory Standards Institute (CLSI). (c) All necessary maintenance to keep the equipment in good operating condition (This element includes both preventive maintenance and emergency repairs and (d) training for Government personnel. Contractors are required to provide delivery, installation and removal of equipment at no additional charge.

(3) Offerors may identify their interest and capability by submitting quotes. All quotes must be received prior to Friday, 12:00pm MT on July 13, 2018. A determination by the Government not to compete this proposed contract based upon responses to this notice is solely within the discretion of the Government. Solicitation Number is 36C25918Q9575. The solicitation is issued as a Request for Quote (RFQ) IAW FAR Part 12.6. This acquisition will utilize full-and-open competition after exclusion of sources and set aside for Small Businesses. Award will be made to the lowest priced offeror who can fulfill the requirements stated in the Statement of Work.

(4) The Government will evaluate quotes on the basis of the material presented in the quote. The Offeror’s quote shall contain: 1) Documents/Literature/Publications showing that the offeror can meet the requirements in the Statement of Work; 2) Completion of Schedule D.1 shall be completed with price information; 3) Quotes shall be submitted via email to Juanita.Street@va.gov ; 4) Each quote section shall not exceed 5MB in size.

(5) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2005-97 (effective 01/24/18).

(6) Telephone calls will not be accepted. All quotes are to be sent electronically to Juanita.Street@va.gov no later than 12:00pm MT, July 13th, 2018.

(7) Acceptance of equipment, reagents, supplies and services received is Rocky Mountain Regional VA Medical Center, Attn: Pathology and Laboratory, 1700 Wheeling Street, Aurora, CO 80045.

(8) A single-award, Blanket Purchase Agreement shall be awarded to the contractor.

(9) Clarifications: The clarification period of time is between issuance of the solicitation and the due date for offers. This time period allows for an exchange for clarification purposes between the VA and all potential offerors. All clarification questions regarding this solicitation shall be sent in writing directly to the Contract Specialist by E-mail to juanita.street@va.gov. The last day to submit questions shall be Friday, July 6, 2018 at 10:00 A.M. Mountain Time.

(10) Submission Details: There are two separate quote volume submissions to be submitted electronically (e-mail attachment) directly to the Contract Specialist. All sections of the quote being submitted via email should be less than 5MB in size. The separate quote volumes are:

1. Volume 1: Technical – Documents/Literature/Publications showing the requirements stated in the Statement of Work can be met.

2. Volume 2: Price – D.1 Schedule of Tests Price columns to be completed as well as the instruments proposed for each facility The following information shall be submitted separately of the Volume:

· One scanned original copy of Standard Form 1449 signature page (completing blocks 17a, 17b, 30a, 30b, and 30c.) with original signature.

· One scanned original copy of any amendments with signature(s) (IF APPLICABLE)

(11) Pricing for this task order shall be Firm Fixed Price and include any discount being offered. Price shall be presented separately from the Technical quote. Price will be submitted by completing the Schedule/CLIN form under Section D.1 Schedule.

(12) Shipping Terms: FOB (Free on Board) is Destination. All shipping, packaging and delivery costs for all reagents, equipment, and supplies must be included in cost per reportable result price. No separate line item for shipping/freight/packaging/delivery shall be accepted.

SCHEDULE:

1. ANA is Antinuclear Antibody.

2. The estimate is based on the following: Approximately 190 patients per month with between 15-25% requiring reflex testing.

3. Reflex testing requires between one and four additional tests.

4. Estimated Annual Tests includes ANA tests, ANA with reflex tests, titers, and QC (quality control).

Estimated TOTAL (Total Annual x 5 years): _______________________

BPA TERMS

INTRODUCTION

In the spirit of the Federal Acquisition Streamlining Act, the Department of Veterans Affairs (DVA) and (Contractor Name). hereby enter into a cooperative agreement, otherwise referred to as a Blanket Purchase Agreement (BPA), to further reduce the administrative costs of acquiring supplies/services.

TERMS AND CONDITIONS

The Contractor agrees to the following terms of a Blanket Purchase Agreement (BPA) EXCLUSIVELY WITH the Department of Veterans Affairs: A single award Blanket Purchase Agreement is established between the Department of Veterans Affairs and (Contractor Name), for a five-year BPA with a period of performance from July 25, 2018 – June 30, 2023. The agreement details all services and supplies with accompanying prices and descriptions, which may be ordered under this BPA. All orders placed against this BPA are subject to the terms and conditions of all the clauses and provisions in full text or incorporated by reference in this document.

PERIOD OF PERFORMANCE

Base Period: July 25, 2018 – June 30, 2023

ADMINISTRATIVE DATA

A Blanket Purchase Agreement (BPA) is hereby established between (Contractor Name). and the Department of Veterans Affairs under the following terms and conditions incorporated in this BPA:

CONTRACTOR:

Contractor Point of Contact:

Department of Veterans Affairs Network Contracting Office 19

NCO 19

6162 S Willow Dr. Ste. 300 Greenwood Village, CO 80111

NCO 19 Point of Contacts:

Bai Perney Contracting Officer 303-712-5815 Bai.Perney@va.gov

Juanita Street Contract Specialist 303-712-5736 Juanita.Street@va.gov

PRICING DATA

1. The prices included on the BPA list (or applicable "discounted" rates submitted in a proposal response to an RFQ resulting in award) that are in effect on the effective date of an order shall govern that order's basic performance period. With regard to any option years, which are later exercised, the proposed option year rates as incorporated into the order award are in effect until such time, if applicable, that the contractor has been authorized a rate increase culminating from a negotiation with the Contracting Officer.

2. The BPA holder can voluntarily reduce offered prices at any time by giving 24-hour advance notice (by facsimile or electronic-mail) to the Department of Veterans Affairs/Contracting Officer. This BPA also allows for additional discounts if a "large order" is placed at one time. An advanced notice is not required for discounts offered for only an individual order. Whether an order is large enough to warrant such a discount is subject to the discretion of the BPA holder.

3. The BPA holder may also increase BPA prices at any time. Any BPA price increase shall not take effect until the Department of Veterans Affairs Contracting Officer receives written notification (U.S. mail, facsimile, or electronic-mail). Any order already issued shall not be affected by any change to BPA pricing. The prices offered under this BPA will undergo annual review by the Department of Veterans

ORDERS

A BPA Order will be established by a contracting officer at Department of Veterans Affairs, Network Contracting Office 19, according to the established price list, to fund supplies against the BPA. Orders will be placed against this BPA via e-mail, Electronic Data Interchange (EDI), FAX, or in hardcopy format. Each individual BPA order will describe the tasks, services, items, and/or deliverables required.

Lab personnel at Rocky Mountain Regional VA Medical Center will be authorized to schedule delivery off of the BPA order. The BPA order will contain information on item, quantity, price per item, delivery address, shipment date and purchase order number for invoicing.

Packaging and delivery will occur in accordance with the Statement of Work.

All unauthorized work, regardless of amount, will be processed through the ratification process.

OBLIGATION OF FUNDS

This BPA does not obligate any funds. The Government is obligated only to the extent of authorized orders actually issued under the BPA by the Contracting Officer.

AUTHORIZED LIMITS

The Government estimates, but does not guarantee, that individual BPA Orders placed against this Agreement may reach $70,000.00/per Order. This Order Limit may be increased by mutual agreement of the parties as necessary, in whole or part. The authorized Ceiling Limit of the Agreement is set at $350,000.00 over the period covered by the Agreement; this ceiling is also not a guarantee. The Ceiling Limit may also be raised in association with order Limit increases or other conditions which, by mutual agreement of the parties, maybe considered necessary. Authorization for individual Task Orders above the stated Task Order and/or Ceiling Limits must be coordinated through the Contracting Officer before larger valued orders can be issued and prior to commencement of work. All unauthorized work, regardless of amount, will be processed through the ratification process.

AUTHORIZED INDIVIDUALS

Department of Veterans Affairs authorizes the following entities to place BPA orders:

Authorized personnel from Rocky Mountain Regional VA Medical Center in Aurora, CO to request delivery (BPA calls) on placed orders:

Rocky Mountain Regional VA Medical Center Attn: Pathology and Laboratory Department Technicians 1700 Wheeling Street Aurora, CO 80045

DELIVERY TICKETS

All shipments under the agreement shall be accompanied by delivery tickets or sales slips that shall contain the following:

Name of Contractor/Supplier BPA Number Date of Purchase Purchase Order Number Itemized List of Supplies or Services Furnished Quantity, Unit Price and Extension of each Item, less applicable documents Date of Delivery or Shipment

INVOICES

Inspection and acceptance shall be accomplished as follows: The Government, for all services and supplies furnished under any resulting order, hereby designates the POCs (Point of Contacts) under Authorized Personnel in the BPA as the point of final inspection and acceptance.

A summary invoice shall be submitted to NCO 19 monthly for all deliveries made during a billing period, identifying the delivery tickets covered therein, stating their total dollar value, and supported by receipt copies of the delivery tickets.

The contractor shall invoice VA Financial Services Center for services and/or deliverables using the purchase order number provided in the BPA Order by the contracting officer at NCO 19. Invoicing will be monthly in arrears.

All invoices from the contractor shall be submitted electronically to the VA Financial Services Center for payment processing, free of charge. For any questions about the e-invoicing program, please contact the FSC at the phone number or email address listed below:

OB10 e-Invoice Setup Information: (877) 752-0900 OB10 e-Invoice email: USClientServices@ob10.com FSC e-Invoice Contact Information: (877) 353-9791 FSC e-Invoice email: vafsccshd@va.gov The following two codes will be required when creating a vendor profile in OB10:

OB10 Buyer Number AAA544240062 Promo Code: VAPC7Y18

FEDERAL HOLIDAYS

Unless specifically authorized in writing by the Contracting Officer, no services will be provided and no charges will be incurred and/or billed to any order on this contract on any of the Federal Holidays listed below.

MANAGEMENT CONTROL

The BPA holder shall provide to the Contracting Officer (CO) a list of all teaming partners or subcontractors within 30 calendar days after order award. As subcontractors and/or teaming partners are added, and/or deleted, an updated listing will be provided to the CO within 30 calendar days of such change. All BPA holder personnel shall display identification badges at all times while charging hours to the order or at a government or government contractor location. Authorized Government personnel shall accompany all visits to Department of Veterans Affairs Program Offices, unless other specific arrangements have been made.

BPA EMPLOYEE IDENTIFICATION

All support BPA holder personnel will be required to wear company identification badges in order to distinguish themselves from Government (organic) employees. When conversing with Government personnel during business meetings and over the telephone, support BPA holder personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Where practicable, support BPA holders occupying collocated space with their Government program customer should identify their workspace area with their name and company affiliation.

OPTION TO EXTEND THE TERM OF THE BPA

a. The Government may extend the term of this BPA within 30 days by written notice to the Contractor at any time prior to the expiration of the BPA, provided that the Government shall give the Contractor a preliminary written notice of its intent to extend at least 30 days before the BPA expires. The preliminary notice does not commit the Government to an extension.

b. If the Government exercises this option, the extended BPA shall be considered to include this option provision.

PRECEDENCE

The Terms and conditions included in this BPA apply to all purchases made pursuant to it. In the event of an inconsistency between the provisions of this BPA and the Contractor's invoice, the provisions of this BPA will take precedence.

STATEMENT OF WORK

1. SCOPE:

Contractor shall provide all equipment, reagents, standards, controls, supplies, consumable/disposable items, parts, accessories and any other item required for the proper operation of its' contractor owned Immunofluorescence Assay Analyzer (IFA) necessary for the generation of a patient Cost Per Reportable Result (CPRR).

2. DEFINITIONS:

Cost Per Reportable Result (CPRR): The per reportable result price shall include costs covering (a) equipment use, (b) all reagents, standards, controls, supplies, consumable/disposable items, parts, software, middleware that enables efficient communication between LIS and instrument which provides a flexible rule engine to automate routine tasks, reruns, reflex testing, accessories and any other item required for the proper operation of the contractor’s equipment and necessary for the generation of a patient reportable result. This does not include those items approved for exclusion by the government such as printer paper, labels etc. This per patient reportable result price shall also encompass all costs associated with dilution, repeat, titration and confirmatory testing required to produce a single patient reportable result. It will also include the material to perform as well as all other costs associated with quality control, calibration and correlation study testing that is prescribed by the Clinical and Laboratory Standards Institute (CLSI). (c) All necessary maintenance to keep the equipment in good operating condition (This element includes both preventive maintenance and emergency repairs and (d) training for Government personnel. Contractors are required to provide delivery, installation and removal of equipment at no additional charge.

1. ANA

2. ANA with Reflex

c. Equipment configuration: Contractor owned IFA systems shall meet the following global criteria for Aurora VA Rocky Mountain Regional Pathology and Laboratory Services:

1. Provide a single analyzer with built in microscope, broad test menu, reliable methodologies capable of automatically perform all immunofluorescence pipetting and reading steps.

2. Sample bar code reader that enables sample traceability and eliminate time and error spent entering ID sample manually.

3. Provides a built in IFA microscope in the system that communicates with data management for technologist final review and approval of result without requiring a darkroom.

4. Provide Bi-directional interface for Data Innovations with VISTA.

i. Contractor shall be responsible for providing Dawning users with cards, cables and necessary software.

5. Accommodate user-defined tests.

6. Provide QC (Quality Control) material within the contract.

7. Provide Lot Number coordination of reagents and QC materials within the Aurora VA Rocky Mountain Regional.

8. Provide QC inter-laboratory comparison program within the contract.

9. Provide assay procedures in CLSI format and on CD-ROM or on Internet (secured).

10. Provide Operator's Manual on CD-ROM.

11. Ability to easily re-transmit test result to host computer.

12. Provide on-board Reagent Inventory including an alert when consumables and supplies are insufficient to process requested tests.

13. Easily accommodate STAT Tests.

14. Ability to analyze small volume samples.

15. Require easily understood and performed maintenance procedures.

16. Provide UPS, if recommended by the manufacturer.

17. Provide long shelf-life for Reagents and controls, including on-board stability.

18. Provide on-board user-friendly Quality Control program.

19. Contractor will provide MSDS and Waste stream for all reagents.

2. Offerors shall provide pricing for each test under ANA such that pricing shall contain sufficient information that allows Aurora VA Rocky Mountain Regional the ability to calculate the actual number of tests performed per kit, including controls, calibrations, CAP surveys, patient test, etc. This information shall include, at a minimum, the expected out-dating and open vial stability of the kits and controls, frequency of calibrations, and how long calibration curves are stable, etc.

3. The contractor is required to provide delivery, installation and removal of equipment at no additional charge.

4. All consumable supplies (reagents, standards, control, disposables, etc.) required for the proper operation to the contractor’s equipment and necessary to perform tests on the equipment provided shall be included, and shall be furnished by the contractor for each IFA analyzer.

5. In the event that the consumables are found to be defective and unsuitable for use with the contractor's equipment, or the contractor has failed to comply with the requirements for routine supply delivery, the contractor shall deliver the consumable supplies within a period of twenty-four (24) hours after receipt of the verbal order for priority delivery from the Government activity. If either circumstance has occurred, the contractor shall deliver to the requesting Aurora VA Rocky Mountain Regional facility site, in the most expeditious manner possible, without additional cost to the Government, the necessary consumables in sufficient quantity as required to allow operation of the contractor's equipment for one week (under normal Government test load volume). If additional requests for emergency supply delivery are required by the Government, they will be honored by the contractor until the arrival at the Government site of the monthly standing order/routine supplies delivery. Failure to reserve adequate inventory may result in default.

d. Billing by Contractor starts on the first day of patient testing after all installation, training, and method validations have been completed and accepted in writing by the Contract Specialist (no later than 60 calendar days from time of award). At this time, the awarded contractor shall have completed full transition of all services under this agreement and shall have full and sole responsibility for services under the awarded BPA.

5. TERMS AND CONDITIONS:

If, for any reason, a contractor ceases testing of any IFA assays, the contractor must notify the contracting specialist or equivalent 60 days prior to the changes. Until a new solicitation can be issued or the problem resolved, the contractor will reimburse the difference in costs to the facilities, as facilities may have to resort to outsourcing the tests in order to continue patient care.

6. LOCATION

Rocky Mountain Regional VA Medical Center Attn: Pathology and Laboratory Department 1700 Wheeling Street Aurora, CO 80045 Point of Contact: James Bloom, James.Bloom@va.gov

CONTRACT CLAUSES

(8) The clause at 52.212-4, Contract Terms and Conditions – Commercial Items (JAN 2017), applies to this acquisition. Addendum to FAR 52.212-4 applies to this solicitation.

(9) The following FAR and VAAR clauses are Incorporated into Reference per 52.252-2 Clauses Incorporated by Reference (FEB 1998). Clauses may be obtained via the internet at: http://www.acquisition.gov/far/index.html (FAR) and http://www.va.gov/oal/library/vaar/index.asp (VAAR)

IT CONTRACT SECURITY (See Attached)

(End of Addendum to 52.212-4)

(10) Clause 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders – Commercial Items (JAN 2018) applies to this acquisition. Addendum to FAR 52.212-1 applies to this solicitation. In addition, the following FAR/VAAR clauses/provisions, either by reference or full text, apply (clauses may be obtained via the internet at:

http://www.acquisition.gov/far/index.html (FAR) and http://www.va.gov/oal/library/vaar/index.asp (VAAR)

CONTRACT PROVISIONS

(11) Provision 52.212-1, Instructions to Offerors – Commercial Items (JAN 2017), applies to this acquisition. Addendum to FAR 52.212-1 applies to this provision.

(12) The following FAR and VAAR Provisions are Incorporated into Reference per 52.252-1 Provisions Incorporated by Reference (FEB 1998). Provisions may be obtained via the internet at: http://www.acquisition.gov/far/index.html (FAR) and http://www.va.gov/oal/library/vaar/index.asp (VAAR)

(End of Addendum to Provision 52.212-1)

(13) The provision at FAR 52.212-2, Evaluation—Commercial Items (Oct 2014), applies to this solicitation along with the following addenda to the provision:

FACTOR 1: Ability to fulfill the requirements stated in the Statement FACTOR 2: Offering the lowest price.

In accordance with FAR 13.106-3, price will be determined fair and reasonable for this acquisition based on competitive quotations received. The award will go to the lowest priced offeror.

(14) IAW FAR 52.212-3, Offeror Representations and Certifications - Commercial Items (Oct 2016), the offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) Web site accessed through http://www.sam.gov/portal. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (r) of this provision. In addition, complete the following addendum to FAR 52.212-3:

(15) Any additional contract requirement(s) or terms and conditions determined by the Contracting Officer to be necessary for this acquisition and consistent with customary commercial practices will be addressed as necessary.

(End of Addendum to Provision 52.212-2)

ATTACHMENT

CONTRACT SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default "program files" directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f.