36C25919R0066-0001000.docx

5. PROJECT NUMBER (if applicable)

CODE

7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION

OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT

THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO:

Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADM

INISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and d ate specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 3

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO

MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer) 06/27/2019 36C259 Department of Veterans Affairs Network Contracting Office

NCO 19

6162 South Willow Drive, Suite 300 Greenwood Village CO 80111 36C259 Department of Veterans Affairs Network Contracting Office

NCO 19

6162 South Willow Drive, Suite 300 Greenwood Village CO 80111 To all Offerors/Bidders

36C25919R0066 06-27-2019

X X X

X

1(ONE)

The purpose of this amendment is to provide answers regarding the solicitation notice.

a. Please see the following pages.

A.1 Industry Question(s)

Question 1: Can the Section D documents please be provided so they can be completed and submitted with the proposals?

Answer 1: Contractor Rules of Behavior (Section A.2) and Quality Assurance Surveillance Plan (Section A.3) are attached.

A.2 CONTRACTOR RULES OF BEHAVIOR

This User Agreement contains rights and authorizations regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the Department of Veterans Affairs (VA). This User Agreement covers my access to all VA data whether electronic or hard copy ("Data"), VA information systems and resources ("Systems"), and VA sites ("Sites"). This User Agreement incorporates Rules of Behavior for using VA, and other information systems and resources under the contract.

1. GENERAL TERMS AND CONDITIONS FOR ALL ACTIONS AND ACTIVITIES UNDER THE CONTRACT:

a. I understand and agree that I have no reasonable expectation of privacy in accessing or using any VA, or other Federal Government information systems.

b. I consent to reviews and actions by the Office of Information & Technology (OI&T) staff designated and authorized by the VA Chief Information Officer (CIO) and to the VA OIG regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. These actions may include monitoring, recording, copying, inspecting, restricting access, blocking, tracking, and disclosing to all authorized OI&T, VA, and law enforcement personnel as directed by the VA CIO without my prior consent or notification.

c. I consent to reviews and actions by authorized VA systems administrators and Information Security Officers solely for protection of the VA infrastructure, including, but not limited to monitoring, recording, auditing, inspecting, investigating, restricting access, blocking, tracking, disclosing to authorized personnel, or any other authorized actions by all authorized OI&T, VA, and law enforcement personnel.

d. I understand and accept that unauthorized attempts or acts to access, upload, change, or delete information on Federal Government systems; modify Federal government systems; deny access to Federal government systems; accrue resources for unauthorized use on Federal government systems; or otherwise misuse Federal government systems or resources are prohibited.

e. I understand that such unauthorized attempts or acts are subject to action that may result in criminal, civil, or administrative penalties. This includes penalties for violations of Federal laws including, but not limited to, 18 U.S.C. §1030 (fraud and related activity in connection with computers) and 18 U.S.C. §2701 (unlawful access to stored communications).

f. I agree that OI&T staff, in the course of obtaining access to information or systems on my behalf for performance under the contract, may provide information about me including, but not limited to, appropriate unique personal identifiers such as date of birth and social security number to other system administrators, Information Security Officers (ISOs), or other authorized staff without further notifying me or obtaining additional written or verbal permission from me.

g. I understand I must comply with VA’s security and data privacy directives and handbooks. I understand that copies of those directives and handbooks can be obtained from the Contracting Officer's Technical Representative (COTR). If the contractor believes the policies and guidance provided by the COTR is a material unilateral change to the contract, the contractor must elevate such concerns to the Contracting Officer for resolution.

h. I will report suspected or identified information security/privacy incidents to the COTR and to the local ISO or Privacy Officer as appropriate.

2. GENERAL RULES OF BEHAVIOR

a. Rules of Behavior are part of a comprehensive program to provide complete information security. These rules establish standards of behavior in recognition of the fact that knowledgeable users are the foundation of a successful security program. Users must understand that taking personal responsibility for the security of their computer and the information it contains is an essential part of their job.

b. The following rules apply to all VA contractors. I agree to:

(1) Follow established procedures for requesting, accessing, and closing user accounts and access. I will not request or obtain access beyond what is normally granted to users or by what is outlined in the contract.

(2) Use only systems, software, databases, and data which I am authorized to use, including any copyright restrictions.

(3) I will not use other equipment (OE) (non-contractor owned) for the storage, transfer, or processing of VA sensitive information without a VA CIO approved waiver, unless it has been reviewed and approved by local management and is included in the language of the contract. If authorized to use OE IT equipment, I must ensure that the system meets all applicable 6500 Handbook requirements for OE.

(4) Not use my position of trust and access rights to exploit system controls or access information for any reason other than in the performance of the contract.

(5) Not attempt to override or disable security, technical, or management controls unless expressly permitted to do so as an explicit requirement under the contract or at the direction of the COTR or ISO. If I am allowed or required to have a local administrator account on a government-owned computer, that local administrative account does not confer me unrestricted access or use, nor the authority to bypass security or other controls except as expressly permitted by the VA CIO or CIO's designee.

(6) Contractors’ use of systems, information, or sites is strictly limited to fulfill the terms of the contract. I understand no personal use is authorized. I will only use other Federal government information systems as expressly authorized by the terms of those systems. I accept that the restrictions under ethics regulations and criminal law still apply.

(7) Grant access to systems and information only to those who have an official need to know.

(8) Protect passwords from access by other individuals.

(9) Create and change passwords in accordance with VA Handbook 6500 on systems and any devices protecting VA information as well as the rules of behavior and security settings for the particular system in question.

(10) Protect information and systems from unauthorized disclosure, use, modification, or destruction. I will only use encryption that is FIPS 140-2 validated to safeguard VA sensitive information, both safeguarding VA sensitive information in storage and in transit regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA.

(11) Follow VA Handbook 6500.1, Electronic Media Sanitization to protect VA information. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders.

(12) Ensure that the COTR has previously approved VA information for public dissemination, including e-mail communications outside of the VA as appropriate. I will not make any unauthorized disclosure of any VA sensitive information through the use of any means of communication including but not limited to e-mail, instant messaging, online chat, and web bulletin boards or logs.

(13) Not host, set up, administer, or run an Internet server related to my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA unless explicitly authorized under the contract or in writing by the COTR.

(14) Protect government property from theft, destruction, or misuse. I will follow VA directives and handbooks on handling Federal government IT equipment, information, and systems. I will not take VA sensitive information from the workplace without authorization from the COTR.

(15) Only use anti-virus software, antispyware, and firewall/intrusion detection software authorized by VA. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with VA.

(16) Not disable or degrade the standard anti-virus software, antispyware, and/or firewall/intrusion detection software on the computer I use to access and use information assets or resources associated with my performance of services under the contract terms with VA. I will report anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages to the COTR.

(17) Understand that restoration of service of any VA system is a concern of all users of the system.

(18) Complete required information security and privacy training, and complete required training for the particular systems to which I require access.

3. ADDITIONAL CONDITIONS FOR USE OF NON- VA INFORMATION TECHNOLOGY RESOURCES

a. When required to complete work under the contract, I will directly connect to the VA network whenever possible. If a direct connection to the VA network is not possible, then I will use VA approved remote access software and services.

b. Remote access to non-public VA information technology resources is prohibited from publicly-available IT computers, such as remotely connecting to the internal VA network from computers in a public library.

c. I will not have both a VA network line and any kind of non-VA network line including a wireless network card, modem with phone line, or other network device physically connected to my computer at the same time, unless the dual connection is explicitly authorized by the COTR.

d. I understand that I may not obviate or evade my responsibility to adhere to VA security requirements by subcontracting any work under any given contract or agreement with VA, and that any subcontractor(s) I engage shall likewise be bound by the same security requirements and penalties for violating the same.

4. STATEMENT ON LITIGATION

This User Agreement does not and should not be relied upon to create any other right or benefit, substantive or procedural, enforceable by law, by a party to litigation with the United States Government.

5. ACKNOWLEDGEMENT AND ACCEPTANCE

I acknowledge receipt of this User Agreement. I understand and accept all terms and conditions of this User Agreement, and I will comply with the terms and conditions of this agreement and any additional VA warning banners, directives, handbooks, notices, or directions regarding access to or use of information systems or information. The terms and conditions of this document do not supersede the terms and conditions of the signatory’s employer and VA.

Contractor’s Company Name

Please complete and return the original signed document to the CO within the timeframe stated in the terms of the contract.

A.3 Quality Assurance Surveillance Plan (QASP) The contractor will be evaluated in accordance with the following:

1. PURPOSE

This Quality Assurance Surveillance Plan (QASP) provides a systematic method to evaluate performance for the stated contract. This QASP explains the following:

· What will be monitored?

· How monitoring will take place.

· Who will conduct the monitoring?

· How monitoring efforts and results will be documented.

This QASP does not detail how the contractor accomplishes the work. Rather, the QASP is created with the premise that the contractor is responsible for management and quality control actions to meet the terms of the contract. It is the Government’s responsibility to be objective, fair, and consistent in evaluating performance.

This QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the contractor through contract modification. Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.

2. GOVERNMENT ROLES AND RESPONSIBILITIES

The following personnel shall oversee and coordinate surveillance activities.

a. Contracting Officer (CO) – The CO shall ensure performance of all necessary actions for effective contracting, ensure compliance with the contract terms, and shall safeguard the interests of the United States in the contractual relationship. The CO shall also assure that the contractor receives impartial, fair, and equitable treatment under this contract. The CO is ultimately responsible for the final determination of the adequacy of the contractor’s performance.

Assigned CO: < Government will enter name> Organization or Agency:

b. Contracting Officer’s Representative (COR) – The COR is responsible for technical administration of the contract and shall assure proper Government surveillance of the contractor’s performance. The COR shall keep a quality assurance file. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf.

Assigned COR: < Government will enter name> Organization or Agency:

3. CONTRACTOR REPRESENTATIVES

The following employee(s) of the contractor serve as the contractor’s program manager(s) for this contract.

Primary:

Alternate:

Page 8 of 18 V 0003 Revised 3/1/2018

4. PERFORMANCE STANDARDS

The contractor is responsible for performance of ALL terms and conditions of the contract. CORs will provide contract progress reports quarterly to the CO reflecting performance on this plan and all other aspects of the resultant contract. The performance standards outlined in this QASP shall be used to determine the level of contractor performance in the elements defined. Performance standards define desired services. The Government performs surveillance to determine the level of Contractor performance to these standards.

The Performance Requirements are listed below in Section 6. The Government shall use these standards to determine contractor performance and shall compare contractor performance to the standard and assign a rating. At the end of the performance period, these ratings will be used, in part, to establish the past performance of the contractor on the contract.

5. METHODS OF QA SURVEILLANCE

Various methods exist to monitor performance. The COR shall use the surveillance methods listed below in the administration of this QASP.

a. DIRECT OBSERVATION. 100% surveillance: (if this method is used, define how surveillance will be accomplished.)

b. PERIODIC INSPECTION. Inspections scheduled and reported quarterly per COR delegation or as needed. (Define what and how often it will be inspected. For example, ten (10) randomly selected patient files will be reviewed per inspection period. All inspections and reports will be conducted in compliance with VA Privacy and Information security standards.)

c. VALIDATED USER/CUSTOMER COMPLAINTS. If this method is used, explain how data will be collected and reported.

d. RANDOM SAMPLING. If this method is used, define what and how often it will be sampled. (For example, ten (10) randomly selected patient files will be reviewed per quarter. All reviews and reports will be conducted in compliance with VA Privacy and Information security standards.)

e. Verification and/or documentation provided by Contractor. Review PWS and if this method of surveillance is selected, define how documentation will be verified and how assessment will be conducted. (For example, off-site contracts may require the contractor to provide information on services provided to patients).

6. SAMPLE QASP PERFORMANCE REPORT DATE:__________________

Reference Performance Requirement

Method Met AQL/DID NOT MEET AQL-

CPAR RATING/ADD COMMENTS

Licensing, registration(s) and certification(s) for Contractor’s physician (s) (s) shall be provided as they are renewed. Licensing and registration information kept current.

Contractor shall provide evidence of annual training of technicians concerning HIPPA

1. CPAR RATINGS ASSIGNED TO QASP ITEMS:

Metrics and methods are designed to determine rating for a given standard and acceptable quality level. The following ratings shall be used (Reference: CPARS User Manual https://www.cpars.gov/pdfs/CPARS-Guidance.pdf p. A2-1):

Government’s benefit. The contractual performance of the element or sub-element being assessed was accomplished with few minor problems for which corrective actions taken by the contractor were highly effective.

Note: To justify an Exceptional rating, you should identify multiple significant events in each category and state how it was a benefit to the GOVERNMENT. However a singular event could be of such magnitude that it alone constitutes an Exceptional rating. Also there should have been NO significant weaknesses identified.

Note: To justify a Very Good rating, you should identify a significant event in each category and state how it was a benefit to the GOVERNMENT. Also there should have been NO significant weaknesses identified.

Note: To justify a Satisfactory rating, there should have been only minor problems, or major problems the contractor recovered from without impact to the contract. Also there should have been NO significant weaknesses identified.

8. DOCUMENTING PERFORMANCE

a. The Government shall document positive and/or negative performance. Any report may become a part of the supporting documentation for any contractual action and preparing annual past performance using CONTRACTOR PERFORMANCE ASSESSMENT REPORT (CPAR).

b. If contractor performance does not meet the Acceptable Quality level, the CO shall inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the CO shall document the discussion and place it in the contract file. When the COR and the CO determines formal written communication is required, the COR shall prepare a Contract Report (CR), and present it to CO. The CO will in turn review and will present to the contractor's program manager for corrective action.

The contractor shall acknowledge receipt of the CR in writing. The CR will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CR will also state how long after receipt the contractor has to present this corrective action plan to the CO. The Government shall review the contractor's corrective action plan to determine acceptability. The CO shall also assure that the contractor receives impartial, fair, and equitable treatment. The CO is ultimately responsible for the final determination of the adequacy of the contractor’s performance and the acceptability of the Contractor’s corrective action plan.

Any CRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO. See Sample CR on the following page.

9. COR AND CONTRACTOR ACKNOWLEDGEMENT OF QASP

SIGNED:

COR NAME/TITLE DATE

SIGNED:

CONTRACTOR NAME/TITLE DATE

CONTRACT REPORT

5. DATES

a. CR PREPARED

6. Issue Identified (Describe in detail. Include reference to PWS Directive; attach continuation sheet if necessary.)

10. CONTRACTOR RESPONSE AS TO CAUSE AND ACTIONS TO PREVENT RECURRENCE. (Cite applicable quality control program procedures or new procedures. Attach continuation sheet(s) if necessary.)

12. GOVERNMENT EVALUATION.

13. GOVERNMENT ACTIONS

14. CLOSE OUT

CONTRACTOR NOTIFIED

COR

CONTRACTING OFFICER

Page 18 of 18 version 0005 Dated 12/1/2016